OSTEOFISIO lab · osteofisiolab.pt
Version dated 7 October 2026
The website osteofisiolab.pt belongs to Osteopatia & Fisioterapia Lab Afonso Pedroso, Lda, trading under the name OSTEOFISIO lab. The entity is responsible for the processing of personal data collected through the website and its contact channels, for the purposes described in this policy.
Address: Praça de Alvalade, no. 7, 11th floor left, 1700-036 Lisbon.
Email: geral@osteofisiolab.pt.
Telephone: +351 960 369 032 (call to a Portuguese mobile network).
Contact for data protection matters: Afonso Pedroso, via geral@osteofisiolab.pt. The clinic has not formally appointed a Data Protection Officer.
This policy covers browsing the website, requests for information and appointments, and contacts initiated by users, including through the form, email, telephone and WhatsApp. It does not replace the specific information provided to patients regarding the processing of data in connection with their clinical care.
Depending on the channel used and the request submitted, the clinic may process the user’s name, telephone number, email address, message content and any information required to respond to and appropriately handle the request. The contact form includes a free-text field in which users may describe their case. Such a description may reveal health-related data, which requires enhanced protection.
When browsing the website, website technologies may process the IP address, cookie identifiers, device and browser data, pages visited, source of the visit and interactions with the website. Cookies and similar technologies are described in the Cookie Policy.
Please provide only the information that is necessary. In forms and on WhatsApp, avoid sending medical reports, examinations, clinical photographs or detailed descriptions of your health. If clinical documentation needs to be provided, please contact the clinic to arrange an appropriate method of transmission. Do not send personal data relating to other individuals unless you have a lawful basis for doing so.
Responding to requests and arranging appointments: the data required to respond, provide information and arrange an appointment request is processed in order to take steps at the request of the data subject prior to entering into a contract, or for the performance of the contractual relationship, pursuant to Article 6(1)(b) of the GDPR.
Healthcare: where the referral or provision of healthcare requires the processing of health data, the conditions set out in Article 9(2)(h) and Article 9(3) of the GDPR also apply, including the duty of professional secrecy or confidentiality. Acceptance of a privacy policy does not replace these conditions, nor does it constitute general authorisation for any use of health data.
Legal obligations: processing that is necessary for compliance with tax, accounting and other legal obligations applicable to the clinic’s activities is based on Article 6(1)(c) of the GDPR.
Security and protection of legal rights: processing that is strictly necessary to protect the website, prevent misuse and establish, exercise or defend legal claims may be based on legitimate interests, pursuant to Article 6(1)(f) of the GDPR, following a balancing of the rights and interests of the data subject. Where health data is involved, an additional applicable condition under Article 9 is required.
Statistics, usage analysis and advertising: the use of non-essential cookies and equivalent technologies is subject to consent, in accordance with applicable legislation. Please refer to the Cookie Policy for details of the relevant categories and services.
Promotional communications: a request for information or an appointment does not, in itself, constitute consent to receive advertising or promotional communications. Where consent is requested for promotional communications, such consent must be separate, optional and specific. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal or the provision of healthcare services.
Requests submitted through the website forms are received by the clinic and may be accessed by the Clinical Management team and Reception in order to respond to and appropriately handle those requests. The clinic also has access to its WhatsApp Business account. Access to personal data must be limited to those professionals and staff members who require it in order to respond to the request, manage the relationship with the patient or provide healthcare services, subject to the applicable duties of confidentiality and professional secrecy.
Contact concerning the website hosting service is managed through the clinic’s marketing support. Providers of website maintenance, communications, administrative and clinical management services and IT support may also be involved, to the extent required for the performance of their respective functions. Where they process data on behalf of the clinic, such processing must be governed by appropriate contractual arrangements and instructions in accordance with the GDPR. Information may also be disclosed to the competent authorities where required by law.
The analytics and advertising services identified in the Cookie Policy may receive browsing data in accordance with the user’s choices. Data entered in form fields, particularly health-related descriptions, must not be sent to advertising or behavioural analytics tools.
The website includes links to social networks and a WhatsApp contact feature, as well as content such as Google Maps. When accessing an external service, the relevant provider may process data in accordance with its own policies. The use of those channels is the user’s choice; contact by telephone or email remains available.
The use of international service providers may involve the processing of data outside the European Economic Area. Where the clinic is responsible for such a transfer, a valid transfer mechanism must be put in place, such as an applicable adequacy decision or Standard Contractual Clauses accompanied by any required supplementary measures. Information concerning recipients and the specific safeguards applicable may be requested via geral@osteofisiolab.pt.
Personal data is retained only for as long as necessary for the purpose for which it was collected, taking into account the nature of the request, the duration of the relationship with the patient, applicable legal obligations and the limitation periods relevant to the establishment, exercise or defence of legal claims.
Requests for information with no subsequent relationship: data is retained only for the period required to respond to the request, complete the requested follow-up and resolve any matters related to that request. Where a clinical relationship is subsequently established, the necessary data will form part of the relevant clinical record and will be subject to the retention rules applicable to the provision of healthcare.
Clinical, tax and accounting documentation: such documentation is retained for the periods required by law and by the applicable professional obligations. The termination of the relationship with the patient does not, in itself, require the deletion of documents that must legally be retained.
Data processed on the basis of consent: such data is retained until consent is withdrawn or until it is no longer required for the purpose for which consent was given. A record may be retained where strictly necessary to demonstrate that consent was given, withdrawn, or that an objection to further communications was made. The duration of cookies is separate from the retention of data within the systems of the relevant service providers.
Subject to the conditions and limitations set out in the GDPR, you may request access to your personal data, its rectification or erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and to direct marketing communications. Where processing is based on consent, you may withdraw your consent at any time.
Please send your request to geral@osteofisiolab.pt. You may be asked to provide only the information strictly necessary to verify your identity and protect your data against unauthorised disclosure. A response will generally be provided within one month. Where the law permits an extension of this period, you will be informed of the reason for the extension and of the new deadline.
The right to erasure is not absolute: certain data may continue to be retained where retention is required by law or where the data is necessary for the establishment, exercise or defence of legal claims. You may also lodge a complaint with the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados, via www.cnpd.pt.
Processing requires technical and organisational measures appropriate to the level of risk, including access controls and measures to protect confidentiality. No electronic communication method is entirely risk-free; avoid transmitting detailed clinical information through general contact channels.
Where a request concerns a minor, contact should be made by the minor’s legal representative, without prejudice to the rules applicable to the rights of minors and the provision of healthcare.
This policy may be updated to reflect changes to the website, the services or applicable legislation. The current version will be made available on this page together with its corresponding date. An amendment to this policy does not permit the expansion of a purpose that is subject to consent without obtaining the required consent.
