Privacy Policy
1. Who we are
Medical Cannabis Systems ("MCS") is a platform and brand operated by Nefos Solutions Ltd, an Ireland-based company. For privacy and data-protection matters, contact contato@medicalcannabis.systems.
2. Scope
This Policy explains how we process personal data in connection with medicalcannabis.systems and, at a general level, how data protection applies to the MCS platform. Where an association, clinic or other customer organisation uses MCS to manage patient, professional or staff information, that organisation may act as controller and Nefos Solutions Ltd may act as processor, depending on the circumstances and applicable contract.
3. Website data
We may process information you provide directly, including name, organisation, role, email address, telephone number, country, message content and information submitted through demo or contact requests. We may also process technical information necessary for site operation and security, such as IP address, technical logs, browser/device information and strictly necessary cookies where applicable.
4. MCS platform data
Depending on a customer's configuration, MCS may process registration and contact details, identification documents, administrative records, care records, clinical documents and health information. Health information is sensitive personal data under Brazil's LGPD. The specific purpose, legal basis and processing rules depend on the context, the responsible organisation and applicable law.
5. Purposes
We may use website data to answer enquiries, arrange requested demonstrations and communications, provide support, administer business relationships, protect the website and services, prevent misuse, maintain operational records and meet legal obligations. Platform data is processed to provide, maintain, secure and support the contracted service in accordance with applicable instructions and responsibilities.
6. Legal bases
Processing will rely on a legal basis appropriate to the specific activity. Depending on the circumstances, this may include steps requested before entering into or performing a contract, compliance with legal or regulatory obligations, establishment or exercise of legal rights, consent where required, and other grounds available under applicable law. Sensitive personal data is subject to the specific grounds applicable to such data. We do not assume that one legal basis applies to every processing activity.
7. Sharing and service providers
We may use infrastructure, hosting, security, technical support, communications and other providers needed to operate MCS. Providers should receive only the information necessary for their functions and be subject to applicable safeguards. We may also disclose information where required by law, to protect or exercise legal rights, or to respond to competent authorities.
8. Hosting, security and international transfers
MCS uses Google Cloud infrastructure. Technical and organisational measures are designed to protect data, including HTTPS/TLS in transit, encryption at rest, authenticated permission-based access controls, daily backups with separate copies, and logging of relevant activities. No system can be guaranteed absolutely secure. Because Nefos Solutions Ltd is based in Ireland and providers or infrastructure may be located outside Brazil, processing may involve international transfers. Where applicable, such transfers must follow the mechanisms and requirements established by applicable data-protection law.
9. Retention
We retain personal data for as long as reasonably necessary for the stated purposes, service delivery, legal or regulatory obligations, dispute resolution and the establishment or exercise of legal rights. Retention periods vary by data type, context and, where Nefos acts as processor, the controller's instructions.
10. Your rights
Subject to the LGPD and other applicable law, individuals may have rights including information about processing, confirmation of processing, access, correction, information about sharing, anonymisation/blocking/deletion of unnecessary, excessive or unlawfully processed data, portability where regulated and applicable, deletion of consent-based data where applicable, information about the consequences of withholding consent, withdrawal of consent, and review of certain solely automated decisions. Rights are not absolute and may be limited by legal obligations, regulatory requirements, contractual duties or the rights of others.
11. Exercising rights
For matters relating directly to the MCS website or processing for which Nefos Solutions Ltd is responsible for handling the request, email contato@medicalcannabis.systems. We may request reasonable information to verify identity and protect data from unauthorised disclosure. Where a request concerns information controlled by a customer association or other customer organisation, we may direct the requester to that organisation or assist with the request according to the applicable role.
12. Cookies
No optional analytics or marketing tool is confirmed for the initial website publication. The website may use cookies or similar technologies that are strictly necessary for operation, security, session management and technical preferences. If Google Analytics, advertising pixels or other non-essential technologies are enabled later, this Policy and the relevant cookie controls should be updated as necessary before or when they are activated.
13. Children and adolescents
MCS is not directed to children as a general audience. Where a customer processes children's or adolescents' data in a healthcare context, processing must follow applicable legal requirements, including the responsibilities of the controller and, where required, the child's legal representative.
14. Changes
We may update this Policy to reflect legal, technical or operational changes. The current version will be published on the website with its effective or updated date.
15. Contact
Nefos Solutions Ltd — Medical Cannabis Systems (MCS)
Website: medicalcannabis.systems
Privacy/LGPD email: contato@medicalcannabis.systems