Privacy Policy

The controller of your personal data is Ourique Smile Lda, the entity that operates Clínica Dentária Ferreira Borges, registered with the Portuguese Health Regulatory Authority (ERS) under number 25393 (establishment no. E128470) and holder of operating licence no. 10984/2015, with its establishment at Rua Ferreira Borges 173C, Campo de Ourique, 1350-130 Lisboa, Portugal (hereinafter "Clínica Ferreira Borges" or "the clinic").

For any matter relating to the processing of personal data, you can contact the clinic by e-mail at [email protected], by telephone on +351 218 277 161 or by post to the address above.

This Policy applies to personal data processed in connection with the use of the website clinicaferreiraborges.pt (the "Site") — in particular through the contact and booking request forms — and, more generally, in connection with the provision of healthcare at Clínica Ferreira Borges.

Use of the Site implies awareness and acceptance of the terms described in this Policy. If you do not agree with any of its provisions, please refrain from using the Site and from providing your personal data.

Depending on your relationship with the clinic, the following categories of personal data may be processed:

• Identification and contact data — name, date of birth, civil and tax identification numbers, address, telephone and e-mail;
• Health data — clinical history, diagnoses, treatments performed, complementary examinations and other clinical information necessary for the provision of healthcare;
• Appointment and scheduling data — dates, times, healthcare professional, attendance and cancellations;
• Billing and payment data — tax number, insurance or health subsystem details and payment records;
• Data submitted through the Site's forms — name, contact details and message content;
• Browsing data — IP address, device and browser type and data collected through cookies, as described in the Cookie Policy.

Personal data is processed exclusively for specified, explicit and legitimate purposes, on the following legal bases:

• Provision of healthcare, appointment management and clinical follow-up — performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR) and provision of healthcare (Art. 9(2)(h) GDPR);
• Responding to information and contact requests submitted through the Site — pre-contractual steps and the clinic's legitimate interest in replying to those who contact it;
• Invoicing, accounting and compliance with tax and regulatory obligations — compliance with legal obligations (Art. 6(1)(c) GDPR);
• Sending informational or marketing communications — your consent (Art. 6(1)(a) GDPR), which can be freely withdrawn at any time;
• Site security and prevention of misuse — the clinic's legitimate interest (Art. 6(1)(f) GDPR).

Health data is a special category of personal data and benefits from enhanced protection. It is processed exclusively by healthcare professionals and staff bound by professional secrecy, strictly to the extent necessary for the provision of healthcare, the management of the clinical record and compliance with legal obligations applicable to the health sector.

The Site is not intended for the collection of health data. Please do not include detailed clinical information in the contact forms; such information should be shared in person or through the appropriate clinical channels.

Personal data is kept only for as long as necessary for the purposes for which it was collected, without prejudice to legally required retention periods, in particular:

• Clinical records — for the minimum periods required by the legislation applicable to health records;
• Invoicing and accounting documents — for 10 years, as required by tax law;
• Contact and booking requests that do not lead to an appointment — for a maximum of 2 years after the last contact;
• Data processed on the basis of consent (for example, marketing communications) — until consent is withdrawn.

The clinic does not sell or transfer personal data to third parties. Data may, however, be shared with:

• Processors providing services to the clinic — including Site hosting, clinical management software and IT services — contractually bound by confidentiality and data protection obligations;
• Dental laboratories and other healthcare providers, where necessary for the performance of treatments;
• Insurers and health subsystems, where the patient requests reimbursement of the care provided;
• Public, judicial, tax or health authorities (including the ERS), where there is a legal obligation to do so.

As a rule, personal data is processed within the European Economic Area (EEA). Where a service provider involves the transfer of data outside the EEA, the clinic will ensure that the transfer takes place under appropriate safeguards provided for in the GDPR, namely adequacy decisions or standard contractual clauses approved by the European Commission.

Under the GDPR, you may exercise the following rights at any time:

• Right of access to the personal data concerning you;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure ("right to be forgotten"), within the terms and limits provided by law;
• Right to restriction of processing;
• Right to data portability;
• Right to object to processing, including for direct marketing purposes;
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before that date.

These rights may be exercised, free of charge, by written request to the clinic at [email protected] or by post to Rua Ferreira Borges 173C, Campo de Ourique, 1350-130 Lisboa, Portugal. To protect you, the clinic may request additional information to verify your identity.

Requests will be answered within one month, extendable by up to two further months in particularly complex cases, as provided for in the GDPR. Erasure of health data may be limited by the statutory retention periods applicable to clinical records.

The Site uses cookies and similar technologies to ensure its operation, measure audiences and improve the browsing experience. Detailed information about the cookies used, their purposes and how to manage your preferences is available in the Cookie Policy.

The clinic adopts appropriate technical and organisational measures to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, including access controls, encryption of Site communications and confidentiality duties for staff.

Nevertheless, no transmission of data over the internet is entirely secure, and the clinic cannot guarantee in absolute terms that incidents beyond its control will not occur.

Personal data of underage patients is processed in the context of healthcare provision with the knowledge and consent of the holders of parental responsibility or legal representatives, where required. The Site is not intended for the deliberate collection of data from minors.

The clinic may update this Privacy Policy at any time, in particular to reflect legislative changes or the evolution of the services provided. The version in force will always be published on this page, together with the date of the last update. We recommend that you review it periodically.

Without prejudice to raising any matter directly with the clinic at [email protected], you have the right to lodge a complaint with the competent supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal · cnpd.pt.

For any question relating to this Privacy Policy or to the processing of your personal data, please contact us by e-mail at [email protected] or by post to Clínica Ferreira Borges, Rua Ferreira Borges 173C, Campo de Ourique, 1350-130 Lisboa, Portugal.