Virtual Assistant Privacy Policy

Last updated: 20 October 2026

This policy explains how PR Médicos processes personal data when you use the virtual assistant available on our website. The assistant is an automated program: it answers questions about our clinics and receives appointment requests. It does not replace a clinical assessment and should not be used to share health information.

1. Who is responsible for your data

The data controller is P. R. Médicos, Prestação de Cuidados de Saúde Oral Lda, tax no. (NIPC) 504381784, with its registered office at Rua Dr. Luís de Sá, n.º 10 B/C, Santo André, 2830-511 Barreiro, Portugal, which operates the PR Médicos clinics:

• Quinta da Lomba: Rua Dr. Luís de Sá, n.º 10 B/C, Santo André, 2830-511 Barreiro · +351 212 168 719 · geralbrr@prmedicos.com
• Baixa da Banheira: Rua de Moçambique, n.º 9, Baixa da Banheira · +351 216 011 264 · geralbxb@prmedicos.com

For any question about your personal data, contact us using the email addresses above or in person at one of the clinics.

2. What data we process

When you chat with the assistant:

• the text of the messages you write and the assistant’s replies;
• a random conversation identifier, which does not identify you personally;
• the clinic you mention, if you mention one;
• the date and time of the messages.

Before storing messages, the system automatically replaces numbers with 6 or more digits (such as phone numbers, tax numbers or health service numbers) and email addresses with [número] and [email].

When you send an appointment request through the form:

• name;
• phone number;
• email address (optional);
• preferred clinic;
• reason for the appointment, in a few words;
• preferred day and time (optional);
• your permission to be contacted.

Technical data: your IP address is used only momentarily, in memory, to limit the number of messages and protect the service against abuse. It is not stored in the database. Our hosting provider keeps technical server logs for a maximum of 7 days. These logs do not contain the text of the conversations.

What we don’t ask for: the assistant does not ask for health data, tax numbers, health service numbers, insurance numbers, documents or photos. Please do not share them in the conversation. If you need to deal with a clinical matter, contact reception or book an appointment.

3. What we use the data for and on what legal basis

Purpose	Legal basis (GDPR)
Answering your questions about the clinics (opening hours, addresses, services, insurance, appointments)	Steps taken at your request prior to entering into a contract (Art. 6(1)(b)) and legitimate interest in providing information to patients (Art. 6(1)(f))
Handling your appointment request and contacting you to confirm it	Steps taken at your request prior to entering into a contract (Art. 6(1)(b)). If the reason given reveals health information: Art. 9(2)(h)
Forwarding the conversation to reception when you ask, when the assistant cannot answer, or in a possible emergency	Legitimate interest in the quality and safety of our service (Art. 6(1)(f)). In an emergency: protection of vital interests (Art. 9(2)(c))
Service security and abuse prevention	Legitimate interest (Art. 6(1)(f))
Improving the assistant’s answers (internal review of conversations, with numbers already masked)	Legitimate interest (Art. 6(1)(f))

We do not use your data for advertising or sell it to third parties.

4. Automated decisions

Replies are generated automatically, but the assistant does not make decisions with legal or similarly significant effects on you:

• it does not book or refuse appointments, because confirmation is always given by a member of the reception team;
• it does not make diagnoses.

If your message contains words that may indicate an emergency (for example, severe pain, facial swelling, difficulty breathing or swallowing, injury or bleeding), the assistant shows a fixed message with our contact details, the Portuguese health line SNS 24 and the emergency number 112, and alerts reception.

5. Who we share data with

We use these service providers (processors), who process data only on our behalf and on our instructions:

• Google (Gemini API): generates the assistant’s replies. It receives only the latest messages in the conversation, with numbers and emails already masked. Data may be processed outside the European Economic Area, under the safeguards provided for in Articles 45 and 46 GDPR (EU–US Data Privacy Framework and/or standard contractual clauses). Under the terms applicable to EEA users, Google does not use this data to improve its products.
• Render: hosts the service and the database, on servers in the European Union (Frankfurt, Germany).
• Google (email): the clinic’s email service, where reception receives alerts and appointment requests. Data may be processed outside the European Economic Area, with the same safeguards as above.

Data may also be disclosed to the authorities where required by law.

6. How long we keep the data

Data	Period
Conversations with the assistant	Deleted automatically 90 days after the last message
Appointment requests in the assistant system	Deleted automatically 90 days after submission
Alert and appointment request emails received by reception	3 months
Technical server logs	Up to 7 days
Server backups	Up to 30 days

If the appointment request leads to an appointment, your data will then be processed as part of your clinical record, in accordance with the clinic’s general Privacy Policy.

7. Data stored on your device

So that the conversation continues when you change page, the assistant stores in your browser:

• a random conversation identifier (localStorage), which is kept until you clear your browser data;
• the text of the current conversation (sessionStorage), deleted when you close the tab.

This data is strictly necessary for the service you requested to work and is not used for advertising or to track your browsing. The assistant does not use advertising or analytics cookies. You can delete it at any time in your browser settings.

8. Your rights

Under the GDPR, you have the right to:

• request access to your data, and its rectification or erasure;
• request restriction of processing;
• object to processing based on legitimate interest;
• receive your data in a structured format (portability), where applicable;
• withdraw your consent, where processing is based on it, without affecting processing already carried out.

To exercise these rights, contact us by email (geralbrr@prmedicos.com or geralbxb@prmedicos.com) or in person at one of the clinics. We will reply within one month.

Conversations are anonymous. To find yours, we may need you to tell us the approximate date and time and part of the text. For an appointment request, your name and phone number are enough.

You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt.

9. Security

We use an encrypted connection (HTTPS) and automatic masking of numbers and emails. Access to the internal dashboard is restricted to the reception team and password-protected. Data is deleted automatically within the periods stated.

10. Minors

The assistant is intended for adults. Requests concerning minors should be made by parents or legal guardians.

11. Changes to this policy

We may update this policy, for example when the assistant becomes available on WhatsApp. The date of the last update is shown at the top of this page.