Privacy Policy

1. Data controller

For customer account data (registration, billing, support), Salvus is the data controller. For the data the customer enters into the platform about their workers, Salvus acts as a processor.

2. Data we process

We process identification and contact data, billing data and service usage data. On behalf of customers, the platform may process workers' health data (special category, Article 9 of the GDPR), such as fitness certificates and occupational medicine exams.

3. Purposes and legal bases

We process data to provide the service, manage the contractual relationship, comply with legal obligations and improve the platform. Legal bases include performance of the contract, compliance with legal obligations and legitimate interest.

4. Health data

Health data is processed solely on behalf of and under the instructions of the customer, with reinforced measures of minimisation, role-based access control and encryption. Salvus does not use this data for its own purposes.

5. Security

We apply encryption at rest and in transit, company- and role-based access control, audit logs, strong authentication and backups. The primary database resides in the EU region; supporting services may process data in other regions under appropriate transfer safeguards.

6. Sub-processors

We use Supabase (EU database, authentication and storage), Vercel (hosting and cookieless technical metrics), Resend (transactional email), Google (Calendar and Meet when enabled; Analytics after consent), PostHog (analytics after consent), and the selected AI provider among OpenRouter, Groq, Google Gemini, NVIDIA, Anthropic and OpenAI. Each service receives only what its purpose requires: calendar invitations include type, time, organisation, name and email; AI receives the context required for the requested action and is not deliberately sent individual clinical records. See the DPA for applicable regions, transfers and conditions.

7. Retention

We retain data for the duration of the contract and for the periods required by law. After those periods, data is securely deleted or anonymised.

8. Data subject rights

Data subjects may exercise the rights of access, rectification, erasure, restriction, portability and objection. Where Salvus acts as a processor, we forward requests to the responsible customer.

9. Contact and complaints

To exercise rights or raise questions, contact info@salvus.pt. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD).

10. Cookies and tracking technologies

We use strictly necessary cookies (authentication session and preferences), Vercel cookieless technical metrics and, with your consent, Google Analytics 4 and PostHog when configured. Your choice is stored locally and can be changed at any time. For full details, see our Cookie Policy at salvus.pt/cookies.