Privacy Policy
This policy explains plainly what data NURA collects, why it collects it, who it is shared with, and what you can demand about it. It covers the whole site and every assessment.
In force since 31 August 2026.
1. Who handles your data
The controller of personal data at NURA is PHR DATA DESENVOLVIMENTO LTDA, Brazilian tax number (CNPJ) 66.100.360/0001-73, at Rua Tereza Mota Valadares, 498 — Buritis, Belo Horizonte/MG, CEP 30575-160.
For anything concerning personal data, including the rights described in section 8, write to our data protection officer at privacidade@nuraperfil.com.
2. What we collect
We collect only what the assessment needs to work and the report needs to reach you:
- Your answers to the assessments, along with how long you took on each question.
- An anonymous identifier for your browser, created automatically so the assessment resumes where you left it and so the result belongs to you alone. It carries no name, no email and nothing that identifies you outside the site.
- Your email address, when you give it to receive the report.
- Purchase data, when there is a purchase: amount, date and payment confirmation. Card details are typed directly into Stripe’s fields and never reach our servers.
- Anonymous page-usage measurement — only if you accept it in the notice shown on your first visit. Your assessment answers never enter that measurement.
3. Your answers are sensitive data
The ADHD self-assessment is a screening instrument, and the answers you give concern your health. Brazil’s data protection law treats health data as sensitive personal data and demands greater care with it. That is why:
- Your answers are tied to your browser’s anonymous identifier, not to your name.
- The database enforces row-level rules that stop any visitor from reading another’s answers, even knowing the address.
- Your answers are never used for advertising, never sold, and never included in usage measurement.
- This data is processed with your specific, highlighted consent — the act of answering after reading what the assessment is for — and you can withdraw it at any time by requesting erasure.
4. What we use it for
- Running the assessment, computing the result and showing it to you.
- Delivering the full report when it is bought, and emailing it to you.
- Meeting our obligations as a seller: issuing the charge, evidencing payment and handling refunds.
- Understanding how the site is used and improving it, in aggregate and anonymously, only with your consent.
- Complying with legal and regulatory obligations that fall on us.
5. On what legal basis
Each use above rests on a legal basis: your consent for the assessment, the health answers and the usage measurement; performance of the contract to deliver and charge for the report; and compliance with legal obligations to keep tax and consumer records.
6. Who we share it with
We do not sell personal data and do not release it for advertising. We share only with the providers the service needs to exist, each limited to what it requires:
- Vercel Inc. (United States) — website hosting and server execution.
- Supabase Inc. (United States) — the database holding sessions, answers and email addresses.
- Stripe, Inc. (United States) — payment processing. Card details are typed into Stripe’s own fields and never reach our servers.
- Resend (United States) — delivery of the email carrying your report link.
- PostHog (United States) — anonymous usage measurement, enabled only if you accept it in the privacy notice.
7. International transfer
Every provider listed above operates outside Brazil, mainly in the United States. That is an international data transfer under Brazilian law, and it happens with your consent and under the contractual protection commitments those providers offer.
8. Your rights
Brazilian data protection law gives you, over your data, the right to:
- Confirm that processing exists and access the data we hold.
- Correct incomplete, inaccurate or outdated data.
- Request anonymisation, blocking or erasure of unnecessary or unlawfully processed data.
- Request portability to another provider.
- Request erasure of data processed on the basis of your consent.
- Know who we share your data with.
- Be informed that you may withhold consent, and what follows if you do.
- Withdraw consent at any time.
9. How to exercise them
Write to privacidade@nuraperfil.com saying what you want. We answer within 15 days. For access or erasure requests we may need to confirm the request comes from the person entitled to make it, and we will ask for the minimum needed to do so.
Requesting erasure of your answers also erases the result and the report built from them — there is no restoring them afterwards, and you would need to take the assessment again.
10. How long we keep it
- Answers, results and sessions: for as long as the service exists, so you can return to your result. They can be erased sooner at your request.
- Email: for as long as you want the report and our messages; leaving is immediate on request.
- Purchase records: for the period tax and consumer legislation requires, even if you request erasure of everything else — on that specific point the law overrides the request.
11. Security
Traffic is encrypted end to end. The database enforces row-level access rules, so each visitor only reaches what is theirs. Card data never touches our infrastructure. No measure removes all risk, and if an incident occurs that could pose relevant risk to you, we will notify you and the Brazilian data protection authority.
13. Minors
NURA’s assessments are designed for adults and the service is not directed at people under 18. If we learn we have collected a minor’s data without proper legal grounds, we will erase it.
14. Changes to this policy
When this policy changes, the date at the top changes with it. Relevant changes will be announced on the site, and continuing to use NURA after them means you are aware of them.