Direto Pharma
Talk to our team Request a quote Patient area Professional area
PT
Direto Pharma PT

Privacy and data protection

Privacy Policy

Caring for your health starts with caring for your information. Here we explain, in plain language, what data Direto Pharma collects, how we use it, who we share it with and how you stay in control.

Last updated: September 30, 2026

This English version is provided for convenience. If there is any discrepancy, the Portuguese version prevails.

1. Who we are

DIRETO PHARMA BRASIL LTDA, Brazilian company registration (CNPJ) No. 54.196.907/0001-05, located at Rua Dr. Rubens Gomes Bueno, 691, Cond. 17007 Nações, Bloco B, Conj. 212, Sala 01, Várzea de Baixo, São Paulo/SP, CEP 04730-903, Brazil, is the controller of the personal data processed on this website, diretopharma.com, under Law No. 13,709/2018, Brazil's General Data Protection Law (LGPD).

Our Data Protection Officer (encarregado) is Silvinei Cordeiro Toffanin. For any matter regarding your data, write to [email protected] or to our support team at [email protected].

2. Data we collect

We only collect what you send us and what the website needs to work:

  • Contact form: name, email, WhatsApp (optional), subject and message.
  • Quote request: name, email, mobile number, CPF (Brazilian taxpayer ID), date, state and city of birth, delivery address, products of interest and the status of your Anvisa authorization.
  • Documents attached to the quote request: prescription, photo ID and, if available, the Anvisa authorization. The prescription is sensitive personal data (health data) and receives enhanced protection, described in section 7.
  • Browsing: IP address and the date and time forms are submitted (for security and abuse prevention) and, if you allow it, analytics cookies, described in section 8.

3. How we use it

  • To answer your messages and questions.
  • To prepare your quote and handle the product import steps under Anvisa RDC 660/2022, including, if you ask, help with applying for the authorization.
  • To arrange delivery of the product to the address you provide.
  • To send you messages about your request and, unless you object, informational content from Direto Pharma. You can opt out at any time.
  • To protect the website against fraud and automated submissions (bots).

We do not use your health data for marketing, and we do not sell personal data.

4. Legal bases

We process your data on the legal bases provided for in the LGPD:

  • Consent (art. 11, I), which you give by checking the authorization box on the quote form, for health data and documents.
  • Pre-contractual steps and performance of a contract (art. 7, V), to prepare your quote and fulfill your order.
  • Compliance with legal or regulatory obligations (art. 7, II, and art. 11, II, "a"), such as Anvisa import requirements.
  • Legitimate interest (art. 7, IX), to respond to inquiries, keep the website secure and send informational messages, always with the option to decline.

5. Who we share it with

We share data only when needed to serve you, and only the minimum necessary:

  • Anvisa and other authorities, when required for the import or by law.
  • Logistics and customs partners, to deliver the product.
  • Technology providers that help us operate: website hosting and email delivery.
  • RD Station (customer relationship platform), which receives only the name, email and phone number of people who fill out the forms. CPF, documents and health data are not sent to it.

These partners may use the data only for the contracted purpose and must protect it.

6. International transfers

Because the Direto Pharma group also operates in the United States and some technology providers operate outside Brazil, your data may be processed abroad. In these cases, we adopt the safeguards provided for in the LGPD (art. 33) and require levels of protection consistent with this policy.

7. Storage and security

  • The website uses a secure connection (HTTPS) on every page.
  • Attached documents are stored in a protected area of the server, not publicly accessible. Only authorized staff, with a username and password, can open them.
  • We keep data for as long as needed to serve you and to meet legal and regulatory obligations. After that, it is deleted or anonymized.

8. Cookies

Cookies are small files the website stores in your browser. We use two types:

  • Essential: keep the website working and remember your cookie choice. They cannot be turned off.
  • Analytics and relationship: help us understand how the website is used (for example, Google Analytics) and connect your inquiries to our support team (RD Station). They are only turned on if you accept.

You can change your choice at any time under , also available in the website footer.

9. Your rights

Under the LGPD (art. 18), you may, at any time and free of charge:

  • confirm whether we process your data and access it;
  • correct incomplete, inaccurate or outdated data;
  • request anonymization, blocking or deletion of unnecessary data;
  • request data portability;
  • find out who we share your data with;
  • withdraw your consent and request deletion of data processed on that basis;
  • object to processing based on legitimate interest.

To exercise any of these rights, write to [email protected]. We may ask you to confirm your identity to protect you. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

10. Children and adolescents

When the treatment is for a minor, the data and documents must be sent by a parent or legal guardian, who gives consent on the patient's behalf under art. 14 of the LGPD. This data is used only to provide our services and always in the best interest of the child or adolescent.

11. Changes and contact

We may update this policy to reflect changes to the website or the law. The date of the last update appears at the top of the page. If you have any questions, contact us by email at [email protected] or on WhatsApp at +55 (11) 93908-5397.