# Privacy policy

What personal data NETBRAND processes on this site and when operating Velô, why, for how long, and how to exercise your rights under GDPR, LGPD and Colombia's Law 1581 of 2012.

Updated 2026-11-05 by NETBRAND CORP · https://netbrandcorp.com/privacy/

> **In short:** this site uses no cookies, analytics or advertising. We only process the data you send us in the POC form and the server's technical logs. Velô, the product, runs inside your network: NETBRAND does not receive your documents or your patients' data.

## Who is responsible

NETBRAND CORP, West Palm Beach, Florida, United States ("NETBRAND"). For any privacy matter: hello@netbrandcorp.com, with the subject "Privacy".

## What data we process on this site

| Data | When | Why | Legal basis | How long |
|---|---|---|---|---|
| Name, work email, institution, document volume and type | When you send the POC form | To answer your request and prepare a proposal | Pre-contractual steps at your request (GDPR art. 6(1)(b)); in Colombia and Brazil, the authorization you give by sending the form | 24 months from the last contact, or until you ask us to delete it |
| IP address, browser, language and page you sent the form from | With the form | To prevent spam and abuse | Legitimate interest in site security (GDPR art. 6(1)(f)) | Same as the request |
| Server logs: IP, date, requested page and browser | On every visit | To run and protect the site | Legitimate interest in site security | 7 days |
| Chosen language | Only if you accept the notice | To show the site in your language | Consent | In your browser, until you delete it |

## What we do not do

- **We use no cookies, pixels, analytics or advertising.** Fonts are served from our own server, with no third-party calls.
- **We do not sell personal data** or share it for advertising.
- **We make no automated decisions** and build no profiles about you.
- **The live demo runs in your browser.** The text you paste is not sent to our servers. Even so, please do not paste real patient data.

## Who it is shared with

- **DigitalOcean**, which hosts the site in its New York data center, United States.
- **Amazon Web Services**, which sends request emails through Amazon SES, region us-east-1, United States.
- **Our email provider**, where we receive requests.
- **The NETBRAND staff** who handle your request.

These providers act as processors under their data protection agreements. We share your data with no one else, except where the law requires it.

## International transfers

Data is hosted in the United States. If you are in the European Economic Area, the United Kingdom, Brazil or Colombia, the transfer relies on the standard contractual clauses included in our providers' data processing agreements and on the safeguards each law requires.

## Your rights

- **GDPR (European Union):** access, rectification, erasure, restriction, portability, objection, and withdrawing consent at any time.
- **Law 1581 of 2012 (Colombia):** know, update and correct your data, request proof of authorization, revoke it, request deletion and file complaints with the Superintendencia de Industria y Comercio.
- **LGPD (Brazil):** confirmation and access, correction, anonymization, blocking or deletion, portability, information on who it is shared with, and revoking consent.
- **United States:** you can ask for access or deletion even if your state's law does not require it.

Write to hello@netbrandcorp.com with the subject "Privacy". We answer queries within 10 business days and complaints or deletion requests within 15 business days, always within the one month set by GDPR. You can also contact your data protection authority: in the European Union, your country's; in Brazil, the ANPD; in Colombia, the SIC.

## Velô in your infrastructure

When you license Velô, the software runs on the Velô Nodo or on your servers, and the license is validated offline. **Your documents and your patients' data do not leave your network or reach NETBRAND:** your institution is the controller of that processing. In a POC we work at your site with your documents, without copying them out. If our staff ever needs access to personal data, for example for support, a confidentiality and data processing agreement is signed first, and we ask you to send only de-identified examples.

## Security

HTTPS across the site, restricted server access, logs deleted after 7 days and requests stored with limited permissions.

## Children

This site is aimed at institutions and professionals. We do not knowingly collect data from minors.

## Changes

If we change this policy, we update the date on this page. Last updated: November 5, 2026.