Privacy Policy

Sleek Intake ("we", "us") provides digital intake forms to spas, esthetics studios and wellness clinics ("Clinics") through our website (sleekintake.com) and mobile app. Sleek Intake is a product of RT DESENVOLVIMENTOS LTDA. This policy explains what we collect, why, and your choices.

1. Who controls the data

• Clinic staff accounts: RT DESENVOLVIMENTOS LTDA (Avenida Vida Nova, 28, Sala 1011 B, Taboão da Serra – SP, 06764-045, Brazil) is the controller of account and billing data.
• Client intake forms: each Clinic is the controller of the forms its clients fill in. We process this data on the Clinic's behalf, as a processor or service provider. To access, correct or delete your intake form, contact the Clinic directly. You can also contact us and we will forward your request.

2. What we collect

• From Clinic staff: name, email, password (stored hashed by our authentication provider), clinic name, address, country, phone, contact email, logo, services and prices, and subscription status.
• From Clinics' clients (intake forms): name, date of birth, email, phone, answers to health questions (for example medications, skin conditions, pregnancy, allergies), notes, accepted consents, signature image, and the date and time of signing. For EU clinics, we also record the GDPR consent text, its version and when it was accepted.
• Technical: basic logs needed to run and secure the service (for example IP address and timestamps). We don't use advertising or tracking tools in the mobile app.

3. Why we use it

• To provide the service: show forms to the Clinic, flag answers for review, generate PDFs and send form links.
• To manage accounts and subscriptions.
• To keep the service secure and to fix problems.

We never sell personal data, and we never use health data for marketing or advertising.

4. Legal basis (EU/EEA)

Health data in intake forms is processed on the basis of the client's explicit consent (Art. 9(2)(a) GDPR), which is collected in the form. Account data is processed to perform our contract with the Clinic (Art. 6(1)(b) GDPR).

5. Service providers

• Supabase (via Lovable Cloud): database, authentication and file storage.
• Stripe: subscription payments, made on the website only. We don't store card numbers.
• Resend: sends form invitation emails.
• Lovable: website hosting.

Each provider processes data only to deliver its service to us.

6. Retention

• Intake forms are valid for 6 months after signing. After that, the client is asked to fill in a new form.
• Forms are kept while the Clinic's account is active, until the Clinic deletes them, or until a deletion request is received.
• When a Clinic closes its account, its data is deleted within 30 days, except what we must keep by law (for example invoices).

7. Security

Data is encrypted in transit (HTTPS/TLS). Each Clinic can only access its own data. Signed forms carry a verification code (a SHA-256 hash) to detect changes. The mobile app's front-desk PIN is stored only on the device.

8. Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, and to withdraw consent. Clients should contact their Clinic. Clinic staff can contact us at thiagoreis@rtdesenvolvimentos.com.br. EU residents may also complain to their local data protection authority.

9. Children

The service is meant for adults. Clinics are responsible for getting parental consent when they treat minors.

10. Changes

If we make material changes to this policy, we'll update this page and notify Clinics by email.

11. Contact

RT DESENVOLVIMENTOS LTDA · Avenida Vida Nova, 28, Sala 1011 B, Taboão da Serra – SP, 06764-045, Brazil · thiagoreis@rtdesenvolvimentos.com.br