Privacy is care, too.

Who is responsible

I, Dr. Walter Zamarian Jr., am the controller of the personal data processed on this site and on the official contact channels. My address is Rua Engenheiro Omar Rupp, 186, Londrina, Paraná, Brazil, ZIP code 86015-360. For any privacy matter, email contato@walterzamarianjr.com or use the contact page.

This policy covers browsing on this site and contact through the official channels. Information recorded during a consultation or medical care is also protected by medical confidentiality and the rules for keeping medical records.

What information may be processed

This site has no login or sign-up area. Send only what your request needs and, if you prefer, ask for a human before sharing sensitive information.

AI assistant and images

On some official channels, the first reply comes from Bruna, an artificial intelligence assistant: on Instagram and Facebook and, on certain pages and when we assist patients in other languages, also on WhatsApp. She always identifies herself as an AI. To generate replies, your messages and, if you choose to send them, your images may be processed by technology providers such as Anthropic.

The assistant does not replace a consultation, diagnosis, surgical recommendation or individual medical advice. You can ask for a human at any time, and the conversation is handed over to my team.

An image you send voluntarily is not permanent permission for further analysis: each one is handled only within that conversation. I do not use images you send for advertising or publication without specific consent.

The illustrative images on this website, including those on the blog, are generated by artificial intelligence, except for the photos of Dr. Walter Zamarian Jr. and the clinic, which are real (in some of them, only the background around Dr. Walter was generated by artificial intelligence). They do not depict patients or surgical results.

What the data is used for

• Providing, protecting and improving the site.
• Responding to requests for contact, information and appointments.
• Measuring browsing and campaign results, depending on the technical setup, the applicable rules and, where required, your consent choice.
• Preventing fraud, abuse and technical failures.
• Meeting legal, regulatory and professional confidentiality obligations.
• Keeping the records needed to defend rights in administrative or legal proceedings.

Depending on the context, the legal basis may be consent, compliance with a legal or regulatory obligation, preliminary steps you have requested, protection of health, the regular exercise of rights or legitimate interest, always weighed for necessity and proportionality.

I do not sell personal data. The content of your messages, your photos and your health information are not used to build audiences or target ads.

Campaign measurement

To learn which content and ads bring in contacts, the site uses technologies from Google (Google Tag Manager, Google Analytics and Google Ads), Meta (the pixel and events sent from the site’s own server) and OpenAI (measuring contact clicks from ads, without contact fields or clinical information).

When a contact moves forward, for example when a consultation is booked or completed, I may report that event to Google and Meta to measure campaigns, using hashed identifiers such as a phone number or email address, or the ad click identifier. The content of conversations, diagnoses and photos is not sent.

Cookies and local storage

Cookies are small files your browser stores to remember preferences, keep essential features working and allow usage to be measured. I may use:

• Essential: for security, for the site to work and to remember your preferences.
• Analytics and advertising: to understand browsing and measure campaigns, using the technologies described above. For visitors subject to specific consent rules, the site asks for your choice before turning them on.
• Embedded media: when you play videos hosted by third parties, such as YouTube.

You can delete or block cookies in your browser settings; some features may then stop working as expected. If an event fails to reach the site’s server, your browser may keep it in local storage for up to 24 hours to try again. After that, or once it is sent, the record is deleted; it is also removed if you decline or withdraw consent in regions where that choice is required.

Sharing and international transfers

I share data only when it is necessary to provide the service, run the site, meet a legal obligation or protect rights. The main providers are:

• Google, for tag management, analytics and campaign measurement, and YouTube, when you play an embedded video;
• Microsoft Clarity, to understand how the pages are used, through heatmaps and session recordings in which anything you type is hidden, only when analytics is allowed;
• Meta, for the official messaging channels (WhatsApp, Instagram and Facebook) and campaign measurement;
• OpenAI, for measuring contact clicks from ads;
• ManyChat, for routing messages from the official channels;
• Anthropic, for AI-assisted replies and limited analysis of images you choose to send;
• Amazon Web Services, for hosting and technical processing;
• Sentry, for technical diagnostics and site security, with filters that reduce personal data in error logs.

Some of these providers process data outside Brazil. In those cases, I aim to use providers and contractual safeguards that meet the applicable data protection rules.

How long data is kept

I keep data for as long as needed to fulfill the purpose it was collected for, meet legal deadlines, protect rights and fulfill professional duties. For contacts that do not lead to care, the clinic’s policy is to delete personal data after three years without any meaningful interaction; automated messages sent by the team do not restart that period.

Medical records follow their own retention rules and are not covered by this deletion rule. Technical and browsing logs are kept for a period consistent with their purpose and with site security. You can ask for deletion before the three years are up, where applicable.

Your rights

Under the LGPD, you can ask for confirmation that your data is being processed, access, correction, anonymization, blocking or deletion where applicable, portability, information about sharing, withdrawal of consent and objection to processing in certain situations, as well as a review of automated decisions that affect your interests.

To make a request, email contato@walterzamarianjr.com. I may ask for reasonable information to confirm your identity before acting on it. If you feel your request was not properly handled, you can file a complaint with Brazil’s National Data Protection Authority (ANPD).

How to request deletion of your data

Send your request by email to contato@walterzamarianjr.com or on WhatsApp at +1 (640) 224-8116, with your full name and the email address or phone number you used to contact us. Requests are processed within 15 business days, and you will receive confirmation once the deletion is complete.

Some data may be kept when required by law, by a regulatory obligation or for the regular exercise of rights (Article 16 of the LGPD), such as medical records that Brazil’s Federal Council of Medicine requires us to keep. If that happens, my reply will explain what was kept and why.

Testimonials and content you have sent

If you gave a testimonial and want to review it or have it removed, email contato@walterzamarianjr.com or use the contact page. Each request is assessed in light of the content, the permission given and the legal and ethical obligations involved.

YouTube comments and use of Google APIs

The “Bruna YT Ghostwriter” app uses the YouTube Data API (YouTube API Services), authorized by the account of my official channel Dr. Walter Zamarian Jr., to read and reply to public comments on that channel’s videos. It does not request access to the Google account of anyone who comments.

Data accessed: public comments and replies on the channel’s videos (text, publication date, the author’s display name and channel ID); the public title and description of the video commented on, for context; and my own channel ID, so the app does not reply to my own messages.

How I use this data: the comment text is used only to prepare and post, as a reply from the channel, a general informational message that is not a substitute for a medical consultation. To generate that reply, the comment may be processed by Anthropic. I keep in an internal system the comment ID and text, the author’s name and ID, the video title and the reply posted, to avoid duplicate replies and keep track of responses. This data is not sold, not used for advertising and not shared with other third parties, except where required by law.

Use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Terms, revocation and deletion: by interacting with the channel, you are also subject to the YouTube Terms of Service and the Google Privacy Policy. You can delete your comment on YouTube at any time and request deletion of the data I keep as described in How to request deletion of your data. Access granted to this app can be revoked in your Google Account security settings.

English summary: The “Bruna YT Ghostwriter” app uses YouTube API Services, authorized only by the clinic’s own YouTube channel account, to read public comments on that channel’s videos (text, date, author display name and channel ID, plus the video’s public title and description) and to post replies as the channel. Comment text may be processed by Anthropic to draft the reply. Comment and reply records are kept internally only to avoid duplicate replies; they are not sold, not used for advertising and not shared with other third parties. Use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements. See the YouTube Terms of Service and the Google Privacy Policy. Deletion requests: contato@walterzamarianjr.com. Access can be revoked at https://myaccount.google.com/permissions.

Security, limits and updates

I take technical and organizational measures proportionate to the risk, such as secure connections, access control and security monitoring. No internet-connected environment is free of all risk; if an incident occurs involving significant risk or harm, I will take the response and notification steps required by law.

This policy explains how data is handled on the site and the official channels. It is not a substitute for a medical consultation or for third-party platforms’ own policies. I may update it when the site, the contact channels or the law change; the date at the top shows the current version and, when a change is significant, I will highlight it appropriately.

Official references

You can read Brazil’s General Data Protection Law (LGPD), the ANPD’s guidance on data subject rights and the ANPD’s guide on cookies (in Portuguese).