Last updated: April 15, 2026
This Privacy Policy explains how RHEA collects, uses, shares, stores, and protects personal data of customers, website visitors, gift card recipients, business contacts, therapist applicants, partner therapists, and other individuals who interact with us.
This policy applies to https://www.rhea.pt, the booking platform, forms, communications by email, phone and WhatsApp, marketing campaigns, customer support, and other interactions related to RHEA's business activities.
Unless otherwise stated, the data controller is:
If a data protection officer (DPO) or legally designated representative is appointed, the relevant details will be provided here.
We may process:
We may process:
Where necessary for the safety and suitability of the service, we may collect health-related data, including:
Such data will only be collected where relevant to the safe provision of the service and on an appropriate legal basis, including explicit consent where required.
We may process transaction data, payment status, payment reference information, tax identification details, and information necessary for issuing invoices. Full card details are, as a rule, processed by payment providers rather than by RHEA.
We may process:
We may process contact preferences, subscriptions, campaign responses, promo code usage, and interactions with newsletters or advertisements.
We may process information relating to complaints, chargebacks, suspected fraud, abusive use of the platform, account blocks, and information needed to defend the rights of RHEA or third parties.
We process personal data for the following purposes:
Depending on the context, we process personal data on the basis of:
Health-related data may constitute special-category personal data under data protection law.
RHEA seeks to limit collection of such data to the minimum necessary to assess whether the service can be delivered safely. Where required, such processing is based on the data subject's explicit consent. Failure to provide relevant health information may make it impossible to provide the service safely.
Health data may be shared with the Professional responsible for the session only to the extent strictly necessary for safe delivery of the service.
RHEA does not use health data for behavioral marketing, sensitive commercial profiling, or sale to third parties.
We may share personal data with:
Name, contact details, service address, booking-related operational data, and, where necessary, health information relevant to the safety and suitability of the service.
Including providers of hosting, cloud services, databases, CRM, automation, communications, analytics, customer support, billing, and payments, who process data on our behalf under appropriate contractual safeguards.
For authentication, payment collection, fraud prevention, processing, and financial reconciliation.
Only where an appropriate legal basis exists and within applicable limits, including in connection with pixels, consent management, advertising campaigns, and performance measurement.
Where necessary to comply with law, respond to valid requests, investigate incidents, prevent fraud, manage claims, or establish, exercise, or defend legal rights.
RHEA does not sell personal data to third parties.
Where personal data is processed outside the European Economic Area, RHEA will implement legally appropriate safeguards, such as adequacy decisions, standard contractual clauses, or equivalent measures, where required.
We retain personal data only for as long as necessary for the purposes for which it was collected, including:
Specific retention periods may vary depending on the type of data, legal obligations, limitation periods, and evidentiary needs.
The website may use strictly necessary, functional, analytical, and marketing cookies.
Non-essential cookies will only be used in accordance with applicable law and, where required, with the user's consent through the relevant consent management platform.
Users may generally configure their browser to block or delete cookies, although doing so may affect website functionality.
RHEA implements reasonable and proportionate technical and organizational measures to protect personal data, including access controls, encryption where appropriate, permission segregation, activity logs, vendor management, and incident response measures.
Despite these efforts, no system is completely infallible. If a personal data breach occurs that is likely to pose a relevant risk, RHEA will act in accordance with applicable legal requirements.
Under applicable law, data subjects may, where applicable, exercise the following rights:
To exercise your rights, contact: [email protected].
RHEA may request reasonable proof of identity before responding to a request.
RHEA may send marketing communications by electronic means where consent exists or another lawful basis permits it. The data subject may object or withdraw consent at any time through the unsubscribe link, account settings, or direct contact.
RHEA does not intentionally direct its platform to children. If we become aware that children's personal data has been collected without an appropriate legal basis, we will take reasonable steps to delete such data.
Personal data may be obtained:
RHEA may use operational automations and anti-fraud mechanisms for triage, risk scoring, abuse prevention, anomaly detection, and booking management. As a rule, such mechanisms are not intended to produce solely automated decisions with legal or similarly significant effects without adequate human involvement; where they do and the law so requires, RHEA will ensure the rights provided by law.
The website may contain links to third-party websites, platforms, or services. RHEA does not control their privacy practices, and users should review the privacy policies of those third parties.
Without prejudice to any other remedy, data subjects may lodge a complaint with the competent supervisory authority in Portugal, namely the CNPD — Comissão Nacional de Proteção de Dados.
RHEA may update this Privacy Policy at any time. The current version will be published on the website together with the relevant revision date.
For privacy questions or to exercise your rights: