Privacy Policy

1. Who is responsible

The controller of your data is CNP, Lda., tax no. (NIPC) 506651940, with registered office at Rua São João de Brito, 610 - S/3, 4100-453 Porto, which operates Oporto Medical Spa, a unit registered with the Portuguese Health Regulatory Authority (Entidade Reguladora da Saúde) under no. E138084.

For any question about your data, write to reservas@oportomedicalspa.com or call 22 616 30 30.

2. What data we collect

• Bookings: name, email, phone, tax number (NIF), treatment, therapist, date and time.
• Email confirmation: a six-digit code sent to your email before payment.
• Vouchers: the buyer’s details, the recipient’s name, the giver’s name, the message and the voucher code.
• Payments: the payment method, the MB WAY mobile number, the reference and the payment status. Card details are entered directly on the euPago page and never reach Oporto Medical Spa.
• Newsletter: your email and a record of your consent.
• Contacts: whatever you send us by email, phone or WhatsApp.
• At the spa: the health data needed for assessment and treatment (complaints, history, medication, contraindications), recorded by the physiotherapist in your file. The website does not ask for health data.
• Technical data: the IP address and connection data that servers record for security.

3. What we use the data for

• Managing bookings and vouchers, confirming them by email and contacting you about your booking: performance of a contract (Article 6(1)(b) GDPR).
• Issuing invoices and meeting tax and legal obligations: legal obligation (point (c)).
• Assessing and treating your health and keeping your clinical record: provision of health care by professionals bound by confidentiality (Article 9(2)(h) and 9(3) GDPR).
• Sending the newsletter and the welcome code: your consent (point (a)), which you can withdraw at any time.
• Confirming your email, preventing fraud, protecting the website and defending our rights in the event of a dispute: legitimate interest (point (f)).

We do not sell your data, we do not use it for third-party advertising and we do not make automated decisions about you.

4. Who we share it with

Only with providers who process data on our behalf, under contract and with data protection safeguards, and only as far as necessary:

• euPago (Portugal): MB WAY, Multibanco and card payments.
• Moloni ON (Portugal): invoicing. Invoices are reported to the Portuguese Tax Authority.
• Zoho (data centre in the European Union): client records and the booking calendar.
• Resend (United States): sending confirmation, voucher and code emails.
• Netlify (United States): website hosting, forms and request logs.
• Google (United States): the website’s fonts (Google Fonts), which receive visitors’ IP addresses.

We also share data with the authorities when the law requires it and, at your request, with your insurer or health scheme.

5. Transfers outside the European Union

Some providers are based in the United States. These transfers take place under the EU-U.S. Data Privacy Framework, where the provider is certified, or under the standard contractual clauses approved by the European Commission.

6. How long we keep the data

• Invoices and accounting documents: 10 years, as required by tax law.
• Clinical records: for the period required by law for health records.
• Client record and booking history: while you are a client and for up to 5 years after your last booking, to deal with requests and complaints.
• Vouchers: until they expire and then for the same period as invoices.
• Newsletter: until you unsubscribe.
• Email confirmation codes: 10 minutes.
• Technical logs: for the short period needed for website security.

7. Your rights

You can request access to, rectification, erasure, restriction or portability of your data, object to processing based on legitimate interest and withdraw your consent at any time, without affecting processing already carried out. Simply write to reservas@oportomedicalspa.com. We reply within one month and may ask you to confirm your identity.

Some data cannot be erased while the law requires us to keep it, such as invoices and clinical records.

You can also lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados) at www.cnpd.pt.

8. Newsletter

We only send the newsletter to people who subscribe and tick the consent box. You can unsubscribe at any time using the link in every email or by writing to reservas@oportomedicalspa.com.

9. Cookies

This website does not use advertising cookies, visitor analytics or tracking tools. It only uses the technical storage strictly necessary for the team’s back office.

Links to Google Maps, Waze, WhatsApp and Instagram only take you to those services if you click them, and their own privacy policies then apply.

10. Security

Data always travels encrypted (HTTPS). Access to the back office and to our providers’ accounts is password-protected and restricted to the team. The entire clinical team is bound by professional confidentiality.

11. Minors

Bookings and purchases on the website are intended for people aged 18 or over. Bookings for a minor must be made by a parent or legal guardian, and the minor must be accompanied.

12. Changes to this policy

We may update this policy. The current version is always on this page, with the date of the last update.