A carregar…
A carregar…
This English text is a convenience translation. The European Portuguese version governs services offered in Portugal, subject to mandatory law.
Text last updated:
CareBridge Connect, Unipessoal Lda., Portuguese company number 519 640 870, is the controller where it determines the purposes and means of processing. Geographic address: Avenida Alexandre Herculano, 29, 1.º D, 2955-112 Pinhal Novo, Portugal.
Address: Avenida Alexandre Herculano, 29, 1.º D, 2955-112 Pinhal Novo, Portugal.
Privacy contact: privacy@carebridgeconnects.com.
Required data is identified in forms. Missing necessary information may prevent an application from being verified, an account from being created or a service from being arranged. A client or representative does not need to provide qualifications, NISS, insurance, a CV or professional registration merely to request support, unless a specific obligation applies to their role.
Consent can be withdrawn at any time. Withdrawal does not affect the lawfulness of earlier processing.
We collect only information needed to assess needs and arrange the service safely. Do not send full clinical reports where a limited description is sufficient.
Health data for needs assessment and care arrangements is based on explicit consent from the individual or lawful representative under Articles 6(1)(a) and 9(2)(a) GDPR. Any other legal basis must be identified.
Access is limited to authorised people who need it for their roles, including authorised clinical reviewers and the professional responsible for the service. Administrative staff access only what their tasks require.
Where data concerns children or represented people, we verify representation as applicable.
Withdrawing consent may prevent a service that depends on this information, subject to legally required retention.
Criminal-record data is processed only where legally authorised under Article 10 GDPR. Where possible, only the result, date and validity are retained and the full copy is deleted when no longer needed.
Data may be provided by the individual, their representative, the booking organisation, the professional or competent verification bodies.
We share only necessary data with the client, organisation or professional involved in a booking; authorised reviewers; technology, payment, communications, support and security providers; confidential advisers; and authorities or regulators where legally based.
Processors are subject to contractual data-protection duties. Some recipients may act as independent controllers for their own processing.
Current production uses the Supabase project located in us-east-1 (North Virginia, United States), including the database and Storage for uploaded files. The agreed EU-hosting configuration is a migration target, but the migration and final acceptance are not complete; the platform must therefore not be described as hosted exclusively in the European Union at present.
Payment, email, support and other providers may process or access data outside the European Economic Area.
International transfers must use an adequacy decision or appropriate safeguards such as standard contractual clauses, with supplementary measures where necessary. Moving to the approved EU configuration requires migration, database and Storage testing, confirmation of subprocessors, transfers, backups and rollback, and acceptance before the current configuration is retired.
You may request information about providers, countries and safeguards from privacy@carebridgeconnects.com.
Incomplete needs assessments are deleted after 30 days. Assessments and needs records linked to completed services are retained for three years after service completion. The daily retention process is active in production and recent runs completed successfully; it deletes assessments and safety briefs covered by these periods.
These periods may be extended for complaints or incidents, legal obligations or the establishment or defence of rights. Data subject to a legal hold is not deleted until the basis ends.
This process does not prove deletion of every account, email, backup or historical Storage object. Other retention periods, deletion authority, legal holds and deletion across backups/Storage remain subject to the approved schedule and operational testing before they are described as complete.
You may request access, rectification, erasure, restriction and portability, object to processing and withdraw consent.
Send requests to privacy@carebridgeconnects.com. We normally respond within one month, subject to lawful limits and extensions. You may complain to the CNPD at www.cnpd.pt.
The platform uses automated checks to calculate assessment results, identify missing or expired documents and flag needs or risks.
These checks may temporarily prevent approval or access to bookings, or route a matter for review. Individuals may request human review and provide explanations through the administrative team.
Clinical decisions and review of flagged matters are made by authorised people. AI tools do not replace that responsibility. Clinical approval remains paused until appropriately registered, verified and authorised reviewers are in place; until then, clinical requests remain pending without booking or payment confirmation.
Any solely automated decision with legal or similarly significant effects requires a legal basis and specific safeguards, including information about its operation, consequences and challenge routes.
The following are implemented and tested in code and synthetic-data checks: role-based access control, multifactor authentication for administrative roles, protected connections, private document storage, provider encryption, audit logs and incident-management procedures.
Access is assigned by role and need. Encrypted backups covering the database and Storage, hosted recovery, an approved scanning provider, complete deletion across backups/Storage and an exercised operational incident response are not yet all configured, approved and tested in production.
Personal-data breaches are assessed and reported to the CNPD and affected individuals where legally required. Genuine document uploads and clinical approval remain suspended while those controls, providers, backups, deletion and review are completed and approved. Report suspected unauthorised access, loss or disclosure to privacy@carebridgeconnects.com.
For privacy questions or requests, contact privacy@carebridgeconnects.com.
You may complain to the Portuguese Data Protection Authority (CNPD) at www.cnpd.pt.
This Policy may be updated for changes to processing or legal duties. The current version and date are made available on the platform. Material changes are communicated where necessary.