Template prepared for review by legal counsel and the data protection officer before final publication.
1. Data controller
The controller of your personal data is Anagen, tax number —, registered with the Portuguese Health Regulatory Authority (ERS) under no. —, operating licence no. —, with registered office at PT. Contact: — · —.
2. Data protection officer
You can contact the data protection officer (—) at — about your data or to exercise your rights.
3. Data we process
- Identification and contact: name, email, phone, country, language and, when needed for invoicing, tax number and address.
- Health data: questionnaire answers (history, medication, allergies), scalp photographs, records of the consultation, planning, surgery and follow-up.
- Communication data: messages exchanged with the clinic and, only with your consent, call recordings.
- Website usage data: anonymous visit statistics, without cookies and without identifying the person; and, if you accept them, statistics or marketing cookies (see the Cookie Policy).
4. Purposes and legal grounds
| Purpose | Legal ground |
|---|---|
| Answering contact, call-back or appointment requests | Pre-contractual steps at your request and consent to be contacted (GDPR, art. 6(1)(a) and (b)) |
| Online assessment with questionnaire and photographs | Explicit consent to process health data (GDPR, art. 9(2)(a)), which you may withdraw at any time |
| Healthcare (consultation, surgery, follow-up) | Provision of care by professionals bound by secrecy (GDPR, art. 9(2)(h); Portuguese Law 58/2019, art. 29) |
| Clinical photographs and recordings | Specific written consent, separate from use in communication |
| Use of images in communication (published cases) | Specific image consent, per channel and period, revocable |
| Invoicing and legal obligations | Compliance with legal obligations (GDPR, art. 6(1)(c)) |
| Marketing communications | Consent (Portuguese Law 41/2004) or, for clients, similar services, with an opt-out in every message |
| Website security and abuse prevention | Legitimate interest in protecting our systems |
Withdrawing consent does not affect processing carried out before and never requires deleting the clinical record, which the law requires us to keep.
5. Who has access
Health data is only available to healthcare professionals involved in your care, bound by secrecy. Sales and reception staff see only what is needed to book and inform, with no clinical content. Every access is logged and you can view it in the patient portal ("Who accessed my data").
We use processors (hosting in the European Union, email, messaging, certified invoicing, payments, video) under data processing agreements; they process data only on our instructions and never for their own purposes, including training artificial intelligence systems.
6. International transfers
Data is hosted in the European Union. If, exceptionally, a provider processes data outside the European Economic Area, this only happens with appropriate safeguards (adequacy decision or standard contractual clauses).
7. Retention
- Clinical record: for the period required by law and good clinical practice (as a prudent reference, 20 years after the last act).
- Contact requests and online assessments that did not lead to a consultation: up to 24 months, then anonymised or deleted.
- Invoicing documents: 10 years.
- Consent and access records: as long as needed for evidence, at least for the duration of the relationship.
- Anonymous website statistics: up to 13 months.
8. Your rights
You have the right of access, rectification, erasure (within the limits of mandatory retention), restriction, portability and objection, and to withdraw consent at any time. You can exercise them in the patient portal, by email to — or in person. We reply within one month.
You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD, www.cnpd.pt).
9. Automated decisions and artificial intelligence
We do not take decisions with significant effects based solely on automated processing. When we use AI support tools, their proposals are always reviewed and validated by a healthcare professional, and you are told whenever you are talking to an automated assistant.
10. Security
We apply appropriate technical and organisational measures: strong team authentication, encryption of clinical data and files, temporary links for photographs, immutable access logs, encrypted backups and a procedure to notify breaches to the CNPD within 72 hours.
11. Changes to this policy
This policy may be updated. The current version is always on this page, with the date of its last publication.