Privacy Policy

1. Who We Are

Covalenty Ltda ("the Company," "we," "us," or "our"), located at Avenida Paulista 1374, Conjunto 11, Sao Paulo, SP, 01310-100, Brasil, operates cienty.org, a B2B marketplace that connects independent Brazilian pharmacies with pharmaceutical distributors. Through the platform, pharmacy operators search for medications by product name or ANVISA registration code, compare real-time distributor prices and availability, and place orders directly. Distributors list their catalogs and receive orders from pharmacies actively seeking stock.

Because the platform sits at the intersection of commercial transactions and regulated health products, we take our data-handling responsibilities seriously. This Privacy Policy explains what personal information we collect, why we collect it, and how it is protected. To contact us about privacy matters: [email protected] or +55 11 3181 7400.

2. Information We Collect

The nature of our marketplace means we handle two distinct categories of user and two distinct data profiles.

Pharmacy account holders provide: business name and CNPJ, responsible pharmacist name and professional registration (CRF), billing and delivery address, phone number, and email address at registration. During platform use, we record search queries (product names, ANVISA codes), price comparisons viewed, order items and quantities, preferred distributors, and platform interaction logs.

Distributor account holders provide: company name and CNPJ, ANVISA authorization documentation, contact name and role, billing address, phone, and email at onboarding. During platform use, we capture catalog listings, inventory updates, order confirmations, delivery commitments, and account-management activity.

For both account types, we automatically collect: IP address, browser type, device identifiers, pages visited, and session timestamps. We use this technical data to operate and improve the platform.

We do not collect sensitive personal information as defined under Lei Geral de Proteção de Dados (LGPD), including health data, biometric data, or political opinions, as part of normal marketplace operation. Product orders are commercial transactions, not patient medical records.

3. How We Use Information

The Company uses the information we collect for the following purposes:

• Operating the marketplace: matching pharmacy search queries against distributor catalogs, presenting real-time price comparisons, processing and routing orders to the correct distributor, and tracking order fulfillment status.
• Account management and authentication: verifying pharmacy CRF registration and distributor ANVISA authorization before granting catalog access or allowing orders.
• Pricing intelligence: aggregating anonymized transaction data to display market-level pricing benchmarks that help pharmacies assess whether offered prices are competitive. Individual pharmacy purchase data is never disclosed to any distributor.
• Platform improvement: analyzing usage patterns to identify search gaps, catalog coverage issues, and UI friction points so we can make the service more useful for both sides of the marketplace.
• Communications: sending order confirmations, delivery updates, payment receipts, and product support messages. We do not send promotional email without explicit opt-in.
• Legal compliance and dispute resolution: maintaining transaction records as required under Brazilian commercial law and as may be relevant to any dispute between a pharmacy and a distributor facilitated through the platform.

We do not sell personal information. We do not use platform data to train AI models or for purposes unrelated to operating the marketplace without explicit written consent from the account holder.

4. Sharing

When a pharmacy places an order, the Company shares the delivery address, contact name, and order details with the fulfilling distributor. This is necessary to complete the transaction. Distributors receive only the information needed to fulfill a specific order; they do not receive aggregate pharmacy browsing history or comparative search activity.

We engage third-party service providers for hosting, payment processing, and platform analytics. Each provider operates under a written data processing agreement restricting their use of data to the services they deliver for us. We do not authorize any processor to use personal information for their own commercial purposes.

We may disclose information to Brazilian regulatory or law-enforcement authorities where required by law, including in response to a valid court order or request from ANVISA, the Receita Federal, or other competent public authority.

If the Company is involved in a merger, acquisition, or restructuring, personal data may be transferred to the successor entity, subject to the same obligations set out in this policy.

5. Retention

Order records, invoices, and related account data are retained for the period required under Brazilian commercial and tax law (generally five years from the close of the fiscal year to which the transaction belongs). Active account data is retained for as long as the account is open. When an account is closed, we delete operational data within 90 days unless a longer retention period is required by law or an open dispute exists.

We apply administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, or disclosure. Access to production data is restricted to employees and contractors with a demonstrated operational need.

6. Your Rights Under LGPD

Brazil's Lei Geral de Proteção de Dados (Law 13.709/2018) grants you the following rights with respect to your personal information held by the Company:

• Confirmation and access: You may confirm whether we hold personal information about you and request a copy.
• Correction: You may ask us to correct inaccurate, incomplete, or outdated information.
• Anonymization, blocking, or deletion: You may request anonymization, blocking, or deletion of unnecessary or excessive personal data, or data processed in non-compliance with LGPD.
• Portability: You may request transfer of your personal data to another service provider, subject to regulatory guidance from the Autoridade Nacional de Proteção de Dados (ANPD).
• Information about sharing: You may request information about which public and private entities we have shared your data with.
• Revocation of consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Objection: You may object to processing carried out on grounds other than consent where you believe it is not compliant with LGPD.
• Review of automated decisions: You may request review of decisions made exclusively by automated processing that affect your interests.

To exercise any of these rights, contact us at [email protected]. We respond within 15 business days. Where we cannot fulfill a request, we will explain the reason. You may also submit a complaint to the ANPD (autoridade nacional de protecao de dados) at www.gov.br/anpd.

7. Cookies

See our Cookie Notice for details on the cookies and technologies we use on this platform.

8. International Data Transfers

Our platform is hosted in Brazil. If we engage service providers located outside Brazil, we ensure that transfers are made in compliance with LGPD Chapter V requirements, including through contractual mechanisms or transfers to countries with equivalent protection levels as recognized by the ANPD.

9. Changes and Contact

We will reflect material changes to this policy with an updated "Last updated" date at the top of this page. If the change is significant, we will notify active account holders by email before the change takes effect.