Privacy Policy — Vertical Medicine
Last updated: [PUBLICATION DATE]
Vertical Medicine provides sports and mountain medicine. We handle health information every day and protect it as seriously as medical confidentiality. This policy explains, in plain language, what data we process, why, for how long and what your rights are, under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese Law No. 58/2019 of 8 August.
1. Data controller
- Entity: Vertical Medicine
- Tax no. (NIF): [NO.] · ERS registration: [NO.]
- Address: Rua N. Senhora da Maia, 131, 4470-204 Maia, Portugal (Art Gym Medicine Project)
- Privacy contact: +351 913 944 449 (call to a Portuguese mobile network) or in person at the address above
- Data Protection Officer: [name and contact, if appointed]
Consultations take place at Art Gym Medicine Project, which shares its premises and a multidisciplinary team with us. When an Art Gym Medicine Project professional is involved in your care, that entity processes your data as a controller [or joint controller under Article 26 GDPR — to be confirmed in the agreement between both entities].
2. What data we process
When you contact us through the contact form or by phone: name, email and phone number; discipline, reason for contact, goal date and your message; any health data you choose to share; and, if you agree, your consent to receive news, events and information from Vertical Medicine.
When you fill in the pre-consultation travel medicine questionnaire: identification and contact details, including date of birth, biological sex and an emergency contact; trip details (destination, dates, activities, altitude, organisation); health data (previous experience at altitude, medical history, medication, allergies, vaccinations, fitness and habits and, where applicable, women’s health); and any test results you choose to attach (PDF or image).
When you are our patient: identification and contact details, tax number and billing details; health data collected during consultations (history, examination, tests, ultrasound images, treatment plans) that form your clinical record; health insurance details, where applicable.
When you visit the website: technical data needed for operation and security (IP address, browser type, date and time), processed by our hosting provider; your language and cookie preferences; aggregated usage statistics, only if you allow them (see the Cookie Policy).
Please share only the clinical information needed to prepare your consultation.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering your request and scheduling a consultation | Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) |
| Preparing your travel medicine consultation from the pre-consultation questionnaire | Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) |
| Sending you news, events and information from Vertical Medicine, only if you agree | Consent (Art. 6(1)(a) GDPR; Art. 13-A of Portuguese Law 41/2004), which you can withdraw at any time |
| Providing healthcare: diagnosis, treatment, rehabilitation, expedition preparation | Performance of a contract (Art. 6(1)(b)) and provision of healthcare by professionals bound by confidentiality (Art. 9(2)(h) and 9(3) GDPR; Art. 29 of Law 58/2019) |
| Keeping clinical records, invoicing and meeting tax and regulatory duties | Legal obligation (Art. 6(1)(c)) |
| Keeping the website secure and working | Legitimate interest (Art. 6(1)(f)) |
| Measuring website use in aggregate | Consent (Art. 6(1)(a)), given in the cookie notice |
| Running mountain medicine education sessions | Performance of a contract (Art. 6(1)(b)) |
We never sell your data or use it for third-party advertising. We only send you news if you have agreed to it, and never based on your health data. We do not carry out automated decision-making or profiling.
4. Health data and confidentiality
Health data is processed only by healthcare professionals or people under an equivalent duty of confidentiality, and access is limited to those involved in your care. Under Portuguese Law No. 12/2005, your health information belongs to you and you have the right to know it.
5. Who we share data with
Only what is necessary, and only with: professionals of the multidisciplinary team (Art Gym Medicine Project) involved in your care; processors acting on our instructions under contract (Art. 28 GDPR) — Vercel Inc. (hosting), FormSubmit (delivery of the contact form and the pre-consultation questionnaire, including attachments, to our email), Google/Gmail (email), [clinical management and billing software — to be added]; authorities where the law requires it; laboratories, hospitals or other clinicians when needed for your treatment and with your knowledge.
6. Transfers outside the European Economic Area
Some providers (Vercel, Google, FormSubmit) may process data in the United States. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or on standard contractual clauses (Art. 46 GDPR) with supplementary safeguards.
7. How long we keep data
Contact requests and pre-consultation questionnaires that do not lead to a consultation: up to 12 months after the last contact. Contact details for news: until you withdraw consent. Clinical records: for the period required by applicable law and professional rules. Invoices: 10 years under tax law. Cookie choices: 6 months. Server logs: as set by our hosting provider for security purposes [to be confirmed]. After that, data is deleted or anonymised.
8. Your rights
You can access, rectify, erase (unless the law requires us to keep it, as with clinical records), restrict, object to and port your data, and withdraw consent at any time without affecting earlier processing. Call +351 913 944 449 or speak to us in person; you can also stop receiving news at any time in the same way or by replying to any message. We reply within one month, extendable as set out in Art. 12 GDPR. We may ask for proof of identity.
You may also lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa · www.cnpd.pt.
9. Security
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), restricted access to health data, strong authentication, backups and staff confidentiality training.
10. Children
The website is not intended for children under 13. Healthcare for minors is provided with the consent and involvement of parents or legal guardians, as required by law.
11. Changes
We may update this policy to reflect legal or service changes. The date of the last update is always shown at the top, and we will flag significant changes on the website.
12. Other information
Electronic Complaints Book: www.livroreclamacoes.pt · Health Regulatory Authority (ERS): www.ers.pt