Sua Clínica
SuaClínica
Sign in

Privacy Policy

Article 1 (Identity of the data controller)

1. This Privacy Policy governs the processing of personal data carried out by SUA CLÍNICA, LDA., a legal entity with registration number 519550412, registered at Avenida 25 de Abril, Edifício Navegador 1011, Loja 67 (piso -2), 2750-515 Cascais, hereinafter referred to as the "Clinic" or the "Company".

2. For the purposes of Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and Law No. 58/2019 of 8 August, the Clinic acts as the controller of personal data collected in the course of its activities.

3. For any questions regarding this Privacy Policy or the processing of personal data, data subjects may contact the Clinic by email at rgpd@suaclinica.pt or in writing to the registered address above.

Article 2 (Scope of application)

1. This Privacy Policy applies to the processing of personal data carried out in connection with:

  • a. the provision of in-person or remote healthcare services;
  • b. the management of contacts, appointments, information requests and communications with patients;
  • c. the use of the website, electronic forms, digital platforms and contact channels of the Clinic;
  • d. administrative, accounting, financial and operational management of the Clinic's activities;
  • e. recruitment and selection of professionals;
  • f. the organisation of events, training sessions and complementary activities related to health and well-being.

2. This Policy applies to personal data of patients, prospective patients, legal representatives, website visitors, applicants, healthcare professionals, employees, suppliers and all other persons who interact with the Clinic.

Article 3 (Categories of personal data processed)

1. The Clinic may process, in particular, the following categories of personal data:

  • a. identification data, such as name, date of birth, gender, tax identification number, identification document number and patient number, where applicable;
  • b. contact data, such as address, telephone number, mobile number and email address;
  • c. administrative and financial data, including billing, payment and banking information where required;
  • d. health and clinical data, including information relating to physical or mental health status, clinical history, complaints, reports, diagnoses, assessments, therapies, prescriptions, care plans and any other information necessary for the provision of care;
  • e. appointment, attendance, absence, cancellation and interaction history data;
  • f. technical and browsing data, such as IP address, device type, online identifiers, access logs and website usage data, to the extent applicable.

Article 4 (Methods of data collection)

1. Personal data may be collected:

  • a. directly from the data subject, in particular through forms, telephone contacts, email, the website, booking platforms, teleconsultation, in-person reception or the provision of care;
  • b. from legal representatives, family members or accompanying persons, when duly authorised;
  • c. from healthcare professionals, care providers, insurers or health subsystems, when necessary for the provision of care or compliance with legal obligations;
  • d. through the use of the website, via cookies or similar technologies, in accordance with the applicable cookie policy.

Article 5 (Purposes of processing)

1. Personal data are processed for the following purposes:

  • a. the provision of healthcare, assessment, diagnosis, clinical monitoring, treatment and continuity of care;
  • b. the management of patients' clinical and administrative records;
  • c. the scheduling, confirmation, modification and cancellation of appointments, sessions and other acts;
  • d. communication with patients, family members or legal representatives, when necessary for the provision of care;
  • e. the issuance of invoices, receipts, credit notes and other accounting and tax documents;
  • f. compliance with legal, regulatory and professional obligations applicable to the Clinic's activities;
  • g. internal management, quality control, security, audit and continuous service improvement;
  • h. recruitment and selection of professionals and employees;
  • i. sending informational communications, campaigns or marketing content, where there is an appropriate lawful basis, including consent where required.

2. Where the processing concerns health data, it shall be limited to what is necessary for the purposes of clinical care and health service management.

Article 6 (Lawful basis for processing)

1. The Clinic processes personal data on the basis of, as applicable, the following lawful grounds:

  • a. performance of a contract or pre-contractual steps at the request of the data subject;
  • b. compliance with a legal obligation to which the Clinic is subject;
  • c. the pursuit of the Clinic's legitimate interests, provided these do not override the fundamental rights and freedoms of data subjects;
  • d. the data subject's consent, where that is the appropriate lawful basis.

2. The processing of health data shall be carried out in accordance with the conditions permitted by the GDPR, in particular where necessary for the purposes of preventive medicine, diagnosis, the provision of care or treatment, or the management of health systems and services, as well as where based on the data subject's explicit consent, where that is the applicable basis.

Article 7 (Recipients of personal data)

1. Personal data may be disclosed, to the extent strictly necessary, to the following categories of recipients:

  • a. healthcare professionals, administrative staff and employees of the Clinic who need access to the data in the performance of their duties;
  • b. laboratories, diagnostic service providers, contracted entities, insurers, health subsystems and other entities involved in the provision of care, where applicable;
  • c. service providers acting as processors, in particular in the areas of IT hosting, clinical software, appointment management, communications, accounting, legal support, cloud services, technical maintenance and marketing;
  • d. public, regulatory, tax, judicial or law enforcement authorities, where disclosure is legally required or necessary for the exercise of rights in legal proceedings.

2. Where the Clinic engages processors, it shall ensure that these provide sufficient guarantees to implement appropriate technical and organisational measures, and that processing is governed by a contract as legally required.

Article 8 (International transfers of data)

1. The Clinic shall seek to process personal data within the European Economic Area.

2. Should certain technology services or providers involve transfers of data to third countries or international organisations, the Clinic shall only proceed with such transfers where the legally required safeguards are in place, in particular adequacy decisions, standard contractual clauses or another admissible mechanism under the GDPR.

Article 9 (Retention periods)

1. Personal data shall be retained only for as long as necessary for the purposes for which they were collected and processed, without prejudice to legally imposed retention periods.

2. Clinical data and other health information shall be retained for the period required by applicable legislation, professional rules and the needs of the Clinic or the data subject to establish, exercise or defend legal rights.

3. Billing data and accounting records shall be retained for the periods legally applicable under tax and accounting law.

4. Data processed on the basis of consent shall be retained until consent is withdrawn, without prejudice to retention required by another legitimate basis or legal obligation.

5. Upon expiry of the applicable retention periods, data shall be deleted, destroyed or anonymised, unless they must be retained to fulfil a legal obligation or to establish, exercise or defend a right in legal proceedings.

Article 10 (Rights of data subjects)

1. Under applicable law, the data subject may exercise, as applicable, the following rights:

  • a. right of access;
  • b. right to rectification;
  • c. right to erasure;
  • d. right to restriction of processing;
  • e. right to object;
  • f. right to data portability;
  • g. right to withdraw consent, where processing is based on that ground, without affecting the lawfulness of processing carried out prior to such withdrawal.

2. The exercise of certain rights may be restricted where the data are necessary to comply with legal obligations, for the provision of healthcare, for the defence of the Clinic's rights or for the protection of the vital interests of the data subject or third parties, as provided by law.

3. Data subjects may exercise their rights by submitting a written request to the Clinic via the contact details set out in this Policy.

Article 11 (Security and confidentiality measures)

1. The Clinic adopts appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, disclosure, unauthorised access or any other form of unlawful processing.

2. Such measures include, in particular, access controls, authentication, permission profiles, backups, activity logs, confidentiality obligations, internal training and measures to ensure the integrity, availability and resilience of systems.

3. Access to health data is restricted to those who, in the performance of their duties, need to access such information and who are subject to duties of professional secrecy and confidentiality.

Article 12 (Personal data breaches)

1. In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, the Clinic shall act in accordance with its legal obligations, including assessing the incident, documenting it, implementing corrective measures and, where applicable, notifying the competent supervisory authority.

2. Where legally required, the Clinic shall notify the Comissão Nacional de Protecção de Dados (CNPD) within 72 hours of becoming aware of the breach.

3. Where a personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, they shall be informed in accordance with applicable law.

Article 13 (Website, cookies and similar technologies)

1. The Clinic's website may use cookies or similar technologies to ensure its operation, improve the browsing experience, carry out statistical analysis and, where applicable, support marketing features or integration with third-party services.

2. Where the use of non-strictly necessary cookies depends on consent, such consent shall be obtained beforehand in a free, specific, informed and unambiguous manner.

3. Data subjects may, at any time, configure their browser or the website's cookie preference manager to accept, refuse or withdraw consent to the use of specific categories of cookies.

4. Detailed information about cookies is set out in the Clinic's Cookie Policy.

Article 14 (Marketing communications)

1. The Clinic may send informational, promotional or commercial communications relating to its services, campaigns, content or initiatives.

2. Marketing communications shall only be sent on the basis of the data subject's prior, free, specific, informed and unambiguous consent, where required by law.

3. The data subject may withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

4. Consent may be withdrawn through:

  • a. an unsubscribe link included in communications;
  • b. direct contact with the Clinic;
  • c. other means made available for that purpose.

5. Withdrawal of consent does not affect the provision of healthcare or the sending of communications strictly necessary for the performance of the service, in particular those relating to appointments, payments or clinical follow-up.

Article 15 (Minors and legal representatives)

1. Where personal data relate to minors, the Clinic may process data provided by their parents, legal representatives or those with valid parental responsibility, where this is necessary for the provision of healthcare or compliance with legal obligations.

2. Where the collection of data is based on consent and the data subject is a minor, the Clinic shall adopt appropriate procedures to verify the legitimacy of that consent, in accordance with applicable law.

Article 16 (Data Protection Officer)

1. Should the Clinic appoint a Data Protection Officer, the relevant contact details will be made available on the website and in this Policy.

2. In the absence of a Data Protection Officer, the contact details set out in Article 1 shall be used for the exercise of rights and all other matters relating to data protection.

Article 17 (Changes to this Policy)

1. The Clinic may update this Privacy Policy at any time, in particular to adapt it to legislative, regulatory, technological or operational changes.

2. The version in force at any given time will be available on the Clinic's website, together with the respective date of update.

Article 18 (Complaints and contact with the supervisory authority)

1. Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the Comissão Nacional de Protecção de Dados (CNPD) if they consider that the processing of their personal data infringes applicable law.

2. Lodging a complaint with the supervisory authority does not affect the data subject's right to seek judicial remedies or other forms of redress provided by law. The CNPD is the national supervisory authority for personal data protection in Portugal.