This Privacy and Data Protection Policy describes how personal data is collected and processed in connection with the pedraem.casa website.

The controller of the personal data is:

Luís Magalhães, acting as a natural person and/or sole trader, as applicable, responsible for the activity carried out through the pedraem.casa project.

Contact for privacy and data protection matters:
[email protected]

This policy applies to the pedraem.casa website, to the forms made available on the site and to contacts initiated through the means indicated there, including, where applicable, communications by email, WhatsApp, Facebook Messenger, phone call, video call and the sharing of supplementary information related to the user’s request.

In connection with the operation of the site and contact initiated by the user, the following personal data may be processed, depending on the case:

• name
• country
• email address
• telephone number
• information about contact applications used by the user
• content of messages sent
• additional information that the user decides to provide voluntarily
• technical and usage data strictly necessary for the operation of the site, security and abuse prevention

Given the nature of the project, the user may also provide, entirely on their own initiative and by personal choice, health data and other potentially sensitive data, including clinical descriptions, symptoms, medical history, tests, reports, images, videos and other information related to their personal situation. Health data is sensitive data and benefits from full protection; it will not be made available in any circumstances to entities external to the pedraem.casa site without the sender’s full and express consent.

Unless otherwise stated, the provision of personal data is optional. However, data identified as necessary in order to respond to the request, make subsequent contact, issue invoices or comply with legal obligations must be provided so that the request can be properly handled by those receiving it within the pedraem.casa project. Failure to provide such data may prevent analysis of the contact, provision of the requested support, follow-up of the communication or compliance with applicable legal obligations.

The user should avoid sending data that is unnecessary, excessive or not relevant to their request.

As a rule, personal data is collected directly from the data subject and may be collected through:

• the contact form available on the website
• direct contact by WhatsApp
• direct contact by Facebook Messenger
• subsequent communications by email, message, phone call or video call
• the voluntary sending of documents, images, videos or other files
• technical means necessary for the operation and security of the site

If the user provides personal data relating to third parties, they must ensure that they have the lawful basis to do so and, where required, that the person concerned has been duly informed.

Personal data may be processed for the following purposes:

• receiving, analysing and responding to contact requests
• providing supplementary information about urinary stone disease and personalised support within the scope of the pedraem.casa project
• assessing the situation presented by the user and organising communication
• following up on support requests, including contact by message, phone call or video call
• managing the relationship with the user before, during and after the provision of support
• invoicing, accounting and compliance with legal obligations, where applicable
• defence of rights and management of complaints
• site security, abuse prevention and detection of automated or fraudulent submissions

Personal data is processed on the basis of the following lawful bases, as applicable to each situation:

• pre-contractual steps and performance of a contract, where processing is necessary to respond to the user’s request or provide the requested support
• compliance with legal obligations, namely in tax, accounting or rights-exercise matters
• legitimate interests, namely for security, internal organisation, abuse prevention, defence of rights and proper management of communications, provided that the rights and freedoms of the data subject do not prevail
• explicit consent, where special categories of data are involved, namely health data voluntarily sent by the user in order to frame the request or the support sought

Given the nature of the website and the support made available, the user may voluntarily communicate information relating to their state of health. Such processing will be limited to what is necessary to:

• understand the request submitted
• respond appropriately
• provide the supplementary support requested
• organise the relevant information transmitted by the data subject themselves

Where applicable, the processing of such data is based on the explicit consent of the data subject. Where processing is based on such consent, it must result from a clear and specific positive action for that purpose and may be collected or confirmed through a mechanism appropriate to the channel used. The voluntary sending of health information by the data subject does not prevent additional confirmation of consent from being requested whenever this proves necessary to reinforce transparency and proof of processing.

The pedraem.casa project provides supplementary support and does not replace medical care, diagnosis, treatment or clinical follow-up.

The service provided falls within the commercial activity registered under the Portuguese CAE number 96093: OTHER PERSONAL SERVICE ACTIVITIES N.E.C.

Personal data may be processed directly by the controller and, where necessary, by technology service providers or platforms used to enable contact and operation of the site, namely:

• FormSubmit, for form forwarding
• WhatsApp, if the user chooses that channel
• Facebook Messenger / Meta, if the user chooses that channel
• hosting, email, domain, security or technical support providers, where applicable

Where such entities act as service providers or processors, the data will be processed on behalf of the controller, in accordance with appropriate instructions from the controller and subject to duties of confidentiality and security compatible with applicable law.

Data will only be disclosed to third parties where this is necessary for the provision of the service, required by law, or authorised by the data subject.

Some of the service providers or platforms used may be located, or may process data, outside the European Economic Area. Whenever this occurs, the legally required safeguards will be adopted, such as European Commission adequacy decisions, Standard Contractual Clauses or other legally admissible mechanisms.

Personal data is retained only for the period necessary for the purposes that justified its collection and processing, and may be retained for a longer period where this results from:

• a legal obligation
• the need to defend or exercise rights
• the existence of an ongoing contractual or pre-contractual relationship
• the need to prove the consent given
• compliance with statutory limitation or expiry periods

In general:

• data relating to simple contact requests may be retained for the time necessary to manage the request and reasonable subsequent follow-up
• data associated with the provision of support, invoicing and compliance with legal obligations may be retained for the legally required periods or for as long as it is necessary for the defence of rights
• data processed on the basis of consent may be retained until consent is withdrawn, without prejudice to additional retention where another legitimate basis or legal obligation exists

Under the terms of the law, the data subject may request:

• access to their personal data
• rectification of inaccurate or incomplete data
• erasure of data, where legally applicable
• restriction of processing
• objection to processing, where applicable
• data portability, where applicable
• withdrawal of consent, where processing is based on consent

Requests must be sent to: [email protected]

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent previously given up to the date of withdrawal.

Unless otherwise stated in a specific situation duly communicated to the data subject, no decisions based solely on automated processing are made and no profiling with legal or similarly significant effects is carried out within the scope of the processing described in this policy.

The controller will respond within the legally applicable time limits, generally within one month, except in situations of special complexity legally permitted. The data subject also has the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD).

Appropriate technical and organisational measures are adopted to protect personal data against destruction, loss, alteration, disclosure or unauthorised access, taking into account the nature of the data processed, including the possible sensitivity of information communicated by the user.

However, no data transmission over the internet is completely risk-free, so the user should act prudently and send only the information that is strictly necessary.

The website and associated services are not specifically directed at minors. If data relating to minors is collected, this must occur within an appropriate framework and lawful basis, in accordance with applicable law.

The website may provide links to external services and platforms, such as WhatsApp and Facebook Messenger. Use of those services is subject to their respective privacy policies and terms of use, over which the controller of the site has no control.

This policy may be updated whenever necessary, with the most recent version being made available on the website.

Cookies are small text files stored on the user’s device when they visit a website. They may be used to ensure the technical operation of the site, remember preferences, enhance security or collect statistical and browsing data.

As at the date of this policy and based on the known technical configuration of this site file, no obvious Google Analytics, Google Tag Manager, Google Ads, YouTube, Google Maps, reCAPTCHA or similar advertising/analytics scripts are identified as forming part of the normal loading of this page. The file essentially shows technical elements of the site itself, a form forwarded through FormSubmit and links to WhatsApp and Facebook Messenger.

The site may nevertheless use cookies that are strictly necessary for its technical operation, security, session management, abuse prevention, content loading or correct form submission, including cookies that may be set by hosting, technical infrastructure or services strictly necessary for operation. If the site configuration comes to include cookies that are not strictly necessary, such use must be reflected and updated in this policy, together with the corresponding consent management mechanism, where legally required.

Strictly necessary cookies may be used without prior consent where they are indispensable to:

• provide functionalities requested by the user
• ensure site security
• allow forms to be submitted correctly
• prevent technical or automated abuse
• ensure the basic operation of the page

Where they exist, these cookies will be retained only for the period strictly necessary for the technical purpose concerned, and may take the form of session cookies, which expire when the browser is closed, or persistent cookies for a limited period, depending on the technical infrastructure used.

Whenever the site comes to use cookies that are not strictly necessary, including analytics, measurement, personalisation, remarketing, behavioural advertising or cookies integrating external services such as those of Google, those cookies should only be activated after the user’s prior, free, specific, informed and unambiguous consent. It must be possible to refuse and withdraw consent as easily as it was given.

Where applicable, the user may accept, refuse, review or change their choices through the consent management mechanism made available on the site. Whenever there is a panel, banner or equivalent link for cookie management, that mechanism should allow the user to reconfigure preferences and withdraw consent in a simple way. Blocking some cookies may affect the operation of certain functionalities.

If the site uses only strictly necessary cookies, a consent banner may not be displayed, without prejudice to the information contained in this policy.

If the site starts integrating third-party services that set cookies, namely Google, YouTube, Maps, reCAPTCHA, Meta or other analytics and marketing tools, such use will be described and updated in this policy, together with identification of the cookie category, purpose, provider and, where possible, respective retention period, as well as the applicable consent mechanism whenever legally required.

In a given technical configuration, the website may use services such as Google Analytics, Google Tag Manager, Google Ads, YouTube, Google Maps, reCAPTCHA, Meta or equivalent tools. These services may use cookies and similar technologies to collect information about use of the site, user preferences, performance, security and, where applicable, campaign measurement or abuse prevention.

Whenever these cookies are not strictly necessary, they will only be activated after the user’s prior consent. Refusal of consent does not prevent general access to the website, although it may limit functionalities dependent on those services.

The user may also manage, block or delete cookies through their browser settings. Menus may vary slightly depending on the version used, but as a rule the options can be found in the following paths:

• Google Chrome: Settings > Privacy and security > Third-party cookies and other site data, or Clear browsing data
• Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data
• Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
• Safari (macOS/iPhone/iPad): Preferences or Settings > Privacy > management of cookies and website data

If a consent management mechanism is available on the site itself, the user should also be able to use it to review choices and withdraw previously given consent.

Disabling strictly necessary cookies may compromise the correct operation of the site.