The hard part of privacy is not the policy: it is the design. Much of what follows is not a promise, it is the absence of a path in the code. The corresponding technical document is SEGURANCA.md, handed to the client's IT team during evaluation.
The organisation's panel suppresses any slice with fewer than five sessions. Suppression happens in storage, not on screen — slicing filters successively does not get around it.
No other user reads a manager's session, not even by direct link. The response for another author's session is identical to that of a session that does not exist.
Support access only exists with a record visible to the session's owner. The record is append-only: there is no delete operation.
The aggregate has no drill-down to the individual session. It is an absent route, not an unchecked permission — there is no key to join on.
The contracting organisation is the controller of its managers' data and of the sessions they create. The Biased Brain Co. acts as processor, handling the data under contract and solely to deliver the service.
Performance of the contract between controller and processor, and the controller's legitimate interest in managing its own operation. The final determination of the applicable basis for each clause rests with the controller and its data protection officer.
Confirmation, access, correction, portability, erasure and information about sharing. Requests arrive through the controller; the processor responds within the contractual deadlines and performs erasure in the base.
Language models are used as sensor and writer: they read the description, run the questions within the method and write the report. The diagnosis is deterministic and auditable. Any model output containing a percentage, a diagnosis about a person, or an injection marker is discarded, never corrected. Retention and non-training conditions with the model provider are set out in the contract and in SEGURANCA.md.