8D Saúde · Assessment

Privacy policy

How we process contact details and answers to the client profile form.

Policy version: 14 October 2026 · English translation: 20 October 2026 · Applies to this form and its backoffice.

1. Form management and contact

2. Data collected

The form asks for your name and email address. A mobile number is required if you choose contact by phone or WhatsApp; it is optional for the other channels. If you choose contact by post, a postal address is required. The form also collects answers about your age group, profession and working routine, health insurance, wellbeing goals, nutrition, sleep, exercise, social life, motivation, the importance you place on health, supported habits, support preferences, indicative monthly investment as a percentage of your budget, availability, decision-making autonomy, and your preferred contact channel and times. You may optionally provide practical preferences or needs.

We store the submission date, the consent version, the score calculated from your answers, and the follow-up history recorded by the team. Some answers may reveal health-related information. This form does not ask for test results, diagnoses or clinical documents.

Hosting providers may process technical data such as IP addresses, dates, requests and errors. To limit abusive submissions, the application uses a protected representation of the IP address; it does not store the plain IP address in the rate-limiting table.

3. Purposes and legal basis

Your contact details and answers are used to understand the support you are seeking, prepare the presentation or conversation you have requested, and manage that follow-up. Submitting the form does not, by itself, authorise newsletters, third-party advertising or campaigns unrelated to this request.

Submission is based on your consent, given through a checkbox that is unchecked by default. Where answers reveal health data, explicit consent is requested to analyse them for these purposes. You may withdraw your consent by email without affecting processing that was lawful before withdrawal.

Technical data strictly necessary for security and operation is processed to protect the service and prevent abuse, on the basis of legitimate interest and subject to necessity and proportionality.

4. Scoring and the team's involvement

Answers produce a score and indicators of alignment with the support sought. The calculation considers answers about profession, priorities, habits, investment, availability and support preferences; answers providing insufficient information are excluded from the calculation.

These indicators help the team follow up. They are not a diagnosis, a clinical assessment or an automated decision about access to healthcare. You may request an explanation, correction of your data or a review by the team.

5. Access, providers and transfers

The backoffice requires an authenticated session and specific authorisation. Authorised team members can view answers and record contacts, notes and the outcome of the request.

The application uses Vercel for hosting and server execution, and Supabase for its database and authentication. This form's database is configured in Ireland. Providers use infrastructure and subprocessors that may involve processing outside the European Economic Area; the database location does not mean that all processing takes place exclusively within the European Union.

The clinic must ensure the safeguards applicable to these transfers, including data processing agreements and mechanisms provided for by the GDPR. You may request information about the safeguards actually adopted using the contact above.

Your data is not made available to the public. If you choose to communicate through WhatsApp or another external channel, that service's terms and practices also apply.

6. Data retention

Contact details, answers and notes should be retained while the request and requested follow-up remain active. Once the request is closed or consent is withdrawn, they should be deleted when no longer necessary, unless a legal obligation or a specific need to defend rights requires retention, with restricted access.

If you begin receiving care, the clinic must separately explain how data relating to that service is processed and retained. This form does not set retention periods for clinical records.

Records used to limit submissions are removed once they are more than one day old, the next time that check runs. Operational logs and any backups follow the providers' settings and cycles; deletion from backups may not be immediate.

7. Your rights and withdrawing consent

Where applicable, you may request access, rectification, erasure, restriction or portability, and object to processing based on legitimate interest. To exercise your rights or withdraw consent, write to info@8dlongevidade.pt. Proportionate identity verification may be needed.

You may lodge a complaint with the Portuguese Data Protection Authority (CNPD).

8. Cookies and browser storage

The application includes no advertising or audience analytics tools. Visitors' answers remain in the form's memory until submission. The application does not save them in persistent browser storage.

The backoffice uses session storage for authentication and local storage for the theme preference. Hosting may use technical security mechanisms and, where applicable, authentication for access to the hosting service. External links open their respective services only when you select them.

9. Using the assessment

Completing the form is voluntary. You may use the non-response options available. Submission requires a name, email address, valid answers to the questions shown and the stated consent. Without consent, you can contact the clinic directly without completing this assessment.

The assessment does not replace a consultation or establish whether a treatment is suitable. Any clinical decision requires assessment by the responsible professionals.

10. Updates and references

Material changes to the purposes or data used should be communicated and, where necessary, accompanied by renewed consent. The version applicable to a submission is recorded with the response.

References: General Data Protection Regulation, Vercel and Supabase.