OnlySmile, owned by Netto & Alvarez Lopes Lda, respects your privacy and is committed to protecting the personal data of its clients and users, ensuring that its processing is done transparently, lawfully, and securely.
This Policy explains how we collect, use, and protect your personal information, in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese legislation.
1. Identification of the Data Controller
Responsible Entity: Netto & Alvarez Lopes Lda
VAT Number: 517437171
Headquarters: Rua de São Francisco, Nº 86, 9500-243 Ponta Delgada, Portugal
Contact Email: direcao@centromendes.com
Legal Representative: João Viveiros
2. Personal Data Collected
OnlySmile collects only the data strictly necessary for the provision of its clinical services and the management of the relationship with patients.
The following types of data may be collected:
- Identification data: full name, date of birth, tax identification number, user number, address.
- Contact data: phone, mobile, email.
- Clinical and health data: medical-dental history, diagnoses, exams, treatment plans, clinical images, and reports.
- Payment and billing data: IBAN, insurance details, policy number, or contracted entity.
- Browsing data and cookies: when using our website, technical information (such as IP address, browser type, or pages visited) may be collected in an aggregated and anonymous form.
3. Purposes of Processing
The personal data collected are processed for the following purposes:
- Clinical and administrative management of patients (scheduling, diagnosis, planning, and execution of treatments).
- Compliance with legal and tax obligations, namely issuing invoices, receipts, and clinical reports required by law.
- Communication with the patient, including appointments, reminders, sending results, or schedule changes.
- Management of insurance and health protocols, when applicable.
- Continuous improvement of services and patient experience, including satisfaction surveys and informative communications, with consent.
- Compliance with professional and ethical duties, namely those provided by the Order of Dentists and other competent entities.
4. Legal Basis for Processing
The processing of personal data by OnlySmile is based on:
- Performance of a contract or pre-contractual measures, when the patient requests the scheduling or performance of a treatment;
- Compliance with a legal obligation, namely tax and public health obligations;
- Consent of the data subject, in cases of optional treatments, sending promotional communications, or use of image;
- Legitimate interest of the clinic, when necessary for service improvement, facility security, or fraud prevention.
5. Data Retention
Personal data will be retained only for the period necessary for the purposes indicated above and in accordance with applicable legal requirements.
- Clinical data: retained for a minimum period of 20 years after the last medical act, according to applicable ethical and legal health standards.
- Administrative and tax data: retained for 10 years, according to the VAT Code and the Corporate Income Tax Code.
- Marketing data and consents: retained until the consent is withdrawn by the data subject.
After these periods, the data will be securely and permanently deleted.
6. Data Sharing with Third Parties
OnlySmile only shares personal data when strictly necessary and always in accordance with the GDPR, namely:
- With dentists, hygienists, or other healthcare professionals at the clinic involved in the treatment.
- With laboratories, partner clinics, or insurers, when indispensable for the execution of the treatment or protocol.
- With public or regulatory entities, such as the Tax Authority, the Health Regulatory Entity, or the Order of Dentists, when required by law.
- With external service providers (e.g., clinical software, web hosting, IT security), subject to confidentiality and subcontracting agreements in accordance with Article 28 of the GDPR.
The data are never sold, transferred, or used for commercial purposes without the explicit consent of the data subject.
7. Rights of Data Subjects
The data subject has, under the law, the following rights:
- Right of access to their personal data;
- Right to rectification of incorrect or incomplete data;
- Right to erasure (“right to be forgotten”);
- Right to restriction of processing;
- Right to data portability;
- Right to object to processing, in certain cases;
- Right to withdraw consent, when processing is based on this ground.
The exercise of these rights can be requested in writing to the email direcao@centromendes.com or by letter addressed to the headquarters.
The data subject also has the right to file a complaint with the National Data Protection Commission (CNPD) – www.cnpd.pt.
8. Security and Confidentiality
OnlySmile adopts appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of personal data, preventing unauthorized access, loss, destruction, or improper disclosure.
All professionals and collaborators are bound by a duty of professional secrecy and confidentiality.
9. Cookies and Browsing Data
OnlySmile’s website uses strictly necessary cookies for its operation, as well as analytical cookies for statistical purposes and to improve the user experience.
Users can configure their browser to block or delete cookies, which may affect the functioning of some site features.
For more information, please refer to the Cookie Policy available on the website.
10. International Data Transfers
OnlySmile does not transfer personal data outside the European Economic Area (EEA).
If, for technical or contractual reasons, this becomes necessary, it will always ensure that transfers comply with the legal requirements of the GDPR, namely through standard data protection clauses approved by the European Commission.
11. Updates to this Policy
This Privacy Policy may be updated periodically, particularly as a result of legal, technological, or organizational changes.
Any updates will be published on the OnlySmile website, indicating the date of the last revision.
Last updated: October 2025
12. Contacts
For clarification of doubts or exercise of your data protection rights, you can contact:
OnlySmile – Netto & Alvarez Lopes Lda
Rua de São Francisco, Nº 86
9500-243 Ponta Delgada – Portugal
📧 direcao@centromendes.com