Privacy Policy
Last updated: 29 October 2026 Version: 2.2.0
1. Introduction
TrataMentes is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store and protect your personal information in accordance with:
- General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679
- Law nº 58/2019 - GDPR implementation law in Portugal
- CNPD Guidelines - Portuguese Data Protection Authority
2. Data Controller
TrataMentes João Goulart - Manual Therapist Email: [email protected] Phone: +351 937 543 312 Website: tratamentes.pt
Data Protection Officer (DPO)
Email: [email protected]
Partner Therapists
The TrataMentes space may host partner therapists who work and invoice independently. When you book a session with a partner therapist, that therapist’s name is shown at the time of booking. That therapist is the controller for the data of your session, your clinical record and your invoicing; TrataMentes processes the booking data and the use of the space. Each therapist’s data is kept separate and is not shared with the others. You can exercise your rights with either of them through [email protected].
3. Personal Data We Collect
3.1 Data Provided Directly
When you contact us or book an appointment, we may collect:
| Category | Data | Purpose |
|---|---|---|
| Identification | Name, email, phone | Contact and scheduling |
| Health | Symptoms, clinical history | Provision of therapeutic services |
| Location | Address (if home visit) | Travel for treatment |
| Financial | Billing data | Invoice issuance |
3.2 Data Collected Automatically
When you visit our website:
| Category | Data | Purpose |
|---|---|---|
| Technical | IP (anonymised), browser, device | Security and functionality |
| Navigation | Pages visited, time on site | Website improvement |
| Cookies | Preferences, session | See Cookie Policy |
4. Legal Basis for Processing
GDPR - Article 6
| Legal Basis | Application |
|---|---|
| Consent (a) | Newsletters, optional cookies, marketing |
| Contract (b) | Scheduling and service provision |
| Legal Obligation (c) | Invoicing, tax retention |
| Legitimate Interest (f) | Security, fraud prevention |
Health Data - Article 9
Health data is processed based on explicit consent (Art. 9(2)(a)) or for healthcare provision (Art. 9(2)(h)).
5. Processing Purposes
We use your personal data to:
Service Provision
- Appointment scheduling
- Manual therapy treatments
- Clinical follow-up
Communication
- Booking confirmation
- Appointment reminders
- Treatment information
Legal Obligations
- Invoicing
- Mandatory clinical records
- Communications to authorities (if applicable)
Service Improvement
- Satisfaction analysis
- Website optimisation
- Development of new services
6. Data Sharing
We Do Not Sell Your Data
We never sell, rent or share your personal data for third-party commercial purposes.
Necessary Sharing
We may share data with:
| Recipient | Purpose | Safeguards |
|---|---|---|
| Accounting | Invoicing | Contract, confidentiality |
| Google (Analytics) | Web statistics | IP anonymisation, EU |
| Google (Maps) | Clinic locations | Consent |
| Elfsight | Testimonials | SCC, consent |
| Hetzner Online | Hosting of the booking system and client records (servers in Finland, EU) | Data processing agreement (Art. 28), sensitive data encrypted |
| WhatsApp (Meta) | Confirmation code, reminders and messages about your booking | Sent from our own server; WhatsApp end-to-end encryption; never clinical data |
| Telegram | Chatting with us, if you choose to message our bot @tratamentes_bot | We only receive what you send and your username; chats with bots are not end-to-end encrypted, so please do not send us clinical data this way |
| SMS Gateway for Android (SMSGate) | Confirmation code, reminders and messages about your booking when your number has no WhatsApp | Sent from the clinic’s phone; the text passes through the service’s server and is deleted after 1 month; never clinical data |
| Google (Calendar) | Booking calendar (name, service, location, time) | Google data processing terms; never clinical data |
| Cloudflare | Secure delivery of the website and booking system | EU-US Data Privacy Framework, SCC |
International Transfers
- Google Ireland Limited: Ireland (EU) - Adequacy
- Elfsight: USA - Standard Contractual Clauses (SCC)
- Hetzner Online GmbH: servers in Finland (EU) - no transfer outside the EU
- WhatsApp Ireland Limited / Meta Platforms, Inc.: Ireland (EU) and USA - EU-US Data Privacy Framework and SCC
- Cloudflare, Inc.: USA - EU-US Data Privacy Framework and SCC
- Telegram: outside the EEA; EU representative under Art. 27 GDPR (European Data Protection Office); the chat only exists because you start it
- SMS Gateway for Android (SMSGate): the service’s server; the text is deleted after 1 month
7. Data Retention
| Data Type | Period | Justification |
|---|---|---|
| Clinical data | 5 years | Legal obligation (health) |
| Invoices | 10 years | Tax obligation |
| Consents | 3 years | Proof of compliance |
| Website logs | 12 months | Security |
| Marketing data | Until withdrawal | Consent |
Deletion
After the indicated periods, data is securely deleted or anonymised.
8. Your Rights
Under GDPR, you have the following rights:
8.1 Right of Access (Art. 15)
You can request a copy of all personal data we hold about you.
8.2 Right to Rectification (Art. 16)
You can correct inaccurate or incomplete data.
8.3 Right to Erasure (Art. 17)
You can request deletion of your data (“right to be forgotten”), except where legal retention obligations apply.
8.4 Right to Restriction (Art. 18)
You can request restriction of processing in certain circumstances.
8.5 Right to Portability (Art. 20)
You can request your data in a structured, machine-readable format.
8.6 Right to Object (Art. 21)
You can object to processing based on legitimate interest.
8.7 Right to Withdraw Consent
You can withdraw consent at any time, free of charge.
How to Exercise Your Rights
Email: [email protected] Response Time: Maximum 30 days (GDPR Art. 12) Cost: Free (except for excessive requests)
9. Data Security
Technical Measures
- HTTPS encryption across the entire website
- Encrypted passwords (hash)
- Regular encrypted backups
- Firewall and intrusion protection
Organisational Measures
- Access restricted to authorised personnel
- Data protection training
- Confidentiality policies
- Incident response procedures
Breach Notification
In case of data breach, we will notify:
- CNPD: Within 72 hours (GDPR Art. 33)
- Affected individuals: Without undue delay (Art. 34)
10. Minors
Minimum Age
Our services are intended for those over 18 years old. For minors, consent from a legal representative is required.
Treatment of Minors
If a minor books an appointment, we request parental authorisation before treatment.
11. Cookies and Similar Technologies
For detailed information about cookies, please see our Cookie Policy.
Summary
- Essential Cookies: Always active (site functionality)
- Analytics Cookies: With consent (Google Analytics)
- Maps Cookies: With consent (Google Maps)
- Testimonial Cookies: With consent (Elfsight)
12. Changes to This Policy
Notification
- Minor changes: Date update
- Significant changes: Website notice
- New purposes: New consent request
Version History
- v2.2.0 (31/10/2026): Telegram and SMS (SMSGate) as contact channels
- v2.1.0 (29/10/2026): Partner therapists; hosting (Hetzner, Finland), WhatsApp, Google Calendar and Cloudflare as recipients
- v2.0.0 (31/12/2025): Complete GDPR 2025 update
- v1.0.0 (15/01/2025): First version
13. Contacts and Complaints
Direct Contact
Email: [email protected] Phone: +351 937 543 312 Response: Maximum 30 days
Supervisory Authority
If you believe your data processing is not compliant, you can lodge a complaint with:
CNPD - Portuguese Data Protection Authority Website: www.cnpd.pt Email: [email protected] Phone: +351 213 928 400 Address: Av. D. Carlos I, 134 - 1.º, 1200-651 Lisbon
Executive Summary
✅ Data Collected: Only what is necessary for services 🔒 Security: Encryption and restricted access 📊 Purpose: Treatments, invoicing and service improvement 🇵🇹 Compliance: GDPR + Portuguese Law nº 58/2019 📧 Contact: [email protected] 🛡️ Rights: Access, rectification, erasure, portability ⏰ Retention: As per legal obligations 🌍 Transfers: EU priority, USA with safeguards
This document complies with Portuguese and European legislation in force.
For specific questions about this policy, contact [email protected]