Política de Privacidade

1. Scope

This Privacy Policy governs the collection and processing of Personal Data of users (hereinafter "User" or "Users") in the context of using the Telos Care iOS and Android Apps, the Website and our support channel (email) (collectively, the "Service"). The Privacy Policy communicates to Users information about the exercise of their rights regarding Personal Data, under Regulation 2016/679, of April 27, General Data Protection Regulation ("GDPR").

If you do not agree with this Policy, please do not use our Service.

2. Data Protection Contact

TELOS, LDA has designated a contact for data protection matters. If you have questions or suggestions regarding our personal data processing policies or practices, please contact us by sending an email to contact@telos.care or writing to our address Rua Hermano Neves, 18, Piso 3, Escritorio 7 V5079, 1600-477 Lisboa, Portugal.

3. Registration and Authentication

To register and log in to Telos Care App, the User must enter the necessary data in the application to create a profile, or connect through an account they have with Google or Apple.

By choosing the second option, the User assumes responsibility for the information shared through Google or Apple accounts, which may be managed according to these entities' own privacy policies.

4. Data Collection and Processing

TELOS, LDA will be responsible for the collection and processing of Users' personal data, under applicable personal data protection legislation, for the purposes of providing health management services.

5. Purposes of Processing and Legal Basis

Personal data collected will be processed and stored electronically by TELOS, LDA for the provision of services and content availability. To provide the requested services, help manage health records, and communicate with our Users about such services, we collect and process Personal Data, including health data, committing to process them only for the purposes of providing the services requested by you and for the management of the App systems and services.

The legal basis for Personal Data processing includes processing data to:

• Perform the contract and provide the Services (Article 6(1)(b) GDPR).
• Comply with legal obligations (Article 6(1)(c) GDPR).
• Pursue legitimate interests in reliability, security and fraud prevention (Article 6(1)(f) GDPR).
• With your explicit consent for health data (Article 9(2)(a) GDPR).

Your data may be communicated to third parties when transmission is carried out within the scope of compliance with a legal obligation, a decision of the National Data Protection Commission or other relevant control entity, or a court order; or when communication is carried out to protect Users' vital interests or any other legitimate purpose provided by law.

Your Personal and Health Data may be stored outside Portugal but within the European Union. The Company performs appropriate due diligence to ensure that such persons and/or service providers are bound by confidentiality duties and the Company implements measures, when necessary, such as standard contractual clauses for data protection adopted by the European Commission, to ensure that any transferred Personal Data remains protected and secure.

We do not sell personal data and do not share it with advertisers.

6. Personal Data Retention

Personal Data collected must be stored so that they can be identified only for the period considered appropriate and/or necessary to fulfill the objectives that motivated their collection, in accordance with applicable Laws. App access data will be retained for the period in which Users maintain an active account, except for access logs (crash reports), which are retained for a maximum of 90 days. Other data is retained as long as the account is active. When you delete your account, all your Personal Data is immediately and permanently deleted from active systems. Backup copies are overwritten on their normal retention cycle and are no longer accessible for routine use; this occurs within 90 days. We may retain limited information where required by law or for the establishment, exercise, or defense of legal claims; such data is access-restricted and deleted once no longer required.

7. Data Subjects' Rights

In accordance with the GDPR, Users have the following rights under data protection law:

• Right of Access:

  The right to confirm whether your personal data is being processed, as well as the right to access your personal data and certain information, including obtaining a copy of your personal data being processed.

• Right to Rectification:

  The right to obtain rectification of inaccurate personal data concerning you, as well as the right to complete your data if it is incomplete.

• Right to Erasure:

  The right to request erasure of your data in certain cases, namely if your personal data is no longer necessary for the purpose that motivated its collection or processing.

• Right to Restriction of Processing:

  The right to request restriction of processing of your data in certain cases, namely if the processing is unlawful and you oppose erasure of the data, requesting instead restriction of its use.

• Right to Data Portability:

  The right to receive your personal data that you have provided to the controller, in a structured, commonly used and machine-readable format, including the right to transmit that data to another controller.

• Right to Object:

  In certain cases, particularly when your personal data is processed for direct marketing purposes, you may object at any time, for reasons related to your particular situation, to the processing of your data.

• Right to Withdraw Consent:

  Where processing is based on consent, you may withdraw it at any time without compromising the lawfulness of processing based on previously given consent.

Such requests should be addressed to the Data Protection Contact through the contacts mentioned above.

If you consider that the processing of personal data by our Company does not meet legally required requirements, you may file a complaint with the National Data Protection Commission (www.cnpd.pt), in case you understand that the processing of your data violates the legal regime in force at any time.

8. Security

We guarantee privacy and security in the processing and transmission of Users' data, maintaining technical means within our reach to prevent loss, misuse, alteration, unauthorized access and misappropriation of personal data provided or transmitted. All data is encrypted in transit and at rest, stored on EU servers.

9. Children

The Service is intended for individuals over the age of majority under applicable laws where they reside (the 'Age of Majority'), unless a valid parental or guardian approval and consent has been obtained in accordance with applicable laws. Under no circumstances should the Service be used by individuals below the Age of Majority without such consent.

We do not knowingly collect personal data from anyone below the Age of Majority without the required parental or guardian consent. If you discover that a child has used the Service without your consent, or that someone has been using the Service for or on behalf of your child without your consent, please contact us using the details in Section 2 (Data Protection Contact). We will take reasonable steps to delete the child's information from our active systems and backups.

10. Links

The App and Website may provide links to pages of other entities. These sites are not owned or operated or controlled by TELOS, LDA, so we are not responsible for, endorse or in any way support or subscribe to the content of these sites, nor of sites linked to them or referenced therein. The use of these links is the sole responsibility of Users.

11. Changes to the Privacy Policy

TELOS, LDA reserves the right to, at any time and without prior notice and with immediate effect, change, add or revoke, partially or totally, this Privacy Policy. Any changes will be published on this same online page. Changes to how your data are used will be notified by the contact details you provided and/or in-app.

Last update date: September 19, 2025.