Privacy Policy

Last updated: 21 October 2026

1. Introduction

Dystonia Virtual Clinic ("we", "us" or "our") is committed to protecting your privacy and ensuring that your personal data is processed lawfully, fairly and transparently.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our website at https://www.dystoniavirtualclinic.com, contact us, book an appointment, receive online physiotherapy services, participate in an online group physiotherapy programme, register for an educational activity or make a payment.

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), Portuguese Law No. 58/2019 and other applicable Portuguese and European legislation.

This Privacy Policy should be read together with our Terms of Service, Cookie Policy and, where applicable, our Consent to Telehealth Services.

2. Data Controller

The data controller responsible for the processing of personal data described in this Privacy Policy is:

DRP Health & Education, Lda.

Operating under the commercial name Dystonia Virtual Clinic.

Registered Office:

Rua Dr. Alexandrino 429
4540-367 Fermedo, Arouca
Portugal

Correspondence Address:

Rua Braamcamp 52, 1º
1250-051 Lisbon
Portugal

Company Registration and Tax Identification Number (NIPC/NIF): 519277600

Registered Share Capital: 1000,00€ EUR

Healthcare Establishment Registration — ERS: E184371

Email: contact@dystoniavirtualclinic.com

Website: https://www.dystoniavirtualclinic.com

DRP Health & Education, Lda. determines the purposes and means of processing personal data in connection with the services provided by Dystonia Virtual Clinic, subject to applicable legal and professional obligations.

3. Personal Data We Collect

The categories of personal data we collect depend on how you interact with our website and services.

3.1. Identification and Contact Information

We may collect:

Full name;
Email address;
Telephone number;
Country of residence;
Information necessary to identify and communicate with you;
Other information voluntarily provided through enquiries or correspondence.

3.2. Booking and Appointment Information

When you book an appointment or register for a programme, we may collect:

Type of appointment or programme selected;
Preferred and confirmed appointment dates and times;
Booking status and appointment history;
Cancellation and rescheduling information;
Payment status;
Information submitted through booking forms;
Records of acceptance of applicable terms and telehealth documentation;
The country where you expect to be physically located during a clinical session.

At the beginning of each clinical session, the physiotherapist requests verbal confirmation of your identity and physical location, including your country and city or locality.

Relevant information may be recorded in your clinical record for healthcare, professional and territorial eligibility purposes.

We do not use IP-based geolocation or continuous location tracking to verify patients' physical locations for clinical eligibility purposes.

This does not prevent our website or external service providers from processing IP addresses for technical, security or operational purposes.

3.3. Health and Clinical Information

When you receive clinical physiotherapy services, we collect and process information necessary for your assessment, treatment, rehabilitation and clinical follow-up.

This may include:

Medical and neurological history;
Medical diagnoses;
Current symptoms and their progression;
Information about dystonia and related neurological or movement difficulties;
Pain and functional limitations;
Previous treatments and rehabilitation experiences;
Relevant medication information;
Medical reports or other documents provided by patients;
Rehabilitation goals and concerns;
Clinical assessments and observations;
Physiotherapy recommendations and treatment plans;
Exercises and rehabilitation activities;
Progress notes and clinical follow-up records;
Other information necessary for the safe and appropriate provision of physiotherapy.

Our initial clinical consultation includes a detailed clinical assessment and documentation of relevant medical history, symptoms, functional difficulties and rehabilitation needs.

Further clinical information may be collected during individual sessions and online group physiotherapy programmes.

Health information constitutes a special category of personal data under Article 9 of the GDPR and is subject to additional legal protections.

3.4. Online Group Physiotherapy Programmes

When you participate in an online group physiotherapy programme, we may process information necessary to assess participation requirements, organise the programme, provide appropriate clinical care and maintain clinical records.

During group sessions, other participants may be able to see or hear your name, image, voice and information you choose to share.

All participants are expected to respect the privacy and confidentiality of others. However, we cannot guarantee that other participants will maintain confidentiality.

Clinical information shared privately with the treating physiotherapist is handled in accordance with applicable professional secrecy and data protection obligations.

3.5. Educational Activities

If you register for an educational seminar, workshop or other non-clinical activity, we may collect:

Identification and contact details;
Registration information;
Payment information;
Attendance information;
Questions or communications voluntarily submitted in connection with the activity.

Educational activities are distinct from clinical physiotherapy services.

Participation in an educational activity does not, by itself, establish a clinical treatment relationship.

3.6. Payment and Billing Information

When you make a payment, we may process:

Payment amount and date;
Service purchased;
Payment status;
Transaction references;
Billing information;
Information necessary to issue invoices;
Refund information;
Records required for accounting and tax purposes.

Payments are processed through external payment service providers.

We do not store complete debit or credit card details on our own servers.

3.7. Website and Technical Information

When you visit our website, Squarespace and other relevant technology providers may process technical information, including:

IP address;
Browser type;
Device and operating system information;
Pages visited;
Dates and times of access;
Information necessary for website functionality and security;
Cookie identifiers and preferences.

Certain optional analytics and similar technologies may process additional information, subject to applicable consent requirements.

Dystonia Virtual Clinic does not use Google Analytics.

The optional Squarespace Activity Log feature is disabled.

For further information, please consult our Cookie Policy.

4. Purposes of Processing

We process personal data for the following purposes:

Responding to Enquiries

To answer questions, provide requested information and respond to communications.

Managing Appointments and Registrations

To schedule, confirm, modify or cancel appointments, manage programme registrations and send relevant service information.

Providing Clinical Physiotherapy

To assess patients, develop rehabilitation plans, deliver physiotherapy, document treatment and ensure continuity of clinical care.

Assessing Clinical and Territorial Eligibility

To determine whether online physiotherapy is appropriate and whether the patient is physically located in a territory where the requested clinical service may be provided.

Managing Online Group Physiotherapy Programmes

To assess participation requirements, organise group sessions, provide clinical guidance and maintain relevant clinical records.

Managing Educational Activities

To organise seminars and workshops, process registrations and communicate relevant information.

Processing Payments and Refunds

To manage transactions, issue invoices, maintain accounting records and process refunds where applicable.

Communicating with Patients and Participants

To send appointment confirmations, reminders, scheduling information and other communications necessary for the requested services.

Maintaining Website Functionality and Security

To operate our website and systems, maintain their security and prevent misuse.

Improving Website Functionality

To understand and improve website performance where permitted by applicable law and subject to consent where required.

Complying with Legal and Professional Obligations

To comply with healthcare, professional, tax, accounting, data protection and other applicable legal requirements.

Managing Complaints and Legal Claims

To respond to complaints, establish or defend legal rights and cooperate with competent authorities where legally required.

We do not sell personal data.

5. Legal Bases for Processing

We process personal data under the legal bases provided by Article 6 of the GDPR, depending on the purpose and circumstances of the processing.

Performance of a Contract — Article 6(1)(b)

Processing necessary to arrange, administer and provide the services you request.

Compliance with a Legal Obligation — Article 6(1)(c)

Processing necessary to comply with applicable healthcare, professional, accounting, tax and other legal obligations.

Legitimate Interests — Article 6(1)(f)

Processing necessary for legitimate interests such as protecting our systems, preventing misuse, managing appropriate operational matters and establishing or defending legal claims, provided those interests are not overridden by your rights and freedoms.

Consent — Article 6(1)(a)

Processing based on your consent where legally required, including certain non-essential cookies and other optional activities.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Special-Category Health Data

Health data receives additional protection under Article 9 of the GDPR.

Where processing is necessary to provide physiotherapy, assess rehabilitation needs, maintain clinical records or manage healthcare services, we rely, where applicable, on Article 9(2)(h) of the GDPR, concerning the provision of healthcare or treatment and the management of healthcare services.

Such processing is subject to the professional secrecy and confidentiality safeguards established by Article 9(3) of the GDPR and applicable Portuguese legislation.

Where another condition under Article 9 is required for a particular processing activity, we will apply the appropriate lawful condition.

Acceptance of our Consent to Telehealth Services concerns the provision of remote healthcare and does not mean that all clinical processing relies exclusively on consent as its GDPR legal basis.

6. Appointment Booking and Scheduling

We use Squarespace Scheduling (Acuity Scheduling) to manage appointments and programme registrations.

When you book an appointment, personal data submitted through the booking interface may be processed for purposes including:

Creating and managing bookings;
Confirming appointment details;
Managing cancellations and rescheduling;
Sending booking confirmations and reminders;
Processing relevant booking-form responses;
Facilitating payments where applicable.

Our Acuity Scheduling account has the HIPAA Enabled configuration activated and is covered by a Business Associate Addendum with Squarespace.

These arrangements provide additional contractual and operational safeguards but do not replace our obligations under the GDPR.

We aim to limit information collected through the booking system to what is necessary for booking administration and appropriate preparation for the requested service.

Clinically relevant information collected through booking or intake forms may be incorporated into the patient's official clinical record.

If information necessary to provide the requested service safely is not supplied, we may be unable to proceed with the booking or clinical consultation.

7. Online Consultations and Telehealth

Dystonia Virtual Clinic uses Zoom Workplace Pro to provide online physiotherapy consultations.

During a consultation, the platform may process participants' names, images, voices and relevant technical information required to operate the service.

Clinical information disclosed during consultations may be documented by the treating physiotherapist in the patient's clinical record.

Our clinical consultation procedures include access controls intended to protect privacy, such as individual meeting links, meeting passcodes and waiting-room controls.

Dystonia Virtual Clinic does not record clinical consultations as a matter of routine and does not use automated transcription or AI-generated clinical summaries for its consultations.

Any recording initiated by the clinic would require an appropriate legal basis and, where legally required, prior consent.

Zoom is not used as the official storage system for patient clinical records.

Although we implement reasonable safeguards, no internet-based communication system can be guaranteed to be completely free from security risks.

Patients are encouraged to participate from a reasonably private environment and to avoid sharing sensitive information where unauthorised persons may overhear them.

For further information, please consult our Consent to Telehealth Services.

8. Payments

Payments for appointments, physiotherapy programmes and other services may be processed through external payment providers.

For appointments booked through Squarespace Scheduling, the available payment methods may include:

Stripe;
PayPal.

For other eligible purchases made through our website, additional supported payment solutions, including Squarespace Payments, may be offered where activated.

The available payment methods are displayed during the relevant checkout process.

Payment service providers may process payment-card information, transaction details, billing information, authentication data and information necessary for fraud prevention and compliance with applicable legal obligations.

Dystonia Virtual Clinic receives the information necessary to confirm payments, manage services, issue invoices and process refunds.

We do not store complete payment-card information on our own servers.

External payment providers may act as independent data controllers for certain processing activities and may apply their own privacy notices.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies to support essential website functionality, security, visitor preferences and optional features.

We use the Squarespace cookie consent banner, which allows visitors to accept, reject or manage non-essential cookies.

Non-essential cookies that require consent must not be activated before the appropriate consent has been obtained.

Visitors may review and change their cookie preferences through the cookie preferences control available on our website.

We do not use Google Analytics or the optional Squarespace Activity Log feature.

Some third-party services, including embedded content, booking systems and payment providers, may use their own cookies or similar technologies.

Further information about cookie categories, providers, purposes and duration is available in our Cookie Policy.

10. Disclosure of Personal Data

We may share personal data with third parties where necessary to provide our services, comply with legal obligations or protect legitimate rights.

Depending on the circumstances, recipients may include:

Healthcare Professionals

Authorised physiotherapists and other healthcare professionals involved in providing or managing clinical care, subject to applicable confidentiality and professional secrecy obligations.

Website and Booking Providers

Squarespace and Squarespace Scheduling (Acuity Scheduling), for website hosting, appointment booking and related functions.

Videoconferencing Providers

Zoom, for the delivery of online consultations.

Email and Communication Providers

Google Workspace, for business email and related communications.

Payment Providers

Stripe, PayPal and other payment solutions activated for the relevant services.

Accounting and Administrative Service Providers

Providers involved in invoicing, accounting and necessary administrative operations.

Professional Advisers

Accountants, lawyers and other professional advisers where disclosure is necessary and legally permitted.

Public Authorities and Regulators

Competent authorities, including healthcare regulators, tax authorities, courts and data protection authorities, where disclosure is required or otherwise permitted by applicable law.

Access to personal data is restricted according to the purpose of processing and the recipient's responsibilities.

Where third parties process personal data on our behalf, appropriate data processing arrangements and safeguards apply.

Certain external providers may act as independent data controllers for specific activities.

We do not sell personal data to third parties.

11. International Data Transfers

Some of the technology and service providers used by Dystonia Virtual Clinic may process or store personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will apply the requirements of Chapter V of the GDPR.

Depending on the circumstances, appropriate transfer mechanisms may include:

European Commission adequacy decisions;
Standard Contractual Clauses approved by the European Commission;
Other lawful transfer mechanisms permitted under the GDPR.

Where required, supplementary safeguards will be considered to ensure an appropriate level of protection.

The applicable transfer mechanisms depend on the providers, services and processing activities involved.

Additional information about relevant international transfers may be requested using the contact details provided in this Privacy Policy.

12. Data Retention

We retain personal data only for as long as necessary to provide our services, ensure continuity of clinical care, comply with applicable legal and professional recordkeeping obligations, and establish or defend legal claims where necessary.

Clinical records are retained in accordance with applicable healthcare and professional retention requirements. Financial and accounting records are generally retained for 10 years, in accordance with Portuguese law.

Booking information, correspondence and other administrative records are retained only for as long as necessary for their respective purposes. Where such information forms part of a clinical record or must be retained for legal or accounting reasons, the corresponding retention requirements apply.

Once personal data is no longer required and there is no lawful reason for its continued retention, it will be securely deleted or anonymised.

13. Your Data Protection Rights

Subject to the conditions and limitations established by the GDPR, you have the following rights:

Right of Access

You may request confirmation of whether your personal data is being processed and obtain access to that data.

Right to Rectification

You may request the correction of inaccurate personal data or the completion of incomplete information.

Right to Erasure

You may request deletion of your personal data where the legal conditions for erasure are met.

This right is not absolute. Certain clinical, accounting or other records may need to be retained to comply with legal or professional obligations.

Right to Restriction of Processing

You may request restriction of processing in the circumstances established by the GDPR.

Right to Object

You may object to certain processing activities, including processing based on legitimate interests, subject to the conditions and exceptions established by law.

Right to Data Portability

Where the legal requirements are met, you may request to receive certain personal data in a structured, commonly used and machine-readable format or request its transmission to another controller.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Rights Relating to Automated Decision-Making

Where applicable, you have the protections established by Article 22 of the GDPR concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Clinical assessment and treatment decisions are based on professional healthcare judgement rather than solely on automated decision-making.

Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority.

In Portugal, the competent authority is:

Comissão Nacional de Proteção de Dados (CNPD)

Website: https://www.cnpd.pt/

Where applicable, you may also contact the competent supervisory authority in another EU or EEA country.

Exercising Your Rights

To exercise your data protection rights, please contact:

contact@dystoniavirtualclinic.com

We may request information reasonably necessary to verify your identity before responding to a request.

Requests will be handled within the time limits and under the conditions established by applicable law.

14. Data Security

We apply appropriate technical and organisational security measures, including encryption and access controls, to protect personal data against unauthorised access, loss, alteration, disclosure and destruction.

Clinical records are stored locally on an encrypted external storage device under the control of DRP Health & Education, Lda.

Access to clinical information is restricted to authorised personnel subject to applicable professional secrecy and confidentiality obligations.

Our security measures also include appropriate controls for online consultations, protection of electronic systems and the use of service providers with relevant security safeguards.

We seek to maintain the confidentiality, integrity and availability of personal data throughout its processing.

However, no electronic information system or internet-based service can be guaranteed to be completely secure.

Where a personal data breach occurs, we will assess and document the incident and, where legally required, notify the competent supervisory authority and affected individuals.

15. Children's Privacy

Dystonia Virtual Clinic provides clinical physiotherapy services exclusively to individuals aged 18 years or older.

We do not knowingly accept minors as patients for individual physiotherapy consultations or online group physiotherapy programmes.

If we become aware that personal information has been submitted in connection with an ineligible clinical booking involving a minor, we will handle that information in accordance with applicable data protection and legal requirements.

Eligibility conditions for educational seminars and other non-clinical activities may be specified separately.

Where the processing of a minor's personal data requires parental authorisation or another lawful basis under applicable legislation, those requirements will be respected.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect:

Changes to our services;
Changes to the personal data we collect or process;
Changes to our booking, payment or communication platforms;
Changes to cookies and website technologies;
Changes to applicable legislation or regulatory guidance;
Changes to our data protection procedures.

The latest version will be published on our website with the corresponding last updated date.

Where legally required, we will provide additional information or obtain new consent before implementing relevant changes to processing activities.

17. Contact

If you have questions about this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, please contact:

Dystonia Virtual Clinic

Operated by DRP Health & Education, Lda.