Privacy Policy
Last updated: July 2026
This policy describes how Sandra R. Santos, as data controller, collects and processes personal data in connection with this website, in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese law. (Template text — review with legal advice before publishing.)
1. Data controller
Sandra R. Santos, Clinical Psychologist (OPP no. 21076).
Contact: [email protected] · +351 913 683 024
2. What data we collect
- Contact details you provide voluntarily (by email, phone or WhatsApp).
- Data provided when submitting a booking request (name, email, phone number, general reason for consultation).
- Aggregated, anonymous technical usage data (see "Analytics").
3. Purposes and legal basis
- Responding to enquiries and requests (legitimate interest / pre-contractual steps).
- Managing booking requests and scheduling (performance of a contract / pre-contractual steps, Art. 6(1)(b) GDPR).
- Sending appointment reminders by SMS and/or email (legitimate interest in reducing no-shows, Art. 6(1)(f) GDPR).
- Improving the website through aggregated statistics (legitimate interest).
4. Processors and transfers
We do not sell your data. For the purposes described above, we engage the following processors, each with a Data Processing Agreement (DPA) in place:
- Twilio Inc. (USA, Standard Contractual Clauses) — sending reminder SMS. Data transmitted: phone number and appointment date/time. No clinical content is included.
- SMTP provider (email) — sending reminder and confirmation emails. Data transmitted: email address and appointment date/time. No clinical content is included.
- Web hosting provider — subject to confidentiality and security obligations.
5. Analytics
We use a privacy-friendly analytics solution (Umami — no tracking cookies and no collection of identifiable personal data) to understand site usage in aggregate. No cookies are used. You can turn this analytics off at any time (see the next section).
6. Cookies and tracking technologies
This website uses no tracking or advertising cookies. Your
interaction with the privacy notice is stored locally in your browser
(localStorage, key srs-consent-v1) for 180 days so we
don't show it again. If you choose to turn analytics off, that preference is
also stored locally (umami.disabled).
| Category | Purpose | Legal basis |
|---|---|---|
| Necessary | Site operation and security. Includes the Cloudflare Turnstile anti-spam check, loaded only on the booking page and only once you start filling in the form. | Legitimate interest / performance of the service you requested (consent-exempt). |
| Analytics | Aggregated, anonymous usage statistics (Umami Cloud). No cookies and no individual identification. | Legitimate interest (Art. 6(1)(f) GDPR). Cookieless — consent-exempt under Art. 5(3). You can object via "Cookie settings". |
The contact page embeds an OpenStreetMap map; loading that page discloses your IP address to that service so the map can be displayed. OpenStreetMap does not use tracking cookies.
You can review or change your choices at any time: .
7. Retention
- Booking and contact data: retained during the clinical relationship and up to 30 days after the last contact without a completed appointment, unless a legal obligation requires otherwise.
- Clinical records: retained for a minimum of 5 years after the last clinical contact, in accordance with Parecer 59/CEOPP/2017 of the Ordem dos Psicólogos Portugueses and professional best practices.
- Analytics data: aggregated only, with no possibility of individual identification.
Once the retention period expires, data is securely deleted. Note that deletion of clinical records before the minimum period may be refused on the basis of a legal retention obligation.
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD).
9. Data location
Your data is stored on infrastructure controlled by the data controller, located within the European Union. Continuous encrypted backups are maintained. Only the data controller has access to the database.
10. Professional confidentiality
Clinical practice is subject to professional confidentiality and the Code of Ethics of the Ordem dos Psicólogos Portugueses. Clinical data is processed outside this website, in a dedicated and secure environment.
11. Complaints Book
As required by Portuguese law, we provide access to the electronic Complaints Book: livroreclamacoes.pt.
12. Changes
This policy may be updated. The date of the last update is shown at the top of the page.