Privacy policy

01What personal data do we process and where does it come from?

In the course of your relationship with us, the following categories of personal data may be processed:

• Identification and contact data of patients or their representatives (including signature, image, health card, social security or mutual insurance number) and any other administrative data.
• Health data included in the patient's Medical Record.
• Personal characteristics and social or socio-health circumstances.
• Transactional data (payments, deposits, transfers, direct debits).

The data may come from the data subject (patient) or, where applicable, from their legal or voluntary representative and/or healthcare staff. In the case of the contact form on our website, only the data described in that form.

02Data controller: who are we?

Company name

SALAK MEDICAL CARE SLU

Tax ID (CIF)

B72487549

Address

Calle Pérez Galdós, nº 10, bajo, 02003, Albacete

Phone

967 15 72 90

Email

juangabriel@clinicasalak.com · jglorenzor@gmail.com

03Purpose of processing: what will we use your data for?

1. Provision of healthcare: your personal data is processed in order to provide the healthcare you need and to properly manage the healthcare and administrative services of the clinic required for it, for example:

• Reminding you of appointments and check-ups;
• Issuing certificates of your attendance at the healthcare centre for family members or related persons who request them, within the framework permitted by law;
• Handling any communication with the healthcare centre reported by the patient;
• Managing any incident or complaint filed by the user and/or patient;
• Carrying out surveys to find out your opinion of the care received, used solely to improve and develop our healthcare and management services;

2. Provision of the Patient Area service: if the patient registers as a user of the portal, users' personal data may be processed to manage access to and use of the tool.

3. Handling requests for information of any kind, including commercial requests, complaints, suggestions, claims, exercise of data protection rights, etc.: in these cases your data will be processed in order to manage and process the request.

4. Compliance with legal obligations: it may be necessary to process personal data in order to meet the applicable legal requirements, specifically data protection, tax and healthcare legislation, among others.

5. Formalisation and performance of the contract: the patient's personal data is processed in order to manage the contractual relationship with the patient.

6. Sending commercial communications, always with your prior consent.

The data collected will be processed for the specified purposes and never in a way incompatible with them. Please note that processing for scientific research or statistical purposes is not considered incompatible with the original purpose.

In all cases, we process your data to serve you with the same level of quality of care, regardless of the channel you use to contact us (healthcare centre or website, whether in person, by phone or online).

04Legal basis: why do we need your data?

05Recipients: who do we share your data with?

To ensure proper provision of the service, certain service providers and/or entities need to process data on behalf of the controller, acting as processors of your personal data.

Your personal data will not be disclosed to third parties except where required by law, in the event of vital interest or with the prior consent of the data subject, only in the cases and to the recipients detailed below:

1. Since the patient may have an insurance contract under which a third party (for example, insurers, mutual insurance companies, public administrations, or even those of a third party in the case of civil liability insurance) is obliged to pay for the healthcare services provided by the centre, provided the patient informs us of this, we may disclose their data to those entities in order to manage, validate, verify and control payment for the healthcare services provided. You expressly and unequivocally authorise this disclosure.

2. If the patient has insurance with an entity located outside the European Economic Area (hereinafter EEA) whose legislation does not offer a level of data protection equivalent to that of the European Union, an international data transfer may be necessary, subject to the patient's explicit consent after being informed of the risks. Such transfers only take place in order to assist the patient and facilitate payment for the healthcare services provided; in short, they only occur for the quickest possible management and verification with the insurer of payment for services where the patient has a policy with an entity located outside the EEA.

3. If you object to the disclosure of your data, these entities may refuse to pay for the healthcare services received, in which case you will be responsible for paying for them, as those entities will be unable to verify, check, validate or control the centre's correct billing of each of your care processes.

We also inform you that your personal data may be disclosed to suppliers of medical equipment, prostheses and implants where required by law, and to ambulance services on the basis of the patient's vital interest. All information provided to us will be treated confidentially and in strict compliance with the security obligations necessary to prevent access by unauthorised third parties.

06Retention: how long will we keep your data?

As a general rule, your data will only be kept for as long as strictly necessary for the purpose for which it was collected.

The personal data provided, as well as data derived from the healthcare provided, will be kept for the time appropriate in each case (according to medical and legal criteria) and for at least ten years from the date of discharge of each care process, unless regional and/or specific regulations establish a different minimum retention period, in which case the applicable regulations will apply.

Once that minimum period has passed and the care and contractual relationship has ended, the controller will keep your data duly blocked for the corresponding statutory limitation periods.

Personal data provided to manage any request for information, complaint, suggestion, claim, exercise of data protection rights, etc. will be kept for as long as necessary to process the request and in any case for the legally established period, as well as for the period necessary for the formulation, exercise or defence of claims.

Data processed to comply with legal obligations will be kept for the period established in the applicable legislation.

Data collected for the formalisation and performance of the contract will be kept for as long as the contractual relationship lasts, as well as for the period necessary for the formulation, exercise or defence of claims.

07Security: how will we protect your data?

We make every reasonable effort to maintain the confidentiality of the personal information processed in our systems. We maintain strict security levels to protect the personal data we process against accidental loss and unauthorised access, processing or disclosure, taking into account the state of technology, the nature of the data and the risks to which it is exposed. However, we cannot be held responsible for your use of the data (including username and password) you use on our website. Our staff follow strict privacy rules, and when we hire third parties to provide support services, we require them to comply with the same rules and allow us to audit them to verify compliance.

08Your rights: what rights can you exercise?

You may exercise the following rights:

• Right of access to your personal data, to know which data is being processed and the processing operations carried out with it;
• Right to rectification of any inaccurate personal data;
• Right to erasure of your personal data, where possible (for example, by legal requirement);
• Right to restriction of processing of your personal data where the accuracy, lawfulness or necessity of the processing is in doubt, in which case we may keep the data for the exercise or defence of claims;
• Right to object to the processing of your personal data where the legal basis for processing is our legitimate interest. SALAK MEDICAL CARE SLU will stop processing your data unless it has a legitimate interest or it is necessary for the defence of claims, where this right applies;
• Right to data portability, where the legal basis for processing is a contractual relationship or your consent;
• Right to withdraw the consent given to SALAK MEDICAL CARE SLU.

You can exercise your rights free of charge at any time by contacting us at Calle Pérez Galdós, nº 10, bajo, 02003, Albacete, or by emailing jglorenzor@gmail.com, always attaching a copy of your ID.

09Protection of rights: where can you file a complaint?

If you believe your rights have not been respected by our organisation, you may file a complaint with the Spanish Data Protection Agency through any of the following channels:

Online

https://www.aepd.es

Post

Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001, Madrid

Phone

901 100 099 · 912 663 517

Filing a complaint with the Spanish Data Protection Agency is free of charge and does not require a lawyer or court representative.

10Updates: what changes may be made to this Privacy Policy?

The Owner reserves the right to amend this policy to adapt it to legislative or case-law developments that may affect compliance with it.

To ensure compliance with personal data protection regulations, SALAK MEDICAL CARE SLU has received consultancy and advisory services from ClickDatos.