Privacy Policy

1. Data controller

The controller responsible for processing your data is Gesto Magnetizante, Lda. (tax identification number 518992381), the entity that operates The Journey MedSpa, with an establishment at Rua Raul Durão, Loja 8A, Lotus Living, Miraflores, 2795-251 Linda-a-Velha. Contact for privacy matters: geral@thejourneymedspa.pt.

2. Data we collect through the website

• Contact form: name, mobile number, contact preference, email (if provided), area of interest and message (if provided).
• Direct contact by telephone, WhatsApp (+351 935 752 824) or email: the data you choose to share.

Your message may contain information related to your health (for example, when describing a concern or intended treatment). This information is handled with enhanced confidentiality, only by the clinic team, and solely to respond to your request. For this reason, we ask for your explicit consent on the form. We suggest reserving clinical details for the consultation.

This website does not use tracking cookies or third-party analytics tools (see Cookie Policy). Patients’ clinical data is processed outside the website within the healthcare relationship, with the applicable legal safeguards.

3. Purposes and legal grounds

• Responding to your contact or booking request: pre-contractual steps (Article 6(1)(b) GDPR) and, regarding any health data you choose to include in your message, your explicit consent (Article 9(2)(a) GDPR).
• Following up your request: legitimate interest in responding to contact initiated by you (Article 6(1)(f) GDPR).

We do not carry out profiling or automated decision-making, and we do not use your data for marketing without separate consent.

4. Retention

Contact messages are kept for the time needed to respond and follow up the request, for a maximum of 12 months after the last contact. If you begin a healthcare relationship with the clinic, the legal retention periods for health records apply.

5. Sharing

We do not sell or transfer your data. It may be processed by technical service providers (website hosting and email service), bound by duties of confidentiality and data protection. Transfers outside the EEA, if any, comply with GDPR safeguards.

6. Your rights

You may exercise the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent at any time via geral@thejourneymedspa.pt. You may lodge a complaint with the CNPD (cnpd.pt). Questions concerning the healthcare establishment may also be addressed to the ERS (ers.pt).

7. Security

We apply appropriate technical and organisational measures, with enhanced attention to the sensitive nature of health information.

8. Changes

This policy may be updated; the date of the latest version appears at the top.