Privacy policy.

1. Controller

Orquídeas Etéreas, Unipessoal LDA (Orvida), NIPC 518912329, Lisbon. Data protection contact: info@orvida.eu.

2. Data we process

Professional registration data (name, licence or college number, NIPC/NIF, clinic, delivery address, email, phone), order and invoicing data, vigilance reports (with no patient-identifying data) and technical browsing data with your consent.

3. Purposes and legal basis

Verification of the professional licence and performance of the sales contract (Article 6(1)(b) GDPR); legal traceability and medical-device vigilance obligations (point (c)); legitimate interest in security and fraud prevention (point (f)); analytics and commercial communications with consent (point (a)).

4. Sharing

Carrier for delivery; manufacturer and competent authorities (INFARMED, AEMPS) in vigilance procedures; accountant, hosting providers and the web-form provider (Formcarry, USA), under a processor agreement. We do not sell data.

5. International transfers

Vigilance reports to the manufacturer, in China, limited to what is necessary and with no patient data. European Commission standard contractual clauses. The website forms are processed by Formcarry, in the United States, under the European Commission Standard Contractual Clauses.

6. Retention

Medical-device distribution records: 10 years after the last delivery (MDR). Invoicing: 10 years. Account data: while the account is active and for 2 years after. Analytics: 14 months.

7. Your rights

Access, rectification, erasure, restriction, portability and objection, by email to info@orvida.eu. Complaints to the CNPD, the Portuguese supervisory authority.

8. Cookies

Essential cookies only by default. Anonymous analytics (GA4, Clarity) only with consent. See the cookie policy.

9. Security

Restricted access, encryption in transit, backups, access logging. Breach notification under the GDPR.

Orquídeas Etéreas, Unipessoal LDA · NIPC 518912329 · Lisbon · info@orvida.eu. Last updated: August 2026.