Legal information
This document explains what personal data we process, for what purposes, on what legal basis, how long we keep it and who has access to it. It also sets out the rights you have and how to exercise them.
It applies to anyone who visits this site, contacts the clinic by any means or is a patient of ours. Some of the information we process is health data, which is subject to reinforced protection under Article 9 of the General Data Protection Regulation (RGPD) and Law no. 58/2019 of 8 August.
Contents
The controller is Couto e Jesus, Lda., company registration no. 514 531 592, with registered office at Rua da Cabeleireira 37, Faíscas, 3140-033 Arazede, which operates the healthcare units trading under the name Jesus Mar Couto, registered with the Portuguese Health Regulatory Authority (ERS) under no. E138849.
This site, drgoncalojesus.pt, is a professional page of Dr. Gonçalo Jesus. The data collected through it — in particular the data from the booking and referral forms — is processed by the company identified above, as part of the activity of its healthcare units.
For any question about data protection, including the exercise of your rights, you may write to [email protected] or go to either of our clinics.
Name, telephone contact, e-mail address, reason for contact and whatever you write in the message field. Only these fields are needed for us to contact you. We ask that you do not include detailed clinical information in the form: that is collected at the consultation.
Identification and billing data, clinical and general health history, medication, allergies and relevant medical background, clinical observations, diagnoses, treatment plans, estimates, and the diagnostic investigations carried out or provided — radiographs, cone beam computed tomography (CBCT), intraoral and extraoral photographs, models and three-dimensional scans.
Identification and professional contact details of the referring dentist, and the clinical and imaging data transmitted to us concerning the patient under their care.
Technical browsing data strictly necessary for the operation and security of the page, including server logs. If you consent, usage statistics are also collected through analytics cookies, in accordance with section 14.
| Purpose | Lawful basis |
|---|---|
| Responding to your request and booking the assessment consultation | Pre-contractual steps at your request — Article 6(1)(b) |
| Providing dental care, including diagnosis, surgery and rehabilitation | Performance of the contract for the provision of care — Article 6(1)(b); as regards health data, Article 9(2)(h) and 9(3) |
| Complying with legal obligations on clinical records, invoicing and tax | Legal obligation — Article 6(1)(c); as regards health data, Article 9(2)(h) |
| Communicating with you about your treatment, by telephone, e-mail or message | Performance of the contract — Article 6(1)(b) |
| Assessing and responding to cases referred by other dentists | Legitimate interest in collaboration between professionals — Article 6(1)(f); as regards clinical data, Article 9(2)(h) and 9(3) |
| Ensuring the operation and security of this site | Legitimate interest in the security of systems — Article 6(1)(f) |
| Measuring use of the site through analytics cookies | Your consent — Article 6(1)(a), and Article 5(3) of Law no. 41/2004 |
| Using clinical images for teaching, publication or case presentation | Only with your express, specific, informed and revocable consent — Article 6(1)(a) and Article 9(2)(a) |
| Defending rights in judicial, arbitral, disciplinary or regulatory proceedings | Legitimate interest in the defence of rights — Article 6(1)(f); as regards health data, Article 9(2)(f) |
References are to the GDPR unless otherwise stated.
We do not sell or pass on your data to third parties for commercial purposes, and we do not use it for behavioural advertising or profiling. The use of clinical images to publicise the clinic's activity is described in section 6 and always depends on your consent.
Health data is a special category of personal data, subject to Article 9 of the GDPR, to Law no. 58/2019 and to Law no. 12/2005 of 26 January, which governs health information. The clinical information in your record belongs to you; the clinic is its custodian and is responsible for keeping it safe and secure.
All dentists and other professionals who access this information are bound by professional confidentiality, under the Code of Ethics of the Portuguese Dental Association (Ordem dos Médicos Dentistas), and access is limited to those who need it in order to care for you.
When a dentist refers a case to us through the referral form, they transmit to us clinical data relating to a patient under their care. In that situation:
Image and DICOM files: we ask that examinations be sent without unnecessary identifying elements. DICOM files may contain patient identifiers in their metadata, such as name and date of birth — worth bearing in mind when sharing examinations through any channel.
The photographs, radiographs and scans taken as part of your treatment form part of the clinical record and are processed for diagnosis, planning and recording the progress of the case. Your consent is not required for that purpose: the basis is the provision of health care.
The use of those images outside the clinical context — to publicise the clinic's activity on this site or on social media, in presentations to professionals, in training or in scientific publications — always depends on your consent, given in writing, specifying the purposes and channels involved.
You can contact us by telephone, e-mail, through the forms on this site or via WhatsApp.
| Data | Period | Why |
|---|---|---|
| Clinical record and diagnostic investigations | Minimum of 20 years, counted from the last recorded clinical act | Article 30 of the Code of Ethics of the Portuguese Dental Association (Ordem dos Médicos Dentistas), which requires individual clinical records to be kept on file for at least that period |
| Invoices and supporting accounting documents | 10 years | Tax obligations |
| Contact requests that do not lead to a consultation | 12 months after the last contact | The period we consider necessary to resume contact and to demonstrate the response given; once it expires, they are deleted |
| Referred cases that do not lead to an individualised clinical assessment | 6 months after the request is closed | Once the preliminary analysis is complete, the need ceases |
| Referred cases with an individualised clinical assessment | Same as the clinical record | The assessment constitutes clinical documentation about an identifiable patient and follows the clinical records regime |
| Conversations on messaging channels | For as long as the clinical relationship lasts and they remain necessary for the follow-up of the case | Clinically relevant information is incorporated into the clinical record; conversations are deleted once they are no longer necessary |
| Consents for the use of images | For as long as they remain in force, and thereafter for the period necessary to prove that they were obtained | Demonstration of compliance — Article 5(2) of the GDPR |
| Server security logs | Up to 12 months | Detection and investigation of incidents |
Once these periods expire, the data is securely deleted or irreversibly anonymised. Where a dispute is pending, it is retained for as long as necessary to defend rights.
Within the clinic, only the professionals who need the information in order to care for you. Outside it, your data may be accessed by three distinct types of entity, under different regimes.
They act only on our instructions, under contracts binding them to confidentiality and security, in accordance with Article 28 of the GDPR:
They receive the data in the exercise of their own functions and are independently responsible for the processing they carry out:
Courts, health authorities, the Portuguese Dental Association (Ordem dos Médicos Dentistas) in disciplinary proceedings, the Portuguese Tax Authority and other public bodies, in the cases and on the terms laid down by law.
The specific identity of the providers referred to in points a) and b) may be requested through the contact given in section 1.
We seek to have your data processed within the European Economic Area. Some of the tools we use are, however, operated by companies whose groups may access data from third countries — in particular the WhatsApp channel and, if you consent to analytics cookies, the usage statistics tool.
In those cases, the transfer relies on the mechanisms provided for in Chapter V of the GDPR, specifically on adequacy decisions of the European Commission, where applicable, or on standard contractual clauses approved by the Commission, together with any supplementary measures that prove necessary.
You may request information about the safeguards applicable to each transfer through the contact given in section 1. If you prefer to avoid the WhatsApp channel, use the telephone, e-mail or the forms on this page.
We apply technical and organisational measures appropriate to the risk, including per-user access control, encryption of the site's communications, backups, storage in premises with restricted access and binding all staff to the duty of confidentiality.
In the event of a personal data breach, we assess the incident and take the measures necessary to contain and mitigate it. We notify the Portuguese Data Protection Authority (CNPD) and inform the people affected in the cases and within the time limits required by law, under Articles 33 and 34 of the GDPR.
You have the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw consent at any time, without this affecting the lawfulness of the processing already carried out on that basis.
The right of access includes the right to obtain a copy of your personal data held in the clinical record. The first copy is free of charge; a reasonable fee, corresponding to administrative costs, may be charged for additional copies. You may also obtain a written report on your clinical situation, under Article 31 of the Code of Ethics of the Portuguese Dental Association (Ordem dos Médicos Dentistas) and Law no. 12/2005.
If you wish, the clinical information can be explained to you by a dentist — this is an option we offer you, not a condition we impose on you. Access does not depend on that mediation, save in the exceptional situations provided for by law.
Erasure of the clinical record cannot be granted while the legal retention period runs, because the law requires us to keep it. The right to object does not apply to processing necessary to comply with legal obligations. In these cases, we inform you of the reasons for the refusal and of your right to lodge a complaint with the supervisory authority.
You also have the right not to be subject to decisions based solely on automated processing, including profiling. We do not take decisions of that kind: clinical decisions are always taken by a dentist.
To exercise any of these rights, write to [email protected]. We respond within one month, which may be extended under Article 12 of the GDPR. We may ask you for additional information where we have reasonable doubts about your identity.
There are three distinct issues here, each with its own rules:
This site uses two types of cookie.
They ensure the operation and security of the page and record your choice regarding the others. They do not require consent, as they are strictly necessary for the service you requested. You can block them in your browser, although this may affect features of the page.
| Cookie | Purpose | Duration |
|---|---|---|
| Cookie preference | Stores the choice you made in the cookie notice, so that we do not ask you again | 6 months |
| Session and security | Operation of the page and protection against abusive use | Session |
They measure use of the site in aggregate form — pages visited, time spent, device type and source of the visit — so that we can understand which content is useful. They are only installed after you consent to them, in the notice that appears on your first visit; until then, no analytics cookie is placed on your device.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Ireland Limited | Distinguishes visitors | 2 years |
| _ga_<ID> | Google Ireland Limited | Maintains session state | 2 years |
You can change or withdraw your choice at any time, by reopening the cookie preferences through the link in the footer of every page. Withdrawal takes effect for the future and does not affect browsing.
We do not use advertising or commercial profiling cookies, and the content of the forms — including any clinical information you write in them — is not sent to statistics tools.
If you consider that the processing of your data breaches the law, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt. Regarding the provision of health care, you may complain to the Portuguese Health Regulatory Authority (ERS) — www.ers.pt — or through the Electronic Complaints Book, at www.livroreclamacoes.pt. We would be grateful if you would first give us the opportunity to resolve the matter with you.
This policy may be updated. The version in force is always on this page, with its date and version number. Significant changes are communicated through the contact details we hold.