Privacy · Porto Alegre

This policy explains how the Hospital Espiritual da Caridade Nossa Senhora de Fátima processes personal data on the website, in accordance with the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018).

Who is responsible
The data controller is the Hospital Espiritual da Caridade Nossa Senhora de Fátima, CNPJ 64.082.402/0001-65, Travessa Viamão, 129, Medianeira, Porto Alegre/RS, CEP 90880-330. The person in charge of processing personal data (data protection officer) is Maico Volpatto, at the email [email protected]. We also answer on WhatsApp 51 99245‑9445.

What data we collect
In the contact form: name, email, phone and message, as well as the record that you consented to this policy.
On the donation page: frequency (one-time or monthly), the amount chosen and an optional comment. This website does not ask for a card number, expiry date, security code or bank password. For donations through Mercado Pago, payment takes place in a window on this site using Mercado Pago's own secure fields (or on Mercado Pago's pages), and Mercado Pago processes the payment data. The site does not receive card data: the card is typed into Mercado Pago's fields, which return only a temporary code used once to create the payment. The email and CPF requested there pass through the site only to create the payment at Mercado Pago (purpose: processing the donation and sending the receipt) and are neither stored nor logged. The site keeps only the payment code, status, type, amount and date, with no name, email or CPF. When the payment is approved, the site notifies Google Analytics (amount and payment code); if you accepted Statistics, this notice uses the visit identifier, which the site deletes right after sending or within 2 days.
In the visit counts: the page path, the referring domain, a generic device class (mobile phone, tablet, computer) and the day. These counts do not store the IP address or the full browser identifier.
In the anonymous visit count: when a page opens and at each step of the donation (opening the page, choosing the method, copying the PIX key, opening Mercado Pago and finishing), the browser notifies the server, which only adds one to the day's total, separated by page, language and device type (mobile phone or computer). This count applies even without accepting Statistics, because it does not set a cookie, does not create a visit code, does not store the IP address and does not make it possible to know who visited.
In our own heatmap, only if you accept Statistics in the cookie notice: where the page was clicked (the position relative to the element and to the page, and the technical name of the element, such as a button), how far the page was scrolled, repeated clicks or clicks with no response, and quick returns to the previous page. With this same choice, the website stores its own usage metrics sent to /api/eventos: clicks on buttons, the donation steps, the schedule posters viewed and failures, such as a script error or a broken image, with a technical visit code that lasts 1 day. We store the event, the page, the language and the screen width. We do not store the text typed or the content of the fields, the name, the email or the IP address. Some visits may be left out of the map by sampling.
In the server's security logs: IP address, date and time, page requested and browser of each access.
In the email news: the email address, the origin of the request (website footer or testimonial), the date and version of the consent, the date of confirmation and, where applicable, the date on which you left the list.
In the Google sign-in, when sending a testimonial: the website asks Google only for the basic account data and stores the name, the first name, the email and the Google account identifier. Google also provides the profile photo, but the website neither stores nor displays it. We do not receive any password, and the access codes that Google returns are discarded immediately.

What we use it for
To answer messages, organize the welcome, publish approved testimonials, send news to those who asked for it and understand, in aggregate form, how the website is used, in order to fix failures. The legal basis is your consent, in the forms and in the cookie notice, and the house's legitimate interest in keeping the website secure and working. The anonymous count of visits and of the donation steps relies on the house's legitimate interest in knowing, in aggregate numbers, whether the website and the donation work (art. 7, IX, of the LGPD), and it does not identify anyone. Our own heatmap depends on the consent given under Statistics. Google Analytics 4, Microsoft Clarity and the YouTube video player depend only on the consent given in the cookie notice (art. 7, I, of the LGPD), which you can withdraw at any time (art. 8, § 5). Signing in with Google is also your choice: the testimonial can be sent without signing in.

Measurement with Google Analytics 4 and Microsoft Clarity
They only work if you accept Statistics in the cookie notice. Without that choice, the Google and Microsoft scripts are not loaded.
Google Analytics 4: records the pages visited and where the visit came from, including the campaign codes (utm) in the link. It also records page scrolling, clicks on WhatsApp, phone, email, social networks and map, copying the PIX key and choosing the donation method, clicks on the buttons to send a contact message and a testimonial, the frequently asked questions opened, the videos hosted on the website itself that were started and watched to the end, the schedule posters viewed and the files downloaded. The page address goes to Google without the other parameters, and the confirmation and exit pages, which carry a code in the link, do not load Google Analytics or Clarity. The text you type in the forms is not sent to Google. Google also receives technical data from the browser and the device and estimates the approximate region. According to Google, Google Analytics 4 does not record or store the IP address.
Google Signals is active. For those who are signed in to a Google account with ad personalization turned on, Google may add estimates of age, gender and interests and combine the visits made on different devices. The house sees this data only in aggregate numbers.
The website tells Google that there is no consent for ads: the use of the data for advertising and for ad personalization is denied, even if you tick Marketing.
Microsoft Clarity: records the session (clicks, scrolling and movements) and builds heatmaps, to show where the page gets stuck. Masking is in Strict mode: all the text on the page appears masked in the recording, and what is typed in fields and lists is not sent to Microsoft. The testimonial form also has its own masking tag. Clarity uses the IP address to estimate the region and stores the data in Microsoft's Azure cloud. The website also tells Clarity that there is no consent for ads.

The house's contacts and announcements
When you sign in with Google to send a testimonial, we store the contact with two separate choices: authorizing the publication of the testimonial with your first name and, if you wish, receiving news from the house. One does not depend on the other, and neither is pre-ticked. Each contact has an exit link; when you use it, the announcements stop and we keep only the date of exit. You can also leave by writing to the contact of the person in charge.

Google reviews
The website may display public reviews left on the house's Google Profile, with the name the author shows on Google, the rating, the date and the text, without changes. Anyone who wants their review removed from the website can ask through the contact of the person in charge.
The /avaliar address, used in the QR code on the posters, leads to the Google review page. On each access, the website counts the day, the origin of the link (utm codes) and the device type, without storing the IP address, and deletes this count after 400 days. The server also sends Google Analytics 4 a qr_avaliacao_google event with the source, the medium and the campaign name and the page address. If you accepted Statistics, the event uses the visit identifier that Google Analytics itself already stored in the browser (the _ga and _ga_D8W1GCCPG4 cookies), so the reading joins the same visit; without that consent, these cookies are ignored and the event uses a random identifier created on the spot. This event carries no IP address, name, email or other browser data of the person accessing it.

Donations
Donations through the website are made by PIX: the website shows the key and the code for you to pay in your bank's app, and the house does not receive bank details through the website. If in the future there is a payment link from another provider, the payment takes place in that provider's environment and follows its policy.

Security and access blocking
To protect the website against bots and attacks, the server logs accesses and automatically blocks, by IP address, those who look for vulnerabilities or make many requests in a short time. The automatic block lasts up to 7 days and is lifted on its own. Networks from which repeated attacks come may remain blocked for longer. If you were blocked by mistake, write to the contact of the person in charge.

Who we share it with
We do not sell data. For the website to work, the house relies on these services, which process data only to provide the service (processors, in the language of the LGPD):
Oracle Cloud: hosts the website's server in Brazil, in São Paulo. Messages, requests and testimonials stay on this server, and the backup copies are encrypted before leaving it.
Cloudflare, a company headquartered in the United States: protects the website and speeds up loading. Every access goes through it, and it sees the IP address and technical data from the browser.
Brevo, a company headquartered in France: sends the website's emails, such as the news confirmation and the new message notices to the team, which contain no data about the person who wrote, only the link to the dashboard.
Google, a company headquartered in the United States: the Google sign-in, if you choose to sign in; Google Analytics 4, if you accept Statistics; the YouTube player (youtube-nocookie.com), if you accept Marketing and play a video; and the cover image of the YouTube videos, which the website's own server fetches from i.ytimg.com and keeps in cache, without sending data about the visitor.
Microsoft, a company headquartered in the United States: Clarity, if you accept Statistics.
These services may process data outside Brazil, in accordance with each one's privacy policy.

For how long
Contact messages, requests and donation intentions are kept for as long as they are necessary for the service and for the house's accountability, and they may be deleted on request.
In our own heatmap, the clicks and scrolling of each visit are kept for 30 days. After that, only totals per section of the page remain, with nothing that separates one visit from another, for up to 180 days. Our other usage metrics are kept for 90 days. The anonymous count of visits and of the donation is kept for 180 days, already totaled per day.
The server's security logs are deleted automatically after 14 days. Records of the team's actions in the admin panel, including the IP address of the person who made the change, are kept for security for up to 12 months and then deleted.
The visit counts are aggregated per day.
In Google Analytics 4, the data linked to each visitor and each event is kept for up to 14 months, and the estimates of age, gender and interests for 2 months. Reports with aggregate numbers, which do not identify the visit, are not subject to this period. In Clarity, recordings are kept for 30 days; those marked as favorites and a sample drawn by Microsoft are kept for up to 9 months. Heatmaps remain available for up to 9 months.
The news email and the house's contact are kept while you are subscribed. If you leave, we keep the email and the date of exit only so as not to send again, and we delete everything if you ask.
Published testimonials stay on the website until you ask for their removal.

Your rights
Under the LGPD, you can ask for confirmation that we process your data, access, correction, anonymization, portability, deletion, information about whom we share it with and the withdrawal of consent at any time. Write to the person in charge at [email protected] or contact us on WhatsApp 51 99245‑9445. You can also file a complaint with the National Data Protection Authority (ANPD).

Cookies
When you accept, the choice is stored in this browser for up to 12 months (version 2026-10-22.2), in local storage, and it is not a browsing cookie. If you decline, by choosing Only the necessary or Not now, the refusal is kept only until you close the browser, in session memory, and so the request may reappear on future visits. After a donation or a request has been sent, those who have not yet accepted may see a short invitation to accept. You can accept or decline at any time in Cookie preferences in the footer.
Necessary: the website's session cookie (hec_session), which lasts up to 12 hours and protects the forms against fake submissions. In the admin dashboard, it also keeps the login. If you sign in with Google, it stores in this browser, encrypted and for up to 1 hour, your name, email and account identifier, to fill in the testimonial, without any password or Google access code. This data leaves the session as soon as the testimonial is sent.
Statistics: turns on Google Analytics 4, Microsoft Clarity and our own heatmap. Google Analytics sets the cookies _ga and _ga_D8W1GCCPG4, which last up to 2 years. Clarity sets the cookies _clck and _clsk on this website and may use Microsoft cookies on its own domains, such as CLID and MUID. With Statistics, the website also sets a technical visit cookie (hec_ux), which lasts 1 day and groups our own usage metrics without identifying the person. None of this comes in before your choice.
Marketing: enables the YouTube videos on the website. The video only opens when you tap it, in YouTube's privacy-enhanced mode (youtube-nocookie.com). In this mode, according to Google, what you watch does not change your YouTube experience and is not used to personalize ads. After you tap, the player works inside the page and follows Google's privacy policy. Without Marketing, the website opens the cookie notice instead of the video. The video's cover image comes from YouTube's image server (i.ytimg.com) as soon as the page opens, before the choice. This request gives Google the IP address and technical data from the browser, and it does not set a cookie. The website does not load any ad pixel, and ticking Marketing does not enable ads in Google Analytics or in Clarity.
The Accept and help button turns on Statistics and Marketing. Only the necessary leaves both off. In Preferences, you choose each one. Public browsing does not require registration.

How to opt out of measurement and of the Google sign-in
To opt out of measurement, open Cookie preferences, in the footer, and untick Statistics, or choose Only the necessary. Right away, our own heatmap stops collecting, the hec_ux cookie is deleted and only the anonymous visit count continues, which does not identify anyone. From the next page on, Google Analytics and Clarity are no longer loaded. The cookies they have already set remain in the browser until they expire or until you delete them in the browser settings.
For Google Analytics, you can also use Google's opt-out browser add-on: tools.google.com/dlpage/gaoptout.
To keep the YouTube player from opening, leave Marketing unticked. The cover image of the videos is served by the website itself, from a cached copy, and your browser does not access the YouTube server to show it.
Google Signals stops applying to your account if you turn off Personalized ads in Google's My Ad Center (myadcenter.google.com).
Signing in with Google is optional: the testimonial can be sent without signing in. Those who have already signed in can disconnect the website at myaccount.google.com/linkedapps, under Sign in with Google. This does not delete what the website has already stored: to delete the contact or the testimonial, write to the person in charge. To stop receiving announcements, use the exit link or write to the person in charge.

Email news
If you ask to receive the news, the website sends a confirmation email through Brevo. Your email only joins the list after you open the link and tap Confirm; without that, no other message is sent. The date of confirmation is stored as a record of your consent. To leave at any time, use the Unsubscribe page (hospitalespiritualdacaridadensf.com/newsletter/sair) or write to the contact of the person in charge. When you leave, Brevo blocks new sends to your email.

Request for spiritual surgery
The help-at-a-distance form asks for name, email, WhatsApp, address, city, state, date of birth and main complaint. The complaint is health data, treated as sensitive personal data, and it is only stored with your consent. The answers stay on the website's server, visible only in the dashboard, so that the team can get in touch.
When a request arrives, the house receives two notices. The first is an email without any data from the form, only with the link to the dashboard. The second is a WhatsApp message with the complete request, including the main complaint, sent only to the house's own WhatsApp number. This message comes from the house's own service, which runs on the website's server and is connected to the house's WhatsApp as a linked device. WhatsApp, from Meta, only transmits the message, with end-to-end encryption. The notice does not use third-party services such as CallMeBot. The purpose is to handle the request, and the notice is temporary: it will be turned off when the team starts following the requests only through the dashboard.
You do not receive an automatic email.

Testimonials
The Tell my story form stores the first name, the treatment indicated, the text of the testimonial, the date and the version of the consent text. If you provide an email, it stays only in the dashboard, so that the house can reply, and it is not published. News is only sent to that email if you tick the news box, which comes unticked. If ticked, the email follows the same path as the email news: a confirmation message arrives with the exit link, and the address only joins the list after you confirm. If it is already on the list, nothing changes and it is not registered again. You can fill it in by hand or sign in with Google. The testimonial only appears on the website after the house approves it. A video, if any, is added by the house in the dashboard.

Last updated: October 23, 2026.

Measurement and privacy

Summary of the measurement tools and of the Google and Microsoft services used on the site. Google Analytics 4 and Clarity only work when the house registers the identifier in the panel and you accept Statistics in the cookie notice. While the field is empty, the tool stays off.

Google Analytics 4

If you accept Statistics, Google Analytics 4 records the pages visited and where the visit came from, including the campaign codes (utm) of the link, the scrolling and the clicks on contact, donation, social networks, map, frequently asked questions, videos of the site itself, schedule posters and files. The page address goes without the other parameters, and the confirmation and exit pages, which carry a code in the link, do not load Google Analytics. The text that you type in the forms is not sent to Google. According to Google, Google Analytics 4 does not record or store the IP address.

Google Signals is active. For people signed in to a Google account with ad personalization turned on, Google may add estimates of age, gender and interests and link visits made on different devices. The house sees this data only as aggregate numbers. The site tells Google that there is no consent for ads. Data linked to each visitor and to each event is kept for up to 14 months, and age, gender and interests for 2 months. The _ga and _ga_D8W1GCCPG4 cookies last up to 2 years.

Microsoft Clarity

If you accept Statistics, Clarity records the session (clicks, scrolling and movements) and builds heat maps, to show where the page gets stuck. Masking is in Strict mode: all the text on the page appears masked in the recording, and what is typed in fields and lists is not sent to Microsoft. The site informs Clarity that there is no consent for ads. Clarity records the cookies _clck and _clsk and may use Microsoft cookies on its domains. Recordings stay for 30 days, and the favorites and a sample drawn by Microsoft, for up to 9 months. Heat maps stay available for up to 9 months.

YouTube videos

The video only opens if you accept Marketing and tap it, in YouTube's enhanced privacy mode (youtube-nocookie.com). In that mode, according to Google, what you watch does not change your experience on YouTube and is not used to personalize ads. Without Marketing, the site opens the cookie notice instead of the video. The cover is requested by the site itself from YouTube's image server (i.ytimg.com) and stored in cache. The browser does not access i.ytimg.com when opening the page.

Sign in with Google

When sending a story you can sign in with Google to fill in name and email, or send without signing in. Without login, the email is optional: if you provide it, it stays only in the panel, for the house to reply, and it is not published. The site asks Google only for the basic account data and stores the name, the first name, the email and the account identifier. The profile photo is not stored. We do not receive a password, and the access codes that Google returns are discarded at once. After the submission, these data leave the session. The story continues waiting for the house's approval. There are two separate choices: publish the story with the first name and, if you wish, receive news.

Anonymous usage metrics

The site itself stores clicks on buttons, the donation steps and page failures, such as a script error, a broken image and a repeated click. The house's heat map stores the click position, as a percentage of the width and of the height of the page, the device type (phone or computer) and the technical name of the element. It also stores how long each band of the page height stayed visible on screen. We do not store the typed text, name, email, IP address or a personal identifier. The visit identifier is a code that changes every day and does not go back to the person. These metrics stay for 90 days and serve to correct the site. They do not depend on Google Analytics. Visits by robots, by the automatic check and by the house's tests do not go into this count.

How to leave

Open Cookie preferences, in the footer, and uncheck Statistics or Marketing, or choose Only the necessary. Google Analytics and Clarity stop loading from the next page on, and YouTube videos no longer open. Cookies that have already been stored stay in the browser until they expire or until you delete them in the browser settings. In Google Analytics, there is also the Google deactivation add-on. Google Signals no longer apply to your account if you turn off Personalized ads in My Ad Center. Whoever signed in with Google can turn off the site in Sign in with Google, in your Google Account. This does not erase what the site has already stored: to erase the contact or the story, write to the person in charge. To leave the announcements, use the house's exit link.