Privacy Policy
Last updated: 22 October 2026
This policy explains how Joana Amram ("I", "me") collects, uses and protects personal data shared through www.joana-amram.com and during nutritional therapy support. It complies with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Portuguese Law 58/2019.
1. Who I am
Data controller: Joana Amram, Registered Nutritional Therapist (ANP, APENB), NIF 249775999, Rua Alexandre Herculano 19, Lisbon, Portugal.
Contact for any question about your personal data: joana@ammarhealth.com · +351 912 434 432.
2. What data I collect, why, and on what legal basis
a) Gut quiz and intake questionnaire
Name, email, answers and result. I use them to send you your result, prepare your first session and, if you ask, follow up. Website forms are sent through Formspree. Legal basis: consent (Art. 6(1)(a)). Answers about symptoms are special category data and are processed with your explicit consent (Art. 9(2)(a)).
b) Free calls and session bookings
Name, email, time zone and any notes you add when booking (via Calendly and Google Calendar). I use them to book and hold the call or session. Legal basis: steps prior to a contract and performance of the service you requested (Art. 6(1)(b)).
c) Client records (clients only)
Identification and contact details, intake questionnaire, history of symptoms and wellbeing, eating and lifestyle habits, medication and supplements, any test results you share, session notes, plans and follow-up communication. This is special category data (Art. 9 GDPR) and receives extra protection. Legal basis: your explicit written consent, given before the first session (Art. 9(2)(a)), and performance of the service (Art. 6(1)(b)).
d) Laboratory tests (optional)
If you decide to do a test (for example, a microbiome analysis), I send the Teletest laboratory (Spain) the data needed to order and deliver the kit: name, contact details, delivery address and type of test. I receive the report so we can go through it together. Legal basis: your explicit consent and performance of the service.
e) Online sessions and messages
Online sessions are held on Zoom and are not recorded. If you prefer to message on WhatsApp, the messages you send me are processed by WhatsApp (Meta). You can always choose email instead. Legal basis: performance of the service and your consent.
f) Email enquiries
Name, email and the content of your message, so I can reply. Legal basis: consent and legitimate interest in answering enquiries (Art. 6(1)(a) and (f)).
g) Invoicing
Name, tax number (NIF) and address, to issue invoices through the Portuguese Tax Authority portal. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
h) Website analytics and advertising
With your consent in the cookie banner, I use Google Analytics 4 and Google Tag Manager to understand how the site is used, and Google Ads conversion measurement to see which ads lead to bookings. Data: pseudonymised identifier, pages viewed, actions, device, browser, approximate location and truncated IP address. I use Google Consent Mode: without your consent, no analytics or advertising cookies are stored. Legal basis: consent (Art. 6(1)(a)).
3. Use of artificial intelligence tools
To organise notes and prepare personalised plans, I use the AI assistant Claude, by Anthropic, on a business account. Under Anthropic's commercial terms, the data is not used to train models. Every recommendation is reviewed and decided by me. No decision about you is made by automated means.
4. Who I share data with
I do not sell personal data or share it for third-party marketing. I use the following providers (processors), who handle data only on my instructions and under data protection agreements:
- Google (Gmail, Drive, Calendar, Sheets, Analytics, Tag Manager, Ads): email, storage of records and documents, calendar, analytics and advertising;
- Anthropic (Claude): AI assistant to organise notes and prepare plans;
- Notion: organising notes and working materials;
- Calendly: bookings;
- Zoom: online sessions;
- WhatsApp (Meta): messages, if you choose this channel;
- Formspree: sending website forms;
- Squarespace: website hosting.
I also share data with the Teletest laboratory (Spain), only if you do a test and with your consent; with the Portuguese Tax Authority, for invoicing; and with public authorities where the law requires it. I only share information with your doctor or another professional if you ask me to or authorise it.
5. Transfers outside the European Union
Google, Anthropic, Notion, Calendly, Zoom, Formspree, Squarespace and Meta (WhatsApp) are based in, or run services from, the United States, so some data may be processed outside the EU. These transfers are protected by the EU–US Data Privacy Framework, where the company is certified, and/or by the Standard Contractual Clauses approved by the European Commission, with additional measures such as encryption. The Teletest laboratory is in Spain, within the EU.
6. How long I keep data
- Gut quiz: up to 24 months, or less if you ask.
- Bookings and enquiries from people who do not become clients: up to 12 months.
- Client records: 5 years after the last session, then securely deleted.
- Invoicing: the period required by tax law (10 years).
- Google Analytics data: 14 months.
7. Your rights
At any time you can ask for access to your data, rectification, erasure, restriction of processing and portability. You can also object to processing based on legitimate interest and withdraw your consent, without affecting what was done before. To do so, write to joana@ammarhealth.com. I reply within 30 days at the latest.
If you are not satisfied, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt.
8. Security
I use strong, unique passwords, two-factor authentication wherever possible, restricted access and controlled devices. If a data breach puts you at risk, I inform the CNPD within 72 hours and, where required, the people affected.
9. Cookies
Essential cookies make the site work and do not need consent. Analytics and advertising cookies are only used if you accept them in the banner, and you can change your choice at any time.
10. Children
This website and its services are intended for adults aged 18 and over. Support for minors only takes place with the consent and presence of a parent or legal guardian.
11. Changes
This policy may be updated. The date at the top shows the current version. If there are significant changes, I will let people whose email address I hold know by email.