Privacy Policy

1 · Data controller

[pending], tax ID [pending], address C. Méndez Núñez, 12, 41001 Sevilla.

Contact for data protection matters: info@clinicamontecarlo.es.

2 · What data is processed and why

Contact form. Name, email address, phone number, reason for contact and the message written. Used to answer the enquiry and, where an appointment is requested, to call and arrange it. Legal basis: the consent given by ticking the box and submitting the form (art. 6.1.a GDPR).

Please do not write details about your health, diagnoses or treatments in that form: that is what the consultation is for. Health data is a special category (art. 9 GDPR) and this website is not the right channel for it.

Online bookings. Name, phone number, email address, the session and time slot chosen, and any notes added. Used to manage and confirm the booking and to notify changes. Legal basis: performance of the booking and pre-contractual steps taken at the person's request (art. 6.1.b GDPR).

Patient area. Signing in requires only an email address, to which a single-use access code is sent, and optionally a name. Used to identify the person and show their bookings. Legal basis: art. 6.1.b GDPR.

This website does not carry out profiling or automated decision-making.

3 · How long data is kept

Contact enquiries are kept while they are being handled and afterwards for as long as needed to account for that handling.

Booking data is kept while the relationship with the clinic lasts and, afterwards, blocked for the applicable limitation periods (including tax and accounting periods).

Access codes for the patient area expire after ten minutes and are deleted once used.

Clinical records, where they exist, are governed by specific healthcare regulations and are not created through this website.

4 · Who else has access

Data is not sold, nor disclosed to third parties for their own purposes. Providers do process data on behalf of the clinic as processors, under a contract signed in accordance with article 28 GDPR:

The booking system provider, which stores bookings and sends confirmation emails and the access codes for the patient area.

The website hosting provider and the provider that delivers contact form submissions.

Some of these providers may process data on servers outside the European Economic Area. Where that happens, the transfer relies on the safeguards set out in Chapter V GDPR (adequacy decision or standard contractual clauses).

Public authorities may also access the data where required by law.

5 · Your rights and how to exercise them

You may request access to your data, its rectification or erasure, the restriction of or objection to its processing, and portability. You may also withdraw your consent at any time, without affecting processing carried out before withdrawal.

To exercise these rights, write to info@clinicamontecarlo.es stating the right you wish to exercise, or contact C. Méndez Núñez, 12, 41001 Sevilla. Proof of identity may be requested.

If you believe your data has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.

6 · Minors

The forms on this website are intended for people aged 14 and over. For appointments or bookings for younger children, the request must be made by a parent or legal guardian.

7 · Security

The website is served over an encrypted connection (HTTPS) and the providers involved apply technical and organisational measures to protect the information. No system is infallible, but the aim is to reduce risk and to detect and report any incident as required by law.

8 · Changes to this policy

This policy may be updated if the website's services or the applicable law change. The version in force is always the one published here, with its update date.