Tell me about your case

Privacy Policy

Version v6-2026-09 · Last updated: 10 November 2026

1. Who is the controller

Controller: Carmem Carvalho
Address: Santa Cruz de Tenerife · Spain
Activity: Private practice in integrative biological medicine
Contact email: hola@carmemcarvalho.com

For any matter relating to your personal data, write to that email address and we will reply within the applicable legal period.

2. What data we collect

If you fill in the form, we collect:

  • Contact details: your phone number (WhatsApp), your name and, if you wish to give it to us, your email address. To talk about your case we write to you on WhatsApp and have a first call; what we do with the email address is covered in sections 3 and 6.
  • Your situation: if you agree to tell us more: the area of the island you are writing to us from (or whether it is outside Tenerife), your age group, in which areas you notice discomfort (digestion, energy, mind or body), whether or not you have a prior diagnosis, and whether you have tried other things before.
  • How you filled it in: which step you are on, how long it took you and whether there were errors.
  • Technical data: type of device, browser language, the language of the page on which you fill in the form, the page you landed on, the origin of the visit, and an encrypted, salted identifier of your IP address. We never store your IP address in plain form.
  • Your journey through the website: while you browse, your browser stores locally which pages and sections you viewed, for how long, and what part of the video you played. That information does not leave your device unless you submit the form; when you submit it, it is attached to your record so that we can understand what you found useful. If you do not submit it, it stays in your browser and we do not receive it.

Even if you do not fill anything in, we measure in aggregate, without identifying you, how the website is used. And if you accept the cookie notice, the services detailed in the Cookie Policy, including session recording, are also switched on.

About health data. What we ask for are general self-classifications by area —“digestion”, “energy”— and whether or not there is a prior diagnosis: we do not collect what that diagnosis is, nor any medical history or medical reports. Even so, out of caution we treat them as special category data under Article 9 of the GDPR: they are collected with your explicit consent, are masked in session recordings and are not shared with any of the advertising providers in section 6.

3. What we use it for

  • Contacting you on WhatsApp to talk about your case, have a first free call and, if it is a good fit, propose that you join the support programme.
  • If you left the form half-finished, asking whether you wanted to complete it.
  • Storing your record in the contact management system (CRM) that Carmem and her team use to follow up each person who gets in touch.
  • Adapting what we tell you to your particular situation.
  • Understanding, in aggregate, which channels and which content work.
  • Writing to you by email, if you gave us your address: information related to what you came looking for, content and, where relevant, our services. You can unsubscribe at any time, using a link in every email or by writing to us, and we will stop without asking you to explain yourself.
  • Measuring and targeting our advertising. Your phone number and email address, always irreversibly encrypted, are shared with the platforms where we advertise —today Google and Meta, and where relevant TikTok— to find out which campaigns work and to show or stop showing adverts to people who already know us. The detail is in section 6.

We do not use your data to sell it, pass it to third parties for their own commercial purposes or make automated decisions about you. And nothing you tell us about your health leaves here: what is described in section 6 is only encrypted contact details, never symptoms or diagnoses.

4. On what legal basis we process it

  • The form data: your consent, which you give unambiguously by pressing the button after reading the notice that accompanies it (Article 6(1)(a) GDPR). For the data covered by Article 9 GDPR, explicit consent (Article 9(2)(a)).
  • Aggregate measurement without identifying you: our legitimate interest in understanding and improving our own website (Article 6(1)(f)). You can object by writing to us.
  • Analytics and advertising cookies: your consent in the cookie notice.
  • Sending your encrypted contact details to the platforms where we advertise (section 6): the consent you give when you submit the form, on the same screen where you leave your contact details (Article 6(1)(a) GDPR). It does not depend on the cookie notice: that notice decides what runs in your browser, and this leaves from our server.
  • The measurement and session recording carried out by PostHog, whether or not you accept the cookie notice: the same legitimate interest as in the previous point. If you do not accept, nothing is stored on your device and you cannot be recognised between visits.
  • The emails we send you: the consent you give when you leave us your email address, having read on that same screen what we will use it for (Article 6(1)(a) GDPR and Article 21 of the LSSI). You can withdraw it whenever you like, using a link in every email or by writing to us.

You can withdraw your consent at any time by writing to the email address in section 1, without affecting the lawfulness of the processing carried out before.

5. How long we keep it

  • Your record: a maximum of 24 months from our last interaction with you, unless you ask for it to be deleted sooner. After that period it is deleted or irreversibly anonymised.
  • Session recordings: 30 days, and then they are deleted automatically.
  • Campaign attribution stored in your browser: 90 days.

6. Who else processes your data

The database where your record lives is on our own server, in Tenerife: it is not hosted by any provider.

The same applies to the contact management system (CRM) where Carmem and her team consult your record: it is also on our server and only the team has access.

WhatsApp messages are sent from our server and travel over the WhatsApp (Meta) network, which processes them under its own terms.

We work with the following providers, all under a data processor agreement in accordance with Article 28 of the GDPR:

  • OVHcloud — hosts our backup server, in Canada (a country the European Union recognises as providing an adequate level of protection). It only comes into play if our main server does not respond when you submit the form: it stores your submission encrypted, without being able to read it, and deletes it as soon as it hands it over to us.
  • Cloudflare — serves the website, protects it against abuse and carries the form to our server.
  • PostHog — the tool we use to understand how the website is used. Data hosted in Frankfurt (Germany). It records the session of every visit —how you move around the page, with what you type always hidden— to understand what works and what does not. It works in two modes: if you do not accept the cookie notice, it measures and records your visit without storing anything on your device and without being able to recognise you afterwards; if you accept, it also stores a cookie that allows it to link your visits to one another. The detail is in the Cookie Policy.

And the platforms where we advertise, which process your data in two different ways: their tags run in your browser only if you accept the analytics and advertising cookies; and your encrypted contact details reach them from our server with the consent given in the form (explained just below):

  • Google (Google Analytics 4 and Google Ads) — measuring the performance of the website and of campaigns.
  • Meta Platforms (Meta Pixel) and TikTok (TikTok Pixel) — measuring the performance of advertising campaigns.

About advanced matching and remarketing: Google, Meta and TikTok may receive an irreversibly encrypted version (a cryptographic digest) of your phone number and your email address. It serves two purposes: attributing the conversion to the right campaign when cookies fail, and targeting or excluding adverts at people who already know us. They cannot reverse that encryption or see your data in plain form, and they receive nothing of what you tell us about your health. Today we use Google and Meta; TikTok only if we switch it on. We do this from our server with the consent you give when you submit the form, and it does not depend on what you choose in the cookie notice. If you reject that notice, your encrypted contact details are used only to attribute the conversion, not to target adverts at you.

Transfers outside the European Economic Area are covered by the standard contractual clauses approved by the European Commission and, where applicable, by the EU-US Data Privacy Framework.

7. Your rights

At any time you can exercise these rights over your personal data:

  • Access — to know what data we hold about you.
  • Rectification — to correct inaccurate data.
  • Erasure — to ask us to delete it.
  • Objection — to ask us to stop processing it.
  • Restriction — to restrict its use in certain circumstances.
  • Portability — to receive it in a structured format.
  • Withdrawing consent — at any time, without retroactive effect.

To exercise them, write to us at hola@carmemcarvalho.com stating your request clearly. We will reply within a maximum of one month.

If you consider that the processing of your data is not appropriate, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. The form saves itself

So that you do not lose what you have written if you close the page, the form saves your answers as you go. That means that, even if you do not reach the last step, what you have entered is recorded.

If you left your contact details and did not finish, we may write to you to ask whether you wanted to carry on. If you do not want us to, tell us by email.

If you type your number but do not press the button, we never write to you. Without that click there is no consent, and without consent there is no message.

9. Cookies and local storage

The full detail —what is stored, who processes it, how long it lasts and how to change it— is in the Cookie Policy.

10. Changes to this policy

If we make a substantial change to this policy, we will notify you by email at the address you gave us, if you gave us one. The current version will always be available on this page, identified by the version number in the header.