1. Data Controller
The data controller for your personal data is McMinsky, located at Azinhaga da Cidade 24A r/c, 1750-063 Lisbon, Portugal. Tax ID: 517747120
2. Data We Collect
We may collect the following types of personal data:
- Identification data: name, date of birth, photograph
- Contact data: email, phone, address
- Academic data: school, grade level, subjects, academic history
- Browsing data: cookies, IP address, pages visited
- Payment data: when applicable for billing
- QR code card access data: see section 13
- Voice messages: audio, transcript, conversation history and, if you provide them, name and contact: see section 14
3. Purposes of Processing
Your data is processed for the following purposes:
- Provision of contracted training and tutoring services
- Administrative management and billing
- Communication about our services and events
- Improvement of our services and user experience
- Compliance with legal obligations
- Knowing which card and origin each access corresponds to, telling repeat visits from the same device apart (only with your consent) and filtering automated bot access
- Receiving, processing and replying to the voice messages you leave
4. Legal Basis
The processing of your data is based on:
- Contract performance: to provide contracted services
- Consent: for marketing communications, non-essential cookies (including any code stored on your device for statistical purposes) and sending voice messages
- Legitimate interest: to improve our services
- Legal obligation: to comply with tax and legal obligations
5. Data Sharing
Your data is not sold to third parties. We may share data with:
- Essential service providers (web hosting, email)
- Competent authorities, when legally required
- Parents or guardians, in the case of minors
- The holder of the card through which you accessed, who receives the voice messages you leave and may reply to them
- Voice processing, transcription and artificial intelligence service providers, who process data on our behalf
6. Cookies
Our website uses cookies to improve your browsing experience. We use:
- Essential cookies: necessary for the site to function
- Preference cookies: to save your choices (e.g., language)
- Analytics cookies: to understand how the site is used
Cookies and similar technologies that are not strictly necessary, including analytics ones, are only used after the user expressly accepts them (Law no. 41/2004, article 5). Browsing the site is not consent. You may refuse or withdraw consent at any time.
You can manage your cookie preferences through your browser settings.
7. Data Retention
Your data is retained only for as long as necessary for the purposes for which it was collected, or as required by law. After that period, data is securely deleted.
The code stored on your device (section 13) lasts 13 months from its creation and is not renewed on each visit. Data linked to that code is kept for 25 months at most. Voice messages are kept for as long as needed to replay them and reply to them, and deleted on your request.
8. Your Rights
Under the GDPR, you have the following rights:
- Access: know what data we hold about you
- Rectification: correct inaccurate data
- Erasure: request deletion of your data
- Portability: receive your data in a structured format
- Objection: object to processing in certain circumstances
- Restriction: limit the processing of your data
- Withdraw consent: at any time, without affecting processing already carried out
To exercise your rights, contact us through the form on the website or at our facilities, or by email at privacidade@medicinup.com.
9. Security
We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or destruction. However, no Internet transmission is 100% secure.
10. Minors
Processing data of minors under 16 years requires consent from the holder of parental responsibilities. We ensure appropriate protection of data of children and young people who use our services.
11. Changes
This Privacy Policy may be updated periodically. Any changes will be published on this page with the update date indicated.
12. Contacts and Complaints
For privacy questions, contact us through the website or by email at privacidade@medicinup.com. You also have the right to file a complaint with the Portuguese Data Protection Authority (CNPD).
13. QR Code Cards
Some of our physical cards have a QR code that opens a page on our website. You can also enter the card code manually. For each opening we record:
- date and time;
- identification of the card holder and of the person the card was given to;
- how it was entered (QR code, manual, link or unknown);
- device type (phone, tablet or computer);
- country, as two letters;
- an indication of whether the access is made by a bot.
Your IP address is not stored. These records are processed on the basis of our legitimate interest in knowing how the cards are used and in protecting the service from automated access. You have the right to object.
With your express consent, we store on your device a random code that allows us to recognise repeat visits from that device. If you do not consent, that code is not created and the card works all the same. The code lasts 13 months from creation and the associated data is kept for 25 months at most. You can delete it at any time in your browser settings.
14. Voice Messages and Artificial Intelligence
Some cards let you leave a voice message. When you do, we process the recorded audio, its transcript and the conversation history, so that the reply has context. You may, if you wish, provide a name and a contact for the reply: this is optional.
The reply is generated automatically by an artificial intelligence system and is read out by a synthetic voice, reproduced from the voice of a real person. It is not a recording or a real-time conversation with that person. Do not take the reply as medical, legal, financial or any other kind of professional advice.
Messages and replies are stored so that you can replay them and so that the card holder can reply. Do not leave health data, third-party data or other sensitive data. You can ask for deletion at any time using the email address above.