Privacy Policy

Your privacy is important to us. This Privacy Policy explains how we collect, use, store and protect your personal data when you use the Aesthetix Cloud platform, in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese legislation.

1. Data Controller

The person responsible for processing your personal data is:

• Corporate Name: Paulo Soares Marques, serviços de saúde, Lda
• NIF: 516308211
• Thirst: Rua 10 de Outubro, n48, 4705-474 Esporões-Braga, Portugal
• Email for privacy concerns: hello@aesthetix.cloud
• Data Protection Officer: Paulo Nuno Soares Marques

2. Data We Collect

2.1 Data provided directly by you

• Registration data: Name, email, password (encrypted);
• Profile data: Clinic name, position, profile photograph (optional);
• Billing details: Information necessary for payment processing (managed by Stripe);
• Platform content: Treatment proposals, products, branding configurations.

2.2 Patient data (entered by the User)

When you use the Platform to create proposals, you may enter patient data, including:

• Patient's name;
• Clinical description/profile;
• Photographs for AI analysis.

Important: The User is responsible for the processing of this patient data and must ensure that they have a valid legal basis (typically, express consent) to enter them into the Platform. Paulo Soares Marques, health services, Lda acts as a subcontractor in relation to this data.

2.3 Data collected automatically

• Usage data: Pages visited, features used, timestamps;
• Technical data: IP address, browser type, operating system, device;
• Cookies: See section 7 below.

3. Purposes of Processing

We use your data to:

Purpose	Legal Basis (GDPR)
Provision of the contracted service	Execution of contract (Art. 6, no. 1, subsection b)
Account management and authentication	Contract execution
Payment processing	Contract execution
AI image analysis	Contract execution / Consent
Communications about the service	Legitimate interest (Art. 6, no. 1, paragraph f)
Platform improvement	Legitimate interest
Compliance with legal obligations	Legal obligation (Art. 6, no. 1, al. c)
Marketing (only with consent)	Consent (Art. 6, no. 1, paragraph a)

4. Data Sharing with Third Parties

We only share data with the following subcontractors, essential for the operation of the service:

Supplier	Purpose	Location
Supabase	Database hosting and authentication	EU (Frankfurt, Germany)
Stripe	Payment processing	EU/US (with standard contractual clauses)
Google (Gemini AI)	Image analysis and text generation	Global (with standard contractual clauses)
Resend	Sending transactional emails	USA (with standard contractual clauses)

All subcontractors are bound by data protection agreements and provide adequate guarantees of GDPR compliance, including Standard Contractual Clauses approved by the European Commission for international transfers.

5. International Transfers

Some of our subcontractors operate outside the European Economic Area (EEA). In these situations, we guarantee the protection of your data through:

• European Commission adequacy decisions;
• Standard Contractual Clauses (CCT) approved by the Commission;
• Certification under the EU-US Data Privacy Framework (where applicable).

6. Data Retention

We retain your data for the following periods:

• Account details: As long as you maintain an active account, and up to 30 days after deleting the account;
• Billing details: 10 years (legal tax obligation);
• Proposals and content: As long as you maintain an active account;
• Usage logs: 12 months;
• AI-processed images: Real-time processing, without permanent storage by AI.

7. Cookies and Similar Technologies

We use cookies to ensure the platform functions and improve your experience:

Category	Purpose	Duration
Essentials	Authentication, security, session preferences	Session / 30 days
Functional	Remember preferences (theme, language)	1 year
Analytics	Anonymous usage statistics	2 years

You can manage your cookie preferences at any time via the cookie banner or your browser settings. Please note that deactivating essential cookies may prevent the platform from functioning correctly.

8. Your Rights

Under the GDPR, you have the following rights:

• Right of Access: Request information about the data we process about you;
• Right to Rectification: Correct inaccurate or incomplete data;
• Right to Erasure: Request the deletion of your data ("right to be forgotten");
• Right to Limitation: Restrict processing in certain circumstances;
• Right to Portability: Receive your data in a structured and machine-readable format;
• Right to Oppose: Oppose processing based on legitimate interest;
• Right to Withdraw Consent: At any time, without affecting the lawfulness of the previous processing.

To exercise any of these rights, contact us at hello@aesthetix.cloud. We will respond within 30 days.

9. Data Security

We implement technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS);
• Encryption of passwords with secure algorithms (bcrypt);
• Role-based access control;
• Security monitoring and intrusion detection;
• Regular backups with encryption.

10. Data Breaches

In the event of a breach of personal data that could result in a risk to your rights, we will notify the National Data Protection Commission (CNPD) within 72 hours and, when applicable, we will directly contact the affected data subjects.

11. Minors

The Aesthetix Cloud platform is intended exclusively for healthcare professionals and does not knowingly collect data from anyone under the age of 18. If you believe we have collected data from a minor, please contact us immediately.

12. Changes to this Policy

We may update this Policy from time to time. We will notify registered users by email of material changes. The "Last Updated" date at the top indicates when it was last revised.

13. Complaints

If you consider that the processing of your data violates your rights, you can lodge a complaint with the Portuguese supervisory authority:

• National Data Protection Commission (CNPD)
• Website: www.cnpd.pt
• Email: geral@cnpd.pt

14. Contact

For questions about this Privacy Policy or exercising your rights:

• E-mail: hello@aesthetix.cloud
• Household: Rua 10 de Outubro, n48, 4705-474 Esporões-Braga, Portugal
• Data Protection Officer: Paulo Nuno Soares Marques