Privacy Policy and Personal Data Protection Notice

1. What is this Privacy and Data Protection Policy?

This Privacy and Data Protection Policy establishes the terms under which Altura Psychology Studio ("Altura", "we", or "the Practice") processes the personal data of its clients in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Portuguese Data Protection Law – Law 58/2019
• Professional and ethical rules of the Portuguese Order of Psychologists (Ordem dos Psicólogos Portugueses – OPP)

This Policy explains what data we collect, how we use it, on what legal basis we process it, and the rights you may exercise.

2. What is personal data and what does data processing mean?

Personal data is any information relating to an identified or identifiable natural person, regardless of the medium (digital, written, audio, or image).

Examples include your name, contact details, identification numbers, clinical information, or any details relating to your psychological care.

Processing of personal data includes any operation performed on such data, whether automated or not: collection, storage, consultation, modification, transmission, or deletion.

3. Who is responsible for processing personal data?

The Data Controller is:

In some cases, data may be processed by third-party service providers (e.g., payment processors, scheduling platforms) acting as Data Processors, under GDPR-compliant contracts.

4. Does Altura have a Data Protection Officer (DPO)?

No. As a small professional practice providing clinical psychological services, the appointment of a DPO is not legally required.

Data protection compliance is maintained directly by the Data Controller.

5. What personal data do we collect and on what legal basis?

Altura collects different categories of personal data depending on the purpose:

5.1 Data collected for appointment scheduling

• Email address
• Phone number (optional)
• Appointment preferences
• Language preference

Legal basis: Consent (Article 6(1)(a) GDPR) when you provide the information voluntarily.

5.2 Data collected for billing

• Name
• Tax identification number (if invoice required)

Legal basis: Contractual necessity (Art. 6(1)(b) GDPR) and Compliance with legal obligations, including tax obligations (Art. 6(1)(c) GDPR)

5.3 Sensitive personal data (health and psychological information)

During psychological services, the psychologist collects clinical information for assessment and intervention. This includes:

• Psychological history
• Emotional and cognitive information
• Case notes and clinical records
• Information shared during sessions

Legal basis: Explicit consent for processing special category data (Art. 9(2)(a) GDPR), Provision of psychological care under professional secrecy obligations, and OPP ethical requirements for record keeping.

All clinical data is strictly confidential and handled in accordance with applicable laws and professional ethics.

6. For what purposes do we process your personal data?

We process your personal data exclusively for:

1. Providing psychological consultations
2. Managing appointments, communication, and follow-up
3. Maintaining clinical records as required by OPP
4. Issuing invoices and complying with legal obligations
5. Ensuring website and system security
6. Improving service quality

Your data will not be used for automated decision-making, profiling, or marketing without explicit consent.

7. How long do we keep your data?

We retain data only for the period necessary to fulfill the purposes for which it was collected or to comply with legal obligations.

• Clinical records: typically retained for 5 years, per OPP recommendations
• Billing data: retained according to Portuguese tax law
• Scheduling and communication data: deleted when no longer necessary

After the retention period, data is securely deleted or anonymized.

8. Are your personal data secure?

Yes. Altura implements technical and organizational security measures, including:

• Encrypted devices
• Secure, password-protected systems
• GDPR-compliant cloud storage
• Access limited solely to the treating psychologist
• Secure email and data transmission protocols

Clinical information is protected by professional secrecy and may not be disclosed except when legally required.

9. Do we share your personal data with third parties?

Altura does not disclose your personal data to third parties except:

• Service providers necessary to deliver the service (e.g., payment processors, scheduling platforms), all GDPR-compliant
• Legal authorities, only when required by law or court order
• Anonymous, non-identifiable information for clinical supervision, which is standard and ethically permitted

Clinical data is never shared without explicit written consent, except under legal obligation or imminent risk situations.

10. What are your rights as a data subject?

You may exercise the following rights under GDPR:

• Right of access to your personal data
• Right to rectification of inaccuracies
• Right to erasure (when legally permitted)
• Right to restriction of processing
• Right to data portability
• Right to object to certain processing activities
• Right to withdraw consent at any time

Some rights may not apply to clinical records where legal or ethical obligations require retention.

You may also lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD).

11. Can your data be used for purposes other than those stated?

No. If data processing is required for new or different purposes, you will be informed and consent will be requested when legally required.

12. What is considered a data breach?

A data breach is any accidental or unlawful incident that results in:

• Destruction
• Loss
• Alteration
• Unauthorized disclosure
• Unauthorized access to personal data

In the event of a breach, Altura will notify the CNPD and affected clients in accordance with GDPR requirements.

13. Contact Information

For questions or to exercise your rights: