Privacy Policy

The privacy and security of your personal data are fundamental to Nexly Healthcare, the entity responsible for the PrEP Online project.

Mindful of the trust our users place in us, we are committed to protecting your personal data rigorously and complying fully with Regulation (EU) 2016/679 — the General Data Protection Regulation (hereinafter GDPR) — and the legal and regulatory rules applicable in Portugal, including Law No. 58/2019 of 8 August, which implements the GDPR nationally.

This page explains how we process your personal data, the purposes for which it is collected, who it may be shared with, your rights as a data subject and the security measures we adopt to protect it.

By using our services or providing your personal data through the PrEP Online website, you expressly agree to this Privacy Policy. If you have questions about the protection of your personal data, you can contact us directly using the details provided in this Policy.

Article 1

(Identity and Contact Details of the Data Controller)

The entity responsible for collecting and processing personal data is the private limited company Sequência Serena - UNIPESSOAL LDA., with its registered office in Lisbon, Portugal, registered with the Bragança Commercial Registry under legal entity number 519498240, hereinafter referred to as the “Clinic”. It operates under the trading name Nexly Healthcare, as part of the PrEP Online project, and is registered with the Portuguese Health Regulatory Authority (ERS) under number E183020.

The Company has appointed André Alçada Fernandes, who is also a director of the company, as its Data Protection Officer. He can be contacted by email at epd@nexly.pt.

Article 2

(Definition of Personal Data and Types of Data Collected)

Under the GDPR, personal data means any information relating to an identified or identifiable natural person. A person is identifiable if they can be recognised, directly or indirectly, by reference to details such as their name, identification number, location data, online identifiers or specific characteristics of their physical, genetic, mental, economic or social identity. Data concerning health means personal data relating to a person’s physical or mental health, including the provision of healthcare services, which reveals information about their health status.

When providing our services, we may collect identification details (such as name, date of birth, tax identification number, telephone number and email address), clinical data (medical history, diagnoses, diagnostic examinations and their results, and prescribed medication), as well as health insurance, billing or payment data. We collect only the data strictly necessary for each specific purpose, in accordance with the principle of data minimisation.

Article 3

(Purposes of Data Processing)

In operating the PrEP Online website and providing the associated clinical services, we use the personal data collected for:

1. Providing online healthcare services, including medical consultations and advice;

2. Scheduling and managing consultations and examinations;

3. Issuing prescriptions and other clinical documents;

4. Billing and processing payments;

5. Auditing and continuously improving the services provided, accrediting healthcare facilities or certifying their services, and assessing and measuring the Clinic’s service levels;

6. Complying with legal and regulatory obligations;

7. Communications relating to the services provided;

8. Sending information and promotional campaigns, subject to prior consent.

Article 4

(Legal Basis for Processing)

The lawful processing of our users’ personal data relies on different legal bases, depending on the specific purpose:

1. Performance of a contract, such as booking and conducting a medical consultation;

2. The data subject’s explicit, freely given, informed and unambiguous consent, particularly relevant to promotional communications or the collection of optional data;

3. Compliance with legal obligations, particularly those arising from legislation applicable to clinical activities;

4. Protecting the Clinic’s legitimate interests, including ensuring platform security, preventing fraud and improving the user experience.

Article 5

(Mandatory or Optional Provision of Data)

Most personal data requested when using the PrEP Online website is mandatory so that we can provide the contracted services appropriately and safely. Details such as full name, date of birth, tax identification number, contact information and clinical information are essential for scheduling and conducting consultations, providing medical follow-up and issuing clinical documents. If the data subject refuses to provide this information, PrEP Online may be unable to provide the requested services, which could prevent a consultation or the issuing of a prescription, for example.

Other data is optional, such as data associated with marketing activities or participation in satisfaction surveys. In these cases, processing will take place only with the user’s express consent, which may be withdrawn at any time without affecting the provision of other services.

Our data minimisation policy applies at every stage of processing: only information strictly necessary for each specific purpose is collected.

Article 6

(Recipients of Personal Data)

Personal data may be shared with third parties, including, but not limited to, the following situations:

• With insurers, at the data subject’s request or when necessary to provide the services;

• With laboratories or other healthcare providers, when necessary for tests or other procedures;

• With public authorities, when required by law.

Nexly Healthcare may work with partners or service providers that process personal data on its behalf. In all cases, Nexly Healthcare will take appropriate steps to ensure that its partners meet all their obligations to protect the personal data they process.

Article 7

(Security Measures and International Data Transfers)

We adopt appropriate technical and organisational measures to ensure the security, integrity and confidentiality of the personal data we process. These measures include access controls, encrypted protocols, regular backups and ongoing staff training to ensure good data protection practices.

The confidentiality of users’ medical information is a fundamental principle of our work. All healthcare professionals working with PrEP Online are bound by professional secrecy under the Portuguese Medical Association’s Code of Ethics and the ethical and legal rules applicable to medical practice in Portugal. Breaching this duty is a serious disciplinary and legal offence.

The security of the communication platforms used for remote consultations is a priority. PrEP Online consultations use Zoom, configured to protect the confidentiality of communications. The connection uses end-to-end encryption, ensuring that only authorised participants can access the session and its content. Use of this platform follows recognised good practice for providing healthcare in a digital environment.

Data is stored on servers located in the European Union and protected by robust encryption systems that ensure only authorised people can access it, reinforcing the confidentiality and integrity of our users’ medical and personal information.

We do not transfer data internationally to third countries outside the European Economic Area, with the potential exception of the browsing data described in Article 10.

Article 8

(Data Retention Period)

Personal data will be retained for as long as necessary to fulfil the purposes for which it was collected and processed. As a general rule, users’ clinical and administrative data will be retained for a maximum of five years after the contractual relationship between the data subject and the Clinic ends, unless a longer period is justified by a legal requirement or the need to defend a potential judicial or administrative proceeding. After that period, the data will be securely deleted or anonymised.

Article 9

(Data Subjects’ Rights)

As a data subject, the user has the right to access their information, request its rectification or restriction of processing, object to processing, and request the portability of their data to another controller.

The right to erasure may be exercised when the data is no longer necessary for the purpose for which it was collected; when the data subject withdraws the consent on which processing is based and there is no other legal basis; when the data subject objects to processing and there are no overriding legitimate interests; when the data has been processed unlawfully; or when erasure is required to comply with a legal obligation.

Where processing is based on consent, the data subject has the right to withdraw it at any time, without affecting the lawfulness of processing carried out before that date.

These rights may be exercised at any time by sending a request to epd@nexly.pt.

Article 10

(Cookies and Analytics Tools)

The PrEP Online website uses cookies to provide an optimised, personalised and secure browsing experience. Cookies are small text files stored on your device (computer, phone or tablet) when you visit a website. Among other functions, these files allow the website to recognise returning users, remember preferences, improve performance and display more relevant content. When first visiting the website, users will be informed about the use and acceptance of cookies.

Types of cookies used:

• Strictly necessary cookies: essential to the website’s basic operation, including secure browsing and access to protected areas.

• Performance cookies: collect information about how visitors use the website, such as the most frequently visited pages. This data is used only for statistical purposes and to improve the browsing experience.

• Functionality cookies: allow the website to remember user choices, such as language or region.

Use of Google Analytics

We use Google Analytics, provided by Google Inc., which uses cookies to collect anonymous information about user behaviour on the website, such as pages visited, time spent on the website and the type of device used. This data helps us understand website use and continuously improve our services. Information generated by Google Analytics cookies may be transferred to and stored on servers outside the European Union.

Article 11

(Automated Decision-making and Profiling)

We do not use automated decision-making processes, including profiling, that produce legal effects or significantly affect data subjects.

Article 12

(Right to Lodge a Complaint)

Data subjects also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD), through www.cnpd.pt, whenever they believe that their data is not being processed in accordance with applicable law.

Changes to the Privacy Policy

This Privacy Policy may be updated periodically. Whenever significant changes are made, registered users will be informed by email before the new version takes effect.

For further information or clarification, please contact us by email at epd@nexly.pt.

Last updated: July 2026