Instituto de Neurociências — Prof. Dr. Manuel Laranjeira ("Instituto de Neurociências", "we") respects the privacy of its patients, staff and visitors to the institutional website, and is committed to protecting the personal data entrusted to it, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (General Data Protection Regulation, "GDPR"), Law No. 58/2019, of 8 August, which implements the GDPR under Portuguese national law, and other applicable Portuguese and European legislation on personal data protection.
This Privacy Policy describes what personal data we collect, for what purposes we process it, on what legal basis, for how long we keep it, and what rights data subjects have.
1. Who is the data controller
The controller responsible for processing personal data collected through this site and in the context of providing healthcare is:
- Entity: Instituto de Neurociências — Prof. Dr. Manuel Laranjeira
- Address: Avenida da Boavista 4795, 4100-141 Porto, Portugal
- Phone: 225 323 370
- Email: secretariado@incbackschool.com
Whenever a Data Protection Officer (DPO) is appointed, under article 37 of the GDPR, their contact details will be made available on this page and may be used by data subjects to exercise their rights or clarify any questions related to the processing of their personal data.
2. What personal data we collect
Depending on how you interact with us, we may collect the following categories of data:
- Identification and contact data: name, phone number, email address and, when applicable, address.
- Appointment-related data: desired specialty, doctor, date and reason for contact.
- Health data: clinical information collected in the context of providing healthcare (clinical history, diagnoses, complementary exams, prescriptions and other information in the clinical record), processed exclusively by the responsible healthcare professionals and subject to professional confidentiality.
- Browsing data: technical information automatically generated by the use of the site (for example, device and browser type), collected only to the extent strictly necessary for the site to function.
We do not collect, through this site, personal data of minors without the consent and involvement of their legal representatives.
3. Purposes for which we process your data
- Manage appointment and contact requests submitted through the site or by phone;
- Provide healthcare, including the creation, updating and retention of the clinical record;
- Comply with legal and regulatory obligations applicable to clinical, tax and accounting activity;
- Respond to information requests and communicate with patients about the services provided;
- Ensure the security, proper functioning and improvement of the institutional site.
4. Legal basis for processing
Personal data is processed based on one or more of the following legal grounds, provided for in article 6 of the GDPR:
- Performance of a contract or pre-contractual steps — namely to respond to appointment requests;
- Compliance with legal obligations to which Instituto de Neurociências is subject, namely in health, tax and accounting matters;
- Consent of the data subject, which may be withdrawn at any time, without affecting the lawfulness of processing carried out based on consent previously given;
- Legitimate interests of Instituto de Neurociências, namely in administrative management and site security, provided that the interests or fundamental rights of the data subject do not prevail.
Regarding health data, a special category of data under article 9 of the GDPR, processing is generally based on the necessity of such data for purposes of preventive medicine or clinical diagnosis, provision of healthcare or treatment, or management of health systems and services, subject to professional secrecy, or on the explicit consent of the data subject, under article 9(2)(a) and (h) of the GDPR.
5. Data retention period
Personal data is kept only for the period necessary to achieve the purposes that motivated its collection, after which it is deleted or anonymized, unless there is a legal obligation to retain it for a longer period.
In particular, data contained in the clinical record is kept for the period legally required for clinical documentation, which may vary depending on the specialty and type of information involved. Data relating to tax and accounting documents is kept for the applicable legal period, currently 10 years.
6. Who we share your data with
Personal data may be shared, strictly to the extent necessary, with:
- Healthcare professionals and staff of Instituto de Neurociências directly involved in providing healthcare;
- Service providers acting on behalf of Instituto de Neurociências (for example, IT hosting, billing and accounting), as processors and under contracts that ensure adequate levels of data protection;
- Public entities, when required by law or by decision of a competent authority (for example, health, tax or judicial authorities).
We do not sell or transfer personal data to third parties for marketing purposes without the prior and express consent of the data subject.
7. International data transfers
Whenever, in the context of services provided by third parties (namely IT hosting services), personal data is transferred outside the European Economic Area, such transfer will only be made to countries that ensure an adequate level of protection or through the adoption of appropriate safeguards, namely the Standard Contractual Clauses approved by the European Commission, under articles 44 to 49 of the GDPR.
8. Cookies and similar technologies
The institutional site uses only cookies strictly necessary for its technical operation, and currently does not use statistical analysis, advertising or social media cookies. Should this change, this Policy will be updated and, where required by law, the user's prior consent will be requested, under Law No. 41/2004, of 18 August, as currently in force.
9. Data security
Instituto de Neurociências adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, preventing unauthorized access, alteration, disclosure or improper destruction of personal data, in compliance with article 32 of the GDPR.
10. Rights of data subjects
Under articles 15 to 22 of the GDPR, any personal data subject has the right, at any time and free of charge, save for legally provided exceptions, to:
- Access the personal data concerning them and obtain information about its processing;
- Request the rectification of inaccurate or incomplete data;
- Request the erasure of data, where applicable;
- Request the restriction of processing, in the cases provided by law;
- Object to the processing of their data, for reasons related to their particular situation;
- Request the portability of data they have provided, when technically feasible;
- Withdraw consent given, at any time, without affecting the lawfulness of processing carried out based on consent previously given.
These rights may be exercised by written request sent to the contacts indicated in point 1 of this Policy, and the request must be accompanied by information allowing confirmation of the data subject's identity.
Without prejudice to any other administrative or judicial remedy, data subjects also have the right to lodge a complaint with the national supervisory authority — the National Data Protection Commission (CNPD), headquartered at Rua de São Bento, n.º 148, 3.º, 1200-821 Lisbon, through the site www.cnpd.pt.
11. Changes to this Policy
Instituto de Neurociências reserves the right to update this Privacy Policy whenever necessary, namely to reflect legislative changes or changes to the services provided. The date of the last update is always indicated at the top of this document. Periodic review of this page is recommended.
12. Contacts
For any question regarding this Privacy Policy or the processing of your personal data, you may contact us by email at secretariado@incbackschool.com or by phone at 225 323 370.