Privacy Policy

Introduction

This Privacy Policy explains how Gigantone, Lda., the entity responsible for managing the Bwizer Health establishment, collects, uses and protects personal data in connection with the website, the provision of care, patient communications and post-appointment feedback.

Gigantone, Lda. processes personal data in accordance with Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR) – and other applicable legislation.

Data controller

The controller responsible for processing personal data is:

Gigantone, Lda. Company number: 515770647 Address: Estrada da Circunvalação 10381, 2.º Esquerdo, 4250-151 Porto, Portugal Email: info@gigantone.com Telephone: 933012483

Personal data collected

Bwizer Health may collect the following categories of personal data:

• identification and contact data, including name, email address and telephone number;
• appointment and consultation data necessary to provide and manage care;
• post-appointment feedback, including the one-to-five-star rating, optional comment, associated appointment and submission timestamps;
• information voluntarily provided through forms, information requests or communications;
• technical website usage data, such as IP address, device, browser, pages visited and time spent on the website.

Technical data may be collected through cookies or similar technologies. Where consent has been given, the website may use tools such as Google Tag Manager and Google Analytics for measurement and analytics.

Post-appointment feedback

After an attended appointment, Bwizer Health may send an optional feedback request. The response is linked to the appointment so that Bwizer Health can evaluate and improve the care provided, analyse quality trends, investigate reported situations and, where appropriate, contact the patient to better understand their experience.

Feedback may be accessed only by authorized staff as required for their roles. Participation is voluntary, and the decision to respond, or the rating provided, does not affect the patient's access to care.

The feedback form must not be used for urgent clinical requests, emergencies or highly sensitive medical information. Patients should use the appropriate clinical or emergency channels in those circumstances.

Purposes of processing

Personal data may be processed to:

• respond to contact or information requests;
• manage appointments, care and relationships with patients, users and prospective clients;
• send operational communications relating to services;
• collect, analyse and follow up on feedback to evaluate and improve the quality of care;
• contact patients to better understand a reported experience;
• send newsletters or informational communications where authorized;
• improve the operation, performance and security of the website;
• perform statistical analysis and manage measurement tools subject to consent controls.

Legal bases for processing

Depending on the purpose, processing is based on:

• the data subject's consent, including for newsletters and analytics tools where applicable;
• steps taken before entering into a contract, performance of a contract and management of the provision of care;
• compliance with legal obligations;
• Gigantone, Lda.'s legitimate interests in evaluating and improving services, following up on patient experience and protecting the website, after considering the rights and reasonable expectations of data subjects.

If a comment voluntarily includes health data, that data will be processed only to the extent necessary for the provision or management of care, by persons subject to confidentiality obligations, or under another applicable legal condition.

Newsletters and communications

Users may subscribe to electronic communications or newsletters through the field expressly provided. They may unsubscribe at any time using the link in the communication or by contacting Gigantone, Lda.

Data sharing and access

Access is limited to authorized staff who need the data for their roles. To operate the website, provide services, send communications and collect feedback, personal data may be processed by service providers acting as processors, including hosting, analytics, tag-management, communications and other technology providers.

These providers process data only on Gigantone, Lda.'s instructions and in accordance with the GDPR.

International data transfers

Some service providers may be located outside the European Economic Area. In those cases, Gigantone, Lda. ensures that the safeguards required by applicable law are in place.

Data retention

Personal data is retained only for as long as necessary for the purposes for which it was collected and to comply with legal obligations. Identifiable feedback is retained for as long as necessary to evaluate and follow up on quality of care, manage complaints or requests and establish or defend legal claims. It will then be deleted or anonymised where possible.

Data used for consent-based communications may be retained until consent is withdrawn, without prejudice to applicable statutory periods.

Data subject rights

Under the GDPR, data subjects may exercise, where applicable, the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Rights may be exercised using the contact details in this policy.

Data security

Gigantone, Lda. implements appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorized access or disclosure. However, no transmission or storage system is completely secure.

Complaints

Data subjects have the right to lodge a complaint with the competent supervisory authority. In Portugal, the authority is the Comissão Nacional de Proteção de Dados (CNPD).

Changes to this policy

Gigantone, Lda. may update this Privacy Policy when necessary. The current version and update date will be available on the website.