Privacy Policy
Version of 10/29/2026 (Portuguese original: “Versão de 29/10/2026”) · Brazilian Law No. 13,709/2018 (LGPD)
Connected professionals: assessment photos and questionnaire answers only leave your device when you actively send them to a professional you linked — end-to-end encrypted, for you and that professional. Photos are sent reduced and without camera data. We cannot open any of it.
Location and body readings: the route of your activities (GPS location) and recovery readings (sleep, heart rate variability, resting heart rate and steps) stay on this device. They are only uploaded to the server, encrypted, if you turn on the backup for that category — each one has its own switch, and turning it off deletes the server copy. The route is never sent to any professional.
1. Privacy contact
For privacy and data protection matters, write to suporte@ritmoleve.com.
2. What we process, and what we can read
| Data | What for | Can we read it? |
|---|---|---|
| Identify the account, recover access, notify about billing | Yes | |
| Session and access data (browser, dates and IP of acceptance) | Keep the account secure and document the acceptance | Yes |
| Password | Authentication | It does not receive the typed password. The device sends a proof derived from it; the server stores an Argon2id hash of that proof. |
| Injections, doses, weight, symptoms, meals | Show your history to you | No. They arrive encrypted (AES-GCM) with a key that has never been on the server |
| Category (dose, weight, symptom, nutrition, workout, activity, route, recovery reading) and change dates of entries | Sync between devices without duplicating or losing anything | Yes — it reveals the category and when a change happened, but not the encrypted content |
| Weekly workout plan and exercise history | Organize your workouts and keep the history on your devices | Yes, encrypted. They are uploaded to the server in the same vault as the other entries, to sync between devices. The server stores the encrypted block and cannot read the content |
| Outdoor activities (type, day, distance, time, pace, splits) | Show your runs, walks and rides | No. They stay on this device. They are uploaded encrypted only if you turn on the activities backup |
| Activity route (GPS location) | Draw the path you took | No. GPS is only used with the app open and with your permission on the device. The points are stored sealed on this device and are only uploaded, encrypted and with their own key, if you turn on the route backup. The route never goes to a professional; on the share card it only appears if you choose, without the first and last 1 km |
| Recovery readings (sleep, heart rate variability, resting heart rate, steps) | Show your numbers and your personal range, with no alert or recommendation | No. They stay on this device, typed by you or read from a file you chose (the file is not sent). They are uploaded encrypted only if you turn on the readings backup |
| Backup choice per category (on or off, and when) | Respect and document your consent for each category | Yes — whether the category is on, not the content |
| Your speech, when you tap "Speak" (microphone) | Turn what you said into text, for you to check before saving | No. The app only uses speech recognition when the browser confirms it runs on this device; the audio is not recorded, not kept and not sent to anyone. Where that is not available, the app does not listen and points to your phone keyboard's microphone, which works under the keyboard's own rules (Google, Samsung, Apple), not Ritmo Leve's |
| Text of "Say what I did" (spoken or typed) | Turn your sentence into an entry, for you to check before saving | No. The sentence is interpreted on this device and is not sent to anyone. Only what you save becomes an entry, like any other |
| Profile and progress photos | Follow your progress visually | No. They stay only on this device and are not sent to the server. Switching devices does not take the photos along |
| Connection with a professional: who the professional is, which areas you authorized and the dates of invitation, acceptance and ending | Allow the connection and know what each professional may receive | Yes — the connection itself. The content exchanged through it, no |
| Workout feedback (effort, pain, comment) | Record how the session went and, if you want, let your personal trainer know | No. It goes encrypted, like the rest of the diary, and reaches the personal trainer only when you send the workout. Only the date and whether you asked for their attention stay readable |
| Assessments requested by a professional (questionnaire and assessment photos) | Answer the professional you authorized | No. They only leave the device when you answer, encrypted for you and that professional. The server stores the block, the date and the size. You can withdraw the answer; what the professional already opened on their device does not come back. A copy of the questionnaire you answered stays in your diary, on this device, and goes into the backup you export (the photos don't) |
| Subscription status and payment history | Unlock the vault, handle billing and meet tax obligations | Yes |
| Acceptance record (date, IP, text version) | Document the sign-up acceptance and that of each new version of these texts | Yes |
| Full card number and security code | — | Not received by our server (VPS) nor saved by Ritmo Leve. The secure fields send this data directly to Mercado Pago. |
3. Legal basis
Health data is sensitive personal data (art. 5, II). We process it based on your specific and highlighted consent (art. 11, I), collected separately from the acceptance of the terms at sign-up.
Sending data to a professional relies on your specific consent for each connection and each area (art. 11, I): you choose the areas when accepting the connection, send each assessment by your own decision and can reduce the areas or end the connection at any time.
Location (route) and body readings have their own consent, per category (art. 11, I): the activities backup, the route backup and the readings backup are turned on one by one, each with its own notice, and stay off until you turn them on. Turning off stops the upload and deletes that category's copy on the server.
Account and billing data follow the performance of the contract (art. 7, V) and compliance with legal and tax obligations (art. 7, II).
You can request revocation through the contact above or delete the account in the app. Revocation ends the processing based on that consent from then on; billing data subject to legal retention may remain for the applicable period.
4. How the encryption works (and what it costs)
Biometric unlock is optional and uses the device's secure confirmation, which may also offer your device passcode. Ritmo Leve does not receive face images or fingerprints. The quick-access setting is stored in this browser with cryptographic protection; your password remains available.
When you create the account, your device generates a random key that is never sent to the server. Every entry is encrypted with it before upload. The server keeps the key only wrapped — protected by your password and, separately, by your recovery code. Without one of the two, the wrapping does not open.
On the other hand: a leak of our database, a lost backup or an order to hand over your entries do not expose the content of your diary, because it does not exist in readable form anywhere under our control.
5. Who we share with
- Mercado Pago — processes payments. It receives your e-mail and the amount, plus the data required to process the charge, such as the payer's CPF (Brazilian taxpayer ID). For cards, the secure form generates a temporary token, forwarded by our API to the provider. The CPF and the token are not saved by Ritmo Leve. We keep identifiers, plan, method, date and status of attempts to avoid duplicate charges and allow lookups. The Mercado Pago form may collect technical data from the device and connection for fraud prevention. Mercado Pago processes this data and the payment data under its own terms.
- Professionals you link — the personal trainer, dietitian or physician you chose. They see only the areas you authorized and only what you send, encrypted for them. You reduce or revoke whenever you want. What the professional does with what they received is their responsibility, as in any care relationship. If you authorize it, the personal trainer can receive the recovery readings and the summaries of the activities you choose to send — day, distance, time and pace; never the route, the time of day or the notes. They see only the day you shared, not the time.
- Transactional e-mail provider — sends verification, password recovery and expiry notices. It receives your e-mail and the message text.
- Hosting provider — keeps the server where the encrypted data is stored.
We do not sell, rent or give away data for advertising. There are no third-party trackers, ad pixels or analytics in the app.
We may disclose data under a court order — and, in that case, we hand over what we have: account and billing data, categories, dates and encrypted blocks that not even we can open.
6. Cookies
We use one strictly necessary cookie: the one that keeps your
session open. It is httpOnly, inaccessible to JavaScript, and
does not track you. No advertising cookies, no third-party cookies.
7. How long we keep data
- Diary entries: while the account exists in the active database. After deletion, earlier copies in the server's backups may remain for up to 14 days.
- Activities, routes and readings on the server: while the category's backup is on. When you turn it off, that category's copy is deleted from the active database immediately; server backups follow the period below.
- What you sent to a professional (assessment answers and photos, workout copies): while the connection exists. 90 days after the connection ends, we delete from the server the questionnaires, answers, assessment photos and copies you sent them. The copy in your diary and the plans they prescribed remain.
- Sessions: until they expire (60 days) or you sign out.
- Acceptances and payments in the active database: removed together with the account. Records kept by the payment processor follow that provider's periods and policy.
- Server backups: kept for up to 14 days and then discarded. They also contain e-mail, categories and dates, account and billing data. A copy of these backups, encrypted before leaving the server, may be kept outside the server for recovery in case of failure, for the same period.
8. Your rights (art. 18)
In the app, without having to ask anyone:
- Access and portability — Settings → Export backup, which generates an encrypted file, protected by a password you choose. In connected accounts, Settings → Export account data separately downloads a readable file with the administrative data and the server's encrypted entries.
- Account deletion — Settings → Security → Delete account, with password confirmation. It deletes the account and the entries in the active database. Local copies on other devices and exported backups must be removed in those places. The same path works in the browser, at ritmoleve.com, without the app installed; if you cannot sign in, request deletion from the account's email address to the support email below.
- Correction — delete the incorrect entry and make another.
For confirmation of processing, information about sharing, revocation of consent or complaints, write to suporte@ritmoleve.com. We reply within 15 days.
You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).
9. Security
- End-to-end encryption of content (AES-GCM, key only on the device).
- Mandatory HTTPS, with HSTS.
- Passwords derived with PBKDF2 on the device and stored with argon2id.
- Per-account isolation in every database query.
- Login attempt limits and session token rotation.
- Database and API accessible only locally on the server, behind a firewall.
In case of an incident with relevant risk, we will notify you and the ANPD within the legal deadlines.
10. Minors
The service is not intended for people under 18 and we do not knowingly collect data from that age group.
11. Changes
Relevant changes will be announced by e-mail and in the app. When a change alters what happens with your data, the app asks for a new acceptance before you continue. Each version you accepted is recorded with its date.