Privacy and Personal Data Protection Policy

MD Alferes, Lda. is committed to complying with the General Data Protection Regulation (hereinafter referred to as GDPR), as well as the provisions of the Constitution of the Portuguese Republic (CRP), the Data Protection Law (DPL), and all other applicable data protection legislation, ensuring the safeguarding of personal data and strengthening the relationship of trust with the client.

This Privacy and Personal Data Protection Policy aims to provide information regarding the data collected, its purpose, and the way it is processed.

If you have any questions regarding the processing of your personal data, please contact us at: geral@drclaudioalferes.com.

By providing your personal data to MD Alferes, the data subject authorises the processing of such data in accordance with this Privacy and Personal Data Protection Policy.

Data controller

MD Alferes, Lda., with VAT number 517345226, headquartered at Rua D. Antão de Almada, no. 62, 4435-011 Rio Tinto, is the entity responsible for processing the personal data collected through its website.

What is personal data?

According to the GDPR, personal data refers to any information relating to an identified or identifiable natural person (the data subject). A natural person is considered identifiable when they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, electronic identifiers (IP address, cookies), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data collected

MD Alferes, Lda. collects different categories of data, such as:

Identifying data, including your name, gender, date of birth, tax identification number, social security number, national health service number, citizen card number and its expiry date, or image;
Communication data, including telephone number, email address and postal address (town/city, postal code, country, district, municipality, parish);
Private life data, such as profession and employment status, family doctor, spouse's name, father's and mother's names (e.g., in the case of a minor), data related to insurance or healthcare subsystems;
Data about third parties authorised to make decisions on your behalf or to be contacted in case of emergency;
Information regarding your health and healthcare services you have received or will receive;
Payment data.

How your data is collected

When you contact us;
When you establish a relationship with us for the provision of a service;
When you post comments or images on our social media pages;
Or whenever you provide us with personal information in any way.

Purposes of data collection and legal grounds

The collection of personal data serves the purposes of executing contracts entered into with clients for the provision of healthcare services, prevention or diagnosis, and/or the provision of treatments, as well as administrative management (e.g., scheduling or rescheduling appointments and treatments, invoicing, accounting, and auditing), marketing communications and other commercial communications, quality control, statistical studies, better understanding of client preferences, and for contact purposes.

The legal bases for collecting your personal data include legal obligations, pre-contractual and contractual relationships, payment management, customer support, the data subject’s consent, and legitimate interests.

With your consent, we may also process your data for the provision of teleconsultations, for the publication of photos or videos for the purpose of promoting our activities internally and externally (e.g., on social media), and for marketing purposes or sending newsletters.

Personal data related to your health will only be processed by professionals bound by confidentiality and only to the extent strictly necessary.

Retention Period and Manner of Personal Data Storage

We process and retain your personal data only for the period necessary to fulfil the respective purposes, to meet your needs and requests, or to comply with legal obligations, which may vary depending on the category of data.

We may also retain some of your personal data to the extent necessary to manage or enforce our rights, including through legal proceedings.

Where processing is based on your consent, we will retain your data in accordance with the consent provided or until such consent is withdrawn.

Who We Share Your Data With?

We may engage other companies to provide certain services and may share your personal data with third parties, such as accounting and IT service providers, competent authorities, legal service providers, consultants, and others. We ensure that, in such cases, these third parties have limited access to personal data, restricted solely to what is necessary to perform the contracted tasks, and that they are subject to the same confidentiality obligations. Similarly, we may disclose your personal data when required by law, in the context of legal proceedings or investigations into suspicious activities.

Security Measures

We have developed appropriate technical and organisational mechanisms and measures to maintain the confidentiality and security of your personal information. Recognising that the data collected may include sensitive information under the GDPR, we take steps to ensure an adequate level of security according to the risk and to protect personal data against destruction, loss, alteration, unauthorised disclosure, or accidental or unlawful access.

To this end, we have implemented various measures such as restricted access to clinical records (physical or digital), use of strong passwords, and maintenance of up-to-date antivirus software. Additionally, all MD Alferes, Lda. employees who have access to your personal data are bound by confidentiality and secrecy obligations.

Data Subject Rights

In accordance with the GDPR, data subjects may exercise, at any time, their rights to be informed, access, rectify, erase and transfer their personal data, as well as to restrict or object to its processing, including the right to withdraw consent. To do so, please contact us at: geral@drclaudioalferes.com.

Understand your rights:

Right to information: You have the right to receive clear, transparent, and understandable information about how we use your personal data.
Right of access: You may access your personal data that we process and store. In such cases, we will provide information about the personal data being processed. Please note that the right of access is not absolute and must be balanced with data protection legislation (which may lead to denial of access, for example, when such access may compromise the rights and freedoms of others) and healthcare law (e.g., in cases where it is clearly demonstrated that access may be harmful to the patient, the requested information may not be disclosed—therapeutic privilege). Access may be granted via a physician, if requested.
Right to rectification: You have the right to have your personal data rectified without undue delay, provided you are the one who supplied the data and it is inaccurate, outdated, or incomplete.
Right to erasure / right to be forgotten: You may request that we delete your personal data. However, this is not an absolute right, as we may have legal grounds—such as legally established retention periods—or legitimate interests for retaining your data.
Right to object: You may object to the processing of your data on grounds relating to your particular situation. This may apply to processing for scientific, statistical, or historical research purposes, unless the processing is necessary for reasons of public interest.
Right to withdraw consent at any time: You may withdraw your consent to data processing when such processing is based on your consent. Please note that withdrawing consent does not affect the lawfulness of the processing based on consent before it was withdrawn.
Right to data portability: You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller.
Right to restriction of processing: You have the right to request the restriction of the processing of your data where you contest its accuracy, if the processing is unlawful and you do not wish for the data to be erased, if the data is no longer required by us but needed by you, or if you have exercised your right to object.

These rights, like any others, must be exercised reasonably and in good faith by the data subject.

Final Notes

By using our services, you agree to our Privacy and Data Protection Policy.
The data subject guarantees that the personal data provided is accurate and up to date, and undertakes to notify us of any changes or modifications. The data subject is solely responsible for any losses or damages caused by the incorrect, inaccurate, or incomplete communication of their personal data.
Please note that when providing personal information online, there is a risk that third parties may intercept and use that information. For your privacy, we strongly advise against including sensitive or confidential personal data via our website or in emails sent to us. Any data breaches or resulting damage will be the sole responsibility of the data subject.
It is also the responsibility of users of our social media platforms to ensure that their devices and equipment are adequately protected against malicious software, viruses, and worms. We recommend keeping your browser, operating system, and antivirus software up to date.
If you wish to contact us for information about your rights or have any questions regarding how we use your information, please contact us via email at geral@drclaudioalferes.com. If you remain unsatisfied, you may contact the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados). Their contact details can be found at www.cnpd.pt.