Privacy Policy and Personal Data Protection

Data Controller

CLÍNICA ELISABETE MOREIRA LDA, NIPC 514056401, with registered office at Circunvalação do Alto S. Domingos, nº 30, R/C, 4590-165 Paços de Ferreira, is the owner of the healthcare provider Instituto Médico e Dentário – Dr. Sara Martins.

What are personal data?

Under the GDPR, personal data are defined as any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, electronic identifiers (IP address, cookies), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Personal Data Collected

The healthcare provider Instituto Médico e Dentário – Dr. Sara Martins collects different categories of data, namely:

• Data that identify you, such as your name, gender, date of birth, tax identification number, social security number, national health service number, citizen card number and its expiry date, or image;

• Communication data, which include, for example, telephone number, email address, and home address (locality, postal code, country, district, municipality, parish);

• Private life data, such as profession and employment status, family doctor, spouse’s name, father’s name, mother’s name (for example, in the case of a minor), information relating to health insurance or healthcare subsystems;

• Data concerning third parties authorised to make decisions on your behalf, or who should be contacted in case of emergency;

• Information relating to your health and the healthcare you have received or will receive;

• Payment-related data.

How Your Data Are Collected

• When you contact us;

• When you establish a relationship with us in the context of the provision of a service;

• When you post comments or images on our social media pages; or

• When, in any way, you send us personal information.

Purposes of Data Collection and Legal Bases

The collection of personal data is intended for the performance of contracts concluded with clients for the provision of healthcare and related services, prevention or preparation of diagnoses and/or provision of treatments, management of administrative services — namely for scheduling or rescheduling appointments and treatments, invoicing, accounting and auditing — as well as for marketing communications and other commercial communications, quality control, statistical studies, better understanding of clients’ preferences, and contact purposes.

​

The collection of your personal data is based on law, pre-contractual and contractual relationships, payment management, customer support, compliance with legal obligations, the data subject’s consent, and legitimate interests.

​

We may also process your data, subject to your consent, for the purpose of conducting teleconsultations, publishing photographs or videos to promote our activity (internally and externally, for example on social media), as well as for marketing purposes or the sending of newsletters.

Personal data related to your health will only be processed by professionals bound by confidentiality and only to the extent strictly necessary.

Retention Period and Manner of Storage of Personal Data

We process and store your personal data only for the period necessary to achieve the respective purposes, to respond to your needs and requests, or to comply with legal obligations, which vary depending on the category of data.

​

We may also retain some of your personal data insofar as it is necessary to manage or enforce our rights, including through legal proceedings.

​

In cases where the client has given consent for the processing of their personal data, we will store the data in accordance with the consent provided, or until such consent is withdrawn.

With Whom We Share Your Data

We may use other companies to provide certain services, and we may also transmit information and data of data subjects to third parties, such as accounting and IT companies, competent authorities, legal service providers, consultants, and others. We guarantee that, in such cases, these third parties will have limited access to the personal data of the subjects, restricted solely to what is necessary for the performance of the contracted tasks, and that they are subject to equivalent confidentiality obligations. Likewise, we may disclose your personal data when required by law, in the context of legal proceedings, or as part of investigations into suspected activities.

Security Measures

We have developed appropriate technical and organisational mechanisms and measures to maintain the confidentiality and security of your personal information, bearing in mind that the information collected includes sensitive data under the GDPR, in order to ensure a level of security appropriate to the risk and to protect personal data against destruction, loss, alteration, unauthorised disclosure, or accidental or unlawful access.

​

To this end, we have implemented several measures such as restricted access to clinical records (whether in physical or digital format), the use of strong passwords, and the maintenance of up-to-date antivirus software. Furthermore, any employee of the healthcare provider Instituto Médico e Dentário – Dr. Sara Martins who has access to your personal data is bound by a duty of confidentiality.

Rights of the Data Subject

In accordance with the GDPR, Data Subjects may, at any time, exercise their right to information, obtain access to, rectify, erase, and transfer their personal data, as well as to restrict or object to its processing, including the withdrawal of consent. To do so, they should contact us at geral@institutomedicodentario.pt

Understanding Your Rights:

​

• Right to information: You have the right to obtain clear, transparent, and easily understandable information about how we use your personal data.

• Right of access: You may access your personal data that we process and retain. In such cases, we will provide information on the personal data being processed. Please note, however, that the right of access is not unlimited and must be balanced with data protection legislation (it may therefore be refused if, for example, access could adversely affect the rights and freedoms of third parties) and health law (for instance, when it is unequivocally demonstrated that access to the information may be harmful to the patient, the information requested may not be provided – therapeutic privilege). Access may be granted through a physician if you so request.

• Right to rectification: You have the right to rectify your personal data, without undue delay, provided that you have supplied it yourself and that it is incorrect, outdated, or incomplete.

• Right to erasure / right to be forgotten: You may request that we erase your data. However, please note that this is not an absolute right, as we may have legal grounds (such as legally prescribed retention periods) or legitimate interests to retain your personal data.

• Right to object: You may object to the processing of your personal data on grounds relating to your particular situation. This may occur, for example, in relation to processing for scientific, statistical, or historical research purposes, unless such processing is necessary for reasons of public interest.

• Right to withdraw consent at any time: You may withdraw your consent to data processing when such processing is based on your consent. Please note that the withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

• Right to data portability: You have the right to receive your personal data, which you have provided to a controller, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller.

• Right to restriction of processing: You have the right to request the restriction of processing of your data if you contest its accuracy, if the processing is unlawful and you do not wish your data to be erased but only restricted, if the data are no longer necessary, or if you have exercised the right to object as set out above.

​​

These rights, like any others, must be exercised reasonably and in good faith by the data subject.

Final Notes

• By using our services, you agree to our Privacy and Personal Data Protection Policy.

• The Data Subject guarantees that the personal data provided to us are true and accurate and undertakes to notify us of any change or modification to them, assuming sole responsibility for any losses or damages caused by the erroneous, inaccurate, or incomplete communication of their data.

• We draw your attention to the fact that when providing personal information online, there is a risk that third parties may intercept and use such information. Therefore, to protect your privacy, we strongly recommend that you do not include sensitive or confidential personal data through our website or in emails you send us. Should you do so, any resulting breach or damage shall be entirely your responsibility.

• We also inform you that it is the responsibility of users of our social media platforms to ensure that the devices and equipment used to access them are adequately protected against harmful software, computer viruses, and worms. We therefore suggest that you keep your browser, operating system, and antivirus software up to date.

• If you wish to contact us to obtain information about your rights or raise any questions about how we use your information, you should contact us at geral@institutomedicodentario.pt

• However, if you remain dissatisfied, you may contact the Comissão Nacional de Proteção de Dados (CNPD), whose contact details can be found at www.cnpd.pt

Amendments to this Privacy and Personal Data Protection Policy

We may implement changes or updates to this Privacy and Personal Data Protection Policy at any time, and therefore we invite you to consult this document regularly.

​

Date: 17/09/2025

​

Management Signature: