Privacy Policy 2026
Last updated: [2026-11-07]
This Privacy Policy explains how [LEGAL COMPANY NAME OR INDIVIDUAL PRACTITIONER NAME] (“we”, “us”, or “the Clinic”) collects and processes personal data through the website https://traumatologia.barcelona/ and through the contact, appointment-request, and patient-care services offered by the Clinic.
1. Data controller
Controller: [LEGAL COMPANY NAME OR INDIVIDUAL PRACTITIONER NAME]
Tax identification number (NIF/NIE): [TAX ID]
Address: Office 112, Number 4 Plaça Dr. Manuel Corachan, 08017 Barcelona, Spain
Email: [EMAIL ADDRESS]
Telephone: [TELEPHONE NUMBER]
Website: https://traumatologia.barcelona/
Data Protection Officer (DPO): [DPO NAME AND CONTACT DETAILS, IF APPOINTED].
If no DPO has been appointed, remove this line.
2. Personal data we process
Depending on how you interact with us, we may process the following categories of personal data:
- Identification and contact data: name, surname, email address, telephone number, postal address, and date of birth.
- Appointment and administrative data: requested appointment details, preferred contact method, insurance details, billing information, and communications with the Clinic.
- Health and clinical data: medical history, symptoms, diagnoses, treatments, test results, imaging, prescriptions, and other health-related information provided by you or generated during care.
- Website and technical data: IP address, device and browser information, pages visited, and other technical data collected through cookies or similar technologies, where applicable.
We ask you not to send sensitive health information through general contact forms, email, or social media unless it is necessary and we have informed you about the relevant processing. For clinical matters, please use the secure or designated channel indicated by the Clinic.
3. Purposes and legal bases
| Purpose | Categories of data | Legal basis |
|---|---|---|
| Responding to enquiries, appointment requests, and other communications submitted through the website, email, telephone, or other contact channels. | Identification, contact, and communication data. | Consent where you voluntarily provide data to request information or contact us; where applicable, steps prior to entering into a contract. |
| Providing healthcare services, managing appointments, maintaining clinical records, issuing invoices, and complying with healthcare, accounting, tax, and administrative obligations. | Identification, contact, health, clinical, insurance, and billing data. | Provision of healthcare and management of the patient relationship; compliance with legal obligations; and, where applicable, your explicit consent. |
| Sending service-related communications, appointment reminders, and information necessary for the management of your care. | Identification and contact data. | Performance of the patient-care relationship or contract; compliance with legal obligations where applicable. |
| Sending newsletters, health information, promotions, or other commercial communications, where you have opted in. | Identification and contact data. | Your consent, which you may withdraw at any time. |
| Analysing website usage and improving the website, where cookies or similar technologies are used. | Technical and browsing data. | Consent for non-essential cookies; legitimate interest or legal obligation only where permitted by applicable law. |
| Handling claims, complaints, legal claims, or requests from public authorities. | Identification, contact, clinical, and administrative data where relevant. | Legal obligation, legitimate interest, or defence of legal claims. |
Health data are special-category data under Article 9 GDPR. We process them only where an applicable legal exception applies, including where necessary to provide healthcare, comply with legal obligations, or where you have given explicit consent for a specific purpose. [20]
4. Data recipients
We do not sell or rent personal data. We may share personal data only with:
- Healthcare professionals and clinical staff involved in your care, where necessary.
- Service providers acting as processors, such as hosting, email, appointment-management, accounting, IT, or security providers, under appropriate contractual safeguards.
- Insurance providers or mutual societies, where necessary to manage coverage, authorisations, or billing.
- Public authorities, courts, or competent bodies, where required by law or necessary to exercise or defend legal rights.
If we transfer personal data outside the European Economic Area, we will ensure that an appropriate transfer mechanism applies, such as an adequacy decision or standard contractual clauses, together with any additional safeguards required.
5. International transfers
[DESCRIBE ANY INTERNATIONAL TRANSFERS, INCLUDING THE COUNTRIES OR SERVICE PROVIDERS INVOLVED, THE TRANSFER MECHANISM USED, AND THE SAFEGUARDS APPLIED.]
If no international transfers are made, replace this section with: “We do not transfer personal data outside the European Economic Area.”
6. Retention periods
We retain personal data only for as long as necessary for the purposes for which they were collected and for any applicable legal, clinical, tax, or limitation periods.
- Contact-form enquiries: for the time necessary to handle the request and, where appropriate, for a limited follow-up period.
- Patient and clinical records: in accordance with the applicable healthcare-record retention rules and professional obligations.
- Billing and accounting records: for the periods required by tax and accounting legislation.
- Marketing-consent records: until consent is withdrawn or the relevant communication is no longer sent.
- Cookie-related data: according to the retention periods specified in the Cookie Policy.
7. Your rights
You may exercise the following rights, subject to applicable legal conditions:
- Access your personal data and obtain information about its processing.
- Rectify inaccurate or incomplete personal data.
- Request erasure of your personal data where applicable.
- Request restriction of processing.
- Object to processing, including processing based on legitimate interests.
- Request data portability where technically applicable.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Request not to be subject to a decision based solely on automated processing, where applicable.
To exercise your rights, contact us at [EMAIL ADDRESS] or write to the postal address indicated in section 1. We may ask you to verify your identity before responding.
You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
8. Cookies and similar technologies
This website may use cookies and similar technologies. Essential cookies necessary for the operation of the website may be used without consent. Non-essential cookies, including analytics, preference, or advertising cookies, require your prior consent.
For details of the cookies used, their purposes, retention periods, and how to accept, reject, configure, or withdraw consent, please see our Cookie Policy.
9. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or misuse. These measures include access controls, confidentiality obligations, secure communications where appropriate, and staff training.
No method of transmission over the internet or electronic storage is completely secure. Please avoid sending sensitive clinical information through unsecured channels unless specifically instructed to do so.
10. Children
This website is not directed at children. Where services are provided to minors, we process their personal data in accordance with the applicable rules on parental responsibility, consent, and healthcare.
11. Changes to this policy
We may update this Privacy Policy to reflect legal, technical, or organisational changes. The date at the top of this page indicates the latest version. Material changes will be communicated where required by applicable law.