___
Last updated: August 2026
She Cares Project ("we," "us," "our") is a nonprofit organization registered in Portugal, working to improve access to healthcare for women who would not otherwise have it,through pro-bono clinical days delivered with our partner clinics in Lisbon and Spain. This policy explains what personal data we collect through www.shecaresproject.org, why, and what rights you have over it.
Data controller: SheCares Registered address: Rua Actor Vale 8 Contact:info@shecaresproject.org
Website visitors. If you fill in a contact form, sign up for our newsletter, or make an inquiry, we collect your name, email address, and anything else you choose to tell us.
Donors. If you donate, including through "Sponsor a Woman", we collect your name, email address, and donation amount. Payment card details are processed directly by our payment provider, Stripe, and are never stored on our own systems.
Corporate partners. If your company sponsors SheCares, we collect the business contact details needed to manage the partnership (name, role, company, email, phone).
Partner organizations and referrals. If you refer women to us for care, we collect the contact details of your organization and the minimum information needed to coordinate a referral.
Women receiving care through SheCares. SheCares does not collect or store medical records. We coordinate referrals using only the minimum contact and scheduling information needed such as a name and a contact method, and, where relevant, the general type of care being referred for (for example, "gynecological check-up"). Any clinical information —medical history, diagnosis, test results, treatment notes — is handled directly by the treating clinic under its own separate medical confidentiality obligations, not by SheCares. See the note below on how we handle even this limited health-related information.
Automatically collected data. Like most websites, ours uses cookies and similar technologies to understand how the site is used. See our Cookie Policy for details.
We process personal data to: respond to inquiries and manage donor and partner relationships (legitimate interest / contract); process donations (contract, and legal obligations such as accounting rules); coordinate healthcare referrals (explicit consent, given the sensitivity of health data); send newsletters or updates (consent, which you can withdraw at any time); and comply with our legal and financial reporting obligations (legal obligation).
SheCares does not collect, request, or store medical records. Any health-related detail we do hold in connection with a referral — such as the general type of care a woman is being referred for — is limited to what's needed to coordinate the appointment, is collected only with the woman's informed consent, is accessible only to the coordination staff who need it to arrange the referral, is never used for marketing, fundraising, or storytelling without a separate, specific consent (for example, for an anonymized impact story), and is deleted once it is no longer needed to coordinate that referral. Because it relates to health, even in this limited form, we treat it with the same care as "special category" data under GDPR, even though we do not hold clinical records ourselves.
We do not sell personal data. We share it only with our partner clinics, to the extent necessary to coordinate a referral; Stripe, our payment processor, to process donations; Google Analytics, to understand how visitors use our website; any marketing tools we may adopt in the future (for example, an email marketing platform or a social media advertising pixel) — this policy will be updated before any such tool goes live; and public authorities, where we are legally required to.
Some of these providers, including Stripe and Google Analytics, may process data outside the European Economic Area. Where this happens, we rely on the safeguards those providers have in place, such as the European Commission's Standard Contractual Clauses.
We keep personal data only as long as needed for the purpose it was collected: donor records for as long as needed for accounting and tax purposes; newsletter and marketing data until you unsubscribe; referral coordination data (see above — this does not include medical records, which we do not hold) only for as long as needed to arrange the referral, and then deleted.
Under the EU General Data Protection Regulation (GDPR), and equivalent UK GDPR provisions for UK-based visitors, you have the right to access the personal data we hold about you, correct it if it's inaccurate, ask us to delete it, restrict or object to certain processing, receive a copy of your data in a portable format, and withdraw consent at anytime where we rely on consent. To exercise any of these rights, contact us at info@shecaresproject.org. You also have the right to lodge a complaint with your national data protection authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados); in Spain, the AEPD (Agencia Española de Protección de Datos); in the UK, the ICO (Information Commissioner's Office).
Our services are directed at adult women. We do not knowingly collect personal data from children. If you believe a child's data has been submitted to us, contact us and we will delete it.
We use reasonable technical and organizational measures — including [encryption / accesscontrols / staff training, as applicable] — to protect the personal data we hold. No system is completely secure, and we encourage you to also take care with your own information online.
We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Material changes will be reflected on this page before they take effect.
Questions about this policy or your data: info@shecaresproject.org
