Privacy and cookie policy

Note: this is a translation of the Política de Privacidade in Portuguese. If the two versions differ, the Portuguese version prevails.

Last updated: 14 October 2026.

This policy explains what data the transgeneros.com.br website records, why it records it, who it shares it with and how you can decide about it.

We have written it in plain language. If anything is unclear, please contact us at the e-mail address below.

Who is responsible for your data

The controller of the data processed on this website is:

• Registered company name: Clinica da Plastica Transgender Center Brazil LTDA
• Trading name: Transgender Center Brazil
• CNPJ (Brazilian company number): 06.928.786/0001-98
• Address: R. Armando Odebrecht, 70, Salas 807-808, Garcia, Blumenau/SC, 89020-403
• E-mail: clinicadr.martins@hotmail.com

In this text, “clinic”, “we”, “us” and “our” refer to the controller above.

What data the website records

The website has no registration form. Contact with the clinic takes place on WhatsApp. For this reason, the website records very little, in three groups.

1. Browsing data, through cookies and similar technologies

When measurement is switched on, the website uses these tools:

• Google Tag Manager: organises how the other measurement tools load.
• Google Analytics 4: measures visits, pages viewed, where visits come from and how the website is used.
• Google Ads: measures whether a visit or a contact came from a Google advert.
• Meta Pixel: measures whether a visit or a contact came from an advert on Facebook or Instagram.
• Microsoft Clarity: shows how the pages are used (clicks, scrolling, heatmaps and session recording). Clarity is set up with strict masking: the text shown on screen and what you type are hidden before they leave your browser.

These tools may receive, among other things, your IP address, the type of device and browser, your language, the pages visited, the referring page and identifiers generated by the cookies themselves.

2. Attribution record of the WhatsApp click

When you click a WhatsApp button on the website, we save a record so we know where that contact came from. This record contains:

• a code generated for that click;
• the campaign parameters of the landing page (UTMs);
• advert click identifiers, when present: gclid, gbraid, wbraid, fbclid, fbp and fbc;
• the button clicked and the pages visited;
• the country of access, estimated from the IP address at the time of the click;
• your consent choice at that moment.

This record contains no name and no phone number. Nor does it store the IP address, the browser type or any free text. For visitors from the European Union, the United Kingdom and Switzerland who have not accepted advertising measurement, click identifiers are not saved.

3. The WhatsApp conversation

The conversation takes place outside the website, in the WhatsApp app. WhatsApp is a Meta service and follows Meta’s privacy policies. What you write in the conversation (for example, your name, phone number and the reason for getting in touch) is received by the clinic’s team and recorded in the clinic’s customer service system (CRM). The message the website suggests on WhatsApp ends with a code (for example, “Código: [G-HOME-12345]”, where “Código” means “Code”). This code links the contact to where the visit came from, without identifying you. You can delete it before sending the message.

What we use the data for and on what legal basis

The clinic processes personal data in accordance with Brazil’s General Data Protection Law (Lei nº 13.709/2018, LGPD).

Purpose	Data used	Legal basis
Making the website work and storing your cookie choice	tc_consent and the website’s session keys	Legitimate interest and compliance with the obligation to record consent (LGPD, art. 7, II and IX)
Measuring website use and improving the pages	Google Analytics 4, Microsoft Clarity	Consent or legitimate interest, depending on the region (see below)
Measuring advert results	Google Ads, Meta Pixel, click attribution record	Consent or legitimate interest, depending on the region (see below)
Replying to and looking after people who get in touch	WhatsApp conversation and CRM record	Preliminary steps towards a contract at the data subject’s request (LGPD, art. 7, V)

Consent rule by region

• Visitors from the European Union, Iceland, Liechtenstein, Norway, the United Kingdom and Switzerland: measurement starts switched off and is only enabled after you accept. Without your acceptance, the Meta Pixel and Microsoft Clarity are not triggered, and Google’s tools do not save measurement or advertising cookies.
• Visitors from everywhere else, including Brazil: measurement is on from the moment you arrive on the website. You can refuse at any time, and your refusal applies from then on.

The region is identified by Google from the IP address of the connection. This indicator is approximate (a VPN, for example, changes the result). If that applies to you, use the “Cookie preferences” button to refuse.

With measurement refused, Google’s tools may still send signals without cookies and without advert identifiers, for aggregate counting. In this state, the website may also keep the advert click identifier in the address of internal pages, instead of saving it in a cookie.

Sensitive data

The website does not ask for information about health, gender identity or sex life. Even so, we know that visiting the website of a gender affirmation clinic may say something about a person. That is why measurement does not record what you type, and the click record contains no name or phone number. Any health information you choose to share in the WhatsApp conversation is treated by the clinic with the confidentiality that belongs to medical care.

How long we keep data

• WhatsApp click attribution record: 180 days. After that, it is deleted by an automatic clean-up.
• Cookies and browser storage: each item has its own duration, shown in the table in the section “Cookie and local storage table”.
• Data in Google, Meta and Microsoft tools: follow the retention period set in each tool and each company’s rules.
• Conversation data recorded in the CRM: for as long as needed for care and for the clinic’s legal obligations.

When the purpose ends and there is no legal obligation to keep the data, it is deleted or anonymised.

Who we share data with

We do not sell personal data. We share it only with the suppliers that make the website and our service work:

Company	Role	What it receives
Google	Tag Manager, Analytics 4 and Google Ads	Browsing data and Google advert click identifiers
Meta	Meta Pixel and WhatsApp	Browsing data, Meta advert click identifiers and the WhatsApp conversation
Microsoft	Microsoft Clarity	Page usage data, with text masked
Vercel	Website hosting	Technical access data, such as IP address and server logs
Supabase	Database for the click record	The click attribution record (no name and no phone number)
Kommo	The clinic’s customer service system (CRM)	Contact details and the WhatsApp conversation

We may also share data when required by law, a court order or a competent authority.

Google and Meta may also use part of this data for their own purposes, such as showing adverts. In that case, each company’s privacy policy applies.

International transfer

Google, Meta, Microsoft and Vercel are companies headquartered outside Brazil. Supabase and Kommo may also store data on servers outside Brazil.

For this reason, some data may be transferred to other countries, including the United States. These transfers follow art. 33 of the LGPD, based on the contractual safeguards offered by these suppliers.

Your rights

Under art. 18 of the LGPD, you may ask the clinic, at any time, for:

• confirmation that we process your data;
• access to the data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymisation, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
• portability of the data to another provider;
• deletion of data processed on the basis of your consent;
• information about who we share your data with;
• information about the option not to give consent and what happens if you do not;
• withdrawal of consent.

You may also object to processing carried out on the basis of legitimate interest, if you believe it does not comply with the law. And you may lodge a complaint with Brazil’s National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD).

How to exercise your rights

Write to clinicadr.martins@hotmail.com with the subject “Privacy”.

• Tell us which right you wish to exercise.
• To protect you, we may ask you to confirm your identity before providing or deleting data.
• The click record contains no name or phone number. To find a record of yours, you may need to give the approximate date of the visit or the code that appeared in the WhatsApp message.

The clinic replies within the time limits set by the LGPD. In simplified form, confirmation and access are immediate. In full form, the reply is sent within 15 days of the request.

Cookie and local storage table

The website’s own items

Name	Purpose	Duration
tc_consent	Stores your cookie choice (accept or refuse)	180 days
tc_attr	Stores where the visit came from (UTMs and landing page) while you browse	Until the tab is closed
tc_landing	Stores the landing page of the visit	Until the tab is closed
tc_lead_id	Stores the WhatsApp click code	Until the tab is closed
tc_lp_sent	Prevents the same visit being recorded more than once	Until the tab is closed
tc_attr_last	Stores where the last visit came from, to attribute a contact made later	90 days
tc_click_ids	Stores advert click identifiers (gclid, gbraid, wbraid, fbclid)	90 days

tc_attr_last and tc_click_ids are not saved when the browser is set to a European time zone and you have not yet accepted cookies.

Third-party items

The durations below are each supplier’s defaults and may change at their discretion.

Name	From	Purpose	Default duration
_ga	Google Analytics 4	Distinguishes visitors	2 years
_ga_<ID>	Google Analytics 4	Keeps the session state	2 years
_gcl_* (for example, _gcl_au, _gcl_aw)	Google Ads	Links visits and contacts to the advert click	90 days
_fbp	Meta	Identifies the browser to measure adverts	90 days
_fbc	Meta	Stores the advert click identifier (fbclid)	90 days
_clck	Microsoft Clarity	Identifies the visitor across sessions	1 year
_clsk	Microsoft Clarity	Groups the pages viewed in the same session	1 day

How to change your preferences

Use the “Cookie preferences” button in the footer of every page.

• There you can accept or refuse measurement.
• You can change your mind as often as you like.
• Your new choice applies from that moment on.

You can also delete cookies and website data in your browser settings. If you do, the website will ask you again or apply your region’s rule again.

Data Protection Officer (DPO)

Until a data protection officer is named here, requests about personal data can be sent to clinicadr.martins@hotmail.com.

Updates to this policy

This policy may change when the website, the tools or the law change. The date of the last update is shown at the top of this page. If the change is significant, we will let you know on the website itself.