Privacy policy

Data controller

The controller of your data is Clinica Dental Dra. Valencia S.L, tax ID B-00000000, with its address at Carrer de Lluçà, 42, local 2, 08028 Barcelona. You can contact us at clinicadentalvalencia92@gmail.com or on +34 682 54 48 99.

For any data protection question, you can also contact our Data Protection Officer via clinicadentalvalencia92@gmail.com, with "Data protection" in the subject line.

We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

What data we process

We only ask for the data needed for each purpose:

• Identity and contact details: name, phone number and email address
• Appointment details: reason for the visit, practitioner, date and time, and any comments you choose to add
• Health data: the reason for your visit that you give when booking and, if you're a patient, the information in your clinical record
• Data about children: if you book for your child, the child's details and those of the parent or legal guardian
• Technical data: IP address and server logs, used for site security and to prevent abuse

Why we use it and on what legal basis

Health data is a special category of data. So when you tell us the reason for your visit when booking, we ask for your explicit consent (Article 9(2)(a) GDPR) through a checkbox that is not pre-ticked.

• Managing your appointment (booking, confirmation, changes and cancellations): steps taken at your request before or under a contract (Art. 6(1)(b) GDPR) and, for the reason for your visit, your explicit consent (Art. 9(2)(a) GDPR)
• Sending you appointment reminders by email: performance of the service you have requested (Art. 6(1)(b) GDPR)
• Providing healthcare and keeping your clinical record: compliance with legal obligations (Art. 6(1)(c) GDPR) and the provision of healthcare (Art. 9(2)(h) GDPR), under Spanish Law 41/2002 and Catalan Law 21/2000
• Answering your enquiries: your consent or steps taken at your request before a contract
• Protecting the website against abuse, spam and attacks: our legitimate interest in keeping our systems secure (Art. 6(1)(f) GDPR)

What we don't do

We don't use your data to send you marketing without your consent, we don't build commercial profiles, we don't make automated decisions that affect you, and we don't sell or share your data with third parties for commercial purposes.

How long we keep your data

• Appointments requested but not attended: for as long as needed to manage them, then blocked for the periods during which legal claims could arise
• Clinical records: at least 5 years from the discharge date of each episode of care, under Article 17 of Spanish Law 41/2002. In Catalonia, Law 21/2000 generally extends retention of the documentation it specifies to 15 years from the discharge date of each episode of care
• Billing data: for the periods required by tax and commercial law
• Technical security logs: only as long as needed for their purpose, up to a maximum of 12 months

Who we share data with

We only disclose your data where the law requires it (for example, to health or judicial authorities) or with your consent.

To provide our service, we use suppliers that process data on our behalf (processors), with whom we have signed or accepted the contracts required by Article 28 GDPR:

• Hostinger: hosting of the website and the appointments database
• Email service provider: sending confirmations, reminders and messages about your appointment
• Dental laboratory, when your treatment requires it, with only the essential data

International transfers

We aim to keep your data hosted within the European Union. If any supplier processed data outside the European Economic Area, it would do so with the safeguards provided by the GDPR, such as an adequacy decision or the European Commission's standard contractual clauses.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without affecting the lawfulness of earlier processing. Please note that clinical records must be kept for the legal periods even if you request erasure.

To do so, email us at clinicadentalvalencia92@gmail.com or write to Carrer de Lluçà, 42, local 2, 08028 Barcelona, stating which right you wish to exercise. If we can't verify your identity, we may ask for proof of ID. We'll reply within one month.

If you feel we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es), the supervisory authority for private organisations. The Catalan Data Protection Authority (apdcat.gencat.cat) covers processing by the Catalan public sector and by organisations providing public services in Catalonia.

Children

Appointments for children under 14 must be requested by their parents or legal guardians, who provide the data and give consent on their behalf, in accordance with Article 7 LOPDGDD.

Security

We apply technical and organisational measures appropriate to the risk, such as encrypted connections (HTTPS), password-protected access to the management panel with lockout after failed attempts, protection of forms against automated abuse, and access to data limited to staff who need it.

Changes to this policy

We may update this policy to reflect legal or service changes. The date of the latest update is always shown at the top of the page.