2. Contact form

2.1 Contact form / information request.

→ Data: name, email, message. → Purpose: to respond to the request and assess service suitability. → Legal basis: data subject’s consent (Art. 6(1)(a) GDPR) → Retention: 6 months after the last contact, unless the person becomes a client

2.2 Client data

→ Data of clients in ongoing support → Data: name, contact details, health data, clinical notes, assessment results. → Purpose: delivery of the contracted psychological service. → Legal basis: performance of the contract and compliance with legal and ethical obligations (Art. 6(1)(b) and (c) and Art. 9(2)(h) GDPR). → Retention: 5 years after the case is closed, as required by professional ethics.

2.3 Browsing data (technical cookies).

→ Data: IP address, browser type, pages visited, time of visit. → Purpose: technical operation of the website and anonymous statistical analysis. → Legal basis: legitimate interest (Art. 6(1)(f) GDPR) → Retention: session, or up to 13 months (analytics cookies with consent).

3. Special categories

Health and psychological data collected in the clinical-support context constitute special- category data under Art. 9 GDPR. Their processing is based on Art. 9(2)(h) (provision of healthcare) and is carried out under professional confidentiality.

4. Sharing

Personal data is not sold, transferred or shared with third parties for commercial or marketing purposes. Data is shared only in the following limited cases: → clinical supervisor: (anonymised data, within mandatory professional supervision) → technical service providers (web hosting, email) under a GDPR data-processing agreement, with no access to clinical data → Apublic authorities where legally required (court order, CNPD, tax obligations).

5. Int’l transfers

Data is stored on servers located within the European Union. Should any technical service require transfer to a third country, it will be carried out on the basis of the safeguards provided in Art. 46 GDPR (standard contractual clauses or a European Commission adequacy decision).

6. Security

Appropriate technical and organisational measures are applied to the nature of the data processed, including encryption at rest and in transit, access control and a minimal-retention policy. In the event of a personal-data breach posing a high risk to data subjects, the CNPD (Portuguese Data Protection Authority) is notified within 72 hours and data subjects are informed without undue delay.