01 Who we are and what this Notice is

gen-t (corporate name: Divegen Gestão e Tratamento de Dados Ltda) conducts the “Gen-t do Brasil” Research — Characterization of Genetic Factors in the Brazilian Population (GNT 01.22), which gathers genetic, health, and demographic data from volunteer participants to advance science and precision medicine.

This Privacy Notice explains, in clear terms, what personal data we process, for what purposes, on what legal basis, with whom we share it, how we protect it, and what your rights are as a data subject. It complements — and does not replace — the Informed Consent Form (TCLE) you sign when joining the research.

We recommend that you read our Terms carefully in order to make the most of the Platform and all its features. Accessing and using it represents full acceptance of these Terms; should you disagree with any of its provisions, registration and use of the Platform may be suspended or limited.

Some features may require additional information or acceptance of supplementary terms. If you do not agree to provide them, the use of those specific services may be limited. Once accepted, those terms become part of our agreement with you.

The Platform is intended exclusively for individuals over 18 (eighteen) years of age, in full possession of their civil rights and interested in taking part in research on the characterization of genetic risk factors in the Brazilian population.

02 Data Protection Officer (DPO)

For any matter relating to the protection of your personal data, you may contact our Data Protection Officer (DPO):

03 What personal data we process

In the context of the research, we may process the following categories of data:

04 Where we obtain the data

• Directly from you: registration, questionnaires, the Informed Consent Form (TCLE), and in-person collection.
• Generated by the research: test results, genotyping, and sequencing.
• Authorized secondary sources: medical records and databases such as e-SUS, subject to your authorization.

05 Why we use the data and on what legal basis

We process your data only for specific purposes, observing the legal bases of the Brazilian General Data Protection Law (LGPD – Law No. 13.709/2018), in particular its Articles 7 and 11, and the applicable research legislation (Law No. 14.874/2024 and, where applicable, National Health Council Resolution No. 466/2012):

• To conduct the “Gen-t do Brasil” Research and build the population’s genetic and health database — basis: data subject’s consent (Art. 7, I and Art. 11, I) and the conduct of studies by a research entity (Art. 7, IV and Art. 11, II, “c”).
• To provide you with test results and health reports — basis: consent and the performance of research activities.
• To share anonymized data with partners for scientific/technological research and development — basis: consent and legitimate interest, always with anonymized data.
• To comply with legal, regulatory, ethical, and good clinical practice obligations — basis: compliance with a legal/regulatory obligation (Art. 7, II).

06 Who we share it with

Your identifiable data is never sold and is not shared with third parties for unrestricted use. Sharing occurs in a controlled manner:

• Contracted technology/cloud providers (e.g., Google Cloud), which act under our instructions and under confidentiality and security obligations.
• Clinical laboratories that perform the tests provided for in the protocol, acting as service providers.
• National and international research partners (universities, consortia, institutions, and healthcare companies such as pharmaceutical firms), exclusively with anonymized data, under formal confidentiality and security commitments.

With the exception of the transfer to the contracted cloud provider, your personal data — including sensitive data — is never transferred to third parties without proper anonymization.

07 International data transfers

Part of the storage and (anonymized) sharing may take place outside Brazil. In such cases, we adopt adequate safeguards, in compliance with the LGPD (Articles 33 et seq.) and with the regulations in force in the destination country. For the international sharing of data for research purposes, we request your specific consent in the Informed Consent Form (TCLE).

08 How we protect your data

We adopt technical and administrative measures to protect your data against unauthorized access and accidental or unlawful destruction, loss, alteration, or disclosure, including:

• Encryption of data at rest and in transit (e.g., HTTPS/TLS; in-memory and in-database encryption with AES-256).
• Pseudonymization and anonymization; use of hash functions (e.g., SHA-256) for indexing without exposing the original data.
• Access control based on the principle of least privilege, individual authentication, multi-factor authentication (MFA), and segregation of environments and databases.
• Access logging, regular backups, and security incident management.

The separation between identification data and research data, combined with anonymization, makes it very difficult to associate a piece of information with a specific person.

09 How long we keep it

We retain your data for as long as necessary to carry out the research and to comply with applicable legal, ethical, and regulatory obligations. Registration data, health information, clinical data, and genomic data are stored securely throughout participation in the study, which provides for follow-up of participants over 5 (five) years.

After the study concludes, the data will be retained for an additional minimum period of 5 (five) years, in accordance with applicable law.

10 Your rights

Under the LGPD (Art. 18), you have the right to:

• Confirm the existence of processing and access your data;
• Correct incomplete, inaccurate, or outdated data;
• Request the anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance;
• Request data portability, where applicable;
• Obtain information about the entities with which we share data;
• Withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before it, and data that has already been anonymized or published cannot be removed.

11 How to exercise your rights or withdraw consent

You may exercise your rights or withdraw your consent through the following channels:

• E-mail: contato@gen-t.science
• WhatsApp/phone: +55 (11) 91948-3533
• In person: at the project’s operating units

Once withdrawal is formalized, your personal data and samples are no longer used and are discarded, within the limits of applicable law.

12 Complaints to the authority

If you believe your rights have not been upheld, we recommend first contacting our Data Protection Officer (DPO), who will seek to resolve the matter. You may also, at any time, file a complaint with the Brazilian National Data Protection Authority (ANPD), the body responsible for overseeing compliance with the LGPD, through the official channels available at gov.br/anpd.

13 Validity and updates

This Notice may be updated to reflect legal, regulatory, or operational changes. The current version, with its respective date, is available in the participant area and on the project’s website. Significant changes will be communicated through official channels.