The protection of your personal data is a priority for us, which is why we are committed to only processing personal data that is strictly necessary for us to provide you with the best service, guaranteeing transparency in information and the application of best practices in the field of security and protection of personal data.
The data processing operation is based on the implementation of the SHEE software - Solutions 4 Healthcare Excellent Experience (hereinafter, "SHEE"), an integrated healthcare ecosystem designed and developed by Shee - Delivering Convenient & Affordable Healthcare, Lda. The SHEE software enables the aggregation of personal customer data from a set of 9 (nine) pharmacies: (I) Farmácia Central da Amora, (II) Farmácia Ronil, (III) Farmácia Largo do Rato, (IV) Farmácia Nova da Sobreda, (V) Farmácia Garantia, (VI) Farmácia Alcântara Terra; (VII) Farmácia A5 Oeiras; (VIII) Farmácia Estácio, (IX) Farmácia Estácio Xabregas, 1 (one) parafarmácia: (I) Shee and 1 (one) Clínica: (I) Clinica da Farma&cia, belonging to the Shee Group.
Shee - Delivering Convenient & Affordable Healthcare, Lda., legal person no. 517050366, with registered office at Rua D. João V, N.º 29-C, 1250-089 Lisboa, determines the purposes and means of the processing in question, together with the following 9 (nine) pharmacies, 1 (one) parapharmacy and 1 (clinic) that make up the Shee Group, thus assuming the position of Joint Data Controllers:
- Farmácia Central da Amora, with the corporate name Fan Farma, Lda., legal person no. 509045600, with headquarters at Rua Movimento das Forças Armadas, N.º 22 B, 2845-380 Lisboa;
- Farmácia Ronil, with the corporate name Ilustre Descoberta U. Lda., legal person no. 509395856, with its registered office at Rua João de Freitas Branco, N.º20 A/B, 1500-359 Lisboa;
- Farmácia Largo do Rato, with the corporate name Kool Koncept Farma, Lda., legal person no. 502403314, with headquarters at Avenida Álvares Cabral, N.º 1, 1250-015 Lisboa;
- Farmácia Nova da Sobreda, with the corporate name Objetivo Dinâmico Lda., legal person no. 514096985, with headquarters at Rua João de Freitas Branco, N.º 20 A/B, 1500-359 Lisboa;
- Farmácia Garantia, with the corporate name Farmácia Garantia, Lda. legal person no. 510673279, with its registered office at Rua João de Freitas Branco, N.º 20 A/B, 1500-359 Lisboa;
- Farmácia Alcântara Terra, with the corporate name Farmácia Alcântara Terra, U. Lda., legal person no. 501137688, with its head office at Rua João de Freitas Branco, N.º 20 A/B, 1500-359 Lisboa;
- Farmácia Estácio, with the company name A3I Serviços Integrados de Saúde Lda., legal person no. 506406415, with headquarters at Rua Bispo de Cochim, N.º 1, 1900-455 Lisboa;
- Farmácia Estácio Xabregas, with the company name A3I Serviços Integrados de Saúde Lda., legal person no. 506406415, with headquarters at Rua Bispo de Cochim, N.º 1, 1900-455 Lisboa;
- Farmácia A5 Oeiras, with the corporate name Farmácia A5 Oeiras, Lda., legal person no. 506248640, with its registered office at Rua João de Freitas Branco, N.º 20 A/B, 1500-359 Lisboa;
- Shee, with the company name SHEE - Delivering Convenient & Affordable Healthcare, Lda., legal person 517050366, with registered office at Rua D. João V, nº 29 C,1250-089 Lisboa.
- Clínica da Farma&cia, with the company name 4FClinic - Healthcare, Lda., legal person no. 514998822, with headquarters at Rua João de Freitas Branco, N.º 20 A/B, 1500-359 Lisboa;
Shee also maintains partnership relations with entities known as 1st and 2nd level subcontractors or other business partners.
The 1st level processor is Quickbytes, unipessoal LDA, legal person no. 517 717 301, with registered office at Avenida Elias Garcia, nº141 B Lisboa, 1050-099 Lisboa, which processes personal data on behalf of the Joint Controllers listed above.
Shee also provides access to the personal data processed in the Shee software to the Pharmaceutical Industry, healthcare professionals and partners, by signing protocols to this effect, as 2nd level subcontractors.
Personal data is subject to anonymization techniques which ensure that it is not attributed to an identified or identifiable natural person. Only anonymized data is transferred to the Pharmaceutical Industry. Whenever your personal data is processed by third parties, we will require them to provide the same level of security and privacy guarantees in terms of personal data protection.
We want to earn your trust and make you feel that your personal data is safe with us, as we will always be committed to protecting your privacy.
How can I contact the Data Protection Officer?
If you have any questions about the processing of your personal data, we will be happy to answer them at the following email address: dpo@shee.pt or by contacting us directly on 21 150 54 76 (national landline).
The personal data processed is as follows:
- Identification data: name; preferred name (how you like to be addressed); gender; ID card number; passport number; date of birth; voice;
- Contact details: address; telephone; e-mail;
- Billing data: tax identification number (TIN);
- Other categories of non-sensitive personal data: National Health System (SNS) number; products and services purchased; average price spent; frequency;
- Family life data: household;
- Work life data: employer;
- Health data: results of biochemical parameters; biophysical parameters; prescription; clinical history; anamnesis;
- Traffic and location data: logs.
- Data for satisfaction/NPS surveys: NPS response (0-10) and free comment (optional); minimum metadata for sending the survey (e.g. e-mail/telephone), when applicable.
Personal data is provided directly by data subjects, or through healthcare professionals, in the following contexts:
- In pharmacies, by filling in the Client File and the Clinical Record;
- In the service channel (API - Contactcenter), through a telephone call between the client (data subject) and a health professional;
- In the Shee software, through registration on the platform by the data subject themselves, which requires filling in an identification form and the automatic extraction of transaction data by the Shee software through Sifarma.
- On the e-commerce platform www.farmaciashee.pt, by filling in the forms made available online to identify the customer/owner.
Registering personal data in the Shee software provides the user with more appropriate, efficient, effective and speedy health care and treatment, as it facilitates access to information about their health and, at the same time, makes it possible to share their personal data with health professionals.
On the other hand, access to certain categories of personal data, organized in the Shee software, by authorized third parties, including the Shee back-office, the Pharmaceutical Industry and partners (through the signing of protocols), contributes to the continuous improvement and personalization of the health care/treatment provided by the units that make up the Shee Group.
The development of the Shee software is the result of the phenomenon of digital transformation that has had a transversal impact on the health sector, boosting a set of valuable functionalities in the interest of those involved - users, health professionals, the pharmaceutical industry and partners.
Therefore, the project to implement the Shee software follows the three main aims assumed by the Portuguese legal system in the field of health data protection, guaranteeing the integrity of this information, the right of access of the holder to the information that concerns him, and protection against undue access and/or disclosure of this information to unauthorized third parties.
The data collected and processed by the Joint Controllers are intended for and are limited to the purposes of (i) automated processing of personal data, purchase and consumption history and data related to transactions carried out through the Shee computer system, (ii) sharing personal data, and/or purchase and consumption history and/or data related to transactions with healthcare professionals, the Pharmaceutical Industry and partners, (iii) personalization of services and campaigns based on customer interests, (iv) marketing communications, and (v) alarming consumption of products or services, covering the following categories of personal data:
a) Automated processing of personal data, purchase and consumption history and data related to transactions carried out via the Shee computer system: name; preferred name (how you like to be addressed); gender; ID card number; passport number; date of birth; voice; address; telephone number; e-mail address; tax identification number (TIN); household name; employer; results of biochemical parameters; bio-chemical parameters; average price spent; frequency; products and services purchased; biochemical parameters; biochemical parameters; biochemical and consumption history; National Health System (SNS) number; employer.Tax identification number (NIF); National Health System (SNS) number; products and services purchased; average price spent; frequency; household; employer; results; biochemical parameters; biophysical parameters; prescription; clinical history; anamnesis; logs;
b) Sharing of personal data, and/or purchase and consumption history and/or data related to transactions with healthcare professionals, the pharmaceutical industry and partners: name; preferred name (how you like to be addressed); gender; ID card number; passport number; date of birth; voice; address; telephone number; e-mail address; tax identification number (TIN); household name; employer; results of biochemical parameters; average price spent; biochemical parameters; biochemical parameters; frequency; household name; employerTax identification number (NIF); National Health System (SNS) number; products and services purchased; average price spent; frequency; household; employer; results; biochemical parameters; biophysical parameters; prescription; clinical history; anamnesis;
c) Marketing communications based on customers' interests: name, e-mail address, telephone number, products and services purchased, average price spent, frequency of purchases, categories, campaigns, services, brands, frequency of visits;
d) Alarm statistics on the consumption of products or services: name, telephone number, e-mail address, medical history, products and services purchased, frequency.
e) The basis for the lawfulness of the processing of the logs corresponds to the need to comply with the legal obligation (pursuant to Article 9(2)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, "GDPR") to electronically record the accesses and health data accessed, which is incumbent on the Joint Controllers, set out in Article 29(7)(c) of Law 58/2019 of August 8.
f) Satisfaction/NPS surveys: collection of the answer to the NPS question (0-10) and, optionally, open comments, in order to measure and improve the experience of customers/users, based on the legitimate interest of the Shee Group in improving services (under the terms of Article 6(1)(f) of the GDPR), with the results being analyzed in aggregate form and no health data being processed for this purpose, and the holders may object at any time.
The basis for the lawfulness of the processing of the other personal data listed above lies in the explicit consent of the data subject, under the terms of Article 9(2)(a) of the GDPR. The constant accuracy and updating of personal data is guaranteed through the possibility of alteration or correction by the data subject (client/user) through direct access to the Shee software, as well as at their request, via the pharmacy operator.
The Joint Data Controllers guarantee that the data is housed in systems equipped with protection measures aimed at ensuring a level of trust appropriate to the risk, in accordance with Article 32 of the GDPR. Personal data is organized by Quickbytes, unipessoal LDA, 1st level subcontractor, according to the following categories: (i) Customers; (ii) Logins; (iii) Log activities; (iv) Sales docs; (v) Newsletter; (vi) E-commerce; (vii) Dictionaries; (viii) Reference Tables; (ix) Forms Data; (x) Business; (xi) Actions. In addition to the Controllers, in some cases the data may be accessed internally by 2nd level subcontractors appointed, where necessary, as data processors by the Joint Controllers. The updated list of these parties can be requested from any of the Joint Controllers at any time. The creation of access is guaranteed by Shee's back-office, through the creation of access credentials, with three (3) profiles that differ according to the categories of personal data that the user can access (Administrator, Creator and Query). Personal data is loaded into the Shee software and stored on the cloud server contracted by SHEE. The automated processing of personal data is carried out within the server.
Personal data will only be kept for the period strictly necessary for the purposes for which it was processed, in accordance with Article 5(1)(e) of the GDPR. Since the processing of personal data is based on the lawfulness of the data subject's consent, as set out in Article 6(1)(a) and Article 9(2)(a) of the GDPR, the retention period corresponds to the moment of withdrawal of consent by the data subject.
The Joint Controllers shall ensure that consent is renewed after 3 years from the date on which it was given, by submitting a request to the data subject to this effect.
Access logs are kept for a maximum of 2 years. The deletion of personal data is guaranteed automatically by Shee's server and complies with the various applicable retention periods. When the processing of personal data depends on the consent of the data subject, the retention period corresponds to the moment of withdrawal of consent.
For satisfaction/NPS surveys, individual records are only kept for as long as is strictly necessary for analysis and the implementation of improvements, never exceeding a maximum period of 12 months; after this period, only aggregated/anonymous data is kept.
As part of compliance with the right to information, enshrined in Article 13 of the GDPR, the pharmacies that make up the Shee Group, as Joint Data Controllers, ensure that their respective Privacy Policies are made available to data subjects by email, in order to acknowledge their consent.
At the same time, pharmacies and Shee permanently publish the Shee software Privacy Policy on their website for users to consult.
On the other hand, the Declaration of Consent that is made available to data subjects emphasizes the following information: (i) the identity and contact details of the Joint Data Controllers; (ii) the purposes of the processing for which the personal data are intended, as well as the fact that consent corresponds to the legal basis for the processing; (iii) the existence of the right to withdraw consent at any time, without compromising the lawfulness of the processing carried out on the basis of the consent given; (iv) the right to lodge a complaint with a supervisory authority; (v) the existence of the right to request the exercise of the rights of consultation, access, rectification, updating, deletion, opposition or portability of personal data; (vi) the existence of automated decisions, including the definition of profiles.
Data subjects may exercise their rights of access and portability before any of the Joint Data Controllers by sending a written request to the email address dpo@shee.pt or by contacting them directly on 21 150 54 76 (national landline), or by contacting the operators of any of the pharmacies that are part of the Shee Group in person.
When requested by the data subject, the Joint Data Controller who receives the request provides a copy of the personal data being processed. If the data subject submits the request by electronic means, and unless the data subject requests otherwise, the information is provided in a commonly used electronic format.
Data subjects can exercise their right to rectification by submitting a written request to dpo@shee.pt, or by calling 21 150 54 76 (national landline), setting out the personal data that needs to be completed/amended and how. You can also do this in person at the pharmacies that are part of the Shee Group.
Data subjects also have the right to obtain from any of the Joint Controllers the erasure of their personal data by exercising the right to withdraw consent, which is the basis for lawful processing.Consent can be withdrawn in the same way as it was given: (i) In pharmacies, via the pads; (ii) In the Shee software, by accessing the "Consent Management" tab; (iii) In the customer service channel (API - Contactcenter), by making an oral statement; (iv) On the e-commerce platforms www.farmaciashee.pt, by accessing the "Consent Management" tab. Without prejudice, the data subject may exercise their right to erasure by sending an express written request via email to dpo@shee.pt. The request to exercise the right to erasure can also be made orally, in person at Shee or at the operators of the pharmacies that are part of the Shee Group, or by calling 21 150 54 76 (national landline).
The Joint Data Controller who receives the request to exercise rights guarantees either the erasure of personal data or its rectification within a maximum period of one month following receipt of the request, sending proof thereof to the data subject by the same means by which the request to exercise rights was submitted.
The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her, including profiling, or, for NPS and to opt out of receiving invitations to future surveys.
In such cases, the data subject may submit an express request, in writing, by sending an e-mail to dpo@shee.pt. The request to exercise the right to object can also be made orally, in person at Shee or at the operators of the pharmacies that are part of the Shee Group, or by calling 21 150 54 76 (national landline).
The Joint Data Controller who receives the request ensures that the processing of personal data relating to the requesting data subject is completed within a maximum period of one month, and the data subject is notified of this operation by the same means by which the request was submitted.
The right to restriction of processing is exercised under the same terms as the right to object, by submitting a written request, by e-mail, or in person to Shee or the operators of the pharmacies that make up the Shee Group, as well as by calling 21 150 54 76 (national landline).
If necessary, the holder of personal data may also lodge a complaint with the National Data Protection Commission (CNPD).
The Shee Group will notify data subjects when a breach occurs that involves a high risk to their rights and freedoms, and is obliged to do so within 72 hours of the incident. Pursuant to Article 34(3) of the GDPR, communication to the data subject is not required in the following cases: If the Shee Group has applied appropriate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the personal data breach, especially measures that render the personal data incomprehensible to any person not authorized to access such data, such as encryption; If the Shee Group has taken subsequent measures to ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialize; If communication to the data subject would involve a disproportionate effort for the Shee Group, in which case it will make a public announcement or take a similar measure through which the data subject will be informed. Any breach of personal data, the processing of which is the responsibility of the Shee Group, may be reported via the following e-mail address: dpo@shee.pt.
The Shee software uses cookies. To find out more about cookies, the data subject can consult our Cookie Policy. If you prefer not to allow cookies, you can disable cookies in the browser you use, but please note that this may prevent some web pages from being displayed correctly.
Pursuant to Article 37(1)(a) and (2) of the GDPR, the Shee Group has appointed a Data Protection Officer, who will ensure that any questions relating to privacy and data protection are addressed to the Data Protection Officer at the following e-mail address: dpo@shee.pt.
The Joint Data Controllers reserve the right to make changes to this privacy policy at any time by communicating it to their users via e-mail or directly on the website, to the extent that it is technically and legally feasible - by sending a notice to users via the contact information provided to the Joint Data Controller. It is highly recommended that the website be consulted several times in relation to the latest modification described at the bottom. If the changes affect processing activities carried out on the basis of the user's consent, the Joint Controller will collect new consent from the user where required.
LATEST VERSION: 16.10.2025
falecomigo@shee.pt
+351 21 150 54 76 
create account