PRIVACY AND PERSONAL DATA PROTECTION POLICY 

GUTFORLIFE Lda, with tax identification number (NIPC) 518932281, headquartered at Rua Vale da Ajuda nº84, 8ºB, 9000-116 Funchal (São Martinho parish, Funchal municipality), is the entity that owns the online healthcare provider Gut for Life – Gastrointestinal Pathology.

Under the GDPR, personal data is considered to be any information relating to an identified or identifiable natural person (the data subject). A natural person is deemed identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifiers (such as an IP address or cookies), or to one or more factors specific to that individual’s physical, physiological, genetic, mental, economic, cultural, or social identity. 

Gut for Life – Gastrointestinal Pathology, as a healthcare provider, collects different categories of data, including: 

​

• Identification data, such as your name, gender, date of birth, tax identification number, social security number, national health service user number, ID card number and its expiration date, or image; 

• Contact data, including, for example, phone number, email address, and physical address (city, postal code, country, district, municipality, parish) 

• Private life data, such as profession and employment status, family doctor, spouse’s name, father’s name, mother’s name (for example, in the case of minors), and information related to insurance or healthcare subsystems; 

• Third-party data, relating to individuals authorized to make decisions on your behalf or to be contacted in case of emergency; 

• Health data, including medical information and details about healthcare services you have received or will receive; 

• Payment data. 

• When you contact us; 

• When you establish a relationship with us in the context of healthcare service provision; 

• When you post comments or images on our social media pages; or 

• Whenever you send us personal information in any other way 

The collection of personal data is intended for the execution of contracts entered into with clients for the provision of healthcare services, prevention, diagnosis and/or delivery of medical treatments, and the management of administrative services, namely for the scheduling or rescheduling of appointments and treatments, billing, accounting and auditing, marketing communications and other commercial communications, quality control, statistical studies, gaining a better understanding of client preferences, as well as for contact purposes.

The legal bases for the collection of your personal data include the law, pre-contractual and contractual relationships, payment management, customer support, compliance with legal obligations, consent of the data subject, and legitimate interests. 

We may also process your data, with your consent, for the purpose of teleconsultations, publication of photographs or videos with the aim of promoting our activity both internally and externally, for example on social media, as well as for marketing purposes or sending newsletters. 

​

Personal data related to your health will only be processed by professionals bound by confidentiality obligations and only to the extent strictly necessary. 

We process and retain your personal data only for the period necessary to achieve the purposes for which it was collected, to respond to your needs and requests, or to comply with legal obligations, which may vary depending on the category of data. 

We may also retain some of your personal data to the extent necessary to manage or enforce our rights, namely through legal proceedings. 

In cases where the client has provided consent for the processing of personal data, we will retain the data in accordance with the consent given or until such consent is withdrawn.

We may rely on other companies for the provision of certain services, and we may transmit information and data of data subjects to third parties such as accounting and IT service providers, competent authorities, legal service providers, consultants, and others. We guarantee that, in such cases, these third parties will have limited access to the data subjects’ information, restricted solely to what is necessary for the execution of the contracted tasks, and that they are subject to the same confidentiality and secrecy obligations. 

​

Likewise, we may disclose your personal data when required by law, within the scope of judicial proceedings, or in the context of investigations into suspected activities. 

We have developed appropriate technical and organizational mechanisms and measures to ensure the confidentiality and secrecy of your personal information, taking into account that the data collected includes sensitive information under the GDPR, in order to guarantee a level of security appropriate to the risk and to protect personal data against destruction, loss, alteration, unauthorized disclosure, or accidental or unlawful access. To this end, we implement several measures such as restricted access to clinical records (whether in physical or digital format), the use of strong passwords, and the regular updating of antivirus software.

Furthermore, any staff member of Gut for Life – Gastrointestinal Pathology who has access to your personal data is subject to a duty of confidentiality and professional secrecy.

In accordance with the GDPR, data subjects may exercise, at any time, the right to information, access, rectification, erasure, and portability of their personal data, as well as the right to restrict or object to its processing, including the withdrawal of consent. To do so, you should contact us at geral@gutforlife.pt. 

​

Understand your rights: 

​

• Right to Information: You have the right to obtain clear, transparent, and understandable information about how we use your personal data. 

• Right of Access: You may access your personal data that we process and retain. In such cases, we will provide information regarding the personal data being processed. However, please note that the right of access is not unlimited and must be reconciled with data protection legislation (which may justify refusal, for example, when access could infringe the rights and freedoms of third parties) and healthcare legislation (for example, in cases where it can be unequivocally demonstrated that access to information could be harmful to the patient, the requested information may not be provided – therapeutic privilege). Access may also be granted through a physician if you so request. 

• Right to Rectification: You have the right to rectify your personal data without undue delay, provided that you were the one who initially provided the data, if such data is incorrect, outdated, or incomplete. 

• Right to Erasure/Right to be Forgotten: You may request the deletion of your personal data. However, please note that this is not an absolute right, as there may be legal grounds for retention, such as legally mandated retention periods or legitimate interests justifying the preservation of your personal data. 

• Right to Object: You may object to the processing of your personal data for reasons related to your particular situation. This may apply, for example, to processing for scientific, statistical, or historical research purposes, unless such processing is necessary for reasons of public interest. 

• Right to Withdraw Consent: You may withdraw your consent to the processing of your data at any time when such processing is based on your consent. Please note that the withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal. 

• Right to Data Portability: You have the right to receive the personal data that concerns you and that you have provided to a controller, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller. 

• Right to Restriction of Processing: You have the right to request the restriction of processing of your data in cases where you contest the accuracy of the data, if the processing is unlawful and you do not want your data to be erased but only limited, if the data are no longer necessary, or if you have exercised the right to object as mentioned above. 

• These rights, like any others, must be exercised reasonably and in good faith by the data subject. 

• By using our services, you agree to our Privacy and Data Protection Policy. 

• The Data Subject guarantees that the personal data provided to us is accurate and correct, and undertakes to notify us of any changes or modifications, assuming full responsibility for any losses or damages caused by the erroneous, inaccurate, or incomplete communication of their data. 

• We caution that when providing personal information online, there is a risk that third parties may intercept and use such information. For your privacy, we strongly recommend that you do not include sensitive or confidential personal data through our website or in emails sent to us. Should you choose to do so, any resulting breach or damage will be entirely your responsibility. 

• We also inform you that it is the responsibility of users of our social media pages to ensure that the devices and equipment used to access them are adequately protected against malware, computer viruses, and worms. Therefore, we recommend keeping your browser, operating system, and antivirus software up to date. 

• If you wish to contact us for information about your rights or to raise any questions regarding how we use your information, you should contact us at geral@gutforlife.pt. However, if you remain dissatisfied, you may contact the Portuguese Data Protection Authority (CNPD), whose contact details can be found at www.cnpd.pt. 

We may implement changes or updates to this Privacy and Personal Data Protection Policy at any time, and therefore we encourage you to review this document regularly. 

Date: 28/08/2025      

Management Signature: