Privacy Policy

1.Who is responsible for your data

Miami Breast Aesthetics (MBA) is an academic program of Ruth Graf Academy, organized and promoted by Pierre Group (Grupo Pierre), also under the brand Breast Implants Program. Pierre Group runs this website, the registrations, the communications and the advertising described in this policy.

The controller of your personal data is:

We are based in Brazil. Because we offer our programs to physicians in the United States, the European Union, the United Kingdom, Brazil and other countries, this policy is written to meet the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the Brazilian Lei Geral de Proteção de Dados (Law 13.709/2018, "LGPD").

This policy explains what we collect, why, who we share it with, where it goes, how long we keep it, and what you can do about it.

2.What this policy covers

This policy applies to:

• the website breastimplantsprogram.com, including the pages for Miami Breast Aesthetics 2027 and for the Beyond the Implant webinar, and their thank-you pages;
• registration for and participation in the Beyond the Implant webinar, a free live online event held on November 9–10, 2026;
• enquiries about, registration for and participation in MBA – Miami Breast Aesthetics 2027, a hands-on course held on February 12–13, 2027 at the MARC Institute (Miami Anatomical Research Center), Miami, Florida, USA;
• communications with us by email, web form or WhatsApp;
• our advertising and marketing activity, including on Meta platforms.

3.What personal data we collect

Information you give us

• Identification: full name;
• Contact details: email address and telephone or WhatsApp number;
• Professional data: medical specialty and, for the hands-on course, the professional information we may ask for to confirm that you are eligible to take part;
• Registration data for the course: billing name and address, and tax identification number where required for invoicing;
• Consent choices: the consents you give or refuse in our forms and cookie banner;
• Correspondence: the content of messages you send us by email, web form or WhatsApp.

Information collected automatically

• IP address and the approximate location derived from it (country, region and city);
• Device type, operating system, browser and language;
• Pages visited, time on page, and links and buttons clicked;
• Referring source, including advertising campaign identifiers (UTM parameters and click identifiers such as fbclid and gclid);
• Cookie and similar identifiers;
• For the webinar: whether you joined the live sessions and for how long, as reported by Zoom (see Section 9).

Information we do not collect

We do not ask for or collect health data about you through our registration process. We do not collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or sexual orientation. Please do not send us such information, and never send us patient information or patient images.

If you have an accessibility or dietary requirement for the course, contact us directly by email. It will be handled individually by a member of our team, used only for that purpose, and deleted after the course.

4.Payment data

The webinar is free, and no payment data is collected when you register for it.

Payment for the hands-on course is processed by our payment provider, Pagaa (pagaa.com.br). When you pay by card, your card number, expiry date and security code are collected and processed directly by Pagaa and its banking partners. We never receive, see or store your full card details.

We receive only confirmation of payment status, the amount, the date, and the identification and billing information needed to issue your invoice and confirm your registration. Where you pay by international bank transfer, we receive the transfer details supplied by your bank.

5.Why we use your data, and our legal basis

Under the LGPD, the corresponding bases are those set out in Article 7 of that law, in particular execution of a contract or preliminary procedures related to it, consent, compliance with a legal obligation, and legitimate interest.

6.Cookies and tracking technologies

We use cookies and similar technologies, deployed through Google Tag Manager.

• Strictly necessary cookies keep the site working: page delivery, security, form submission and remembering your cookie preferences. These do not require consent.
• Analytics cookies (Google Analytics) tell us how visitors find and use the site, which pages hold attention, and where people drop off.
• Advertising cookies (the Meta Pixel and equivalent technologies) measure the results of our advertising and allow us to show ads to people who have visited our site.
• Embedded videos: if you play a video embedded on our pages, the video hosting provider may set its own cookies.

Where the law of your country requires consent for analytics and advertising cookies, as in the European Economic Area and the United Kingdom, we use them on the basis of the choice you make in our cookie banner. You can withdraw or change your choices at any time through the cookie settings on our site and through your browser settings. Withdrawing consent does not affect processing carried out before withdrawal.

7.Advertising on Meta platforms

We advertise on Facebook and Instagram. Three distinct activities are involved, and we want to be explicit about the third.

• Meta Pixel. A tracking script on our website that records visits and actions such as viewing a page or completing a registration.
• Meta Conversions API. Sends equivalent event information from our systems to Meta, so that advertising measurement continues to work when browser-based tracking is blocked. It processes the same categories of data, on the same basis.
• Custom Audiences from contact lists. We may upload lists containing email addresses and telephone numbers to Meta, so that Meta can match them against its own user accounts. This lets us show advertising to people already in contact with us, exclude existing registrants from campaigns, and build "lookalike" audiences of people with similar characteristics.

Identifiers are hashed before upload, but this is a genuine disclosure of your contact details to Meta and we treat it as such. Where the law of your country requires consent for this, as in the European Economic Area and the United Kingdom, we include your details only if you have given that consent.

For Custom Audiences, we and Meta Platforms Ireland Limited act as joint controllers in respect of the matching operation, under a joint controller arrangement made available by Meta. Meta then processes matched data as an independent controller under its own Privacy Policy.

To be excluded from advertising audiences at any time, email contact@breastimplantsprogram.com. We will remove you from our source lists and request deletion from the corresponding audiences. You can also manage advertising preferences directly in your Meta account settings.

8.Email communications

Our emails are sent through ActiveCampaign, which processes your contact details and records whether you open our emails and click links, so that we can send relevant material and measure results.

When you register for the webinar, we send you operational emails about it: your registration confirmation, reminders before each session and the access link. After the webinar, we may send you information about Miami Breast Aesthetics 2027, the course the webinar is part of, as described in Section 5. Marketing emails about other or future events are sent only with your consent.

Every email contains an unsubscribe link, and unsubscribing takes effect immediately. You can also email us to be removed. Unsubscribing does not affect operational emails about an event you have registered for.

9.The webinar on Zoom

The Beyond the Implant webinar is broadcast live on Zoom, provided by Zoom Communications, Inc. When you join, Zoom processes the name and email you use, your IP address, device information and the times you join and leave, and the content of any chat messages or questions you send. Zoom shares attendance reports with us so we know who took part.

Zoom processes this data under its own privacy terms. Sessions may be recorded. If a session is recorded, we will tell you at the start, and recordings focus on the speakers and the presentation.

Please do not share patient information or images in the chat or in questions.

10.Who we share your data with

We do not sell your personal data. We share it with:

Service providers acting on our instructions

Academic program and venue

Ruth Graf Academy is responsible for the academic program of Miami Breast Aesthetics. Where necessary to deliver the course, for example to prepare the program and issue certificates, we share the name and professional details of registered course participants with Ruth Graf Academy.

The hands-on course takes place at the MARC Institute (Miami Anatomical Research Center). Where the venue requires it for access control and to meet the rules that govern anatomical research facilities, we share the name and professional details of registered course participants with the MARC Institute. This sharing is necessary for your participation in the course.

Webinar registrations are not shared with the venue.

Professional advisers and authorities

Accountants, lawyers and insurers where necessary, and public authorities where we are legally required to disclose.

11.WhatsApp

We use WhatsApp as a contact channel (+44 7555 146549). If you message us there, your telephone number, profile name and the content of your messages are processed by us and by WhatsApp under WhatsApp's own privacy terms, on servers operated by Meta.

Please do not send sensitive personal information, patient information or identity documents through WhatsApp. If you prefer not to use WhatsApp at all, email works for everything.

12.International transfers

Our operations are based in Brazil, our service providers operate in the United States and elsewhere, and the hands-on course takes place in the United States. If you are in the European Economic Area or the United Kingdom, your data will be transferred outside that territory.

Brazil does not benefit from a European Commission adequacy decision. Transfers to us are made on the following bases:

• Article 49(1)(b) GDPR: the transfer is necessary for the performance of the contract between you and us, namely your registration for and participation in the webinar or the course. We cannot register you, send you your access details, invoice you or admit you to the venue without receiving your data in Brazil.
• Article 49(1)(a) GDPR: your explicit consent, where you have been informed of the risks, in respect of processing that is not necessary for the contract, such as marketing.

Brazil has a comprehensive data protection law (LGPD) and an independent supervisory authority (ANPD), and this policy grants you the rights described in Section 14 regardless of where your data is held.

Transfers to our service providers located outside the EEA are made under Standard Contractual Clauses approved by the European Commission, or under an applicable adequacy decision, as provided in each provider's data processing terms. You may request further information about these safeguards at contact@breastimplantsprogram.com.

13.How long we keep your data

At the end of these periods, data is deleted or irreversibly anonymized.

14.Your rights

Under the GDPR you have the right to:

• Access: obtain confirmation of whether we process your data, and a copy of it;
• Rectification: have inaccurate or incomplete data corrected;
• Erasure: have your data deleted where one of the grounds in Article 17 applies;
• Restriction: have processing limited in the circumstances set out in Article 18;
• Portability: receive data you provided in a structured, machine-readable format, and have it transmitted to another controller;
• Object: object to processing based on legitimate interest, and object to direct marketing at any time, without needing to give a reason;
• Withdraw consent: at any time, without affecting processing already carried out;
• Not be subject to automated decision-making: we do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal or similarly significant effects.

Under the LGPD you additionally have the right to confirmation of processing, anonymization or blocking of unnecessary or unlawfully processed data, information about the entities with whom your data has been shared, and information about the consequences of refusing consent.

To exercise any of these rights, email contact@breastimplantsprogram.com. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. There is no charge, unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting.

15.Complaints

If you are unhappy with how we handle your data, please contact us first. Most issues are resolved quickly. You also have the right to lodge a complaint with a supervisory authority:

• European Economic Area: the data protection authority of your country of residence, work, or where the alleged infringement occurred. The full list is available at edpb.europa.eu;
• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk;
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd.

16.Security

We apply appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS), restricted access on a need-to-know basis, access controls on the systems we use, and selection of service providers that maintain recognized security standards.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by Articles 33 and 34 GDPR and by the LGPD.

17.Children

Our webinar and course are educational experiences for medical professionals. Our services are not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe we have, contact us and we will delete it.

18.Changes to this policy

We may update this policy. The current version is always published at this address with the date of the last update at the top. Where changes materially affect how we use your data, we will notify registered participants and marketing subscribers by email.

19.Contact