Privacy Policy

Who we are

Isabel Martins, ENI, trading as IMM — Integrated Maternal Medicine ("IMM", "we"), tax ID (NIF) 257020861, of Rua Veneza 9, 2605-881 Casal de Cambra, Sintra, Portugal, is the controller of the personal data collected through the imm.care website and in the course of providing healthcare, training and digital products.

Healthcare consultations are registered with the Portuguese Health Regulatory Authority (ERS, Entidade Reguladora da Saúde) under no. EPSI48495.

For any privacy question, including exercising your rights, contact us at dpo@imm.care.

What data we collect

We collect only what each purpose requires. Depending on your relationship with us, we may process:

• Identification and contact data: name, email, phone, guardian address, date of birth and gender.
• Account data: sign-in credentials, email verification status and two-factor authentication settings.
• Booking data: chosen professional, consultation type, language, date and time, any notes you provide and, for bookings made without an account, the adult's and child's name and a contact email.
• Clinical and health data: information about the child and family, including date of birth, sex, blood type, allergies, conditions, medication, vaccinations, growth measurements, clinical notes and documents you send us.
• Purchase data: products bought, amounts, payment status and transaction identifiers. We never collect or store your card details.
• Communication data: messages sent through the contact form, eBook requests and a record of the emails we sent you.
• Technical data: the IP address and browser identification tied to your session, for security purposes.

Health data

Health data is a special category of personal data protected by Article 9 GDPR. We process it only where a specific ground applies:

• With your explicit consent, when you provide health information in a booking form or during family onboarding.
• For preventive medicine, diagnosis and the provision of healthcare under Article 9(2)(h), under the responsibility of professionals bound by professional secrecy.

Access to clinical records is restricted to healthcare professionals and authorised clinical staff who need that information to provide care.

Purposes and legal bases

• Booking and delivering consultations — performance of a contract and provision of healthcare.
• Maintaining the clinical record — legal obligation and provision of healthcare.
• Creating and managing your account — performance of a contract.
• Selling and delivering courses and eBooks — performance of a contract.
• Invoicing and tax compliance — legal obligation.
• Responding to contact form enquiries — pre-contractual steps or our legitimate interest in replying to those who contact us.
• Sending newsletters, educational content, and commercial communications about courses, products and services — consent, which you may withdraw at any time.
• Website usage statistics — consent, collected through the cookie banner.
• Platform security and abuse prevention — legitimate interest.

Who we share data with

We use service providers that process data on our behalf under data processing agreements:

• Stripe Payments Europe, Ltd. (Ireland) — payment processing.
• Amazon Web Services EMEA SARL (Luxembourg) — transactional and campaign email delivery.
• DigitalOcean / Amazon S3 (EU regions) — file hosting, including clinical documents.
• Google Ireland Ltd. — website usage statistics, if you allow them.
• Microsoft Ireland Operations Ltd. — optional professional calendar synchronisation (Microsoft 365), only if the professional connects their calendar. When connected, each booking sent to the calendar includes the date and time, the type of consultation, the name of the child and/or of the adult, the booking notes and, where provided, the address of the visit.

Video consultations are absent from that list: they run on servers IMM operates, audio and video are encrypted in transit, are not recorded, and are handed to no video-conferencing provider. All we keep of the call itself is a record of who joined, when, and what they consented to. The clinical notes the professional writes during the consultation go into the child's medical record, as they would for any other appointment.

We may also disclose data to public authorities where the law requires it.

International transfers

Our services are configured to process data within the European Economic Area wherever possible. If a provider processes data outside the EEA, the transfer only takes place with the safeguards required by Articles 44 to 49 GDPR. You can request information about those safeguards through the privacy contact given above.

How long we keep data

• Clinical records: kept for the periods required by applicable health legislation, which mandates extended retention even after an erasure request.
• Invoicing and purchase data: kept for the statutory tax retention period.
• Enquiries and leads with no follow-up: deleted or anonymised after 24 months.
• Email delivery logs: 12 months.
• Sessions and technical logs: 30 days.
• Cookie consents: 24 months, so we can demonstrate that consent was obtained.

Your rights

As a data subject you may request access, rectification, erasure, restriction of processing, portability and object to processing, and you may withdraw any consent previously given without affecting the lawfulness of processing carried out beforehand.

You can exercise these rights on the "My data" page of the website or by writing to dpo@imm.care. Every request is reviewed by a member of our team and answered within 30 days at the latest. We ask you to confirm your email address before we act on a request, so that we never disclose data to the wrong person.

If you believe your data is not being handled properly, you may lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

Security

We apply technical and organisational measures appropriate to the risk, including encrypted traffic, role-based access control, two-factor authentication for accounts with access to clinical data, logging of privileged access, and storage of clinical documents in private areas that are not publicly reachable.

Children

The care we provide is often directed at children. Children's data is provided and authorised by the holders of parental responsibility, who are also the audience for this policy. We do not create accounts directly with minors.

Cookies

Our use of cookies and similar technologies is described in detail in our Cookie Policy. No analytics or marketing cookie is set before you allow it.

Workshops and training

When you enrol in the «Cuidados Essenciais ao Recém-Nascido» workshop, we collect your name, email, phone number, invoicing details and enrolment-form information to manage the booking, payment, invoicing and the session itself.

CHITAS, LDA (NIPC 516202812) is the contracting entity responsible for collecting and invoicing these enrolments. Dr Isabel Martins, owner of the IMM brand, and the session trainers may access the data needed to organise and deliver the workshop.

Payment is processed by Stripe Payments Europe, Ltd. We never collect or store your card details.

Changes to this policy

This policy may be updated. We keep a version history and show the effective version at the top of this page. Material changes will be communicated through our usual channels.