Privacy notice

Controller

Yan Dobromyslov, Portugal, is the controller. Privacy requests can be sent to [email protected].

What the form collects

The form records your name, email address, website when supplied, form location, and message. Required fields are needed to receive and assess the enquiry; submitting the form is optional.

Do not submit patient information, health information, passwords, or other sensitive personal information. This is a business enquiry surface and is not provided on behalf of a medical practice.

Cloudflare Turnstile separately processes network, browser, and request signals to distinguish people from automated abuse. Its token is verified and is not stored in the enquiry record or event log.

Purpose and legal basis

The information is used to assess and reply to the business enquiry, administer the resulting discussion, and protect the form from spam. The legal basis is the legitimate interest in responding to enquiries people choose to send and keeping the service secure under Article 6(1)(f) GDPR.

The submission is not added to a newsletter or used for unrelated marketing. Automated anti-abuse checks may reject likely spam, but they do not make a legal or similarly significant decision about a person.

Processors and international processing

Supabase hosts the form function and database; the database is stored and primarily processed in AWS's Ireland region. Cloudflare protects the form. Resend delivers the acknowledgement and operator notification. Google hosts the contact mailbox used for replies and rights requests.

These providers and their subprocessors may process information outside the European Economic Area. Depending on the provider and destination, applicable safeguards include European Commission standard contractual clauses, adequacy decisions, and the EU–US Data Privacy Framework. A copy of the applicable safeguards can be requested at the address above.

Retention

The submitted form record is deleted 12 months after submission. It may be deleted sooner when it is invalid, a test, contains inappropriate sensitive information, is no longer needed for the stated purpose, or a valid deletion or objection request applies. If work begins, only information needed for that work moves to separately governed client records.

Technical consult-event records contain no form contents and are deleted after 30 days. Resend states that its email copy is retained for 30 days. Deleted information can remain temporarily in restricted disaster-recovery backups until the relevant backup expires; those copies are not used for ordinary operations.

Your rights

Depending on the circumstances, you may request access to, correction or deletion of your information, restriction of processing, or object to processing based on legitimate interests. Portability applies where its legal conditions are met. Identity may need to be verified before a request is completed.

You may also complain to Portugal's Comissão Nacional de Proteção de Dados or the data-protection authority where you live or work.