Privacy Policy

1. Core principle: absolute local-first

Panaceia is a browser extension designed around the principle of absolute local-first. Clinical data — including any health information captured from systems such as e-SUS APS PEC, SISREG, SEI, and others — never leaves your device without an explicit action from you. There is no automatic transmission of clinical data to Panaceia's servers or any third party.

2. What we collect

We do not collect clinical data. The extension processes health data exclusively in your browser, storing it locally with AES-256-GCM encryption and an Argon2id-derived key. No clinical payload is sent to the Panaceia team.

We do not collect identifying information. Panaceia does not request or store your name, email, national ID, or any personally identifiable information.

3. Local storage and encryption

All captured data is stored in the browser's IndexedDB on your device. Sensitive fields (raw clinical data, FHIR resources, notes) are encrypted with AES-256-GCM before being written. The master key is derived from your password via Argon2id and is never transmitted.

Data backup is performed only via manual export by the user, generating an encrypted file (.panaceia). There is no automatic cloud sync.

4. Telemetry and analytics

The extension has no telemetry. There is no usage tracking, automatic error reporting, or any form of "callback home" that sends data from your browser. The panaceia.io website uses only Cloudflare edge analytics (aggregate visit counts, no user identification) — no cookies, no tracking pixels, no Google Analytics or any third-party analytics SaaS.

5. Cookies

The panaceia.io website does not use cookies. The extension does not create cookies on the sites you visit.

6. Extension permissions

The extension requests host permissions only for the systems you explicitly activate (adapters). No host permission is required by default. Each permission is justified in the source code.

The extension never requests <all_urls> as a mandatory permission.

7. Data export

When you choose to export data — such as a FHIR R4 Bundle or an encrypted backup — that action is initiated exclusively by you. Panaceia has no access to the destination of exported data. If you send data to an institutional FHIR server, the relationship is directly between you and that institution.

8. Open source and auditability

The Panaceia core — extension, official packs, validator — is licensed under AGPL-3.0-or-later. That doesn't change across tiers: no clinical data flows differently for core users versus institutional saude.dev contracts. As Panaceia is currently in closed beta, code audits are shared under agreement with partner institutions — contact panaceia@saude.dev . Sciereli HDC separately offers, outside this repository, an enterprise layer (managed deploy, direct RNDS integration, packs on demand) — see details .

9. LGPD (Brazilian Data Protection Law)

Panaceia is personal-use software. In the default scenario (local-first), Panaceia acts as a tool for the data subject themselves, not as a data processor or controller under Brazil's General Data Protection Law (Lei 13.709/2018 — LGPD). Health data is classified as sensitive personal data (Art. 11 of the LGPD) and we treat that fact with the utmost seriousness.

10. Contact and security incidents

To report security vulnerabilities or privacy concerns, contact us at security@panaceia.io . We follow responsible disclosure practices and are committed to notifying the ANPD of relevant incidents within the statutory 72-hour window (Art. 48 of the LGPD).