Privacy Policy

The website endodontics.pt and the portal portal.endodontics.pt (together, "the Platform") are operated by HSD, Lda., tax number 513381660, registered office at Vila do Conde, Portugal, represented by Dr. Hugo Sousa Dias, dentist registered with the Portuguese Dental Association (Ordem dos Médicos Dentistas, OMD) under professional licence no. 06201.

For any matter concerning your personal data, contact us at privacidade@endodontics.pt or by post at the address above.

This policy explains, transparently and in accordance with Articles 12 to 14 of Regulation (EU) 2016/679 (GDPR) and Portuguese Law no. 58/2019 of 8 August, which data we process, why, on what legal basis, for how long, and what your rights are.

2.1 Visiting the website

When you browse the website, the server records technical data needed to deliver pages and keep the site secure (IP address, date and time, pages requested, browser type). These logs are kept by the hosting provider for a short period to detect abuse and resolve problems. Legal basis: our legitimate interest in keeping the site secure and working (Article 6(1)(f) GDPR). We do not use analytics or advertising tools.

2.2 Appointment request

When you request an appointment through the website, we collect your name, phone number, email address, the clinic you choose and, if you provide it, a brief description of the reason. Please do not include detailed clinical information in this form. The request is forwarded to the chosen clinic, which contacts you to schedule the appointment, and we receive a copy for follow-up. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR). If you include information about your health, processing is based on your explicit consent and on the provision of health care (Article 9(2)(a) and (h) GDPR).

2.3 Education, information requests and pre-registrations

If you request information about a course, pre-register or express interest in mentoring, we collect your name, email, phone, country, professional licence number and your message. Legal basis: pre-contractual steps at your request (Article 6(1)(b)). With your consent, we add your contact to the "Interested in courses" list to inform you about future editions; you may withdraw consent at any time through the link in every message.

2.4 Newsletter

Subscribing to the newsletter requires double opt-in: you only start receiving messages after confirming your email address through the link we send you. Legal basis: consent (Article 6(1)(a) GDPR and Article 13-A of Law no. 41/2004). You can unsubscribe in any message or by writing to us.

2.5 Contact forms (education, lectures, industry)

We process your name, email and message to answer your request. Legal basis: our legitimate interest in replying to those who contact us, and pre-contractual steps. Please do not send clinical information through these forms.

2.6 Referral portal (portal.endodontics.pt)

The portal is intended for dentists who refer patients and follow their treatment. It processes data of registered dentists (name, professional licence, clinic, contact details, access logs) and data of referred patients (identification, contact details, tooth, symptoms, probable diagnosis, imaging, treatment reports), which are health data.

The referring dentist is responsible for informing the patient and obtaining their authorisation to share the data with Dr. Hugo Sousa Dias for treatment purposes, and declares this at the time of referral. Legal basis: provision of health care and management of health services by a professional bound by secrecy (Article 9(2)(h) and 9(3) GDPR; Article 29 of Law no. 58/2019), and performance of the referral relationship with the dentist (Article 6(1)(b)).

The portal has its own privacy notice and terms of use, presented at registration.

2.7 Published clinical cases (Case Atlas, Decision Room, videos)

Clinical cases and images published on the website are anonymised and are only published with the patient's specific written consent for educational purposes. No image contains a name, date or any element that could identify the patient.

We do not sell personal data or pass it on for third-party marketing. Data is processed by processors (database and website hosting, email sending and video playback), bound by contract under Article 28 GDPR.

The clinics where Dr. Hugo Sousa Dias practises receive the appointment requests addressed to them and process them as controllers for scheduling and care.

Some of these providers may process data outside the European Economic Area, in which case the transfer is protected by European Commission adequacy decisions or standard contractual clauses with any necessary supplementary measures. You may request a copy of the applicable safeguards.

We may also disclose data where the law requires it, to judicial or supervisory authorities or to the Dental Association.

• Appointment requests received through the website: deleted within 90 days of forwarding to the clinic; the clinical record is kept by the clinic as required by law.
• Information requests and pre-registrations: up to 24 months after the last contact, or until the related course is completed.
• Newsletter and interest list: until you withdraw consent.
• Contact forms: up to 12 months after the reply.
• Referral portal: for the legally applicable retention period for clinical documentation, set in the portal settings (by default, 10 years after the case is closed), after which cases are exported on request and deleted.
• Technical and audit logs: for as long as needed for security and accountability, no longer than 24 months, unless legally required.

Under Articles 15 to 22 GDPR you have the right to access your data, to rectify it, to request its erasure, to restrict or object to processing, to receive your data in a structured format and transmit it to another controller (portability), and to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to privacidade@endodontics.pt. We reply within one month, extendable by two further months in complex cases, and may ask you to confirm your identity. Some rights may be limited by legal obligations to retain clinical documentation.

You also have the right to lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, geral@cnpd.pt.

We apply technical and organisational measures appropriate to the risk: databases hosted in the EU with row-level access control, mandatory two-factor authentication for administration, clinical files in private storage accessible only through short-lived signed links, access audit logging, encryption in transit (HTTPS) and at rest, and full separation between the public website (which never stores patient data) and the clinical portal. Email notifications never contain clinical data.

The website and portal are intended for adults and health professionals. Appointment requests for minors must be made by their legal representatives.

We make no decisions based solely on automated processing with legal or similarly significant effects, and we do not profile you.

We may update this policy to reflect legal or Platform changes. The date of the last update appears at the top. Where changes are material, we will inform you on the website or by email.