Privacy Policy

The controller of your personal data is:

Name

Ode Therapy — Odenildo Pereira

Phone

+351 926 560 206

As a small business, we have not appointed a Data Protection Officer. For any question about your data, please use the contact details above.

We only process the data needed to book and provide sessions:

• Contact details: name, email and phone number.
• Booking details: service, date and time, session type, price, any voucher or pack used and, for home visits, the address, postal code and town.
• Packs: the pack requested, the pack code and the sessions used.
• Anything you choose to share in the notes, such as preferences or information about your health.
• Testimonials: the name you give, your rating and your comment.
• Minimal technical server data (IP address, date and time of the request), used for security and to prevent abuse.

To adapt the session safely, you may want to tell us about contraindications, injuries, pregnancy or other conditions. This is special category data (GDPR Article 9) and is only processed with your explicit consent, which you give by sharing it and accepting this policy. It is used only by the therapist to prepare and record sessions and is never shared with third parties.

You don’t have to share health information to book. You can withdraw your consent at any time by asking us to delete it; this does not affect processing already carried out.

• To manage booking requests, confirmations, changes and cancellations.
• To manage pack and gift voucher requests and record the sessions used.
• To contact you about your booking (email, phone, SMS or WhatsApp).
• To prepare and follow up sessions, including any health information you share.
• To meet legal obligations, such as invoicing.
• To publish testimonials, only once approved and with your consent.
• To keep the website secure and prevent abuse.

• Performance of a contract or steps taken at your request before entering into one (GDPR Article 6(1)(b)): bookings, packs and related contact.
• Explicit consent (Article 9(2)(a)): health information you choose to share.
• Consent (Article 6(1)(a)): publishing testimonials and loading Instagram content.
• Legal obligation (Article 6(1)(c)): invoicing and keeping accounting records.
• Legitimate interests (Article 6(1)(f)): website security and preventing abuse.

• Bookings, pack requests and related contact details: up to 5 years after the last session, for managing our relationship, history and any complaints.
• Invoicing records: for the period required by Portuguese law (currently 10 years).
• Health information: until you ask us to delete it or, at most, 2 years after your last session.
• Testimonials: while they are published or until you ask us to remove them.
• Technical server logs: for a short period, only as long as needed for security.

We don’t sell or hand over your data. We only use service providers that process data on our behalf (processors), with the safeguards required by the GDPR:

• The hosting provider of the server that runs the website and database.
• The email delivery provider, when confirmations are sent by email.
• The SMS and WhatsApp provider (for example, Twilio), when messages are sent.
• Meta Platforms (Instagram), only if you load the Instagram posts on the website; WhatsApp, only if you choose to contact us that way.
• Public authorities, where required by law.

Some of these providers may process data outside the European Economic Area (for example, in the United States). In those cases, transfers rely on the safeguards provided by the GDPR, such as adequacy decisions or standard contractual clauses approved by the European Commission.

The website uses no advertising or analytics cookies. It only stores necessary technical preferences:

• Your chosen language (NEXT_LOCALE cookie).
• Light or dark theme (ode-theme cookie and local storage).
• Instagram posts are only loaded after you click “Load Instagram posts”; from then on, Meta may set its own cookies under Meta’s privacy policy.

Under the GDPR you can, at any time:

• Access your data and get a copy.
• Ask us to correct inaccurate or incomplete data.
• Ask us to erase your data (“right to be forgotten”), unless the law requires us to keep it.
• Ask us to restrict processing.
• Receive the data you gave us in a structured format (portability).
• Object to processing based on legitimate interests.
• Withdraw any consent you gave, without affecting processing already carried out.

To exercise these rights, use the contact details shown on the website. We reply within one month.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD — www.cnpd.pt).

We use encrypted connections (HTTPS), password-protected access to the management area and backups, and we limit access to data to what is strictly necessary. If a data breach poses a risk to you, we notify the CNPD and, where required, the people affected, as the law requires.

Complaints Book: you can file a complaint in Portugal’s electronic Complaints Book (Livro de Reclamações).

Alternative dispute resolution: in a consumer dispute, consumers may turn to an alternative consumer dispute resolution body. More information on the Portuguese Consumer Portal (www.consumidor.gov.pt).

We may update this policy when the website or the way we handle data changes. The date of the last update is shown at the top of the page.