Privacy Policy

1. Who is responsible for your data

The data controller is Isabella de Jesus Medici Pereira, a sole trader, tax number 326668438, operating at R. Nunes dos Santos 21 Lj 20, São Pedro do Estoril, 2765-546 Lisboa.

For any privacy question, or to exercise the rights described in section 7, contact isabellamedici@gmail.com.

2. What data we collect

It depends on what you do on the site.

• Booking request: name, mobile number, chosen services, preferred date and time, and any notes you write.
• Client account (optional): first and last name, mobile number, date of birth, an optional profile photo, and a 4-digit PIN. The PIN is never stored as you typed it — it is put through an irreversible process.
• Anamnesis form: name, email, mobile number, date of birth, occupation, answers to the clinical questions, and your signature drawn on screen. The clinical answers include health data (allergies, medication, pregnancy, diagnosed conditions, among others).
• Appointment record: whether you attended, amount paid and payment method (cash or MB WAY), filled in by the professional afterwards. The site never receives or stores bank card details.
• Internal notes: observations the professional writes about each client’s follow-up.

3. Why we use it, and on what legal basis

We do not use your data for advertising, we do not sell it, and we do not make automated decisions about you.

• Health data from the anamnesis form: used to assess whether a procedure is safe for you and to adapt the technique. The basis is your explicit consent (Art. 9(2)(a) GDPR), given in the checkbox at the end of the form. You may withdraw it at any time.
• Bookings and client account: used to schedule, confirm and manage your appointment. The basis is performance of the service contract (Art. 6(1)(b)).
• Payment and invoicing records: compliance with legal tax and accounting obligations (Art. 6(1)(c)).
• Internal follow-up notes: legitimate interest in service quality and continuity (Art. 6(1)(f)).

4. Who has access

Your data is consulted by the professional. Besides her, technical providers host or process the data on our behalf (processors), without being allowed to use it for their own purposes:

• Supabase — database and photo storage. Data is hosted in the European Union (Ireland).
• Vercel — hosting and running the site. Form processing runs on servers in the European Union (Ireland). Vercel is a US-based company and is certified under the EU-U.S. Data Privacy Framework, which covers any technical-support access from outside the EU.
• Google — if the professional has connected her calendar, your booking’s name, phone number and notes are created as an event in a private calendar in her Google account, for scheduling purposes. Google is likewise certified under the EU-U.S. Data Privacy Framework.

5. How long we keep it

• Anamnesis forms and health data: 5 years after submission. This period covers the window in which a reaction to a procedure could be linked to it.
• Client account and booking history: for as long as the account stays active. If you request deletion, we erase what we are not legally required to keep.
• Records with tax relevance: for the period required by Portuguese tax law.

6. Cookies

This site uses no advertising cookies and no traffic analytics tools such as Google Analytics.

We use only cookies essential to operation: the one keeping you signed in (30 days), a temporary 1-hour cookie letting you download the form you have just submitted, and the admin area session cookie. These do not require your consent, because the site cannot work without them.

The Google map on the contact page is external content that sets Google cookies. It is therefore only loaded after you allow it. If you decline, you can still open the address in Google Maps via the button — which only acts when you click it.

7. Your rights

At any time you may request: access to the data we hold about you, correction of inaccurate data, erasure, restriction of processing, portability (receiving your data in a machine-readable format), and objection to certain processing.

Where processing is based on your consent — as with health data — you may withdraw it whenever you wish, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, write to isabellamedici@gmail.com. We reply within one month at most.

If you believe your data is not being handled properly, you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the supervisory authority in Portugal.

8. Security

The connection to the site is encrypted. Client PINs are stored irreversibly, never in readable form. Access to the admin area requires authentication and is limited to the professional. Anamnesis forms can only be downloaded by someone with an admin session or, for one hour after submission, by the person who filled it in.

9. Changes to this policy

If this policy changes, the last-updated date at the top of the page is updated. Significant changes will be communicated to clients with an account.