1. Who we are
The Health Lab platform is operated by Santos & Balêcho, Lda, a company with tax number (NIPC) 518336417, registered at OneWorld Business Center, Rua dos Pocinhos 2, sala 470, 2655-241 Ericeira, Portugal. For the purposes of data protection law, Santos & Balêcho, Lda is the controller of the personal data collected through this website and the platform. Wherever "Health Lab", "we" or "our" is used, it means Santos & Balêcho, Lda as the entity operating the Health Lab brand. For any question about data protection, you can contact us at geral@health-lab.pt.
The conditions of use of the platform (plans, payments, cancellation and responsibilities) are in the Terms and Conditions, which complement this policy.
2. What this policy applies to
This policy applies in two contexts. First, to the data we collect when you express interest in the platform, through the early-access sign-up forms for individuals and for health professionals. Second, to the data you process on the Health Lab platform itself, when you create an account and use it to follow your health, including health data, which deserves reinforced protection and is dealt with in section 5.
The osteopathy and physiotherapy appointments advertised on this website are provided by Santos & Balêcho, Lda, at the Health Lab unit, licensed by the Portuguese health regulator (Entidade Reguladora da Saúde) under no. 27228. The clinical director is João Paulo Oliveira dos Santos, who is also the technical lead for Osteopathy (ACSS licence no. C-0032357); the technical lead for Physiotherapy is Tiago Alexandre Patrício Pereira (Portuguese Physiotherapists' Association, licence no. 734).
Appointments are booked through an external scheduling platform. Any records that come to be entered on the Health Lab platform are covered by this policy.
3. What data we collect
On early-access sign-up, we collect what you give us in the form: name; email address; telephone number and its country code; what brings you to Health Lab; and how you found us. In the case of health professionals, we also collect the area of practice and, when given, the number of patients followed and the software currently used. We record your consent through the date and time of sign-up and the date and time at which you confirmed it through the link sent by email. Beyond what you tell us, we automatically record the origin of the visit (the address that referred you to our site, the page on which you signed up and, when present, the campaign parameters in the address), which we use only to understand how people find us. We do not collect health data through these forms.
On creating and using an account, we collect: identification and authentication data (name, email and password, or the Google account data if you choose that method); date of birth; biological sex, which determines the applicable clinical reference ranges; and, optionally, gender identity. We also record your preferences in the application, namely the visual theme.
When you use the platform, the data you enter or authorise us to process is processed: records of habits and routines; follow-up metrics, such as weight, waist circumference, blood pressure, hours of sleep, resting heart rate or heart rate variability; answers to validated questionnaires, including mental health and stress instruments; laboratory results you upload, and the values extracted from those documents; other health documents you decide to keep; and notes and assessments recorded in the course of clinical follow-up.
If your account is created by a professional through the admission process, the initial data (including clinical history and reason for the appointment) is what you provide in that form.
4. What we use your data for and on what basis
To contact you about the launch and news of the platform, when you sign up for early access, by email, telephone and WhatsApp. We undertake not to send spam or unsolicited advertising. While the sign-up is not confirmed, we may send you up to three emails reminding you of that step; if you do not confirm it, the sign-up is marked as expired and is no longer contacted. The legal basis is your consent, under Article 6(1)(a) of the GDPR.
To provide you with the platform service: to create and maintain your account, keep your records, calculate consistency indicators and show you your history. The legal basis is the performance of the contract you enter into with us when you create an account, under Article 6(1)(b) of the GDPR.
To process your health data, under the conditions described in section 5.
To process payments, when you subscribe to a paid plan, and to meet legal invoicing and accounting-retention obligations. Your card details are handled directly by the payment provider and are neither accessible to nor stored by us.
To keep the platform secure and working, including technical access logs and error diagnostics, on the basis of our legitimate interest in protecting the service and those who use it, under Article 6(1)(f) of the GDPR.
You can withdraw consent at any time, without affecting the lawfulness of processing carried out up to that date.
5. Health data
Health data is a special category of personal data, with reinforced protection under Article 9 of the GDPR. We process it only with your explicit consent, given when you create an account and join the platform, under Article 9(2)(a). When processing takes place in the course of clinical follow-up provided by a health professional bound by professional secrecy, Article 9(2)(h) additionally applies.
You can withdraw this consent at any time. Doing so means you can no longer use the platform features that depend on this data, since they are the service itself.
Your health data is not used for advertising, is not sold, and is not shared with insurers, employers or third parties for purposes unrelated to providing the service. Access by health professionals is limited to those who follow you.
The platform does not replace medical advice. The information shown is intended for follow-up and health literacy and does not constitute a diagnosis or a prescription. In the event of a worrying symptom or an emergency, contact a health professional or the emergency services.
6. Use of artificial intelligence
When you upload a laboratory results document, the content of that document is sent to an artificial intelligence service, Anthropic, for the sole purpose of extracting the biomarker values and the collection date, sparing you manual entry. Under the terms of the service used, content sent through the programming interface is not used to train models.
This extraction is a reading aid, not a decision. The extracted values remain available for review and correction, and no decision with legal effects or that significantly affects you is taken solely by automated means.
7. Statistics and scientific research
We do not sell your personal data, under any circumstances, nor do we pass it to third parties for commercial or advertising purposes.
We may, however, use the data collected on the platform in aggregated and anonymised form (without name, without contact details and without any element that would allow it to be linked to you) to produce statistics, understand patterns of health and wellbeing among those who use the platform, improve the service, and for scientific research purposes, including the publication of articles and presentations.
Once effectively anonymised, this data ceases to be personal data and no longer allows you to be identified. We publish only aggregated results, never individual cases, and only about groups large enough that no result can be traced back to a specific person.
If we ever intend to use, for research purposes, data that allows you to be identified, even if only indirectly, we will first ask for your specific and separate consent for that purpose. You can refuse it without any consequence for the service we provide you.
8. How long we keep your data
Sign-up data: kept while you maintain consent and for the period needed for the purposes described. If you withdraw consent, or if you do not confirm the sign-up, the data is deleted or marked as expired and is no longer used for contact. In any case, we review the data kept within a maximum of 24 months.
Account and health data: kept while your account remains active. If you request deletion of the account, we delete your data from the production systems, except where there is a legal obligation to keep it (namely clinical records or documents with accounting and tax relevance), in which case we keep only what is necessary and for the period required. The clinical records of appointments provided at Health Lab are kept for 10 years after the last clinical act (for minors, counted from the age of majority), for defence in any dispute, under Article 21 of Portuguese Law no. 58/2019; at the end of that period, they are deleted or anonymised. The data you enter on the platform on your own initiative (habits, metrics, lab results and documents you upload) is not a clinical record of the clinic and is deleted when you ask. Backups are replaced cyclically, so deletion is reflected in them within the respective rotation cycle.
9. Who we share your data with
We do not sell your data or pass it to third parties for marketing purposes, as stated in section 7. We use service providers that process data on our behalf and under our instructions, under processing agreements: Supabase, which hosts the database, authentication and the files you upload, on servers located in the European Union (Frankfurt, Germany); Cloudflare, which hosts and delivers this website and the application and counts visits to the public pages, under section 13; Resend, which sends the service's emails, including confirmations, reminders and password recovery; Anthropic, under section 6; Stripe, which processes payments when you subscribe to a paid plan; and WhatsApp (Meta Platforms), when communication with you takes place through that channel.
Some of these entities are based outside the European Economic Area and may, to that extent, process data outside the EEA; in those cases, we ensure that appropriate safeguards under the GDPR are in place, namely standard contractual clauses approved by the European Commission. The database where your records are stored is located in the European Union.
10. Security of your data
We adopt technical and organisational measures appropriate to the risk, under Article 32 of the GDPR. Specifically:
In transit and at rest. All communication with the platform is encrypted over HTTPS, enforced by a strict transport policy; access over an unencrypted connection is not allowed. Data stored in the database and the files you upload are encrypted at rest by the infrastructure that hosts them.
Isolation between users. The database applies row-level security rules, active on every data table without exception, so that each person can only read and write their own records. Access to the files you upload is validated against your user identifier, preventing access to other people's documents even by direct manipulation of addresses.
Authentication. Passwords are managed by the authentication service in irreversibly encrypted form and are never accessible to us. Sign-in uses an authorisation flow with proof of possession, which avoids exposing credentials in the browser's address. Sign-in through a Google account is available, should you prefer not to manage one more password.
Infrastructure. We use professional hosting providers that maintain physical and logical security measures in their data centres, including access control, network segmentation and firewall protection, and monitoring against malicious traffic and denial-of-service attacks. Daily backups of the database are kept.
In the browser. The site is served with a restrictive content policy, which limits the origin of executed code and prevents the application from being embedded in third-party sites, reducing the surface for content-injection and overlay-fraud attacks.
Internal access. Access to user data is restricted to the people who need it to provide the service, through profiles with their own permissions. Keys with elevated privileges exist only on the server side and are never sent to the browser.
What we ask of you. Security is shared. Choose a strong password unique to this platform, do not share it with anyone, sign out on devices that are not yours and keep your device and browser up to date. If you suspect improper access to your account, contact us immediately.
Limits of what we can guarantee. We undertake to apply the measures described, to review them periodically and to adopt those that prove necessary as threats and the state of the art evolve. There is, however, no computer system that is completely immune: no measure entirely eliminates the risk of improper access, loss or unavailability. This acknowledgement does not remove the responsibilities the law assigns to us as controller, which we assume in full.
11. Data breaches
We have procedures to detect and respond to security incidents. Should a personal data breach occur, we notify the Portuguese data protection authority (Comissão Nacional de Proteção de Dados) within 72 hours of becoming aware of it, under Article 33 of the GDPR. When the breach is likely to result in a high risk to your rights and freedoms, we also inform you directly, without undue delay, describing what happened, the likely consequences and the measures taken, under Article 34.
12. Your rights
Under the GDPR, you have the right to: access your data; rectify incorrect or outdated data; request deletion of the data; restrict or object to processing; data portability; and withdraw consent at any time. You can exercise the right to portability yourself, at any time: in the application, under Profile → Export my data, you download a file with everything we hold about you, in a structured, machine-readable format. It is available on all plans, including the free one. To exercise the other rights, contact us at geral@health-lab.pt. We reply within one month, extendable under the law when the request is complex. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD), at www.cnpd.pt.
13. Cookies and local storage
This site does not use cookies. To know how many people visit the public site, we use Cloudflare Web Analytics, a visit-counting tool that uses neither cookies nor local storage, does not create a visitor identifier, does not follow you across sites and does not use the IP address to identify you. It records, in aggregate, the page visited, the site you came from, the type of browser and the country. It is active only on the public pages (presentation, services, contacts, this policy and the terms) and only on the page through which you enter: never inside the application, the admission form, invitation sign-up or the access pages, where there is no measurement at all. We do not use advertising cookies, social-network pixels or any other tracking technology, our own or third-party. For that reason, you are not shown a cookie consent request: there would be nothing to consent to.
The application uses your browser's local storage, which is not transmitted to us and which you can clear at any time in the browser settings, for three strictly functional things: to keep you signed in, so you do not have to enter the password on every visit; to remember that you have already seen a hint about using the interface, so as not to repeat it; and to remember that you dismissed the notice of a monthly report, so as not to show it again. None of these serves to identify you outside the platform or to follow your browsing.
Your account preferences (such as the visual theme) are kept in your profile in the database, not in the browser; they are therefore covered by the previous sections of this policy, including the right to export and to delete them.
Should tools that use non-essential cookies or that identify the visitor come to be used, this policy will be updated and, where required by law, your prior consent will be requested.
14. Changes to this policy
We may update this policy whenever necessary. The version in force is identified by the date and version number shown at the top. When changes are significant, we will seek to inform you through the available contact channels.
Controller: Santos & Balêcho, Lda · NIPC 518336417 · geral@health-lab.pt