This policy explains in practical terms what happens to the data you share with Clínica Prisma through the website, forms and Prisma Assistant. Information from a clinical appointment is also processed in accordance with the rules applicable to healthcare.
Last updated: 1 October 2026Who processes the data
The data controller is Prisma RBR, Clínica Médica e Dentária, Lda. (Clínica Prisma), NIPC 509112390, Rua Pêro Vaz de Caminha 19, 3030-200 Coimbra. For privacy enquiries, write to geral@clinicaprisma.pt.
What data we collect and why
- Contact and appointment requests: name, telephone number, email address where provided, reason for the request and preferred day or time, to respond, arrange the appointment and follow up on the request.
- Messages to the clinic: the data and content you choose to send, to provide information or answer your question.
- Website use: technical data necessary for operation, security and abuse prevention; measurement and advertising data only in accordance with your cookie choices.
- Provision of care: when you become a patient, the clinical data necessary for assessment, treatment and compliance with applicable legal obligations.
The reason for an appointment or a free-text message may reveal health information. Share only what is necessary to receive a response; do not send test results, clinical images or other sensitive data through the chat unless instructed by the clinic.
Legal bases for processing
We process contact and appointment requests to respond to steps requested before an appointment or within an established relationship; technical data necessary for website security and operation on the basis of legitimate interests or legal obligations, as applicable; and clinical data for the provision of healthcare, with the applicable safeguards and professional confidentiality. Non-essential cookies and marketing communications require consent where required by law, which you may withdraw with effect for the future.
Submitting an appointment request does not constitute consent to receive advertising. If you do not provide the necessary contact details, we may be unable to respond or arrange the appointment.
Prisma Assistant and artificial intelligence
Prisma Assistant is an automated channel for information and contact requests. It does not replace a healthcare professional, make diagnoses or confirm appointments. The clinic's team confirms availability, and clinical decisions are made by professionals.
To generate answers, questions and recent conversation context may be transmitted to an AI technology provider, OpenAI, through its API. The system attempts to conceal telephone numbers and email addresses sent in messages, but this filtering may not identify all personal or health data. Therefore, avoid including detailed clinical information in the conversation field. Data collected during the guided appointment request sequence (name, telephone number and preferences) is processed on the clinic's server for the request and is not included in that AI call; information about the reason for the appointment written in earlier messages may form part of the context sent.
For continuity, security and follow-up purposes, the clinic stores each conversation in a separate private file outside the publicly accessible area of the website. Detection of contact details in the text is automated and may fail; other personal or clinical data in the messages may remain in the record. The default retention period configured in the code for these files is 30 days, although the server configuration may specify a different period. After a period of inactivity, a copy of the conversation history may be emailed to the clinic for follow-up. Appointment requests sent to the clinic are processed for as long as necessary to manage them and meet applicable obligations.
The clinic does not use the AI API for solely automated decisions that have legal or similar effects on patients. According to OpenAI's documentation, data sent through the API is not used by default to train its models, but may be subject to that provider's retention and security rules. See OpenAI's information about API data.
Who we may share data with
Internal access is restricted to those who need the data to respond, manage requests and provide care. We use technical providers needed for hosting, email, forms, the AI assistant and website maintenance. Analytics and advertising services, such as tools managed through Google Tag Manager, Meta and Microsoft Clarity, may be activated according to your cookie choices. We do not sell personal data.
Where a provider processes data outside the European Economic Area, the clinic must ensure a valid basis for the transfer and appropriate safeguards under the GDPR. You may ask us for information about the recipients and safeguards applicable to your situation.
How long we retain data
We retain data only for the period necessary for its purpose and the applicable statutory retention periods. Contact requests and correspondence are kept for as long as needed to respond and manage the relationship; clinical records are subject to the retention obligations specific to healthcare. Prisma Assistant conversation files have a default retention period of 30 days, subject to the server's actual configuration. Emails sent to the clinic containing requests or conversation histories are subject to the retention arrangements applicable to the mailbox and the management of those requests. You may request information about the specific retention period for a category of data.
Security and children's data
We adopt technical and organisational measures to restrict access to data, protect records and reduce the risk of misuse. No transmission over the Internet is entirely risk-free; use the clinic's contact details to share clinical information that is not necessary for the initial request.
Where a request concerns a child, contact details must be provided by the child's representative or someone authorised to arrange the appointment. The child's health information is processed with the safeguards applicable to healthcare.
Your rights
You may request access to, rectification or erasure of your data, restriction of processing or data portability, and object to certain processing, subject to the terms and limits of the GDPR. Where processing is based on consent, you may withdraw it at any time without affecting previous processing. To exercise these rights, contact geral@clinicaprisma.pt. We may request additional information strictly necessary to confirm your identity if there are reasonable doubts; we do not automatically require a copy of your Citizen Card.
If you believe your rights have not been respected, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD). For more information about the legal framework, see the General Data Protection Regulation.
Changes to this policy
We may update this text when services, providers or applicable rules change. The date above identifies the published version. For the clinic's identification details and the website terms of use, see the Legal Notice.