Privacy policy

This document is an integral part of the regulatory body for the protection of personal data of the Next Fertility brand, considering the General Data Protection Regulation (2016/679), hereinafter GDPR.

Whenever this document is updated, a new version will be made available immediately after its approval.
The General Data Protection Regulation (GDPR) on the protection of individuals with regard to the processing of personal data and the free movement of such data came into force on May 25, 2016 and will apply from May 25, 2018.
As it is a Community Regulation, it is directly applicable in all Member States, thus guaranteeing legislative harmonization in terms of data protection.

Although the matters covered by the regulation are not entirely new, being already covered by the previous Data Protection Act, the regulation imposes new rules and obligations on all organizations, which will lead to data protection matters being strengthened.
In this sense, Next Fertility, as the company responsible for processing personal data and taking into account the characteristics of the sector and its specific needs, has drawn up this Code of Conduct with the aim of specifying the application of this regulation and drawing up a set of good practices which, although already followed in this sector, should be reinforced in order to better guarantee the privacy of users, employees and suppliers.

Scope and purpose

This Privacy Policy has been implemented to demonstrate our commitment to and respect for the rules on privacy and the protection of personal data.

Why this Privacy Policy?

This Privacy Policy is designed to inform you of the general rules regarding the privacy and processing of your personal data, which we collect and process in strict compliance with national and EU legislation on the protection of personal data.
The Next Fertility brand is committed to respecting best practices in the field of security and protection of personal data, and to this end has established procedures capable of safeguarding the protection of the data made available to us by all those who in any way relate to the Next Fertility brand.

What does this Privacy Policy cover?

This Privacy Policy applies exclusively to the essential collection and processing of personal data carried out by Next Fertility within the scope of its activities.

Recipients

This Privacy Policy is intended for the general public (patients, candidates, subcontractors) and establishes obligations for all employees of the organization, both internal and external, and public regulatory and auditing bodies.

1. DEFINITIONS

Personal data:

All information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by name, identification number, location data, electronic identifiers or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Special Categories of Personal Data:

Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership of a natural person, as well as the processing of genetic data, biometric data to uniquely identify a person, data concerning health or data concerning sex life or sexual orientation.

Treatment:

It is the set of operations carried out on personal data, by automated or non-automated means, such as collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure by transmission or otherwise making available, restriction, erasure, or destruction.

Responsible for treatment:

It is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria applicable to its appointment may be provided for by Union or Member State law.

The person responsible for processing personal data is NFertility.Lda and the Data Protection Officer is the Operational Coordinator.

Personal Data Breach:

It is a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to personal data transmitted, stored, or otherwise processed.

Subcontractor:

It is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller.

Next Fertility’s subcontractors include accounting firms, human resources, law firms, OSH services, external and internal auditing, gamete banks, clinical analysis laboratories, genetic laboratories, and pathological anatomy laboratories. Next Fertility’s holding company is Nex Clinics Spain.

Third:

A natural or legal person, public authority, service, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

This includes regulatory bodies (ERS, IGAS, CNPMA), state bodies (SS, AT).

2. COLLECTION AND PROCESSING OF DATA

Within the scope of the Next Fertility brand’s activity, personal data is collected, recorded, organized, stored, used, and consulted. Other “personal data processing” operations may also take place.

Personal data relates not only to clients/users, but also to employees, candidates and suppliers.
The Next Fertility brand collects personal data, namely the data required for billing, data for contact with patients, data to be used in medical prescriptions, physiological, biometric and other data associated with medical history and medical treatments, the data legally required for Informed Consents, and the data required to comply with legal obligations for data collection, statistics and retention (CNPMA requirements).

When collecting personal data through consent, Next Fertility provides data subjects with detailed information about the nature of the data collected and the purpose and processing of that data. Information is also provided on the right of access to personal data as well as the right to erasure and portability.

3. SUBCONTRACTORS

As part of the processing of the owner’s data, the Next Fertility brand uses or may use third parties, subcontracted by it, to process the owner’s data on behalf of the Next Fertility brand and in accordance with the instructions given by it, in strict compliance with the provisions of the law and this Privacy Policy.

These subcontractors may not transmit the owner’s data to other entities without the prior written authorization of Next Fertility, nor may they contract with other entities without the prior authorization of Next Fertility.

The Next Fertility brand is committed to only subcontracting entities that provide sufficient guarantees that the appropriate technical and organizational measures are in place to ensure that the rights of the data subject are upheld.
When collecting personal data, the Next Fertility brand provides the data subject with information on the categories of subcontractors that may process data on behalf of the Next Fertility brand.

4. DATA COLLECTION CHANNELS

Next Fertility collects data directly. It can be collected through the following channels: in person, by telephone, by e-mail, by regular mail or through the information/booking request form on our website and social networks.

5. GENERAL PRINCIPLES APPLICABLE TO THE PROCESSING OF DATA

In terms of general principles relating to the processing of personal data, Next Fertility undertakes to ensure that the data it processes are:

• Object of lawful, fair and transparent processing in relation to the data subject;
• Collected for specific, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and up to date whenever necessary, with all appropriate measures being taken to ensure that inaccurate data, considering the purposes for which it is processed, is erased, or rectified without delay;
• Kept in a form that allows the identification of the data subject for no longer than is necessary for the purposes for which the data is processed;
• Handled in a manner that ensures their security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, and appropriate technical or organizational measures are taken.

The data processing carried out by Next Fertility is lawful when at least one of the following situations applies:

• The data subject has given his or her explicit consent to the processing of the data subject’s data for one or more specific purposes;
• Processing is necessary for the performance of a contract to which the data subject is a party, or for pre-contractual measures at the request of the data subject;
• The processing is necessary for compliance with a legal obligation to which Next Fertility is subject;
• Processing is necessary for the protection of the vital interests of the data subject or another natural person;
• Processing is necessary for the purposes of the legitimate interests pursued by Next Fertility or by third parties (unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail);
• If you have used the inquiry form on our website, we base the legitimacy for processing your data on the consent you have given.

Next Fertility undertakes to ensure that the data subject’s data is only processed under the conditions listed above and with respect for the aforementioned principles.

When the data subject’s data is processed by Next Fertility based on the data subject’s consent, the data subject has the right to withdraw their consent at any time. However, withdrawing consent does not compromise the lawfulness of the processing carried out by Next Fertility based on the consent previously given by the data subject.

The length of time for which data is stored and retained varies according to the purpose for which the information is processed.

In fact, there are legal requirements that oblige data to be kept for a minimum period. Therefore, whenever there is no specific legal requirement, the data will only be stored and kept for the minimum period necessary for the purposes for which it was collected or subsequently processed, after which it will be deleted.

If you have given your consent for us to send you commercial communications about our products and services, we will use your name and e-mail address and/or telephone contact for this purpose until you withdraw your consent.

6. USE AND PURPOSES OF PROCESSING THE DATA SUBJECT’S DATA

In general terms, Next Fertility uses the data subject’s data for various purposes, including:

• contact for appointments;
• sending communications about the clinic electronically;
• diagnosis and clinical treatments;
• billing and collection from the holder of the personal data;
• human resources management;
• employee recruitment;
• supplier management;
• data for cycle statistics, which must be provided periodically to the CNPMA (coded data – REGISTO DA ATIVIDADE EM PMA);
• data for records relating to treatment cycles using third-party donors, which must be provided to the CNPMA (REGISTER OF DONORS AND BENEFICIARIES).

The owner’s data collected by the Next Fertility brand is not shared with third parties without the owner’s consent (as is the case with the Informed Consents and the CNPMA’s Birth, Newborn and Child Development Report Templates).

Under the applicable legal terms, the Next Fertility brand may transmit or communicate the data of the owner to other entities in the event that such transmission or communication is necessary for the execution of the contract established between the owner and the Next Fertility brand, or for pre-contractual procedures at the request of the owner, in the event that it is necessary for the fulfillment of a legal obligation to which the Next Fertility brand is subject or in the event that it is necessary for the purpose of pursuing the legitimate interests of the Next Fertility brand or a third party. If the data subject’s data is transferred to a third party, reasonable efforts will be made to ensure that the transferee uses the data transmitted in a manner consistent with this Privacy Policy.

7. TECHNICAL, ORGANIZATIONAL AND SAFETY MEASURES IMPLEMENTED

In order to guarantee the security of the owner’s data and maximum confidentiality, Next Fertility treats the information received in an absolutely confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are updated periodically as necessary, as well as in accordance with the terms and conditions provided by law.

Depending on the nature, scope, context and purposes of the data processing, as well as the risks arising from the processing for the rights and freedoms of the data subject, Next Fertility undertakes to apply, both when defining the means of processing and at the time of the processing itself, the necessary and appropriate technical and organizational measures to protect the data subject’s data and comply with legal requirements.

It also undertakes to ensure that, by default, only the data that is necessary for each specific purpose of processing is processed and that this data is not made available without human intervention to an indeterminate number of people.

In terms of general measures, the Next Fertility brand adopts the following:

• Awareness-raising and training of staff involved in data processing operations;
• Mechanisms capable of ensuring the permanent confidentiality, availability, and resilience of information systems;
• Mechanisms that ensure the restoration of information systems and access to personal data in a timely manner in the event of a physical or technical incident;

8. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

The personal data collected and used by Next Fertility is not made available to third parties established outside the European Union. Should such a transfer take place in the future, Next Fertility undertakes to ensure that the transfer complies with the applicable legal provisions, in particular with regard to determining the suitability of such country about data protection and the requirements applicable to such transfers.

9. RIGHT TO INFORMATION

Information provided to the data subject by Next Fertility (when the data is collected directly from the data subject):

• The identity and contact details of Next Fertility, the brand responsible for processing and, if applicable, its representative;
• The purposes for which the personal data are processed and, if applicable, the legal basis for the processing;
• If the processing of the data is based on the legitimate interests of Next Fertility or a third party, an indication of such interests;
• If applicable, the recipients or categories of recipients of the personal data;
• If applicable, an indication that the personal data will be transferred to a third country or an international organization, and the existence or not of an adequacy decision adopted by the Commission or a reference to appropriate or adequate transfer guarantees;
• Personal data retention period;
• The right to request from Next Fertility access to personal data, as well as its rectification, erasure or limitation, the right to object to processing and the right to data portability;
• If the processing of data is based on the consent of the data subject, the right to withdraw consent at any time, without compromising the lawfulness of the processing carried out based on the consent previously given;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• Indication of whether the communication of personal data constitutes a legal or contractual obligation, or a necessary requirement for concluding a contract, as well as whether the data subject is obliged to provide personal data and the possible consequences of not providing such data;
• If applicable, the existence of automated decision-making, including profiling, and information on the underlying logic, as well as the significance and envisaged consequences of such processing for the data subject.
• If applicable, in the event that the data subject’s data is not collected directly by Next Fertility from the data subject, in addition to the information referred to above, the data subject is also informed about the categories of personal data being processed, as well as the origin of the data and whether it comes from publicly accessible sources.
• If Next Fertility intends to further process the data subject’s data for a purpose other than that for which the data was collected, prior to such processing Next Fertility will provide the data subject with information on that purpose and any other relevant information, under the terms set out above.

Procedures and measures implemented to comply with the right to information:

The aforementioned information is provided in writing (including by electronic means) by Next Fertility to the data subject prior to the processing of the personal data in question. Under the terms of the applicable law, Next Fertility has no obligation to provide the data subject with this information when and to the extent that the data subject is already aware of it.

The information is provided by Next Fertility free of charge.

10. RIGHT OF ACCESS TO PERSONAL DATA

Next Fertility guarantees how the data subject can access their personal data.

The data subject has the right to obtain from Next Fertility confirmation as to whether personal data concerning them is being processed and, if so, the right to access their personal data and the following information:

• The purposes of data processing;
• The categories of personal data in question;
• The recipients or categories of recipients to whom the personal data has been or will be disclosed;
• The retention period for personal data;
• The right to request from Next Fertility the rectification, erasure, or limitation of the processing of personal data, or the right to object to such processing;
• The right to lodge a complaint with the CNPD or another supervisory authority;
• If the data has not been collected from the data subject, the information available on the origin of that data;
• The existence of automated decisions, including profiling, and information on the underlying logic, as well as the significance and expected consequences of such processing for the data subject;
• The right to be informed of the appropriate guarantees associated with the transfer of data to third countries or international organizations.

Upon request, Next Fertility will provide the data subject, free of charge, with a copy of their data that is being processed. The provision of other copies requested by the data subject may entail administrative costs.

11. RIGHT TO RECTIFICATION OF PERSONAL DATA

The data subject has the right to request the rectification of their personal data at any time, as well as the right to have incomplete personal data completed, including by means of an additional declaration.

In the event of rectification of the data, Next Fertility will notify each recipient to whom the data has been transmitted of the rectification, unless such communication proves impossible or involves a disproportionate effort for Next Fertility.

12. RIGHT TO ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”)

The data subject has the right to obtain from Next Fertility the deletion of their data when one of the following reasons applies:

• The data subject’s data is no longer necessary for the purpose for which it was collected or processed;
• The data subject withdraws the consent on which the processing of the data is based and there is no other legal basis for said processing;
• The data subject objects to the processing under the right to object and there are no overriding legitimate interests justifying the processing;
• If the data subject’s data is processed unlawfully;
• If the data subject’s data must be deleted in order to comply with a legal obligation to which the Next Fertility brand is subject;

Under the applicable legal terms, Next Fertility has no obligation to delete the data subject’s data insofar as the processing proves necessary to comply with a legal obligation to which Next Fertility is subject or for the purposes of declaring, exercising, or defending a right of Next Fertility in legal proceedings.

In the event of data deletion, Next Fertility will notify each recipient/entity to whom the data has been transmitted of the deletion, unless such notification proves impossible or involves a disproportionate effort for Next Fertility.

When Next Fertility has made the data subject’s data public and is obliged to erase it under the right to erasure, Next Fertility undertakes to take reasonable measures, including technical measures, taking into account available technology and the costs of their implementation, to inform the persons responsible for the actual processing of the personal data that the data subject has asked them to erase the links to such personal data, as well as copies or reproductions thereof.

13. RIGHT TO RESTRICTION OF PROCESSING OF PERSONAL DATA

The data subject has the right to obtain from Next Fertility the limitation of the processing of the data subject’s data if one of the following situations applies (the limitation consists of inserting a mark in the personal data stored with the aim of limiting its processing in the future):

• If you dispute the accuracy of the personal data, for a period that allows Next Fertility to verify its accuracy;
• If the processing is unlawful and the data subject opposes the erasure of the data, requesting instead that its use be restricted;
• If Next Fertility no longer needs the data subject’s data for processing purposes, but such data is required by the data subject for the purposes of declaring, exercising, or defending a right in legal proceedings;
• If the owner has objected to the processing, until it is established that Next Fertility’s legitimate reasons prevail over those of the owner.

When the data subject’s data is subject to limitation, it may, apart from storage, only be processed with the consent of the data subject or for the purposes of declaring, exercising, or defending a right in legal proceedings, defending the rights of another natural or legal person, or for reasons of public interest legally provided for.

The data subject who has obtained the restriction of processing of their data in the above cases will be informed by Next Fertility before the restriction of processing is lifted.

In the event of limitation of data processing, Next Fertility will inform each recipient to whom the data has been transmitted of the respective limitation, unless such communication proves impossible or involves a disproportionate effort for Next Fertility.

14. RIGHT TO PORTABILITY OF PERSONAL DATA

The data subject has the right to receive the personal data concerning him/her that he/she has provided to Next Fertility, in a structured, commonly used, and machine-readable format, and the right to transmit this data to another data controller, if:

• The processing is based on consent or on a contract to which the data subject is a party;
• The treatment is carried out by automated means.

The right of portability does not include inferred data or derived data, i.e., personal data that is generated by Next Fertility as a consequence or result of the analysis of the data being processed.

The data subject has the right to have personal data transmitted directly between data controllers, whenever technically possible.

15. RIGHT TO OBJECT TO PROCESSING

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on the exercise of legitimate interests pursued by Next Fertility or when the processing is carried out for purposes other than those for which the personal data were collected, including profiling, or when the personal data are processed for statistical purposes.

Next Fertility will cease processing the owner’s data, unless it has compelling legitimate reasons for such processing that prevail over the interests, rights, and freedoms of the owner, or for the purposes of declaring, exercising, or defending a right of Next Fertility in legal proceedings.

The data subject also has the right not to be subject to any decision taken solely based on automated processing, which produces effects in his/her legal sphere or significantly affects him/her in a similar way, unless the decision:

• It is necessary for the conclusion or execution of a contract between the proprietor and the Next Fertility brand;
• It is authorized by legislation to which the Next Fertility trademark is subject; or
• It is based on the explicit consent of the data subject.

16. PROCEDURES FOR THE EXERCISE OF RIGHTS BY THE HOLDER

The right of access, the right to rectification, the right to erasure, the right to restriction, the right to portability and the right to object can be exercised by the data subject by contacting Next Fertility.

Next Fertility will respond in writing (including by electronic means) to the owner’s request within a maximum period of one month from receipt of the request, except in cases of particular complexity, where this period may be extended by up to two months.

If the requests submitted by the owner are manifestly unfounded or excessive, in particular due to their repetitive nature, Next Fertility reserves the right to charge administrative costs or refuse to comply with the request.

17. PERSONAL DATA BREACHES

In the event of a data breach and insofar as such breach is likely to entail a high risk to the rights and freedoms of the data subject, Next Fertility undertakes to report the personal data breach to the CNPD within 72 hours of becoming aware of the incident (“Personal data breach notification form”).

Under legal terms, communication to the owner is not required in the following cases:

• If Next Fertility has applied appropriate technical and organizational protection measures and such measures have been applied to the personal data affected by the personal data breach, in particular measures that render the personal data unintelligible to any person not authorized to access such data, such as encryption;
• If Next Fertility has taken subsequent measures to ensure that the high risk to the rights and freedoms of the proprietor is no longer likely to materialize; or
• If communication to the owner involves a disproportionate effort for the Next Fertility brand. In this case, Next Fertility will make a public announcement or take a similar measure through which the owner will be informed.

18. CHANGES TO THE PRIVACY POLICY

Next Fertility reserves the right to change this Privacy Policy at any time. In the event of a change to the Privacy Policy, the date of the last change, available at the top of this page, will also be updated.

19. APPLICABLE LAW AND JURISDICTION

The Privacy Policy, as well as the collection, processing, or transmission of Data of the holder, are governed by the provisions of Regulation (EU) 2016/679, of the European Parliament and of the Council, of April 27, 2016, and by the legislation and regulations applicable in Portugal.