Privacy Policy

01

Data Controller

The controller of your personal data is FÁBRICA DO SORRISO – CLÍNICAS MÉDICAS E DENTÁRIAS, LDA, holder of tax number (NIPC/NIF) 513511180 and others, with the following registrations with the Portuguese Health Regulatory Authority (ERS) and operating licences: Almada — ERS 127658, licence 10264; Fernão Ferro — ERS 142522, licence 16701; Baixa da Banheira — ERS 140946, licence 16034, with registered office at Rua da Liberdade, 74 J · 2805-355 Almada · Portugal (hereinafter "Fábrica do Sorriso" or "the clinic").

For any matter relating to the processing of personal data, you can contact the clinic by e-mail at [email protected] or by post to the address above.

02

Scope of this Policy

This Policy applies to personal data processed in connection with the use of the Site — in particular through the contact and booking request forms — and, more generally, in connection with the provision of healthcare at the Fábrica do Sorriso clinics.

Use of the Site implies awareness and acceptance of the terms described in this Policy. If you do not agree with any of its provisions, please refrain from using the Site and from providing your personal data.

03

Personal Data We Process

Depending on your relationship with the clinic, the following categories of personal data may be processed:

• —Identification and contact data — name, date of birth, civil and tax identification numbers, address, telephone and e-mail;
• —Health data — clinical history, diagnoses, treatments performed, complementary examinations and other clinical information necessary for the provision of healthcare;
• —Appointment and scheduling data — dates, times, clinic and healthcare professional, attendance and cancellations;
• —Billing and payment data — tax number, insurance or health subsystem details and payment records;
• —Data submitted through the Site's forms — name, contact details and message content;
• —Browsing data — IP address, device and browser type and data collected through cookies, as described in the Cookie Policy.

04

Purposes and Lawful Bases

Personal data is processed exclusively for specified, explicit and legitimate purposes, on the following legal bases:

• —Provision of healthcare, appointment management and clinical follow-up — performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR) and provision of healthcare (Art. 9(2)(h) GDPR);
• —Responding to information and contact requests submitted through the Site — pre-contractual steps and the clinic's legitimate interest in replying to those who contact it;
• —Invoicing, accounting and compliance with tax and regulatory obligations — compliance with legal obligations (Art. 6(1)(c) GDPR);
• —Appointment reminders and continuity-of-care messages (for example, letting you know it is time for your hygiene appointment) — the clinic's legitimate interest in the follow-up of its patients, together with the provision of health care (Art. 6(1)(f) and Art. 9(2)(h) GDPR);
• —Messages about the clinic's dental services sent to people who are already its patients — the clinic's legitimate interest in promoting services analogous to those the patient already receives (Art. 6(1)(f) GDPR), under the existing-customer regime in Art. 13.º-A(2) of Portuguese Law 41/2004; you may object when your details are collected and in every message you receive, without giving a reason;
• —Marketing communications sent to people who are not yet patients of the clinic — your consent (Art. 6(1)(a) GDPR), which can be freely withdrawn at any time;
• —Site security and prevention of misuse — the clinic's legitimate interest (Art. 6(1)(f) GDPR).

05

Health Data

Health data is a special category of personal data and benefits from enhanced protection. It is processed exclusively by healthcare professionals and staff bound by professional secrecy, strictly to the extent necessary for the provision of healthcare, the management of the clinical record and compliance with legal obligations applicable to the health sector.

The Site is not intended for the collection of detailed clinical information. The booking and contact forms may include a free-text field for the reason for your appointment or a note for the team; please keep it to what is strictly needed to schedule the visit. Where we need to know your history, we will speak with you in person or through the appropriate clinical channels.

Anything you do enter in those fields is handled with the same enhanced protection described in the paragraph above, and used only to prepare and carry out the appointment.

06

Retention Periods

Personal data is kept only for as long as necessary for the purposes for which it was collected, without prejudice to legally required retention periods, in particular:

• —Clinical records — for the minimum periods required by the legislation applicable to health records;
• —Invoicing and accounting documents — for 10 years, as required by tax law;
• —Contact and booking requests that do not lead to an appointment — for a maximum of 2 years after the last contact;
• —Data used for messages about the clinic's services — until you object or withdraw your consent;
• —The record of objections and withdrawals — kept indefinitely, because keeping it is the only way to guarantee that the wish you expressed continues to be honoured.

07

Sharing of Data with Third Parties

The clinic does not sell or transfer personal data to third parties. Data may, however, be shared with:

• —Processors providing services to the clinic — including Site hosting, clinical management software and IT services — contractually bound by confidentiality and data protection obligations;
• —Dental laboratories and other healthcare providers, where necessary for the performance of treatments;
• —Insurers and health subsystems, where the patient requests reimbursement of the care provided;
• —Public, judicial, tax or health authorities (including the ERS), where there is a legal obligation to do so.

08

International Transfers

As a rule, personal data is processed within the European Economic Area (EEA). Where a service provider involves the transfer of data outside the EEA, the clinic will ensure that the transfer takes place under appropriate safeguards provided for in the GDPR, namely adequacy decisions or standard contractual clauses approved by the European Commission.

09

Your Rights

Under the GDPR, you may exercise the following rights at any time:

• —Right of access to the personal data concerning you;
• —Right to rectification of inaccurate or incomplete data;
• —Right to erasure ("right to be forgotten"), within the terms and limits provided by law;
• —Right to restriction of processing;
• —Right to data portability;
• —Right to object to processing, including for direct marketing purposes;
• —Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before that date.

10

Exercising Your Rights

These rights may be exercised, free of charge, by written request to the clinic at [email protected] or by post to Rua da Liberdade, 74 J · 2805-355 Almada · Portugal. To protect you, the clinic may request additional information to verify your identity.

Requests will be answered within one month, extendable by up to two further months in particularly complex cases, as provided for in the GDPR. Erasure of health data may be limited by the statutory retention periods applicable to clinical records.

11

Cookies

The Site uses cookies and similar technologies to ensure its operation, measure audiences and improve the browsing experience. Detailed information about the cookies used, their purposes and how to manage your preferences is available in the Cookie Policy.

12

Security

The clinic adopts appropriate technical and organisational measures to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, including access controls, encryption of Site communications and confidentiality duties for staff.

Nevertheless, no transmission of data over the internet is entirely secure, and the clinic cannot guarantee in absolute terms that incidents beyond its control will not occur.

13

Minors

Personal data of underage patients is processed in the context of healthcare provision with the knowledge and consent of the holders of parental responsibility or legal representatives, where required. The Site is not intended for the deliberate collection of data from minors.

14

Changes to this Policy

The clinic may update this Privacy Policy at any time, in particular to reflect legislative changes or the evolution of the services provided. The version in force will always be published on this page, together with the date of the last update. We recommend that you review it periodically.

15

Complaints and Supervisory Authority

Without prejudice to raising any matter directly with the clinic at [email protected], you have the right to lodge a complaint with the competent supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal · cnpd.pt.