Privacy Policy

1. Identification of the Data Controller

The controller responsible for processing personal data collected through this Website is:

• Company: Brave Care, Unipessoal Lda.
• Portuguese company registration number (NIPC/NIF): 518 099 709
• Registered office: Rua dos Lusíadas, n.º 19, R/C Dto., 1300-366 Lisbon, Portugal (Alcântara)
• General contact: bravecaresaude@gmail.com
• Data protection contact: bravecaresaude@gmail.com

2. What Personal Data We Collect

We collect personal data provided directly by the user, namely through the forms made available on the Website, and data collected automatically while browsing. Depending on how the user interacts with the Website, we may collect the following categories of data:

2.1. Identification and contact data

When the user fills in the contact or information request form available on the Website, we collect name, phone number, location and the content of the message sent.

2.2. Health data

When the contact or information request relates to the provision of healthcare, the form may collect information about the patient's health status, clinical situation or care needs (for example, the type of care requested, an associated condition, or level of dependency). This data constitutes a "special category of personal data" under Article 9 of the GDPR and is processed with an enhanced level of protection.

Collecting this data always depends on the explicit, informed and freely given consent of the data subject (or their legal representative), given when the form is filled in, and is essential to allow the initial assessment of the request and the provision of the requested nursing care service.

2.3. Browsing data, IP address and cookies

Whenever the user visits the Website, our servers automatically record the IP address from which access is made, together with the date and time of the visit. The IP address is personal data and is used to ensure the security and proper functioning of the Website (detecting and preventing abusive or fraudulent access), for aggregated statistical analysis and, where applicable, to determine the user's approximate geographic location (at country or city level, never the exact address). The IP address is retained only for as long as necessary for these purposes and is not used to directly identify the user outside this context.

The Website may also use cookies and similar technologies to ensure its proper functioning, measure its audience and, where applicable, display advertising content. The user can manage their cookie preferences through the consent banner shown on their first visit to the Website and, at any time, through their browser settings.

2.4. Social media and external contact channels

The Website provides direct links to Brave Care's WhatsApp, email, Instagram, TikTok and Facebook, allowing the user to contact us through those platforms. By using these links, the user starts interacting directly with the relevant application or social network, subject to its own privacy policy and terms of use, over which Brave Care has no control. We recommend reading the privacy policies of WhatsApp, Meta (Instagram and Facebook) and the email provider used, before sharing personal data through those channels.

3. Purposes and Legal Basis for Processing

The personal data collected is processed for the following purposes, with the legal bases indicated:

• Responding to contact and information requests: taking pre-contractual steps at the data subject's request (Article 6(1)(b) GDPR).
• Assessing nursing care requests and providing the service: performance of a contract and explicit consent for processing health data (Articles 6(1)(b) and 9(2)(a) GDPR).
• Complying with legal and tax obligations: legal obligation to which Brave Care is subject (Article 6(1)(c) GDPR).
• Improving the Website and statistical usage analysis: user consent, where applicable to non-essential cookies (Article 6(1)(a) GDPR).
• Marketing communications and newsletter: consent of the data subject (Article 6(1)(a) GDPR).

4. Data Retention Period

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, except where a longer retention period results from an applicable legal obligation, namely tax and accounting requirements (generally 10 years) or nursing clinical records, subject to the profession's own legal and ethical retention periods. Contact data that does not result in a service being contracted is retained for 12 months, after which it is deleted or anonymised.

5. Recipients and Data Sharing

The personal data collected may be shared with:

• The nurses and other healthcare professionals who are part of the Brave Care team, strictly to the extent necessary to provide the requested care, and who are bound by professional secrecy and contractual confidentiality obligations.
• Service providers subcontracted by Brave Care for the operation of the Website and administrative activity (for example, website hosting, email or invoicing services), always acting as processors under Article 28 GDPR.
• Public entities or institutional partners, where required by law or necessary to provide the contracted healthcare service (for example, insurers, for the reimbursement of healthcare costs, subject to the data subject's authorisation).

Brave Care does not sell, rent or transfer personal data to third parties for direct marketing purposes unrelated to its activity.

6. International Data Transfers

Some of the service providers used by Brave Care (namely web hosting, email or social media services) may involve transferring personal data outside the European Economic Area. In such cases, Brave Care ensures that such transfers are carried out under legally recognised mechanisms, namely European Commission adequacy decisions or standard contractual clauses approved by the European Commission, under Chapter V of the GDPR.

7. Data Subject Rights

Under the GDPR, the data subject may, at any time, exercise the following rights:

• Right to information: to be informed, at the time of collection, of the purpose of processing, the controller, the recipients of the data, and which data is mandatory or optional.
• Right of access: to obtain confirmation that your data is being processed and to access it.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your data, where applicable.
• Right to restriction of processing: to request that processing be restricted in certain circumstances.
• Right to data portability: to receive your data in a structured format and transmit it to another controller.
• Right to object: to object to processing of your data for reasons related to your particular situation.
• Right to withdraw consent: at any time, without affecting the lawfulness of processing based on consent already given.
• Right to be informed of a data breach: to be notified if a security breach occurs that is likely to result in a high risk to your rights and freedoms, as described in section 9 of this Policy.

These rights can be exercised by contacting bravecaresaude@gmail.com. Brave Care will respond to the request within one month, extendable under the terms provided by law.

The data subject also has the right to lodge a complaint with the supervisory authority, the Portuguese national data protection authority (CNPD), at www.cnpd.pt.

8. Information Security

Brave Care adopts appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, namely access controls, encryption where applicable, and team training and awareness to comply with confidentiality and data protection obligations, particularly regarding health data.

9. Personal Data Breaches

In the event of a personal data breach (unauthorised or unlawful access, disclosure, alteration or loss of data), Brave Care undertakes to notify the CNPD within 72 hours of becoming aware of the breach, whenever it is likely to result in a risk to the rights and freedoms of data subjects, under Article 33 GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of individuals, Brave Care will also notify the affected data subjects without undue delay, under Article 34 GDPR, informing them of the nature of the breach and the measures taken or proposed to mitigate any negative effects.

Brave Care is not responsible for content accessed through hyperlinks that take the user outside the Website, where such hyperlinks are the responsibility of third parties. Unauthorised access, or an attempt at unauthorised access, to Brave Care's databases constitutes a breach of applicable law and may give rise to civil and criminal liability for the offender.

10. Cookie Policy

The Website uses cookies and similar technologies to ensure its proper functioning and improve the user's browsing experience. A cookie is a small text file that the user's browser stores when the Website is visited, allowing the device to be recognised on subsequent visits and browsing preferences to be retained, without, by itself, revealing data that directly identifies the user.

10.1. Types of cookies used

• Essential cookies: necessary for the basic functioning of the Website and safe browsing; these cannot be disabled.
• Functionality cookies: allow user preferences (such as language) to be retained between visits.
• Analytics cookies: help us understand how the Website is used, identify the most visited pages and detect technical errors, without revealing the user's identity.
• Third-party cookies: the Website may include cookies placed by third parties (for example, social sharing buttons for Instagram and Facebook), over whose placement and subsequent processing Brave Care has no control. We recommend reviewing the privacy policies of those platforms.

10.2. Managing cookies

On the first visit to the Website, the user is shown a cookie notice/banner allowing them to accept or reject non-essential cookies, on a granular basis, before they are installed. The user can also change their preferences at any time through that mechanism or their browser settings. Disabling certain cookies may affect the functionality or browsing experience of the Website.

11. Minors

Under Law no. 58/2019, of 8 August, the minimum age for giving independent consent to the processing of personal data in the context of information society services offered directly to a child is 13 years. The Website is not intended for the direct, independent collection of personal data from children under 13. Where a request for nursing care concerns a minor, the relevant personal and health data is only collected with the consent of the holder of parental responsibility or legal representative.

12. Changes to this Privacy Policy

Brave Care reserves the right to update this Privacy Policy whenever justified, namely due to legislative changes or changes to its own activity. The version in force is always the one published on the Website, indicating its update date.

13. Contact

For any question relating to this Privacy Policy or the processing of your personal data, you can contact Brave Care at: bravecaresaude@gmail.com.