Privacy Policy

The controller of personal data processed through this website is AURORAMED, LDA (NIPC 518380211), Rua Domingos Xavier Pereira, Número 3, 4º C, Olhão, Portugal.

Privacy contact: hello@auroramed.pt

Data Protection Officer: reachable at hello@auroramed.pt

This policy covers the public website auroramed.pt and email correspondence with AuroraMed addresses.

It does not cover AuroraMed's clinical products (such as ARGUS and ARGUS-RON). Processing of patient or clinical data in those products is governed by the contracts and data processing agreements signed with each healthcare institution.

The website has no user accounts, no forms and no analytics. Personal data is processed in two situations.

a) Visiting the website. Our web server automatically records each request in its logs: your IP address, the date and time, the page or file requested, the response status, the referring page and your browser's user-agent string. We use these logs to keep the site running, to detect and investigate attacks and abuse, and to diagnose errors.

b) Emailing us. If you write to hello@auroramed.pt (or any other AuroraMed address), we receive your email address, your name if you include it, and whatever the message contains. We use this to reply and to handle your request. You are not required to give us any personal data. Without an email address we cannot reply. Please do not send patient or other health data by email.

We do not sell personal data, use it for advertising, or make automated decisions about you.

• Server logs: our legitimate interest in operating a secure, working website (Article 6(1)(f) GDPR).
• Emails: our legitimate interest in answering the people who contact us (Article 6(1)(f)); where you personally ask us to enter into a contract with you, taking steps at your request before entering into it (Article 6(1)(b)).

The website sets no cookies and stores nothing in your browser.

It loads no third-party scripts, fonts or embeds; all assets are served from auroramed.pt. Links to LinkedIn, Instagram, Facebook and other external sites are ordinary links. Those services receive data from you only if you click through, and their own privacy policies then apply.

We use the following service providers, which process data on our behalf under their data processing terms:

Google receives data only if you email us. Browsing the website sends nothing to Google.

We may also disclose data where the law requires it (Article 6(1)(c) GDPR), for example to a court or a competent authority.

Website logs stay in the EU.

Email handled by Google may be processed outside the European Economic Area, including in the United States. Such transfers are covered by the EU–US Data Privacy Framework, under which Google LLC is certified, and by the European Commission's Standard Contractual Clauses included in Google's data processing terms. Google's Cloud Data Processing Addendum, including the Standard Contractual Clauses, is available at cloud.google.com/terms/data-processing-addendum; the Data Privacy Framework list is at dataprivacyframework.gov/list.

• Server access and error logs: about 15 days. Logs are rotated daily and the oldest file is deleted after 14 rotations. The error log is rotated only on days it records something, so its entries may be kept longer: an entry is deleted after 14 further days on which errors were logged.
• Emails: we keep correspondence for as long as we need it to deal with your enquiry and any follow-up. Where it leads to a business relationship, we keep it for the length of that relationship and as long as the law requires afterwards (Article 6(1)(c); for example, accounting records). We delete correspondence that no longer serves any of these purposes.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectification of inaccurate data;
• erasure of your data;
• restriction of processing;
• portability of data you gave us, where processing is based on contract.

You have the right to object at any time to processing based on our legitimate interest, on grounds relating to your particular situation. This covers both server logs and emails.

To exercise any of these rights, email hello@auroramed.pt. We may ask you to confirm your identity. We answer within one month, or up to three months for complex requests, in which case we tell you within the first month.

Because server logs record only an IP address and keep it for about 15 days, we may be unable to link log entries to you. To ask about them, tell us your IP address and the date and time of your visit.

You may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, geral@cnpd.pt, www.cnpd.pt, or to the supervisory authority of the EU country where you live or work. Applicable law is Regulation (EU) 2016/679 (GDPR) and Lei n.º 58/2019.

We update this policy when the website or our processing changes. The date at the top shows the latest version.