Privacy Policy

Last updated: June 6, 2026

International WBCT Society ("we", "us", or "our") is committed to protecting the personal data of its members. This Privacy Policy describes how we collect, use, store, and protect your information when you use the WBCT member platform (the "Service").

This policy is consistent with the Brazilian Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018) and applicable international privacy standards.

1. What Data We Collect

We collect the following categories of personal data:

Full name and professional email address
Password (stored as a one-way cryptographic hash — never in plain text)
Medical registration number and medical specialty
Professional biography and profile photo (optional)
Content you publish (posts, comments)
Social interactions (follows, connections, event participation)
Login timestamps and last active time
Cookie and consent preferences
IP address at the time of consent registration

2. Legal Basis for Processing (LGPD Art. 7)

Consent — Cookie preferences, marketing communications, newsletter subscription, and event communication opt-ins. You may withdraw consent at any time.

Contract execution — Account creation, membership management, and access to member-exclusive content.

Legitimate interest — Platform security, fraud prevention, system integrity, and service improvement analytics.

Legal obligation — Compliance with applicable laws and responding to lawful regulatory requests.

3. How We Use Your Data

To provide and maintain the member platform and its features
To manage your membership registration and approval
To send transactional notifications (account status, event updates)
To send newsletter and promotional communications (with your consent)
To enable community interactions (posts, messages, events)
To detect and prevent security threats and misuse
To comply with legal and regulatory requirements

4. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, your personal data (profile, posts, messages) is permanently erased from our systems. Consent audit logs are retained for 5 years to meet legal traceability requirements. Security and activity logs are retained for 12 months.

5. Data Processors

We share data with the following trusted processors who act on our instructions and are bound by data protection agreements:

Appwrite (database.wbctmember.org) — database storage and authentication infrastructure. Data is stored in our self-hosted Appwrite instance.
Resend — transactional and newsletter email delivery. Only your name and email address are shared for this purpose.

We do not sell your personal data to third parties.

6. Cookies and Tracking

We use cookies and similar technologies to operate the platform and, with your consent, for analytics and marketing. You can manage your cookie preferences at any time. For full details, see our Cookie Policy.

7. Your Rights (LGPD Art. 18)

Under the LGPD, you have the right to:

Access — download a copy of all your personal data via your profile settings
Rectification — update your profile information at any time
Erasure — permanently delete your account and all associated data via profile settings
Portability — export your data in JSON format
Withdrawal of consent — update cookie or communication preferences at any time
Information — request information about how your data is processed

To exercise any of these rights, use the controls in your profile or contact us directly.

8. Security

We implement appropriate technical and organisational measures to protect your data, including password hashing (bcrypt), JWT-based session authentication, role-based access control, and administrative action audit logging.

9. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will communicate the breach to affected individuals without undue delay, in accordance with LGPD Art. 48.

10. Children's Privacy

Our Service is intended exclusively for licensed medical professionals. We do not knowingly collect personal data from anyone under the age of 18.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this page regularly.

12. Contact

For questions, data subject requests, or to contact our Data Protection Officer (DPO):

Email: info@wbctsociety.org
Website: wbctsociety.org/contact-us