Health data notice
How your health information is protected, who can see it, and how long it is kept.
Last updated 9 November 2026
Who is responsible
BÚZIOS E TARTARUGAS - LDA (Eleva.care) runs the booking, payment, video and messaging platform. The independent expert you choose provides your care and is responsible (the controller) for the clinical content of your sessions: the notes, transcripts and reports they create.
Eleva is responsible for your account, bookings, payments and support requests. When Eleva stores session records for your expert, it acts only on the expert's documented instructions, as their processor (see the Data processing agreement).
What health information we may hold
Depending on how you use Eleva:
- What you choose to tell the expert when you book or in a message, for example the reason for your visit.
- Session details: the time, the expert, and whether you meet online, by phone or in person.
- Encrypted session records: intake answers, the expert's notes, and reports not yet shared with you.
- A live transcript of the session, only when you turn it on for that booking.
We never use your health information for advertising.
Why it is used (GDPR Article 9)
Your expert uses it to provide the care you ask for, as a health professional bound by professional secrecy (Article 9(2)(h) and 9(3) GDPR). When Eleva stores it as processor, it follows your expert's instructions and the Data processing agreement.
Where you give your own explicit consent, for example to live transcription or to an AI draft of the session report, we record it on behalf of your expert, with the date and the text you saw. You can withdraw it at any time; the Privacy notice explains how.
How it is protected
Session records are encrypted before they are stored, and files are kept in a private store that only signed-in people with a reason to see them can reach. See Security.
How long it is kept
- Session records (intake, notes, transcript, report): 7 years after the last session.
- Bookings and payments: 10 years, for payment and tax records.
- Security logs: up to 1 year.
The full table is in the Privacy notice.
Your rights
Write to privacy@eleva.care. For clinical content your expert is responsible for, we may ask you to contact them first, and we help you do it. You can also complain to the CNPD, the Portuguese data protection authority.