Privacy policy
1. Controller and legal framework
In accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights (LOPDGDD), and Law 34/2002 of 11 July on information society services and electronic commerce (LSSI-CE), we inform you as follows.
The controller for personal data collected through this website is "JESSICA TELLECHEA PEÑA", tax ID "55363503L", address "Avda Central, 4, Calafell, Tarragona". To exercise your rights or ask questions about data protection, contact "[email protected]".
This policy supplements any information provided in specific forms (for example, appointment requests via the processor platform).
2. Purpose and scope
This policy explains how we process your personal data in connection with this website.
It applies to you as a site user regardless of where you access from, insofar as the processing relates to the services offered on the site.
3. Categories of data we may process
Depending on active forms or features, we may process identity and contact details (name, surname, ID document where needed, phone, email), appointment-related data (date, time, professional or service), limited technical connection data (IP address, device identifiers where needed for security), and, if used, anti-abuse verification metadata from reCAPTCHA without storing challenge media on this site.
Cookies and local storage are described in the cookie policy linked in the site footer.
4. Children
Site content and services are aimed at people aged 16 or over. If you are a child, do not use the site without a parent or guardian. Processing of children data will only be lawful as permitted by applicable law and, where relevant, with appropriate authorisation or supervision.
5. Purposes and legal bases
To manage the relationship with site users (requests, communications, service improvement), maintain site security, and comply with legal obligations applicable to the clinic. Depending on the case, the legal basis may be performance of pre-contractual measures or a contract (Art. 6(1)(b) GDPR), legitimate interests in a secure, operational site (6(1)(f)), and legal obligations (6(1)(c)).
Online appointment handling aims primarily at providing the service requested by the data subject (scheduling and communications related to the appointment), mainly on the basis of performance of pre-contractual measures or contract (6(1)(b)).
For cookies and similar preferences, see the cookie policy: strictly necessary or security cookies may rely on legitimate interests or service performance where appropriate; other categories only after the configuration or consent required by the site mechanism.
If direct marketing is added later, it will be offered separately and only with prior informed consent (6(1)(a)) unless another legal basis applies.
6. Retention
Data are kept only as long as necessary for each purpose, applicable legal duties, and limitation periods. Exact periods depend on the data category and channel (website, clinic diary, or processor platform); you may request further detail using the contact details in section 1.
7. Processors, recipients, and transfers
For online appointments, "JESSICA TELLECHEA PEÑA" uses the Nubimed / Clinica en la nube platform as a processor, acting on documented instructions under an appropriate processing agreement.
You may request an up-to-date list of processors via the contact details in section 1.
Google Ireland Limited provides reCAPTCHA when enabled on the booking form; this may involve transfers outside the EEA subject to Google safeguards. See Google privacy information for that product.
We do not sell personal data. Any further disclosure (for example, to authorities) will only occur where required by law.
8. Your rights
Right of access: you may ask whether we process your data and, if so, obtain information on purposes, categories of data concerned, and other elements provided for by law.
Right to rectification: you may ask us to correct inaccurate data or complete incomplete data.
Right to erasure (“right to be forgotten”): you may ask us to erase data where the legal grounds apply.
Right to restriction: in the cases set out in the GDPR, you may ask us to restrict processing.
Right to object: in certain circumstances and on grounds relating to your particular situation, you may object to processing unless we demonstrate compelling legitimate grounds or processing for legal claims.
Right to data portability: where processing is based on consent or contract and is carried out by automated means, you may receive the data you provided in a structured, commonly used, machine-readable format and transmit them to another controller where technically feasible.
Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise these rights, write to "[email protected]". You may lodge a complaint with your local supervisory authority (in Spain, the AEPD).
9. Security measures
We apply appropriate technical and organisational measures, including encrypted transmission where hosting configuration allows, data minimisation, and access controls for processors. No system is fully immune; if you notice an incident concerning your data, you may report it to the contact address above.
10. Changes to this policy
"JESSICA TELLECHEA PEÑA" may update this policy to reflect legal, technical, or site changes. The current version will be published on this page; we encourage you to review it periodically. Continued use after changes may imply acceptance of the updated policy, without prejudice to the legal bases applicable to each processing activity.
11. Two-step collection (website and booking platform)
Some data are collected on this site (for example, slot selection and basic contact details) and some processing occurs on the Nubimed processor platform to complete the appointment request. Both layers must respect applicable transparency and consent rules; controller contact details are in section 1.