This Privacy Policy was last updated on 5 November 2026 and applies to visitors of this website, including citizens and legal permanent residents of the European Economic Area and Switzerland.
1. Who we are
This website belongs to the i2X project, Intelligent Implementations of the European Electronic Health Record Exchange Format, co-funded by the European Union under the Digital Europe Programme (grant agreement No 101195323). The project is coordinated by UpHill SA (“UpHill”), corporate entity no. 513509593, with its registered office at Estrada Municipal 506, Ubimedical, 6200-284 Covilhã, Portugal. UpHill is the controller of the personal data collected through this website (the “Website”) for the purposes described below.
2. Protection and privacy of personal data
UpHill respects the privacy of visitors to the Website (“Users”) and takes the measures needed to protect their personal data. We process personal data in line with Regulation (EU) 2016/679 (the “GDPR”), Portuguese Law no. 58/2019 and any other applicable data protection rules. This policy explains when we process your data, how it is collected, who receives it, and what rights you have.
3. What are personal data?
Personal data is any information relating to an identified or identifiable person, directly or indirectly, for example a name, an e-mail address, an online identifier or an IP address.
- Controller: the body that decides the purposes and means of processing. Here, UpHill.
- Processor: a body that processes data on the controller’s behalf, such as a hosting or analytics provider.
- Consent: a freely given, specific, informed and unambiguous choice, made by a clear affirmative action.
- Supervisory authority: the independent public authority that monitors the GDPR. In Portugal it is the Comissão Nacional de Proteção de Dados (CNPD).
4. Data controller
UpHill, identified in section 1, is responsible for processing the personal data collected through the Website for the purposes in section 7.
5. Data Protection Officer
UpHill’s Data Protection Officer (DPO) answers questions about how your data is processed and makes sure your rights are respected. Contact: dpo@uphill.pt.
6. General principles
We make sure personal data is:
- processed lawfully, fairly and transparently;
- collected for specified, explicit and legitimate purposes, and not used in an incompatible way;
- adequate, relevant and limited to what is necessary;
- accurate and kept up to date;
- kept in identifiable form no longer than necessary;
- processed securely, with protection against unauthorised access, loss or damage.
7. Purposes, legal basis and retention
7.1 Website analytics, performance and improvement
| Data | Pages viewed, clicks on downloads and links, approximate location (country), device and browser type, referring page and a pseudonymous online identifier (Google Analytics cookie). We do not collect names or e-mail addresses in analytics, and we do not use advertising features or Google signals. |
|---|---|
| Purpose | To count visits, understand which content is used and improve the Website. Aggregated figures also support the project’s reporting to the European Commission. |
| Legal basis | Your consent, Art. 6(1)(a) GDPR. Nothing is measured until you accept analytics cookies in the cookie banner. You can withdraw consent at any time with “Manage consent” in the footer. |
| Retention | Event-level data: 14 months in Google Analytics. Aggregated monthly totals (visits, countries, downloads) contain no personal data and are kept as part of the project record. |
7.2 Enquiries sent to the project
| Data | Name, organisation, e-mail address, the content of your message, and any information you choose to share. The Website has no contact form: enquiries are sent from your own e-mail program to the project address. |
|---|---|
| Purpose | To answer your question and, where needed, route it to the right consortium partner. |
| Legal basis | UpHill’s legitimate interest in answering enquiries, Art. 6(1)(f) GDPR. |
| Retention | Up to 24 months after the last exchange, or longer if required by law. |
7.3 Newsletter and project updates
| Data | Name and e-mail address, and your professional affiliation if you give it. |
|---|---|
| Purpose | To send the i2X newsletter and project news. |
| Legal basis | Your consent, Art. 6(1)(a) GDPR. |
| Retention | Until you unsubscribe or withdraw consent. |
7.4 Security and operation of the Website
| Data | IP address, date and time, requested page and browser details, recorded in server logs. Strictly necessary cookies that keep the Website and your cookie choice working. |
|---|---|
| Purpose | To keep the Website secure, find faults and prevent abuse. |
| Legal basis | UpHill’s legitimate interest in securing the Website, Art. 6(1)(f) GDPR. |
| Retention | Server logs: up to 90 days. Consent choice cookie: 12 months. |
8. When we share personal data
UpHill relies on other entities for some services. Where they can access personal data, we use contracts and data-processing terms that require appropriate technical and organisational measures. Recipients are:
- the hosting provider of the Website;
- Google Ireland Ltd., which provides Google Analytics 4, only for visitors who accept analytics cookies;
- other i2X consortium partners, only when an enquiry concerns them and only as needed to answer it;
- public authorities, where the law requires it.
As a rule we keep personal data within the European Union. Google may process analytics data outside the EEA. Any such transfer relies on an adequacy decision of the European Commission or on standard contractual clauses with appropriate safeguards. Embedded or linked third-party content, such as YouTube videos, is governed by that provider’s own policy and loads cookies only after you consent.
9. Your rights
You may at any time exercise the following rights, without affecting the lawfulness of processing carried out before:
- Access: confirmation that we process your data, and a copy with the purposes, categories, recipients, retention period and your rights.
- Rectification: correction or completion of inaccurate or incomplete data.
- Erasure: deletion where the data is no longer needed, you withdraw consent and no other basis applies, you object successfully, the data was processed unlawfully, or the law requires deletion. It does not apply where processing is needed for a legal obligation, for statistical or scientific purposes where erasure would seriously impair them, or for legal claims.
- Restriction: limiting processing while accuracy is checked, or where you have objected and the check is pending.
- Portability: receiving data you provided in a structured, machine-readable format, where processing is based on consent or contract and is automated.
- Objection: to processing based on our legitimate interest. We stop unless we have compelling legitimate grounds.
- Withdrawal of consent: at any time, for example through “Manage consent” in the footer or by unsubscribing from the newsletter.
- Complaint: to the CNPD (www.cnpd.pt) or to the supervisory authority of your own Member State.
10. How to exercise your rights
Write to dpo@uphill.pt. We reply within 30 days. This period may be extended where the request is complex, and we will tell you if so.
11. Security measures
The Website is served over HTTPS only. Administrator accounts use two-factor authentication, access is limited to the people who need it, and the software is kept up to date. Aggregated analytics exports contain no personal data. We review these measures regularly.
12. Cookies and analytics
Strictly necessary cookies keep the Website and your consent choice working. Google Analytics 4 cookies are set, and usage is measured, only if you click Accept in the cookie banner. If you decline, no measurement data is sent. The full list, with each cookie’s purpose and duration, is in the Cookie Policy. You can change your choice at any time with Manage consent in the footer.
13. Changes to this policy
UpHill may update this policy. The “last updated” date at the top changes whenever it does. If we add a new analytics tool or change a purpose, we update this page before the change takes effect and, if the change is substantial, show a notice on the Website.
14. Applicable law
This policy, and the collection and processing of data on the Website, are governed by the GDPR, Law no. 58/2019 and other data protection rules applicable in Portugal.