1. Who we are and who is responsible for your data
Júlia Rocha Integrative Health is a registered brand, based at Praceta José Fontana, n.º 2, 9.º Esq., 2600-173 Vila Franca de Xira, Portugal, with tax identification number 203 982 924.
This entity is the controller of the personal data collected through the website jrintegrativehealth.com and in the course of providing its health coaching, therapeutic chi kung and integrative therapy services.
Contact details for data protection matters:
- Email: info@jrintegrativehealth.com
- Telephone: +351 913 891 067 (call to the national mobile network)
- Postal address: Praceta José Fontana, n.º 2, 9.º Esq., 2600-173 Vila Franca de Xira
2. Legal framework
We process your personal data in accordance with:
- Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR);
- Law No. 58/2019 of 8 August, which ensures the implementation of the GDPR in national law;
- Law No. 41/2004 of 18 August, as amended, concerning privacy in electronic communications;
- Decree-Law No. 7/2004 of 7 January, concerning electronic commerce;
- Regulation (EU) 2024/1689 — Artificial Intelligence Act (AI Act), with regard to the transparency obligations applicable from 2 August 2026.
3. What data we process, for what purpose and on what basis
Personal data is any information relating to an identified or identifiable natural person, regardless of its format — text, image, video or audio.
The following table summarises all the processing we carry out:
| Purpose | Data processed | Lawful basis | Retention |
|---|---|---|---|
| Responding to contact enquiries | Name, email, telephone number, message content | Art. 6(1)(b) — pre-contractual steps; or (f) — legitimate interest in responding | 12 months; 24 months if a proposal is made |
| Scheduling and providing sessions and ongoing support | Identification, contact details, health history, habits and goals | Art. 6(1)(b) + Art. 9(2)(a) — explicit consent | Duration of support + 5 years |
| Invoicing and compliance with tax obligations | Name, tax identification number, address, payment details | Art. 6(1)(c) — legal obligation | 10 years |
| Sending newsletters and marketing communications | Name and email | Art. 6(1)(a) — consent; Art. 13-A of Law No. 41/2004 | Until consent is withdrawn |
| Publishing and moderating blog comments | Name, email, IP address, browser user agent, content | Art. 6(1)(a) — consent; (f) for spam detection | For as long as published; IP address 12 months |
| Managing user accounts | Credentials and profile data | Art. 6(1)(b) — performance of a contract | Active account + 12 months |
| Job applications and recruitment | CV and application data | Art. 6(1)(a) — consent | 12 months, renewable |
| Website security and abuse prevention | IP address, access logs | Art. 6(1)(f) — legitimate interest | 6 months |
| Cookies and similar technologies | Identifiers, browsing data | Consent — Art. 5(3) of Law No. 41/2004 | See Cookie Policy |
| Exercising and defending rights in legal proceedings | Data relevant to the case | Art. 6(1)(c) and (f) | Applicable limitation periods |
Like any website, we also collect technical information beyond your name and contact details — in particular, IP addresses and browsing patterns. This data is collected through cookies to optimise the user experience. Please see our Cookie Policy for details.
4. Health data
The nature of our services means that, as part of the support we provide, you may share information with us about your health, habits, symptoms, medical history or emotional well-being. This data belongs to a special category, subject to enhanced protection under Article 9 of the GDPR and Article 29 of Law No. 58/2019.
The following safeguards apply:
- This data is only processed with your explicit consent, given separately and specifically before support begins.
- It is processed solely for the purposes of supporting you and never for marketing, commercial profiling or sharing with third parties for promotional purposes.
- Access is restricted to those who have a genuine need to know, and everyone involved is bound by a duty of confidentiality.
- You may withdraw your consent at any time without affecting the lawfulness of processing carried out up to that point.
5. Retention periods
We retain your data only for as long as necessary for the purposes for which it was collected, as indicated in the table in section 3, or for any longer period required by law. Once that period has expired, the data is deleted or irreversibly anonymised.
6. Who we share your data with
We do not sell or give away your personal data. We share it only with the following categories of recipients, and always only to the extent strictly necessary:
- Web hosting and website maintenance service providers;
- Email marketing platforms, for sending newsletters;
- Scheduling and video conferencing service providers;
- Accounting and invoicing services;
- Statistical traffic analysis service providers;
- Public authorities, where there is a legal obligation to disclose it.
We enter into data processing agreements with all providers who process data on our behalf under Article 28 of the GDPR, imposing obligations of confidentiality, security and deletion of data at the end of the service.
7. International data transfers
Some of the providers we work with — particularly email marketing platforms, traffic analysis platforms and social networks — may process data outside the European Economic Area, particularly in the United States of America.
In these situations, we ensure that the transfer is based on one of the following mechanisms provided for in Chapter V of the GDPR:
- An adequacy decision by the European Commission, including the provider's certification under the EU-U.S. Data Privacy Framework;
- Standard Contractual Clauses approved by the European Commission, accompanied by any supplementary measures that prove necessary;
- Your explicit consent, where applicable.
You may request information about the safeguards applied to a specific transfer using the contact details provided in section 1.
8. Cookies and similar technologies
We use functionality, preference, statistical and marketing cookies. Only cookies that are strictly necessary for the site to function do not require consent; all others are only installed after you have given your consent through the cookie settings panel, under Article 5(3) of Law No. 41/2004.
You can change or withdraw your preferences at any time through the 'Cookie settings' option available on the site. Details of each cookie, its purpose and its lifespan can be found in our Cookie Policy.
9. Use of artificial intelligence systems
In compliance with Article 50 of Regulation (EU) 2024/1689 (AI Act), applicable from 2 August 2026, we provide the following information about the use of artificial intelligence systems on our digital channels.
AI-assisted content
Some content published on this website — particularly graphic materials — may be produced with the support of generative artificial intelligence tools. All content is reviewed and approved by people before publication, with editorial responsibility remaining entirely human.
- No health recommendation, support plan, diagnosis or assessment concerning you is produced exclusively by an automated system. All decisions concerning you involve human intervention and oversight.
- We do not use your personal data, or any health information you share with us, to train artificial intelligence models.
- We do not use emotion recognition or biometric categorisation systems.
In Portugal, the national supervisory authority for the AI Act is ANACOM — the National Communications Authority. The National Data Protection Commission retains responsibility for all matters involving personal data.
10. Automated decision-making and profiling
We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing, including profiling, under Article 22 of the GDPR.
Any segmentation that may occur when sending newsletters — for example, based on topics in which you have expressed an interest — does not produce legal effects or significantly affect you, and can be stopped at any time by unsubscribing.
11. Marketing communications
We only send you marketing communications with your prior, express consent, or where you are a client and the communications relate to services similar to those you have already purchased, under Article 13-A of Law No. 41/2004.
All communications include a simple, free way to unsubscribe. You can also request to unsubscribe by emailing info@jrintegrativehealth.com. The request is actioned without undue delay.
12. Minors
Our services are not aimed at children under 13. Under Article 8 of the GDPR and Article 16 of Law No. 58/2019, processing the personal data of children under 13 in connection with information society services is only lawful with the consent of those who hold parental responsibility.
Where support involves a minor, consent is obtained from their legal representative and documented. If you become aware that a child under 13 has provided us with data without this authorisation, please contact us and we will delete it.
13. Information security
We adopt appropriate technical and organisational measures to protect your data against destruction, accidental loss, alteration, unauthorised disclosure or access, under Article 32 of the GDPR, including:
- Encryption of communications using the HTTPS protocol;
- Access control with authentication and permissions assigned on a need-to-know basis;
- Regular updates to the software and systems used;
- Regular backups;
- Binding all persons with access to data to a duty of confidentiality.
No system is entirely immune to risk. We recommend using devices with up-to-date security software and supported browser versions.
14. Personal data breaches
If a personal data breach occurs that is likely to pose a risk to your rights and freedoms, we notify the National Data Protection Commission within 72 hours of becoming aware of it, under Article 33 of the GDPR.
Where the breach is likely to pose a high risk, we inform you directly of the incident without undue delay, describing the nature of the breach, its likely consequences and the measures taken, under Article 34 of the GDPR.
15. Your rights
As a data subject, you have the following rights:
- Information and access — to know what data we process about you, for what purposes, for how long and to whom it is disclosed, and to obtain a copy of it.
- Rectification — to correct or complete inaccurate or incomplete data.
- Erasure — to request the deletion of your data, except where there is a legal obligation to retain it or it is necessary for exercising rights in legal proceedings.
- Restriction of processing — to restrict the use of your data in certain circumstances.
- Portability — to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to request its transfer to another entity.
- Objection — to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. In the case of direct marketing, the objection is unconditional and immediate.
- Withdrawal of consent — to withdraw any consent given at any time and as easily as you gave it, without affecting the lawfulness of processing carried out up to that date.
- Not to be subject to automated decisions — not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you.
To exercise any of these rights, contact us at info@jrintegrativehealth.com. We respond within one month of receiving the request, which may be extended by a further two months in particularly complex cases, in which case we will inform you of the extension and the reasons for it. We may request additional information to confirm your identity where there are reasonable doubts.
16. Complaints
If you believe that the processing of your personal data breaches the applicable legislation, you have the right to lodge a complaint with the supervisory authority:
National Data Protection Commission (CNPD)
Av. D. Carlos I, n.º 134, 1.º — 1200-651 Lisboa
Telephone: +351 213 928 400 · Email: geral@cnpd.pt · www.cnpd.pt
We would appreciate it if, whenever possible, you contact us first at info@jrintegrativehealth.com so that we can try to resolve the matter directly.
17. Social media
We maintain a presence on Facebook, Instagram and LinkedIn. When you visit our pages or interact with our posts, the social network concerned may process your personal data, link it to your account and use it to personalise advertising, including across different devices.
This processing is carried out by the social network under its own policies, over which we have no control. We recommend consulting the privacy policies of the respective platforms and reviewing your account's privacy settings.
With regard to the aggregated page statistics that the platforms make available to us, we act as joint controllers under the terms defined by each platform.
18. Links to other sites
This website may contain links to third-party sites that we do not control. We are not responsible for the privacy practices of those sites. We recommend consulting their policies before providing any personal data.
19. Changes to this policy
We may update this Privacy Policy whenever necessary, particularly in response to changes in legislation or in the processing we carry out. The current version is always the one published on this page, with its update date indicated.
Where changes are substantial and affect processing based on your consent, we will inform you in advance using the contact details you have provided to us.
This Privacy Policy was updated on 1 August 2026.