Privacy Notice

Last updated: 11 October 2025

This Notice explains how we collect and use personal data when you visit myleukaemia.eu or contact us through the site.

Scope. This Notice covers website interactions (visits, contact forms, emails). If you join pilots, studies, events, or receive materials beyond the website, you’ll receive a separate privacy information sheet.

1) Controller

Controller: Hugo R. Caires (pre-incorporation, using the name “MYLeukaemia”)
Establishment: Portugal (EU)
Email (privacy contact): myleukaemia@outlook.com
Postal contact: Available on request.
DPO: Not appointed. Use the email above for privacy matters.

When MYLeukaemia incorporates, we will update the controller identity, registered office, and contact details here.

2) What we collect

• Contact & identifiers: name, email, role/company, phone (if provided), and your message.

• Technical/usage data: IP address, device and browser type, pages visited, timestamps, referrer/UTM, basic diagnostics produced by hosting/security tools.

• Preferences: subject selected on the contact form, and any marketing preferences (if you opt in).

Do not submit special-category data (e.g., health, genetic/biometric data) or patient information via the website. If such data is sent inadvertently, we will promptly delete or restrict it and ask you to use an appropriate clinical/secure channel.

3) How we collect it

• Directly from you (forms, emails, meeting bookings).

• Automatically via your browser and our hosting/security/analytics tools (see Cookies).

If we receive your details indirectly (e.g., someone introduces you by email), we process minimal contact data to respond and will point you to this Notice at first contact.

4) Purposes and legal bases

Purpose Examples Legal basis Run, secure, and improve the website Hosting, uptime, logs, fraud/abuse prevention, aggregated stats Legitimate interests (Art. 6(1)(f)) Respond to enquiries / pre-contract steps Partner/pilot/media/careers enquiries, scheduling Art. 6(1)(b) (pre-contract) and Art. 6(1)(f) Keep basic business records & handle disputes Bookkeeping, compliance, regulatory requests, legal claims Art. 6(1)(c) (legal obligation) and Art. 6(1)(f) Optional updates/marketing News you request; unsubscribe anytime Consent (Art. 6(1)(a)) Non-essential cookies/analytics Audience measurement beyond strict-necessary Consent (ePrivacy + Art. 6(1)(a))

Legitimate interests test (summary). We process only what’s necessary to operate a secure, reliable site and to answer requested enquiries, using proportional safeguards (limited retention, access controls, opt-outs). You may object at any time (see Rights).

Special categories. We do not intentionally process special-category data via the website. If received, we will delete/restrict it and request use of appropriate channels.

5) Cookies & analytics

• Essential cookies run to serve the site and maintain security.

• Non-essential cookies/analytics run only after your consent via the banner. You can change/withdraw consent anytime via Cookie Settings.

• See our Cookie Policy / Cookie Settings for details on providers, cookie life, and purposes.

6) Disclosures (recipients)

We share personal data only with:

• Processors (service providers) acting on our instructions under GDPR-compliant contracts (e.g., hosting, security, email/form handling, CRM/booking, analytics).

• Professional advisers/insurers where necessary.

• Public authorities/regulators where required by law or to establish/exercise/defend legal claims.
  We do not sell personal data. An up-to-date list of processors is available on request.

7) International transfers

If data is transferred outside the EEA/UK, we use adequacy decisions or Standard Contractual Clauses (SCCs) with appropriate transfer impact assessments and safeguards. You may request information about relevant safeguards at myleukaemia@outlook.com.

8) Retention

We retain personal data only for the shortest period necessary for each purpose:

• Enquiries & correspondence: up to 24 months after last activity.

• Security/log data: up to 12 months (longer if needed to investigate incidents).

• Marketing (opt-in): until you withdraw consent or unsubscribe.
  We may extend retention where needed to comply with law or for legal claims (then delete or anonymise).

9) Security

We apply appropriate technical and organisational measures, including TLS encryption, access controls/least-privilege, audit/logging, backups, and vendor due-diligence with DPAs. No method is perfectly secure; we review and improve safeguards periodically.

10) Your rights

Subject to legal limits, you can request:

• Access, rectification, erasure, restriction, portability, and objection (especially to processing based on legitimate interests or to direct marketing).

• We do not make decisions based solely on automated processing producing legal or similarly significant effects.
  To exercise rights, email myleukaemia@outlook.com. We reply within 1 month (extendable by 2 months for complex requests).

You may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) or with any EU supervisory authority where you live or work.

11) Children

The site is not intended for children under 16. If we learn we’ve collected such data, we will delete it promptly.

12) Third-party links

Third-party sites have their own privacy notices. Please review them before providing data.

13) Changes to this Notice

We may update this Notice. Material changes will be posted here with a new “Last updated” date.

Plain-English summary

We use the minimum data needed to run this site and answer messages; non-essential cookies only run with consent; we don’t sell data; and you can access, fix, delete, object, or unsubscribe anytime by emailing myleukaemia@outlook.com.