Privacy Policy

Last updated: November 2026

Medabri – Sociedade de Medicina no Trabalho, Lda. respects your privacy and processes your personal data with rigour, transparency and security, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR) and applicable Portuguese law.

1. Data controller

Medabri – Sociedade de Medicina no Trabalho, Lda.
Tax number (NIPC): 504 979 574
Registered office: Largo da Cruzinha, Lote 29, Fração A, 2580-040 Abrigada, Portugal
Email: geral@medabri.pt
Telephone: +351 913 232 111 (call to a Portuguese mobile network)

Data Protection Officer (DPO): António David
Contact: geral@medabri.pt, marked “For the attention of the Data Protection Officer”.

2. What data we process

We only process the data needed for each purpose, namely:

Identification and contact data (name, telephone, email, address) of clients, patients, employees of client companies and people who contact us;
Professional data (employer, job title, workstation);
Health data, exclusively in the context of Occupational Medicine, Nursing and Health and Safety services and the care provided at our clinics;
Billing data of companies and patients;
Browsing data collected through cookies (see our Cookie Policy).

3. Purposes and legal bases

Providing Occupational Health and Safety services to client companies, including pre-employment, periodic and occasional examinations — compliance with legal obligations (Portuguese Law no. 102/2009 of 10 September, as amended) and performance of a contract;
Providing healthcare at our clinics and managing appointments — performance of a contract and provision of healthcare (Article 9(2)(h) GDPR);
Managing the DOMUS CARD programme — performance of a contract;
Answering requests for information and enquiries — pre-contractual steps or legitimate interest;
Billing and compliance with tax and accounting obligations — legal obligation;
Sending informational communications, only where consent has been given — consent, which may be withdrawn at any time.

4. Health data and confidentiality

Health data is processed exclusively by healthcare professionals bound by professional secrecy, or by people bound by a duty of confidentiality. In Occupational Medicine, the employer only receives the fitness-for-work certificate, without access to the worker’s clinical information.

5. Sharing of data

Your data is never sold or passed on for commercial purposes. It may only be disclosed:

To the employer, within the limits set by law (fitness-for-work certificate);
To public authorities, where required by law (for example, the DGS, ACT or the Tax Authority);
To service providers acting on our behalf (for example, IT hosting, laboratories or clinical software), bound by contract to ensure the security and confidentiality of the data;
To DOMUS CARD partner organisations, only to the extent needed to use the benefits.
To Google (Google Analytics), only if you accept statistics cookies, to measure website use in aggregate.

6. International transfers

Some service providers may process data outside the European Economic Area. This is the case with Google Analytics, used only if you accept statistics cookies: browsing data may be transferred to Google LLC in the United States.

These transfers take place under the EU-US Data Privacy Framework, recognised by the European Commission as ensuring an adequate level of protection, and, where applicable, under the standard contractual clauses approved by the Commission. We do not use Google Analytics for advertising purposes.

7. Retention

We keep data only for as long as needed for the purpose for which it was collected or for the period required by law. Occupational Medicine clinical records are kept for the periods set out in applicable legislation, and tax documents for the legal period of 10 years.

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction, portability and objection to processing, and withdraw any consent given, without affecting the lawfulness of prior processing. To do so, contact us at geral@medabri.pt.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) (www.cnpd.pt).

9. Security

We take appropriate technical and organisational measures to protect your data against loss, unauthorised access, alteration or disclosure.

10. Changes

This policy may be updated. The version in force is always available on this page.