Privacy Policy.

This policy describes how Ser Paciente collects, uses and protects the personal data you share with me. For any question, write to marta@serpaciente.pt.

Controller

Marta Fonseca, sole trader (empresária em nome individual). Online or in person in Cascais, Portugal. NIF (Portuguese tax number) 234454997. Contact: marta@serpaciente.pt.

Data collected

• Name, email and telephone number when you fill in forms.
• Birth data (date, time, place) and other personal information you write in the Map questionnaires, including, depending on the Map, data about health, family relationships or data about other people (for example, a child or the other parent). These are special categories of data; the processing rests on your explicit consent, given when you submit the questionnaire.
• The content of messages sent through the contact form, by email, or through Instagram and WhatsApp, if you choose to write to me there.
• Billing and payment data, processed directly by Stripe. This site does not see or store card numbers.
• If you book a session through Cal.com, the data you fill in there (name, email, telephone number, choice of format), directly by Cal.com.

Purpose and legal basis

Data is processed in order to answer enquiries (steps taken at your request before entering into a contract, Article 6(1)(b) GDPR), to produce and deliver the Maps and to hold the sessions (performance of the contract), to book sessions, to issue a receipt (legal obligation), and, in the case of the special categories of data in the questionnaires, on the basis of your explicit consent (Article 9(2)(a) GDPR), which you can withdraw at any time without affecting what was processed before that.

When a questionnaire asks for data about a third person (for example, a child, or the other parent in a "Seeing with other eyes"), the person answering declares that they have the agreement of that person, or the parental responsibility that makes it legitimate to answer on their behalf.

If you come for cancer support

Once you have booked and paid for the first session, I send you a short questionnaire by email, called "Antes da nossa primeira sessão". It is not linked anywhere public on this site, and that is deliberate: asking these things of someone who is still deciding would mean collecting health data from a person who may never become a client.

There are five questions: how you would like me to address you, where you are in the illness, when you were diagnosed, which treatments you have already had, and which ones are planned. Any of them can be left unanswered, and "I do not know" is as good an answer as any.

This is health data, which the GDPR treats as a special category of data (Article 9). The processing rests on your explicit consent (Article 9(2)(a)), given when you submit the questionnaire, and you can withdraw it whenever you like. It serves one purpose only: so that I arrive at the session already knowing the essentials, instead of spending the first half hour asking.

The answers are held in Google Workspace, under the same Data Processing Agreement described below. They do not pass through Cal.com or Stripe: the free-text fields in the booking form are switched off precisely so that a diagnosis does not end up in systems with no legal basis in place to receive it.

They are kept for as long as the support continues and, after that, for as long as is needed to meet the record-keeping obligations that apply to this activity. You can ask for them to be deleted sooner, subject to those obligations.

When you give a Map to someone else

When you buy a gift, I ask you in a form for the name and email of the person who will receive it, the delivery date and, if you like, a message from you. This data serves only to prepare and deliver the gift: to send the gift code to that person on the date you chose, with your message. The legal basis is the performance of the contract with you and the legitimate interest in delivering the gift to the person who will receive it.

The data of the person who receives the gift is kept until one year after the code is delivered, which is how long the gift stays valid, and is deleted after that, unless in the meantime that person uses the code and becomes the one filling in the questionnaire. Whoever receives the gift has the same rights described below, and can exercise them by writing to marta@serpaciente.pt.

When the Map given is about a child or a teenager, the declaration of parental responsibility is not given by the person giving the gift: it is given by the person receiving it, at the moment they use the code and fill in the questionnaire.

Who else processes your data

No data is sold. Some processors handle data on my behalf, in order to provide their service:

• Stripe (payments), based in Ireland and the United States. It holds its own PCI-DSS certification and uses standard contractual clauses for transfers outside the EEA, where applicable.
• Cal.com (session booking, when active), with processing in the United States. Until a data processing agreement (DPA) and standard contractual clauses are confirmed, the data asked for in Cal.com is kept to a minimum: name, email, telephone number and a closed choice of format, never free text.
• Google Workspace (email, calendar, questionnaire forms, storage of the Maps), under the Google Workspace data processing agreement (DPA) for customers in the EU.
• Cloudflare (website hosting).
• Meta (Instagram and WhatsApp), if you choose to write to me there. Messages are stored in Meta systems, subject to their terms and their privacy policy, with possible transfer outside the European Economic Area under the mechanisms Meta declares. For that reason, on matters involving health or other sensitive data, I prefer email or the form on this site, and that is where I will point you if the conversation goes that way.
• Web3Forms (sending the forms on this site). It receives what you write in the form and forwards it to my email. It is a company based in India and keeps a copy of the submission for up to three years, on Amazon Web Services servers. Transfers outside the European Economic Area are made under the standard contractual clauses of their data processing agreement. If you want your message deleted from there before that period is up, write to me and I will take care of it.

How long data is kept

Billing data is kept for the legal period of 10 years (tax and accounting obligations). The data in the Map questionnaires is kept for as long as the relationship lasts and, after that, for as long as is needed to answer complaints or legal obligations; you can ask for it to be deleted earlier, subject to the legal retention obligations above.

Rights of the data subject

You can ask for access, rectification, erasure, portability, restriction of and objection to the processing of your data, and withdraw your consent at any time, by writing to marta@serpaciente.pt. You also have the right to lodge a complaint with the Comissão Nacional de Protecção de Dados (CNPD), the Portuguese data protection authority, at cnpd.pt.

Last updated: 3 September 2026.