Privacy Policy and Data Protection

Hospital de Olhos Leiria de Andrade, located at Rua Rocha Lima, 1140 – Aldeota, Fortaleza/CE (postal code 60.135-000), Brazil, is the controller of the personal data processed through this website, under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).

Depending on what you use on the website:

• Appointment booking: name, national ID (CPF), date of birth, phone, WhatsApp, email, health insurance provider and plan.
• Patient portal: CPF and password (stored only as a hash, never as plain text), plus your registration code at each hospital unit.
• Eye Health Questionnaire (QSO): health information you voluntarily provide, such as pre-existing conditions and symptoms.
• Messages to your doctor: the content of the questions you send through the portal and the replies you receive.
• Contact form: name, email, phone and the message sent.
• Technical logs: IP address, browser and date/time of actions, used for security, abuse prevention and audit trails.

Information from the questionnaire and from messages to your doctor is sensitive personal data (LGPD, art. 5, II). It is processed exclusively for your healthcare, by professionals bound by confidentiality, and never for advertising, commercial profiling, or sharing with third parties not involved in your care.

Each purpose has its own legal basis:

• Health protection (art. 11, II, "f"): appointment booking, health questionnaire and communication with your doctor.
• Performance of a contract (art. 7, V): providing the contracted care and access to the portal.
• Legal obligation (art. 7, II): keeping medical records as required by health regulations and the Federal Council of Medicine.
• Legitimate interest (art. 7, IX): website security, fraud prevention and responding to the contact form.

Your appointment data is recorded in the hospital system (SISAC) and made available to the care team involved in your treatment. It may be shared with your health insurance provider, when necessary for authorization and billing of your care, and with public authorities when legally required.

We use cloud infrastructure providers to host the website and the portal account database; they act as data processors and cannot use your data for their own purposes. We do not sell your data.

Data related to your care follows the legal retention periods for medical records. Portal records remain for as long as your account exists. Contact form messages and technical security logs are kept for as long as needed to handle the request and investigate incidents. Exact retention periods will be detailed here once defined by the hospital.

This website does not use advertising tracking cookies. We only use local storage in your browser to keep you logged into the portal and to remember your choice on the cookie notice. Appointment booking uses an anti-bot verification service (CAPTCHA), which processes technical request data to distinguish people from automated traffic.

Access to the hospital system happens only through a controlled interface with minimum privilege. The website never writes directly to the hospital's database. We use encryption in transit, passwords stored as hashes, rate limiting, anti-bot verification and audit trails of appointment actions.

The LGPD guarantees you: confirmation that processing exists; access to your data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary data; data portability; information about who we share data with; withdrawal of consent; and review of automated decisions.

Some of these rights are limited by the legal obligation to keep medical records: we cannot delete care records before the period required by law.

You can update your phone, WhatsApp, email and address yourself at any time in the Patient Portal.

To exercise any of the rights above, or to ask questions about privacy, contact us by phone at +55 85 32665511, by email at ouvidoria@leiriadeandrade.com.br or in person at Rua Rocha Lima, 1140 – Aldeota, Fortaleza/CE.

This policy may be updated to reflect changes in our services or in the law. The date of the last update will always be shown below.

Last updated: July 27, 2026.