DentalX Back to home

Brazil Annex

ANX-BR · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

Convenience translation: the Português text controls.

Read in: English · Português

SHA-256 of this text: d98662663685dc91bacf66f9493aa165df6f29a78ff9a3d2b2c3ac7304a33eb9

PART II — ANX-BR: Brazil Annex (Section IV additional clauses)

1. Precedence

  • Over Canadian law and the cap. The Clauses, including their governing-law and jurisdiction clause, prevail over the Manitoba choice of law and forum in the Terms and in MDPA clause 23. They also prevail over the limitation of liability in the Terms and in MDPA clause 17.
  • Mandatory law. The LGPD applies in full to the processing of personal data collected in Brazil, whatever law governs the commercial relationship (LGPD Art. 3).
  • Liability. The importer is jointly liable with the exporter where LGPD Article 42, §1, I so provides.

2. Security incidents

  • 24-hour notice. VstreamX notifies the Clinic of any security incident that may cause relevant risk or damage to data subjects within 24 hours of becoming aware of it, as MDPA clause 9 provides.
  • Purpose of the clock. This allows the Clinic to communicate the incident to the ANPD and to data subjects within 3 business days, as Resolution CD/ANPD 15/2024 requires.
  • Assistance. VstreamX provides the information the ANPD's incident form requires, as far as it holds it.

3. Encarregado

  • VstreamX's encarregado. VstreamX has appointed an encarregado (data protection officer) for its operations relating to Brazil, whose identity and contact details are [[TO CONFIRM: name and email of VstreamX's encarregado for Brazil]].
  • The Clinic's encarregado. The Clinic records its own encarregado in the Service. Resolution CD/ANPD 2/2022 may exempt a small-scale processing agent from appointing one. However, the processing of health data on a large scale may remove that exemption. [[TO CONFIRM: counsel's guidance text for clinics on the encarregado exemption]]

4. Transparency

4.1 The Clinic's transparency page. VstreamX generates, in Portuguese, a "Transferência internacional de dados" page for the Clinic. It describes the transfer under these Clauses: recipients, countries, purposes, and data subjects' rights.

  • The Clinic publishes the page on its website or makes it available to its patients, as the transparency obligation in Resolution 19 requires.
  • The Clinic attests in the Service that it has done so. Until the Clinic attests, the Service reminds the Clinic, but does not block it.

4.2 Copy of the Clauses. Where a data subject requests a copy of the Clauses, VstreamX gives the Clinic, within 15 days of the Clinic's request, the full text of the Clauses as signed, together with the Executed Copy data that may be shared. Commercial and industrial secrets may be protected.

5. Health records and prescriptions

5.1 Not the Clinic's sole legal record. DentalX is not certified by SBIS/CFM at assurance level NGS2, and does not apply ICP-Brasil signatures to clinical records. Under CFO Resolution 91/2009, it therefore cannot be the Clinic's sole legal dental record without paper. The Clinic is responsible for keeping its records in a legally valid form. The Service displays this notice to Brazilian Clinics.

5.2 Controlled substances. Electronic prescriptions for controlled substances require a qualified ICP-Brasil signature (Law 14.063/2020, Art. 13). DentalX does not issue them. Prescriptions for controlled substances are blocked or labelled in the Service as non-dispensable drafts.

6. Retention and deletion

6.1 Clinic records. Under Law 13.787/2018, Article 6, dental records must be kept for at least 20 years from the last entry. DentalX does not auto-delete clinical records of Brazilian Clinics.

6.2 At the end of the Service.

  • MDPA clause 14 applies. The complete export is the return of the data to the Clinic, so that the Clinic can keep it for the period the law requires.
  • VstreamX then deletes the data as MDPA clause 14 provides, keeping only what LGPD Article 16 allows.

7. Data subject rights

VstreamX assists the Clinic, as MDPA clause 8 provides, to answer data subjects' requests under LGPD Article 18. Assistance is given within 5 business days, which allows the Clinic to meet the 15-day period for a full reply under LGPD Article 19(II).

8. Records and the ANPD

  • Records. VstreamX keeps the record of processing operations that LGPD Article 37 requires of a processor.
  • The ANPD. VstreamX cooperates with the ANPD as the Clauses provide.

9. Governing law and forum for data protection

For all matters of personal data protection, this Annex and the Clauses are governed by Brazilian law and subject to the Brazilian courts. MDPA clause 23 applies to the rest of the commercial relationship.

10. Language

The Portuguese version of this Annex and of the Clauses is the authentic text.

Items to confirm before publication (Brazil)

  1. Publication date.
  2. Embedding of the official DOU Portuguese text of Resolution 19/2024 Annex II from the official source (Part I §1.2).
  3. The Manitoba corporation number of VstreamX Studio Inc. (Clause 1).
  4. Name and email of VstreamX's encarregado for Brazil (Clause 1; Part II §3).
  5. Blocking: the Vertex AI regional endpoint, named countries for every recipient, and each recipient bound by the ANPD clauses or another Resolution 19 mechanism (Clause 3).
  6. The clause numbers of the Designated Party's obligations, and of the governing-law and forum clause (expected Clause 24), in the official text (Clause 4; Section II).
  7. Counsel's guidance text for clinics on the encarregado exemption under Resolution 2/2022 (Part II §3).