Privacy policy

This policy explains what personal data we collect when you visit this site, buy a programme or sign up for a plan with guidance, why we collect it, who else processes it and how you can exercise your rights. It was written to comply with the European Union's General Data Protection Regulation (GDPR), Portuguese Law No. 58/2019, which implements it in Portugal, the UK GDPR and, for California residents, the California Consumer Privacy Act (CCPA).

Who is responsible for your data

The controller of your personal data is:

Send any privacy request to privacidade@heloraterap.com. Given the size of this business, we are not required to appoint a data protection officer; Ana Sofia Oliva dos Reis handles these requests personally.

What we collect and why

Data about your emotional wellbeing

Information about your mental health, emotions, relationships or family life may be a special category of personal data (Article 9 GDPR). That is why:

• We never ask for this information from people who only buy a programme. The worksheets in the lessons are for you to fill in privately, on paper or on your device, and they never reach us.
• In the guidance, you decide what you tell us. We only process that information with your explicit consent, given on the checkout page for plans with guidance, and only to reply to you.
• You can withdraw your consent at any time by writing to privacidade@heloraterap.com. From then on, we stop processing that information and delete it; the guidance ends and we refund the weeks not yet provided, in proportion to the part of the price that corresponds to the guidance.
• Share only what is useful. Do not include information about other people (your partner, your children, other relatives) beyond what is necessary, and never include medical documents.
• Messages are kept in a mailbox protected by two-factor authentication, which only Ana Sofia Oliva dos Reis can access, and they are not used for anything else: not for marketing, not for statistics and not for training artificial intelligence.

What we never do

• We never see or store your full card number. Stripe handles that.
• We do not sell or rent personal data, and we do not share it for other companies' marketing.
• We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.
• We do not load advertising or analytics scripts unless you accept them in the cookie banner.

Who processes data on our behalf (processors)

Each provider may only use your data to provide its service to us, under a data processing agreement or a duty of professional confidentiality, except where it is stated above that it acts as an independent controller.

International transfers

We are established in Portugal and some of our providers are in the United States. Transfers outside the European Economic Area are based on the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses. You can request a copy at privacidade@heloraterap.com.

Emails we send

After a purchase, we send transactional emails: the access link, the receipt and important notices about what you bought. They are part of the service, so you cannot opt out of them. We do not send newsletters or advertising.

Your rights

Under the GDPR, you have the right to:

• find out whether we hold data about you and get a copy (access);
• have inaccurate or incomplete data corrected (rectification);
• have data we no longer need deleted (erasure);
• ask us to restrict a specific use, or object to a use based on legitimate interest;
• receive your data in a portable format;
• withdraw any consent you have given at any time, without affecting what was done before.

California residents also have the right to know, the right to delete and the right to correct, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising, as defined by the CCPA.

Send your request to privacidade@heloraterap.com from the email address you used for the purchase. We reply within one month, as the GDPR requires, and usually much sooner. The request is free unless it is manifestly excessive. If you ask us to delete your data, we will no longer be able to confirm your purchase or resend your access link, and records the law requires us to keep, such as invoices, are kept until the end of the legal period.

Complaints

If you disagree with how we handle your data, please tell us first. You also have the right to complain to a supervisory authority: in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt; in Spain, the Agencia Española de Protección de Datos (AEPD), at aepd.es; in another European Union country, that country's data protection authority; and in the UK, the Information Commissioner's Office (ICO), at ico.org.uk.

Security

The site uses HTTPS on every page. Access links are digitally signed, so they cannot be guessed or altered, and the lessons are only served to people with a valid link. Card details never reach our servers. Access to our Stripe, hosting and email accounts is protected by two-factor authentication. If a data breach creates a risk to you, we notify the CNPD within 72 hours and inform the people affected without undue delay, as the GDPR requires.

Minors

Our programmes and guidance are sold to adults only. We do not knowingly collect data from anyone under 18. If you think a minor has sent us personal data, write to privacidade@heloraterap.com and we will delete it.

Changes to this policy

If we change this policy in a way that affects you, we will tell customers by email before the change takes effect. The date at the top of this page shows the version in force.