Privacy Policy
Version 1.0, effective 17 September 2026
1. Who processes your data
Patrícia Sofia Soares Bernardo, practitioner of non-conventional therapies, holder of professional licence no. C-61967 in Traditional Chinese Medicine issued by the Portuguese Central Administration of the Health System (ACSS), trading as «Patrícia Sofia Homeopatia», is the controller of the personal data collected through the website patriciasofia.com, the messaging channels, the booking system and consultations.
Data protection contacts: servicos@patriciasofia.com and +351 914 038 264.
Practice locations: «Espaço Soul», Rua Belo Horizonte 9G, Oeiras, and «No Limits» Building, Restelo, Av. Dr. Mário Moutinho 33A, Lisbon, Portugal.
2. What data we collect, why, and on what basis
2.1 Booking consultations and treatments
We collect your name, email, telephone number and the details you enter in the booking form. We use them to schedule, confirm, remind you of and invoice the consultation. The legal basis is the performance of the service contract you request, under Article 6(1)(b) of Regulation (EU) 2016/679 (GDPR), and compliance with tax obligations for invoicing, under Article 6(1)(c).
2.2 Health data
During the consultation, and in the forms that precede it, we collect information about symptoms, medical history, medication and state of health. This is special-category data.
We process it with your explicit consent, under Article 9(2)(a) of the GDPR, and, insofar as the consultation constitutes the provision of health care, under Article 9(2)(h). The practitioner is required to keep a record of observations and acts performed, under Article 9(1) of Portuguese Law no. 71/2013 of 2 September, and is bound by professional secrecy over its content.
Consent is given in writing, separately from any other consent, and may be withdrawn at any time without affecting what was done before.
In some lead forms we ask, optionally, for the main symptom or health condition that brings you to us. We process that information only with your explicit consent, requested separately from the subscription to communications, and only to prepare the first contact.
2.3 Newsletter and marketing communications
If you subscribe, we collect your email and, where provided, your first name, surname and telephone number. We use them to send you content, news and information about services. The legal basis is your consent, under Article 6(1)(a) of the GDPR and Article 13-A of Portuguese Law no. 41/2004 of 18 August, as amended.
You can unsubscribe in any email, through the unsubscribe link, or by writing to us.
We never use health information to segment marketing communications without specific consent for that purpose.
2.4 Contacts via WhatsApp, Messenger, Instagram, website forms and the website assistant
We collect the content of the conversation, the channel identifier and the details you give us, in order to reply and follow up on your request. The legal basis is the taking of pre-contractual steps at your request, under Article 6(1)(b) of the GDPR.
The first response on these channels, including the «Falar com a Inês» chat assistant on the website, is provided by an automated assistant. It is identified as such, and you can ask to speak to a person at any time. Conversations with the assistant are recorded. Do not write health data in these channels: that is what the consultation is for.
2.5 Browsing the website
The website uses cookies and similar technologies, first-party and third-party, for operation, audience measurement and advertising. The third parties involved are listed in section 3. You can manage or block cookies in your browser settings. A separate Cookie Policy, with the detailed list and the means of managing consent, will be published on this page.
3. Who we share data with
We do not sell personal data. We use providers that process data on our behalf, as processors, under contracts that bind them:
| Purpose | Provider |
|---|---|
| Website and hosting | Duda, Inc. |
| Bookings and payments | SimplyBook.me |
| Email marketing | UAB «MailerLite» |
| Transactional email sent from patriciasofia.com | Resend, Inc. |
| Messaging and channel automation | ManyChat, Inc. |
| Chat assistant on the website | ElevenLabs, Inc. |
| Measurement and advertising | Google Ireland Limited, Meta Platforms Ireland Limited |
| Reviews | EmbedSocial |
| Lead-capture tools on the website | Sumo |
Some of these providers are established outside the European Economic Area, notably in the United States of America. In those cases, transfers rely on the European Commission’s standard contractual clauses or, where applicable, on the EU-US Data Privacy Framework. You may ask us for a copy of the applicable safeguards.
We also disclose data to public authorities where the law requires it.
4. How long we keep data
| Data | Period |
|---|---|
| Clinical record | 10 years after the last consultation. The law requires the record to be kept, without setting a period; this is the period set by the controller under Article 21(1) of Portuguese Law no. 58/2019 of 8 August |
| Invoicing and accounting | 10 years, as required by tax law |
| Bookings with no consultation held | 12 months after the booked date |
| Newsletter subscribers | Until you unsubscribe, and thereafter for as long as needed to prove the unsubscription |
| Conversations on messaging channels and the website assistant | 24 months after the last interaction |
| Browsing data | The lifetime of each cookie, as stated in the Cookie Policy |
Once these periods end, data is deleted or anonymised.
5. Your rights
You have the right to access your data, to rectify it, to erase it, to restrict its processing, to object to it and to receive it in a portable format. Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, write to servicos@patriciasofia.com. We reply within one month, extendable under Article 12(3) of the GDPR.
If you believe your data is not being processed as it should be, you may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados), at www.cnpd.pt.
6. Security
We adopt appropriate technical and organisational measures to protect your data: an encrypted connection (HTTPS) on the website, authentication-protected access to the platforms we use, and access to the clinical record restricted to the controller.
7. Changes
This policy may be updated. The version in force is always the one published on this page, with the update date shown at the top.