Privacy Policy

Last updated: 05/08/2026

1. Introduction

This Privacy Policy explains how Clínica Dra. Susana Santos (“Clinic”, “we”) collects, uses, stores and protects the personal data of users and patients who visit the website drasusanasantos.com (“Website”) or who contact us through the means made available herein.

This policy has been drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and with the Law No. 58/2019, of 8 August, which ensures the implementation of the GDPR in Portugal.

2. Data Controller

Person in charge: Biscaia dos Santos – Atividades Médicas, Lda NIN: 515857076 Address Avenida de Moscavide, Nº 66 A 1885-062 Moscavide Contact email for privacy queries: info@drasusanasantos.com Telephone: +351 918 667 266

3. What Personal Data We Collect

We collect data through:

• Contact/appointment booking form (WPForms): name, telephone, email, treatment of interest, message.
• Clicks on WhatsApp and telephonewe recorded the click (for statistical purposes), not the content of the conversation.
• Site Navigation: via cookies and similar technologies (Google Analytics, Google Tag Manager, Google Ads) — IP address, device type, pages visited, traffic source.
• Direct communicationsif you contact us by email, phone or WhatsApp, we may keep the content of that exchange to follow up on your request.

4. Health Data — Special Category

If, when filling out the form or in any other communication, you share information about your oral health condition or treatments of interest, this data is considered special category of personal data under the terms of Article 9 of the GDPR.

These data are only processed with your explicit consent, provided upon submitting the form (via the GDPR consent checkbox), and are intended exclusively for preparing and providing oral healthcare, never being used for other purposes without further consent.

5. Purposes of Processing

We use your data to:

• Responding to enquiries and booking appointments;
• Provide clinical care and manage the patient's journey;
• Communicating with you regarding appointments, treatments or schedule changes;
• Fulfill legal and tax obligations;
• Improving the website and our marketing campaigns (Google Ads/Analytics), in an aggregated and, whenever possible, anonymised manner;
• Send marketing communications, only if specific consent has been given to that end.

6. Legal Basis

We process your data on the basis of:

• Consent (Art. 6(1)(a) and Art. 9(2)(a) UK GDPR) — for forms and health data;
• Performance of a contract or steps prior to entering into a contract (art. 6(1)(b)) — when booking an appointment;
• Fulfilment of legal obligation (art. 6(1)(c)) — tax and clinical record-keeping obligations;
• Legitimate interest (Art. 6(1)(f)) — Website security, usage statistics.

7. Data Sharing with Third Parties

We may share data with:

• Google (Google Ads, Google Analytics, Google Tag Manager) — for campaign performance measurement and traffic analysis;
• WPForms / WordPress hosting provider — for technical processing of the form;
• Clinical management software providers, where applicable;
• Public authorities, when required by law.

We do not sell or rent your personal data to third parties for their own commercial purposes.

8. Cookies

The Website uses first-party and third-party cookies (Google Analytics, Google Ads, Google Tag Manager) for operational, statistical analysis, and advertising purposes. You can manage your cookie preferences via the consent banner displayed upon your first visit to the Website, and change them at any time in your browser settings.

9. Retention Period

We retain the data:

• Patient data/clinical recordsfor the legal retention period applicable to health records in Portugal (as a general rule, a minimum of 5 years after the last clinical act, though this may vary);
• Contact form data without follow-up: up to 2 years, or until its deletion is requested;
• Navigation/analytics data: in accordance with the retention periods configured in Google Analytics (typically 14 to 26 months).

10. Your Rights

Under the GDPR, you have the right to:

• Access to your personal data;
• Rectification of incorrect or incomplete data;
• Deletion (right to be forgotten), where applicable;
• Limitation of the treatment;
• Portability of the data;
• Opposition to processing, specifically for direct marketing purposes;
• Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, contact us at [EMAIL].

You also have the right to lodge a complaint with the National Data Protection Commission — www.cnpd.pt.

Data Security

We have adopted appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or improper disclosure, including access controls, communication encryption (HTTPS) and regular backups.

12. International Transfers

Some of our suppliers (e.g. Google) may process data outside the European Economic Area. In such cases, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

13. Minors

The Website is not intended for the intentional collection of data from minors under 16 years of age without the consent of those holding parental responsibility. Consultations for minor patients are managed directly between the Clinic and their respective legal guardians.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the latest update is indicated at the top of the document. We recommend checking this page regularly.

15. Contacts

For any questions regarding this Privacy Policy or the processing of your personal data, contact us:

• Email: info@drasusanasantos.com
• Telephone: +351 918 667 266
• Address 2 Camilo Castelo Branco Street, 2nd Floor Right, Lisbon