LGPD and data handling

SauBit treats prescription/clinical-context data as sensitive personal health data whenever it can be linked to an individual by the hospital — even without a national ID/name, via patient_reference.

Roles and purpose

• Controller: the organization (hospital/clinic/pharmacy) that decides the processing.
• Processor: SauBit, processing on the controller's behalf for medication-safety decision support.
• Legal basis: defined by the controller (e.g. health protection/contract performance); formalize it in a Data Processing Agreement (DPA).

Minimization and retention modes

• Send the minimum necessary; prefer patient_reference (a pseudonym) over identifiers.
• No medical record (stateless): don't send a persistable patient_record — analyze per request (the analysis is stored for audit/idempotency; see retention).
• Pseudonymization ≠ anonymization: patient_reference is a pseudonym (re-linkable by the controller), not anonymization.

Data subject rights

• Access/portability: GET /api/v1/prontuario/by-reference/{patient_reference}.
• Erasure (hard delete): DELETE /api/v1/prontuario/{id}?purge=true physically removes the record (works even on an already soft-deleted record). Without purge, the delete is soft (reversible, auditable).
• Rectification: PATCH /api/v1/prontuario/{id}.

Security and segregation

• Encryption in transit (TLS) and at rest (infrastructure-managed).
• Multi-tenant segregation by organization_id across all data.
• Logs without clinical data: PII is redacted; the body is scrubbed before logging.

Documentation backlog (planned)

DPIA (RIPD), backup removal window, sub-processors, contractual zero-retention mode and full per-subject export — in progress with legal. Regulatory items (SaMD) in Regulatory compliance.

Privacy questions: dpo@saubit.com.br.