Privacy Policy
Welcome to Curious! This Privacy Policy applies to the processing of personal data of data subjects located in Brazil who use the Curious application and website (the "Platform"), a product of Child Mind Institute, Inc. (referred to in this policy as “CMI”, “we”, “our” or “us”), a non-profit dedicated to transforming the lives of children and families struggling with mental health and learning disorders by giving them the help they need to thrive. It is governed by Brazilian Federal Law No. 13,709/2018 (the Brazilian General Data Protection Law, or "LGPD").
1. Processing Roles
Depending on the context, CMI acts as either (i) a controller, where it determines the purposes and means of processing – for example, with respect to website visitors, administrator account holders, and marketing communications; or (ii) a processor, where it processes personal data on behalf of and under the instructions of a third party that creates Applets (research or healthcare institutions, "Applet Creators"), which acts as the controller. In the latter case, CMI processes the data solely for the purpose determined by the relevant Applet Creator and does not use it for its own purposes.
We encourage you to read this section carefully to identify which role applies in your case, since it determines whether you should direct your requests to CMI or to the relevant Applet Creators.
2. To What Information Does this Privacy Policy Apply?
The privacy and security of your information is very important to us, and we are committed to protecting it through our compliance with this Privacy Policy. Accordingly, we have created this Privacy Policy to describe how we collect, use, protect and disclose the information you provide when you visit the Site, create an account, use Applets made available by Applet Creators, or otherwise interact with the Platform.
A Note to Parents or Guardians of users younger than 18 years old: When we process the personal data of children or adolescents, we do so in their best interest, in accordance with the LGPD. Where we act as a processor on behalf of an Applet Creator, the appropriate legal basis for such processing is obtained and ensured by the relevant Applet Creator.
3. What Categories of Personal Information Do We Collect?
“Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a particular person, but does not include any information that is aggregated.
A) When CMI acts as a controller
When you visit our website, create an administrator account, or otherwise interact with us directly, we process the following categories of Personal Information:
Identifiers, such as your name, email address, country, username, and password;
Professional or contact information, such as your business address, business email, and phone number, when you interact with us on behalf of an institution;
Internet and device data automatically collected when you access the Platform, such as IP address or other device identifier, browser and operating system type, and usage details (date and time of access, pages viewed, links followed, and related analytics); and
Any other Personal Information you choose to provide when you contact us or request information.
B) When CMI acts as a processor on behalf of an Applet Creator
When you access and use Applets made available by an Applet Creator (such as a research or healthcare institution), CMI processes the Personal Information collected through those Applets solely on behalf of and under the documented instructions of the relevant Applet Creator, which acts as the controller. CMI does not use this information for its own purposes and does not disclose it to any third party other than the relevant Applet Creator, except as instructed by that Applet Creator or as required by law.
Depending on the Applet and the study or service determined by the Applet Creator, the Personal Information processed in this capacity may include:
Identifiers, such as name, email address, username, and password;
Demographic data, such as age, gender, and education level;
Sensitive personal data, in particular health-related data, including self-reported symptoms of mental health conditions, mood self-assessments (e.g., happiness, irritability, and stress levels measured through brief Likert-type scales), and well-being satisfaction scales;
Reports of physical pain and general health perceptions;
Behavioral and lifestyle data, such as eating habits and daily routines; and
Social context data, including information about social interactions (e.g., people the participant has been with in the last few hours) and environments frequented (e.g., home, school, workplace).
The processing of sensitive personal data is carried out in accordance with Article 11 of the LGPD and the additional safeguards described in this Privacy Policy. We limit our collection to the Personal Information that is necessary for the purposes determined by the relevant Applet Creator, in accordance with the principle of necessity. The categories listed above are illustrative and may vary depending on the specific Applet and the purposes determined by the relevant Applet Creator. For more information about how your Personal Information is processed in connection with a specific Applet, including the specific categories of personal data processed, we encourage you to consult the privacy policy of the relevant Applet Creator.
4. From What Sources Do We Collect Personal Information?
Information you provide. We collect the Personal Information you provide directly, or that is provided by your legal representative, such as when you fill out forms or fields, register for an account, interact with us on behalf of an institution, or contact us or request information about us (whether by email or other means).
Information provided through an Applet Creator. Where CMI acts as a processor, the Personal Information processed through an Applet, including, where applicable, the sensitive personal data described in Section 2, is collected at the direction of and on behalf of the relevant Applet Creator, which acts as the controller. For information on the sources and purposes of that collection, we encourage you to consult the privacy policy of the relevant Applet Creator.
Information we collect automatically. When you visit the Platform, we may automatically receive and record certain information from your computer, web browser or mobile device that may constitute Personal Information (as further described above).
Cookies. We may use cookies (small text files placed on your device) to make the Platform easier to navigate, recognize your browser, store your preferences, record past activity to improve our services, analyze how the Platform is used, and promote trust and safety You may configure your browser to refuse or delete cookies, or to alert you when cookies are being sent; please consult your browser manufacturer's instructions for the applicable procedure. If you choose to disable cookies, however, some parts of the Platform may not function properly.
5. How Do We Use the Personal Information We Collect?
We may use the Personal Information we collect for the following purposes, depending on whether CMI is acting as a controller or as a processor:
A) When CMI acts as a controller
To provide, maintain and administer your account ant the Platform;
To respond to your requests and provide information you ask us for;
To contact you for administrative purposes such as account recovery or to notify you of changes to the Platform, our policies or our services;
To ensure the security and integrity of the Platform and to detect, prevent, and investigate fraudulent, harmful, or unlawful activity; and
To comply with legal and regulatory obligations.
B) When CMI acts as a processor on behalf of an Applet Creator
When we act as a processor, we use the Personal Information processed through an Applet solely to provide the services determined by the relevant Applet Creator and strictly in accordance with its documented instructions and the agreement entered into with that Applet Creator. We do not use this Personal Information for our own purposes, and we do not process it in a manner incompatible with the purposes defined by the Applet Creator. Any processing beyond the Applet Creator's instructions is carried out only where required by law, in which case we will inform the Applet Creator of that requirement, unless the law prohibits such notice.
C) Non-Identified Information
Additionally, we may use non-identifying information (including aggregated data), which cannot reasonably be associated with an identified or identifiable natural person, to understand and analyze the usage metrics and trends; improve the Platform, and enhance security, in accordance with applicable law.
6. To Whom and For What Purpose Do We Disclose Your Personal Information?
We may disclose Personal Information that we collect or you provide as described in this Privacy Policy (whether directly or automatically) to the following categories of third parties for the enumerated processing activities. The recipients and purposes may vary depending on whether CMI acts as a controller or as a processor:
To the relevant Applet Creator, where the Personal Information was collected through its Applet. In this case, CMI acts as a processor and discloses the Personal Information to the Applet Creator in accordance with its instructions and the agreement entered into with it.
To our third-party service providers and sub-processors, including data storage, DNS and security services, analytics, fraud screening providers, hosting providers, feature management, customer support, internal communications and operations, push notification sand other third-party service providers (the foregoing “Service Providers”), to provide application and website development, hosting, data storage, maintenance, accounting, legal, advisory and other services for us.
To third parties as permitted or required to do so by applicable law or regulation or in the good-faith belief that such action is necessary to take precautions against liability; to comply with various reporting obligations; to establish, exercise, or defend our rights in judicial, administrative, or arbitral proceedings; to protect ourselves and our other users from fraudulent, abusive, or unlawful uses or activity; to protect the security or integrity of the Platform; to investigate and defend ourselves against any third-party claims or allegations; to assist government enforcement agencies; to comply with state and federal laws; or in response to a court order, judicial or other government subpoena or warrant.
To a buyer, investor or other successor in the event of a business transaction such as a divestiture, merger, consolidation, investment or asset sale, whether as a going concern or in the unlikely event of a bankruptcy or similar proceeding.
To any other third party with your consent or at your direction, or as otherwise described to you at the time you provide the information.
Additionally, we may disclose anonymized or aggregated information, that is, information that, by reasonable technical means, can no longer be associated with an identified or identifiable individual, without restriction.
7. Our Commitment to Minor’s Privacy.
Protecting the privacy of minors is especially important, and we are committed to providing a safe and secure online experience for children and adolescents who visit the Platform and their families. At this time in Brazil, the Platform is only available to children and their family members who are accessing the Platform through an Applet Creator. That Applet Creator is responsible for verifying the age of any individuals the Applet Creator directs to the Platform.
Where children or adolescents use the Platform, we adopt appropriate measures to confirm users' age or age range and to enable parental supervision, consistent with applicable law.
Any data collected for age-assurance purposes is used solely for that purpose. We do not use the personal data of children or adolescents for behavioral profiling or targeted advertising.
Where CMI acts as a processor on behalf of an Applet Creator, the appropriate legal basis for the processing of a minor's personal data is determined and ensured by the relevant Applet Creator, which acts as the controller.
Once you have registered for an account, you or, where applicable, your parent or legal representative, may request updates, corrections, or deletion of your profile information and preferences at any time by submitting a support ticket.
8. Our Commitment to Data Security.
We follow generally accepted industry standards and adopt technical and administrative security measures appropriate to to protect the Personal Information submitted to us in order to protect against the loss, misuse or alteration of such information. These measures include additional safeguards proportionate to the risks involved in processing sensitive personal data and the personal data of children and adolescents. No method of transmission over the Internet or of electronic storage is fully secure, and while we use commercially reasonable means to protect your Personal Information, we cannot guarantee absolute security.
9. International Data Transfers
The Site and Curious App are controlled and operated by CMI in the United States. CMI adopts appropriate technical, organizational, and contractual measures to ensure that any international transfer of Personal Information is carried out in accordance with applicable data protection laws, including the LGPD. Where applicable, international transfers will be based on one or more of the legal mechanisms authorized under Articles 33 to 36 of the LGPD, including standard contractual clauses or other valid transfer mechanisms recognized by the Brazilian Data Protection Agency (ANPD), including those provided for in ANPD Resolution No. 19 of August 23, 2024.
CMI will take reasonable measures to ensure that Personal Information transferred internationally receives a level of protection consistent with the requirements of the LGPD and applicable ANPD regulations.
Data subjects may request additional information regarding the safeguards adopted for international data transfers by contacting the Data Protection Officer through the channels indicated in this Privacy Policy.
10. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was processed, in accordance with Articles 15 and 16 of the LGPD.
Where CMI acts as a controller, we determine the applicable retention period and erase the personal data once it is no longer necessary, except where its retention is authorized by law, for example, to comply with a legal or regulatory obligation.
Where CMI acts as a processor on behalf of an Applet Creator, the retention period is determined by the relevant Applet Creator, which acts as the controller. Upon termination of the processing or upon the Applet Creator's instruction, we erase or return the personal data, except where its retention is required by law or authorized for study by a research body, ensuring anonymization whenever possible.
11. Your privacy rights
As a data subject, you have the rights set out in Article 18 of the LGPD with respect to your personal data, which you may exercise at any time: :
To obtain confirmation of the existence of processing;
To access your personal data;
To correct personal data that is incomplete, inaccurate or out of date;
To Request anonymization, blocking or deletion of unnecessary, excessive or processed personal data that does not comply with the provisions of the Brazilian law;
To request the portability of your personal data to another service or product provider, subject to our commercial and industrial secrets, after regulation by the relevant authority;
To request the deletion of personal data processed on the basis of your consent;
To obtain information about the entities with which we have shared your data;
To obtain information about the possibility of not providing your consent and the respective consequences;
To object to processing that violates the law;
To request the review of decisions made solely based on automated processing of your personal data.
How your rights are exercised depends on CMI's role. Where CMI acts as a controller, we are responsible for responding to your request directly. Where CMI acts as a processor on behalf of an Applet Creator, the Applet Creator is the controller responsible for your request; in that case, we will, as instructed, either forward your request to the relevant Applet Creator or assist it in responding, and we will direct you to the appropriate channel.
We will respond to your request within 15 (fifteen) days, except where a different period is established by specific ANPD regulation. If you are unsure which entity is responsible for a given Applet, you may contact us through the channels in Section 12, and we will direct you accordingly.
You also have the right to lodge a complaint with the ANPD regarding the processing of your personal data.
12. Changes and Updates to this Privacy Policy.
We reserve the right to make changes to this Privacy Policy at any time. If we make any material change to this Privacy Policy, we will post the updated Privacy Policy and indicate at the top of the Privacy Policy when it was last updated. Please revisit this page periodically to stay aware of any changes to this Privacy Policy.
13. Our Contact Information:
If you have any questions, comments, or requests regarding this Privacy Policy or the processing of your Personal Information, please contact our Data Protection Officer with any questions or comments about this Privacy Policy at [email protected].
Additionally, CMI has appointed a Data Protection Officer to act as a communication channel between CMI, data subjects, and the ANPD. The Data Protection Officer responsible for matters related to Brazilian users may be contacted through the following channels:
Email: [*][KLA1]
Brazilian users may contact the Data Protection Officer to exercise their rights under the LGPD, submit requests related to the processing of their Personal Information, obtain information regarding the handling of their data, or submit privacy-related inquiries.
Without prejudice to any other administrative or judicial remedy, data subjects also have the right to submit petitions or complaints regarding the processing of their Personal Information directly to the ANPD, in accordance with applicable law.
