Privacy policy

01Who is responsible for processing your data

The controller of your personal data is Dr Michelle Campagnoli, a doctor holding professional licence no. 69467 of the Ordem dos Médicos (Portuguese Medical Association), who practises at Clínica Luxmed through the company Círculo Sagaz, Lda., NIF 517299062.

For any question about the protection of your data, or to exercise your rights, you can contact us by email at info@luxmed.pt, or by post to:

Círculo Sagaz, Lda. (Clínica Luxmed)
Avenida das Túlipas, n.º 5, 5A, 5B, 5C e 5D, 9.º C
1495-161 Miraflores

02What personal data we collect

We collect only the data we need, depending on how you contact us or use the website:

• Booking request: name, mobile number, email, the speciality you are interested in and your message, if you wish to write one.
• Direct contact: the data you give us by telephone, WhatsApp, email or in person, and the content of messages.
• Consultation and treatment: identification and contact details, date of birth, NIF and address for invoicing, and health data (clinical history, assessments, treatments, clinical images and informed consents), which are recorded in your clinical record.
• Virtual assistant: the name, email and mobile number we ask for before the conversation begins, and the questions you write.
• Website: technical browsing data (such as the type of device and browser, and the pages visited), collected by cookies, as explained in the section on cookies.

We do not ask for health data through the booking form or the virtual assistant. Keep it for the consultation.

03What we use your data for and on what legal basis

04Health data and medical confidentiality

Health data is a specially protected category of data. Access to your clinical record is restricted to the doctor and, where necessary for your care, to members of the team who are also bound by professional confidentiality.

We do not use your health data for marketing. Photographs and clinical images are taken only with your permission, and are used outside your clinical record only if you give us specific consent for that purpose.

05Who we share your data with

We do not sell your data. We share it only when necessary, and only with those who need to receive it:

• Service providers who process data on our behalf (for example, website hosting, email, communications and clinic management software), under contracts that require them to protect the data and to use it only on our instructions.
• Accounting and tax advisers, so that we can meet our legal obligations.
• Public authorities, courts and regulators (such as the Portuguese Health Regulatory Authority, the Entidade Reguladora da Saúde), where the law requires it.
• Other healthcare professionals, only if you ask or authorise us to, for example to ensure continuity of your treatment.

Whenever a provider processes data outside the European Economic Area, we require appropriate safeguards, such as the standard contractual clauses approved by the European Commission.

06How long we keep your data

We keep data only for as long as necessary for the purposes above, and never for less time than the law requires:

• Clinical record: 20 years after your last consultation or treatment. This is the period recommended by the Portuguese Medical Association (Ordem dos Médicos) and follows the general limitation period of 20 years laid down in the Civil Code. Once this period has ended, the record is securely destroyed.
• Invoicing and accounting documents: 10 years, under article 52 of the VAT Code and article 123 of the Corporate Income Tax (IRC) Code.
• Enquiries, appointment requests and contacts made through the virtual assistant that do not lead to a consultation: 12 months after the last contact, after which they are deleted.
• Marketing communications: until you withdraw your consent.

07Virtual assistant and “how to get here” search

Before the conversation begins, the website's virtual assistant asks for your name, email and mobile number. We ask for this information for security: it helps to tell real people from automated programs, protects the assistant and the clinic from attacks and bulk messages, and allows the team to reply to you if the conversation needs follow-up.

The details are validated before the conversation starts. After several invalid attempts in a row, the assistant is blocked for a few minutes.

The assistant is automated and does not use artificial intelligence: it replies with the clinic's own information. Please do not share health data in the conversation. For that, speak to the clinic or book a consultation.

The “Where are you coming from?” search on the contact page is used to work out the route to the clinic. The navigation buttons (Google Maps, Waze and Apple Maps) open third-party apps, which have their own privacy policies.

Conversations with the assistant are saved after removing your name, email, phone number and other contact details, to improve the service, and kept for as long as they are useful for that purpose. We only use them to train the assistant if you tick the authorisation box, which you may leave unticked. If you left your contact details and want the linked conversation deleted, write to info@luxmed.pt.

08Cookies

The website uses essential cookies in order to work and, only with your consent, statistics or marketing cookies. You can accept, refuse or change your choices at any time under “Cookie preferences”, at the bottom of every page.

09Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• access your data and obtain a copy;
• rectify incorrect or incomplete data;
• erase your data, where the law allows;
• restrict processing in certain situations;
• object to processing based on legitimate interest;
• port your data, in a commonly used format, where applicable;
• withdraw your consent at any time, without affecting the lawfulness of processing already carried out.

To exercise these rights, write to info@luxmed.pt. We reply within a maximum of one month and may ask you for proof of identity, in order to protect your data. We do not take decisions about you based solely on automated processing.

If you believe that the processing of your data breaches the law, you also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).

10How we protect your data

We adopt appropriate technical and organisational measures to protect data against unauthorised access, loss or alteration: access restricted by role, encrypted communications on the website, and a duty of confidentiality for everyone who processes the clinic's data. In the event of a data breach that poses a risk to you, we notify the CNPD and, where the law requires it, you as well.

11Minors

The website is intended for people aged 18 and over. The processing of data relating to minors, including their appointments and consultations, requires the authorisation of whoever holds parental responsibility.

12Changes to this policy

We may update this policy to reflect changes in the law or in the way we process data. The date of the last update is always shown at the top of this page.