The National Registry of Rheumatic Patients (hereinafter referred to as ‘Reuma.pt’) is the national registry of rheumatic patients, conceived and promoted by the Portuguese Society of Rheumatology.

As part of its activity, Reuma.pt collects personal data from healthcare professionals and rheumatic patients. In order to protect the privacy and security of data subjects, we have established this Privacy Policy, through which we regulate and make public the management we carry out of your personal data, namely identifying the data that is collected, how and why it is used, to whom it is communicated and how it is protected.

As data controllers, we pay special attention to privacy and information security, in particular by implementing the necessary measures to ensure full compliance with current data protection legislation.

It is of the utmost importance that you read the following text to understand how your personal data is processed, as well as the rights you have as a data subject.

Data controller

The data controller referred to in this privacy policy is the Portuguese Society of Rheumatology (SPR), namely the National Registry of Rheumatic Patients (Reuma.pt), with headquarters at Avenida de Berlim, n.º 33-B, 1800-033 Lisboa, Portugal.

Purpose and lawfulness of processing personal data

Personal data will only be processed for the respective purposes and always on the grounds set out in the legislation.

The collection of personal data from minors under the age of 16 depends on the consent of their parents/guardians. To this end, the holder(s) of parental responsibility will be asked for their personal data and consent to the processing of the personal data of the minors in question.

Personal data retention periods

Reuma.pt keeps your personal data for the time necessary to fulfil the purpose for which it was collected or, where applicable, for the specific period stipulated by law.

The personal data of healthcare professionals will be kept for as long as they keep their Reuma.pt account active, with the exception of logs, which are kept for a maximum of 2 years after the conclusion of the Reuma.pt cohort.

The personal data of patients registered on the Reuma.pt platform will be kept for 5 years after the end of the Reuma.pt cohort. If you withdraw your consent, it will be deleted within 30 days. If you have consented to your personal data being used in clinical studies, it will be stored for 5 years after the studies have been completed.

After the storage period has elapsed, the personal data will be deleted and will only be stored for a longer period if there is a legal obligation to do so or if there are strong reasons of public interest that justify it.

Transmission of personal data to third parties

The sharing of personal data with third parties takes place in situations that are strictly necessary for its activity or due to legal obligation.

Reuma.pt sometimes needs to use other organisations to provide certain services, particularly IT support and archiving. This provision of services may involve access to personal data by these entities. In these circumstances, the subcontractor will process the personal data in the name and on behalf of Reuma.pt under the strict obligation to follow its instructions, with Reuma.pt ensuring that it offers sufficient guarantees to protect the rights of the data subjects.

Whenever necessary and appropriate for the fulfilment of legal or judicial obligations and/or in response to requests from public or governmental authorities with powers to do so, Reuma.pt transmits personal data to third parties, such as the National Data Protection Commission, the Directorate-General for Health, the National Authority for Medicines and Health Products.

In any of the above situations, Reuma.pt undertakes to take reasonable steps to ensure the effective protection of the personal data it processes.

International data transfers

Reuma.pt participates in international registries and projects involving partners from different countries, that may include third countries: United Kingdom, Iceland, Switzerland, Israel, Turkey, Israel, Brazil. In such cases, personal data may be transferred outside the European Union for scientific research purposes.

In these situations, it is Reuma.pt’s responsibility to ensure that transfers of personal data are carried out with a level of data protection equivalent to that of the applicable European legislation. This protection is ensured through the existence of an adequacy decision by the European Commission or through the conclusion of standard contractual clauses approved by the European Commission between Reuma.pt and the importing organisation.

If you would like more information about the international transfers made by Reuma.pt, please contact reuma.pt@spreumatologia.pt.

Rights of data subjects

In accordance with the applicable legislation, Reuma.pt is committed to respecting the confidentiality of the personal data it holds and guaranteeing the exercise of the rights of data subjects. The law recognises the following rights for data subjects: information, access, rectification, erasure, portability and restriction of processing.

If you so wish, you can request access to additional information on how your data is being processed, as well as rectify it whenever you consider it to be out of date or inaccurate, by emailing reuma.pt@spreumatologia.pt.

Within certain limits, you can also request the deletion of your data by sending a reasoned request to the same address. Whenever data collected on the basis of your consent is involved, you can revoke it at any time and request its prompt deletion, without, however, jeopardising the lawfulness of any operations carried out with the data up to that point.

Contact us

The data subject may exercise their rights of access, rectification, modification or erasure, as well as request any information regarding the processing of their personal data by writing to the following e-mail address: reuma.pt@spreumatologia.pt and postal address: Sociedade Portuguesa de Reumatologia, Avenida de Berlim, n.º 33-B, 1800-033 Lisboa, Portugal.

You can also contact our data protection officer by e-mail at dpo@reuma.pt or by letter to the following address: Avenida de Berlim, n.º 33-B, 1800-033 Lisboa, Portugal.

You also have the right to lodge a complaint with the National Data Protection Commission at https://www.cnpd.pt/.

Changes to the privacy policy

This privacy policy may be reviewed and amended so that it always corresponds to the procedures adopted by Reuma.pt with regard to personal data. We therefore recommend that you check it regularly so that you are always up to date.

Reuma.pt’s privacy policy was last updated on 12 February 2024.