Privacy policy
This policy explains how personal data is processed when someone visits this website, contacts the clinic or requests information or an appointment. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and the applicable healthcare regulations.
1. Data controller
Controller: Marc Esteve Fernández
Tax ID (NIF): 41527385B
Address: Carrer Orient, 14, 6è-A, 17230 Palamós (Girona), Spain
Email: clinicadentalesteve@gmail.com
Phones: +34 972 317 358 / +34 620 897 373
2. Data that may be processed
Depending on the channel used, identification and contact data may be processed, such as first name and surname, phone number, email address and the content of communications.
If users provide information about their state of health, medical history, tests, diagnoses or dental treatments, this information may constitute health data, a special category of data under the GDPR. Such data will only be processed where necessary for the provision of healthcare or on another legal basis, with the appropriate confidentiality safeguards.
3. Purposes of processing
- Responding to enquiries and contact requests.
- Managing appointment requests and information about dental services.
- Providing and managing the dental services requested.
- Managing the relationship with patients and users.
- Complying with legal, tax, accounting, healthcare and professional obligations.
- Managing, where applicable, the exercise of data subjects’ rights.
4. Legal bases
The legal basis depends on the specific purpose. It may include taking pre-contractual steps or performing a contract or relationship requested by the data subject, compliance with legal obligations, the provision of healthcare and, where necessary, the consent of the data subject.
Where health data is processed, the specific conditions of Article 9 GDPR applicable to the provision of healthcare and the management of dental care will apply.
5. Data provided through the website
The contact form asks for your name, phone number and message, and optionally your email address. This data is used solely to respond to your enquiry and is sent to the clinic by email. You must accept this privacy policy to send the form.
Users are not obliged to provide personal data, but certain data is necessary in order to respond to an enquiry or handle a request. We recommend not sending detailed clinical information through the form or other open channels unless it is necessary to handle the initial request.
6. Retention
Data will be kept for as long as necessary for each purpose and, thereafter, for the periods required by legal obligations or while liabilities may arise.
Clinical records are subject to the specific retention periods laid down in healthcare regulations. In Catalonia, the rules on clinical documentation set minimum retention periods, including at least five years for certain documents and fifteen years for particularly relevant clinical documentation, without prejudice to other retention cases.
7. Recipients
As a general rule, data will not be disclosed to third parties unless there is a legal basis that permits or requires it. The controller may use providers that process data on its behalf, as data processors, with the required contractual safeguards.
Disclosures may also result from legal obligations, requests from competent authorities or needs related to the provision of healthcare.
8. Third-party services and international transfers
The website’s typefaces are served from its own domain, with no connection to third-party servers. Only if the user requests it does the website load the Google Maps map; this service is provided by Google, which receives the visitor’s IP address and may process it outside the European Economic Area in accordance with the safeguards provided for in the GDPR. If other providers involving transfers to third countries are used in the future, this policy will be updated.
9. Your rights
Data subjects may exercise, where applicable, their rights of access, rectification, erasure, objection, restriction of processing and portability, and may withdraw their consent where consent is the legal basis for processing.
Requests can be sent to clinicadentalesteve@gmail.com. Additional information may be requested to verify the identity of the applicant when necessary.
Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they consider that the processing of their data infringes the applicable regulations.
10. Confidentiality and security
Everyone involved in processing personal data is bound by a duty of confidentiality. Technical and organisational measures appropriate to the risk are applied to protect data against unauthorised access, loss, alteration, disclosure or processing.
11. Updates
This policy may be updated when processing activities, the services used, the applicable legislation or the circumstances of the activity change. We recommend checking it periodically.