Privacy Policy — Brazil Import Healthcare Solutions (BIHS) · English version
In case of any discrepancy, the Portuguese version prevails.
1. Who we are and scope
The controller of the personal data covered by this policy is Brazil Import Soluções para Saúde Ltda., doing business as Brazil Import Healthcare Solutions (BIHS), CNPJ 34.625.205/0001-84, Av. Caborê, 204-B, Sala 03, Anexo Pousada Recanto dos Maddas, Paraty, State of Rio de Janeiro, Brazil, ZIP 23970-000, a Brisa Advisors Group company operating under the BRISA Advisors brand (“BIHS”, “we”).
BIHS provides regulatory consulting and acts as Brazilian Registration Holder (BRH) before ANVISA for manufacturers of health products. The personal data we process is, as a rule, business contact data of representatives of manufacturers, clients and partners, and the data required to meet our regulatory obligations as registration holder.
This policy follows the Brazilian General Data Protection Law (Law No. 13,709/2018, “LGPD”) and, for data subjects located in the European Economic Area, the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), to the extent applicable.
Contact for data subjects: privacidade@brisa.com.br. Through this channel you can exercise your rights, ask questions and reach the person responsible for data protection at BIHS.
2. Data we process, why, and on what legal basis
We process only the data needed for each purpose.
| Situation | Data | Purpose | Legal basis (LGPD) |
|---|---|---|---|
| Clients and their representatives | Name, title, e-mail, phone, company and country | Providing the contracted regulatory consulting and registration holder services | Performance of contract (Art. 7, V) |
| ANVISA filings and maintenance of registrations | Data of representatives and technical officers included in regulatory documents | Preparing filings and keeping registrations and records for the period required by health regulations | Legal or regulatory obligation (Art. 7, II) |
| Post-market surveillance and technical complaints | Data of the notifier and, where unavoidable, patient health data reported in the notification | Receiving, recording and forwarding notifications to authorities and to the manufacturer | Legal or regulatory obligation (Art. 7, II, and Art. 11, II, “a”), with minimal data |
| Business contacts (trade shows, website, referrals) | Name, title, e-mail, phone, company and country | Presenting BIHS services and answering inquiries | Legitimate interest (Art. 7, IX, and Art. 10) |
| Communications to clients about services of BIHS and companies of the same group | Name and business e-mail | Informing about services related to the client’s business in Brazil, always with an unsubscribe option | Legitimate interest (Art. 7, IX, and Art. 10) |
| Referrals received from the gropo platform | Name, title, e-mail, phone, company and country | Contacting those who authorized BIHS to reach them | Consent given on the gropo platform (Art. 7, I, and § 5) |
| Legal defense and audits | The data above, as necessary | Exercising rights in judicial, administrative or arbitral proceedings | Regular exercise of rights (Art. 7, VI) |
3. Who we share data with
We do not sell personal data. We share data only as follows.
- ANVISA and other authorities, when required by health regulations, by law or by court order.
- The client manufacturer, for the data needed to perform the contracted services and for post-market surveillance notifications.
- NONSTOP IMPORT TECH LTDA. (gropo), CNPJ 53.740.141/0001-07, a company of the same group: business contact data of manufacturers, for commercial prospecting on the gropo platform, based on legitimate interest. You may object to this sharing through the contact channel.
- Service providers acting for BIHS, such as e-mail, cloud storage and customer relationship management, which process the data only on our instructions and under confidentiality duties.
- Corporate transactions, such as reorganization or investment, with the same protection as this policy.
4. International transfers
Because we serve manufacturers in other countries and use providers that may store data abroad, data may be transferred internationally. Such transfers take place when necessary to perform the contract or to meet regulatory obligations, or with the contractual safeguards required by Art. 33 of the LGPD and by ANPD regulations.
5. Retention
| Data | Period |
|---|---|
| Clients and their representatives | During the contract and up to 5 years after it ends |
| Regulatory and post-market surveillance records | While the registration is in force and for the period required by health regulations |
| Business contacts without a contract | 24 months without new interaction |
| Request for deletion or no contact | Only the e-mail, in a suppression list, to ensure no further contact |
When these periods end, the data is deleted or anonymized, unless the law requires its retention (LGPD, Art. 16).
6. Your rights
Through the contact channel you may request at any time (LGPD, Art. 18): confirmation that we process your data and access to it; correction; anonymization, blocking or deletion of unnecessary data or data processed in breach of the law; portability; information on who we share data with; withdrawal of consent, where that is the legal basis; and objection to processing based on legitimate interest, including unsubscribing from commercial communications, also available in every e-mail.
We will reply within 15 days and may ask for information to confirm your identity. You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).
7. Data subjects in the European Economic Area (GDPR)
If you are in the European Economic Area, the processing described above relies on the performance of a contract (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c)), our legitimate interest in maintaining and developing business-to-business relationships (Art. 6(1)(f)) and, where local law requires it for commercial communications, your consent (Art. 6(1)(a)). You have the rights of access, rectification, erasure, restriction, portability and objection (Arts. 15 to 21) and may lodge a complaint with the data protection authority of your country. Transfers to Brazil follow the safeguards required by Chapter V of the GDPR.
8. Security
We apply technical and administrative measures to protect data against unauthorized access, loss and alteration. In the event of an incident that may cause relevant risk or harm, we will notify the ANPD and the affected data subjects, as required by regulations.
9. Changes to this policy
We may update this policy to reflect changes in our services or in the law. The current version is published at brazilimport.com.br/privacy (English) and brazilimport.com.br/pt/privacidade (Portuguese), with the date of the last update.
Version: BIHS-PRIV-v1.1 · last update: October 16, 2026.