Legal information
Privacy Policy
This policy explains which personal data Cosmo Clinic collects through this website and its contact channels, why, for how long, who it is shared with, and the rights you have over it.
1. Who is responsible for your data
The controller of your personal data is GOGO CLINIC, LDA (Cosmo Clinic), NIPC 518 708 950, with its establishment at Rua Filipe Folque, n.º 30, R/C C, 1050-113 Lisboa, Portugal.
For anything concerning your data, email info@cosmo-clinic.pt or write to the address above.
2. What we collect
Consultation request form. Your name, phone number and, if you give them, the treatment you are interested in and your message. Without a name and phone number we cannot answer the request; the other fields are optional. We also record the page you sent the request from, the date and time, and the consent you gave.
Forms in Facebook and Instagram ads. If you ask to be contacted through a form in one of the clinic's ads, we receive the name and phone number you enter and the record of the consent you give. Meta displays the form; if it is pre-filled with details from your profile, you can change them before sending.
Direct contact. Whatever you send us by phone, WhatsApp or email, including the number or address it came from.
Technical data. The provider that receives our forms logs the IP address and browser type to block automated and abusive submissions.
Browsing data. Cookies and similar technologies, only with your consent and as described in the Cookie Policy.
Clinical data. Data collected at the consultation and during treatment becomes part of your clinical record. That record is governed by the legislation on health records, not by this policy, which covers only the data collected through the website and the contact channels.
3. Health data
A consultation request at an aesthetic medicine clinic reveals, on its own, an intention to be treated. We therefore treat the request as data concerning health, a special category of personal data.
We do so only with your explicit consent, given in the box you tick before sending the form, on the website or in the ad (GDPR Article 9(2)(a)). You can withdraw that consent at any time; doing so does not affect the lawfulness of processing carried out before.
4. What we use the data for, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your request and booking the consultation | Name, phone, message, consent record | Consent (Article 6(1)(a) and Article 9(2)(a)) |
| Meeting legal obligations, including tax and accounting | Invoicing data | Legal obligation (Article 6(1)(c)) |
| Keeping the site secure and blocking abusive submissions | Technical data | Legitimate interest (Article 6(1)(f)) |
| Measuring site usage and advertising effectiveness | Browsing data | Consent, given in the cookie notice |
| Sending news by email | Separate consent, never pre-ticked |
We make no automated decisions with legal effects about you, and we do not sell personal data.
5. Who we share data with
We use providers that process data on our behalf, only for the purposes above and bound by contract:
- Formcarry (Teijal, Inc., USA): receipt and delivery of the forms sent through the website, under a data processing agreement. Some of its sub-processors, for email delivery and spam filtering, are in the USA.
- Google Cloud EMEA Limited (Google Workspace): the clinic's email, where we receive the form requests.
- bunny.net (BunnyWay d.o.o., Slovenia): hosting and delivery of the website.
- Google Ireland Limited: Google Analytics 4, only if you accept statistics cookies; Google Ads, only if you accept marketing cookies.
- Microsoft Ireland Operations Limited: Microsoft Clarity, only if you accept analytics cookies.
- Meta Platforms Ireland Limited: Meta Pixel, only if you accept marketing cookies; contact forms in Facebook and Instagram ads, if you use them; WhatsApp, if you choose to contact us that way.
- WATI (Clare.AI Limited, Hong Kong): management of the clinic's WhatsApp conversations and the website chat widget, which only loads if you accept WhatsApp chat in the cookie notice. The first replies on WhatsApp may come from a virtual assistant, which says so; the team always confirms bookings.
We may also disclose data to public authorities where the law requires it, including the Portuguese health regulator (ERS).
6. Transfers outside the European Economic Area
Some of these providers may process data in the United States or in Hong Kong. Such transfers rely on a European Commission adequacy decision, including the EU-US Data Privacy Framework for companies certified under it, or on the Commission's standard contractual clauses. You can ask us for a copy of the safeguards that apply.
7. How long we keep data
- Consultation request that does not lead to a consultation: 2 years from the date it was sent, unless you withdraw consent earlier.
- Request that leads to a consultation: becomes part of your clinical record, kept for the periods set by health legislation.
- Invoicing documents: 10 years, as required by tax law.
- Consent record: for as long as we keep the data it relates to.
- Cookie preferences: 6 months, in your browser.
At the end of the period, data is deleted or anonymised.
8. Your rights
You have the right to access your data, to have it corrected, to ask for it to be erased, to restrict or object to its processing, to receive it in a commonly used format (portability), and to withdraw consent at any time.
To exercise any of these rights, write to info@cosmo-clinic.pt. We reply within one month. We may ask you to confirm your identity before acting.
If you believe the processing breaches the law, you can lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt.
9. Security
The site is served over HTTPS only. Forms are delivered through the provider named in section 5 and are not stored on the website itself. Access to requests is limited to the people at the clinic who need to handle them.
10. Minors
Our services are for adults aged 18 and over. We do not knowingly collect data from minors through the website. If you become aware that a minor has sent us data, contact us so we can delete it.
11. Changes to this policy
Any change is published here, with the update date at the top of the page. If a change matters for data you have already given us, we will let you know through the contact you left.
Last updated: