Privacy Policy
This is an English translation provided for convenience. The original Portuguese version (read it here) is the legally binding text; in case of any discrepancy, the Portuguese version prevails.
Version 1.0 · Last updated: October 8, 2026
What data Whit processes, why, on what legal basis, who we share it with and for how long. Written under Brazil’s General Data Protection Law (Law No. 13,709/2018, “LGPD”), based on what the system actually does. Where something is not yet defined, we say so instead of making promises.
Important for dentists: do not include data that identifies the patient (name, Brazilian taxpayer ID (CPF), phone number, address, facial photos or any information that would allow them to be recognized). Describe the case in de-identified form: age, clinical findings, tests and your question. That is enough for Whit to support your reasoning.
1. Who is responsible, and in what role
| Controller | JParizotto Technology LTDA, Brazilian company registration (CNPJ) No. 55.618.423/0001-61, headquartered at Avenida Paulista, 1106, Sala 01 / Andar 16, Bela Vista, São Paulo/SP, CEP 01310-914, Brazil |
|---|---|
| Product | Whit, at whit.dental and via WhatsApp |
| Privacy channel (data protection officer) | privacy@whit.dental |
We are the controller of our users’ registration, usage and contact data: we decide what to collect, for what purpose and for how long.
We are the processor of third-party data that you enter into conversations, such as patient information. In that case you are the controller, and Whit processes that data only to provide the service, according to your instructions. This defines who answers to the data subject and who decides the legal basis.
2. What data we process
2.1 Data you provide
- Identification and contact: name, email, WhatsApp number.
- Profile: whether you are a dentist or a student, and the record of your acceptance of the Terms and of this Policy.
- Waitlist: name, email, WhatsApp number, whether you are a dentist or a student, the optional answer on how you heard about Whit, the sign-up date and the record of your acceptance (accepted text and page of origin).
- Content: messages, audio, images, files and questions you send via WhatsApp or the website, and the answers generated.
2.2 Data collected automatically
- Security and access: IP address, browser and device type, date and time of access and relevant actions. Used to protect the service, investigate incidents and comply with Brazil’s Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014).
- Service usage: features used, errors and performance, to fix defects.
- Cookies and local storage: the website does not currently use analytics or marketing tools, and we do not install Google Analytics, Meta Pixel or similar tools. If this changes, we will update this policy and ask for your consent before enabling them. There may be technical records needed for the website to work and stay secure, and your language preference stored in your browser. You can delete this data in your browser settings.
2.3 Third-party data within your content
Clinical cases often involve data about patients, who are not Whit users. This data is processed exclusively to carry out what you asked, under your instructions, with the same access restrictions as the rest of your content. We recommend sending only what is necessary, without identification.
2.4 Sensitive data
We do not ask for sensitive personal data about you. Information about the health of an identified or identifiable person is sensitive data (LGPD, art. 5, II, and art. 11). If it appears within a case you send, it is treated as your content under section 2.3, and the legal basis for having entered it is your responsibility as controller.
3. Purposes and legal bases
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and maintain your access and provide the requested service | Performance of a contract or of preliminary procedures, art. 7, V |
| Process your questions and generate answers using artificial intelligence | Performance of a contract, art. 7, V |
| Verify your status as a dentist or student, when required | Performance of a contract, art. 7, V |
| Log access and actions for security and incident investigation | Legal obligation (Marco Civil, art. 15) and legitimate interest, art. 7, II and IX |
| Fix defects and improve the service with aggregated metrics | Legitimate interest, art. 7, IX |
| Prevent fraud and misuse | Legitimate interest, art. 7, IX |
| Support and communication about the service | Performance of a contract, art. 7, V |
| Add you to the waitlist and notify you when Whit launches | Consent, art. 7, I, revocable at any time |
| Send news and content | Consent, art. 7, I, revocable at any time |
| Issue tax documents and comply with legal obligations, when there is a charge | Legal obligation, art. 7, II |
| Exercise rights in judicial, administrative or arbitration proceedings | Art. 7, VI |
Where the basis is legitimate interest, you may object to the processing through the channel in section 12.
4. Artificial intelligence: what happens to your content
4.1 How it works. Whit is a clinical decision support assistant. To answer, the content of your question is sent to a language model from a third-party artificial intelligence provider, through an orchestration platform, and the answer may draw on a knowledge base made up of selected scientific literature.
4.2 Training. Whit does not use your content to train artificial intelligence models, whether its own or third parties’. According to the model provider’s policy for its API, data sent via the API is not used to train its models unless the customer expressly opts in, and Whit has not opted in.
4.3 Retention by providers. Providers may keep records of requests for their own periods, for operations and abuse prevention, under their terms. According to the model provider’s public policy for its API, abuse monitoring logs may contain requests and responses and, by default, are kept for up to 30 days, with legal or technical exceptions. The orchestration platform keeps the log history while Whit’s account is active, according to the contracted plan, and the final deletion of copies and backups follows the provider’s rules. We do not promise zero retention.
4.4 Minimization. We ask that the content you send be limited to what is necessary for the query and, whenever possible, not identify the patient.
4.5 Support, not replacement. Answers support, and never replace, the clinical judgment of the dentist, who decides and is responsible for patient care. No decision with legal effects on you is made solely by automated means. See the Terms of Use.
4.6 What we don’t do. We do not sell or hand over your data for third parties’ own use. We do not build a profile of you for advertising. Internal access to conversations is restricted to the Whit team and happens only when necessary, for example to fix system errors or comply with a court order.
5. Sharing
We share data only with service providers that process it on our behalf, under contracts or terms that limit use to the contracted purpose, and when the law requires:
| Provider category | Purpose | Location |
|---|---|---|
| Artificial intelligence model provider | Generate the answers | United States |
| AI orchestration platform | Organize the chat and the knowledge base | United States |
| Scientific literature search provider | Find articles and sources to support the answers | As per the provider |
| Cloud database | Store registrations and records | São Paulo, Brazil |
| Automation platform | Automate data flows | European Union |
| Meta Platforms (WhatsApp) | Deliver messages via WhatsApp | As per Meta |
| Website hosting | Make the website available | Global content delivery network (includes Brazil and the United States) |
| Email and productivity | Communication and administration | As per the provider |
We may also share data with authorities, by legal obligation or order of a competent authority (informing you when the law allows), and in a corporate reorganization, in which case the data remains protected by this policy.
6. International transfer
Some of these providers operate outside Brazil, so your data may be processed abroad. These transfers rely on the safeguards of art. 33 of the LGPD, through the contractual clauses and safeguards adopted by each supplier. We do not claim that all of Whit’s data stays in Brazil.
7. How long we keep data
- Waitlist: until launch and the sending of notices, or until you ask for deletion or unsubscribe. If you do not interact with our communications for 24 months, your registration is deleted.
- Registration data: while you use the service and, afterwards, for the longest applicable statute of limitations or forfeiture period and for the access log retention period set by the Marco Civil da Internet (art. 15), to comply with legal obligations and for the regular exercise of rights, including defense in proceedings. Once that period ends, the data is deleted or anonymized.
- Conversation content: while your account is active. You may ask for deletion at any time, and we will comply within 30 days, except where retention is required by law.
- Access logs: for the period set by the Marco Civil da Internet (art. 15, six months).
- Tax documents, where applicable: for the period of the tax obligation.
After that period, data is deleted or anonymized, unless retention is required or authorized by law.
8. Your rights
| Right (LGPD, art. 18) | What it means |
|---|---|
| Confirmation and access | Know whether we process your data and obtain a copy |
| Correction | Correct incomplete, inaccurate or outdated data |
| Anonymization, blocking or deletion | Of unnecessary or excessive data, or data processed in breach of the law |
| Portability | Receive your data in a structured format |
| Information about sharing | Know who we share data with |
| Withdrawal of consent | Withdraw consent previously given |
| Review of automated decisions | Request review of a decision made solely by a system |
| Objection | Object to processing based on legitimate interest |
To exercise these rights, write to privacy@whit.dental. We respond within 15 days. We may ask for information to confirm your identity, so as not to disclose data to someone who is not the data subject. You may also file a petition with Brazil’s National Data Protection Authority (ANPD).
9. How we protect data
We adopt technical and administrative measures capable of protecting data against unauthorized access, loss, alteration and destruction (LGPD, art. 46): encrypted communication in transit, access control restricted to what is necessary, and the use of providers with recognized security practices.
No system connected to the internet is absolutely secure, and our obligation is one of means, not of result. In the event of an incident posing a relevant risk to your rights, we will notify you and the ANPD, under art. 48 of the LGPD, stating what happened, the data involved and the measures taken.
10. Third-party data
This policy details the processing of users’ own data, of which Whit is the controller. As for patient data that the user enters in queries, the user is the controller and is responsible for the legal basis and for the duty to inform the data subject. Whit processes such data solely to provide the service, according to the user’s instructions.
11. Minors
Whit is intended for dentists and dental students aged 18 or over. We do not knowingly collect data from children or adolescents as users. If we identify such a registration, the account is closed and the data deleted.
12. Data protection officer and contact
Requests, questions and complaints about personal data should be sent to our privacy channel, which serves as data protection officer (LGPD, art. 41): privacy@whit.dental.
13. Changes
If there is a relevant change, we will publish the new version on this page, with its date, and notify you through the service’s channels before it takes effect. Previous versions are available on request to the privacy channel.