Privacy Policy

1. Who we are

Dr. Décio Carvalho — Plastic Surgery (Decio Carvalho, MD P.A.) is a plastic surgery practice in Coral Gables, Florida. We are the data controller for the personal data described in this policy. This means we decide why and how your data is used.

E-mail: info@deciocarvalho.com
Postal address: 266 Palermo Avenue, Coral Gables, FL 33134, United States

2. What this policy covers

This policy explains how we handle personal data when you use:

• our website, deciocarvalho.com, and its patient portal;
• our messaging channels: WhatsApp, Instagram Direct and Facebook Messenger, operated through our messaging application "Decio Carvalho Messaging";
• messages handled by our virtual assistant on those channels.

It applies to patients, prospective patients and anyone else who contacts us through these channels.

3. What we collect through messaging

When you message us on WhatsApp, Instagram or Messenger, we may collect:

• the content of your messages, and any photos, voice notes or files you choose to send;
• your name as shown by the messaging channel;
• channel identifiers, such as your phone number or your Instagram or Facebook user ID;
• appointment, evaluation and treatment-journey details that you provide, such as the procedure you are interested in, your travel dates, or how your recovery is going;
• delivery metadata provided by Meta, such as timestamps and read status.

Photos and health details you send us are sensitive information. Please share only what is needed for your care.

4. Why we use it

We use this data to:

• answer your questions;
• schedule and confirm consultations and evaluations;
• send information you request, such as pre- and post-operative instructions;
• coordinate your care with our team;
• keep a record of the conversation for continuity of care.

We send marketing messages only with your consent. You can stop them at any time by replying STOP (or PARAR / PARE) in the same channel, or by e-mailing us.

5. Automated assistance

A virtual assistant powered by artificial intelligence may draft replies to your messages. Our staff can read every conversation, can take it over at any time, and are responsible for all clinical decisions. The assistant never gives a diagnosis or a medical opinion. If you would prefer to speak only with a person, just say so in the conversation.

6. Who we share it with

We share personal data only with:

• Meta Platforms, as the provider of WhatsApp, Instagram and Messenger. Meta's own privacy policies apply to how those services process your data.
• Our technology providers that host and process data on our behalf, including Google Cloud. They act only on our instructions.
• Professionals involved in your care, such as our clinical and administrative team, and where needed the surgical facility.

We do not sell personal data. We do not share it for third-party advertising.

7. How long we keep it

We keep your data for as long as our patient relationship lasts. After that, we keep the parts that form your medical record for as long as Florida medical-record retention rules and other applicable laws require. Messaging metadata that is not part of your medical record is deleted when it is no longer needed.

8. Security

We protect your data with encryption in transit, and we limit access to authorised staff who need it for their work. Our data is hosted in the United States.

9. Your rights

You have the right to:

• ask which personal data we hold about you;
• access a copy of that data;
• correct data that is inaccurate;
• request deletion of your data;
• withdraw your consent to marketing at any time.

To exercise any of these rights, e-mail us at info@deciocarvalho.com. We answer requests within 30 days. Please note that some data must be kept by law, for example medical records, even after a deletion request. We will tell you if that applies.

10. Data deletion

To request deletion of data we collected through WhatsApp, Instagram or Messenger:

• e-mail us at info@deciocarvalho.com, from the e-mail address on your patient account if you have one;
• include the phone number or Instagram username you used to message us, so we can find your conversation;
• write "Data deletion request" in the subject line.

We will confirm receipt, complete the deletion, and tell you when it is done. The only exception is records we must keep by law, such as your medical record. We will let you know if any data is kept for that reason.

11. Children

Our services are for adults. We do not knowingly collect personal data from anyone under 18 through our messaging channels. If you believe a minor has sent us data, please contact us and we will delete it.

12. Changes to this policy

When we update this policy, we publish the new version on this page and change the "Last updated" date at the top. If a change is significant, we may also tell you through the channel you use to contact us.

13. Contact

Dr. Décio Carvalho — Plastic Surgery
266 Palermo Avenue, Coral Gables, FL 33134, United States
E-mail: info@deciocarvalho.com
Phone: +1 (954) 600-9510 (main) · +1 (954) 600-9309 (English / Spanish) · +1 (786) 425-1140 (Portuguese)