1. Controller
Dr Fernando Casals Seoane
Tax ID: 51098888H
C/ Juan Bravo 39, 9th Floor, 28006 Madrid, Spain
Email: citas@doctorcasals.com
Telephone: 682 92 97 32
2. Personal data processed
The booking system may process:
- first and last name;
- mobile telephone number;
- email address;
- type of appointment;
- date and time;
- preferred language;
- booking reference;
- information concerning confirmation, amendment or cancellation;
- optional satisfaction score and comments.
The booking system does not request symptoms, diagnoses, medical history, medical reports, test results or clinical documents.
However, requesting healthcare and selecting a particular type of medical appointment may in itself reveal information concerning an individual's health.
3. Purposes and legal bases
Appointment management. Personal data are processed to book, confirm, amend or cancel an appointment and manage related administrative communications. Legal basis: Article 6(1)(b) GDPR and, where health data are involved, Article 9(2)(h) GDPR.
Confirmations and reminders. Administrative emails and SMS messages relating exclusively to the requested appointment may be sent. Legal basis: Article 6(1)(b) and, where applicable, Article 9(2)(h) GDPR.
Coordination with the hospital. Data necessary to organise healthcare will be communicated to the Admissions Department of Hospital Ruber Juan Bravo. Legal basis: management and provision of the requested healthcare services, Articles 6(1)(b) and 9(2)(h) GDPR.
Satisfaction survey. Following the appointment, the patient may receive a short voluntary survey to assess and improve the quality of the service. Legal basis: the controller's legitimate interest in assessing and improving the quality of the service, Article 6(1)(f) GDPR, and Article 9(2)(h) GDPR where processing reveals information connected with healthcare. Completing the survey is voluntary.
Security. Certain technical data may be processed to protect the systems, prevent misuse and maintain the security of the service. Legal basis: Article 6(1)(f) GDPR.
4. Health data
Data connected with the request for and provision of healthcare are subject to enhanced protection.
Data minimisation, confidentiality, security, restricted access and data protection by design and by default principles are applied.
Patients must not enter symptoms, diagnoses, medical reports, test results or other clinical information in the booking system or survey comments.
5. Hospital Ruber Juan Bravo
Data necessary to arrange the appointment may be communicated to the Admissions Department of Hospital Ruber Juan Bravo 39, whose controller for healthcare processing is UNITED SURGICAL PARTNERS MADRID, S.L.
The hospital processes the data received for its own purposes and responsibilities, including administrative management, billing and provision of healthcare.
The medical record is managed and retained by the hospital in accordance with applicable healthcare law.
6. Service providers
The following service providers may process personal data on behalf of the controller:
- Netlify: web hosting and server functions.
- Supabase: booking database, configured in a European region.
- Brevo: transactional email delivery.
- Commify Iberia / Esendex: SMS delivery.
- Google Workspace / Google Meet: where video consultations are provided.
Such providers must be bound by appropriate data processing terms and may only process personal data in accordance with the agreed instructions and purposes.
Other technical or professional providers may be used where necessary, subject to the safeguards required by applicable law.
7. International transfers
Services will, where reasonably possible, be configured so that the main processing of personal data takes place within the European Economic Area.
Certain providers or subprocessors may nevertheless be established or allow access from countries outside the European Economic Area.
Where an international transfer takes place, a mechanism recognised under the GDPR will be used, such as an applicable adequacy decision, European Commission Standard Contractual Clauses or other legally valid safeguards.
Further information on the applicable safeguards may be requested at citas@doctorcasals.com.
8. Email and SMS communications
Confirmation and reminder messages contain only the information necessary to manage the appointment and unnecessary clinical references are avoided.
The email provider may generate technical information regarding delivery, bounces and, where technically enabled, anonymised service-performance metrics.
These communications will not be used to individually track opens or clicks for advertising or profiling purposes.
9. Website analytics and advertising campaign measurement
With the user's prior authorisation, doctorcasals.com may use Google Analytics 4 and Google Ads to obtain statistics on the use of the website and to measure the effectiveness of its advertising campaigns.
When the user gives consent, the following may be processed: online and cookie identifiers, IP address, technical information about the device and browser, URL and referring page, interactions on the website, identifiers relating to an advertising interaction and, where applicable, the information that a booking has been completed.
The patient's name, telephone number, email address, symptoms, diagnosis, clinical reports and other health documentation are not disclosed to Google.
Nevertheless, recording a conversion consisting of booking a medical appointment may indirectly reveal health-related information. For this reason, this processing only takes place where the data subject has expressly authorised it.
Purpose: to analyse the use of the website, measure the performance of advertising campaigns and attribute bookings to those campaigns.
Legal basis: the data subject's consent, Article 6(1)(a) GDPR and, with regard to information that may reveal health-related data, explicit consent under Article 9(2)(a) GDPR.
Consent is entirely voluntary and refusing it does not restrict access to the website or the ability to request or book healthcare.
Google as recipient
Where measurement is authorised, the necessary data may be disclosed to Google Ireland Limited and, where applicable, processed by Google LLC and other entities of its group within the framework of Google Analytics and Google Ads.
Google may act under the data processing terms applicable to each of its services. The controller maintains the contractual terms applicable to Google Analytics and Google Ads.
Data obtained through doctorcasals.com is not used to create remarketing audiences, Customer Match lists or health-related personalised advertising.
International transfers
The use of Google services may involve processing information outside the European Economic Area, including the United States.
Google LLC states that it participates in the EU-US Data Privacy Framework and also relies on the contractual safeguards applicable to its services for international data transfers.
Further information about these safeguards can be requested by writing to citas@doctorcasals.com.
Withdrawing consent
Users may withdraw or change their consent at any time through the Cookie settings link available in the footer.
When consent is withdrawn or refused, Google Analytics and Google Ads will no longer be used to measure the user's subsequent activity on doctorcasals.com.
10. Record of cookie consents
To be able to demonstrate that we have obtained your consent, when you accept, reject, configure or withdraw your cookie choice we record a random identifier, the date and time, the decision made, the categories authorised and the version of the information text shown to you. This record does not include your name, email address, telephone number or IP address and is not linked to your bookings or to any other data about you.
Purpose: to demonstrate the choices made regarding cookies and, where applicable, the consent obtained.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR, in connection with Article 7(1) GDPR) and compliance with the accountability principle.
Retention: 3 years from the last choice or withdrawal of consent.
Hosting: Supabase, on infrastructure located in the European Union.
11. Retention
Identifiable booking data will be retained for a maximum of 24 months from the appointment, cancellation or last related administrative action, unless a legal obligation applies or particular information needs to be restricted and retained in connection with an outstanding legal claim or liability.
After this period, the data will be deleted or irreversibly anonymised.
Anonymised activity and quality statistics may be retained for longer provided that individuals can no longer be identified.
Medical records are retained separately by Hospital Ruber Juan Bravo in accordance with applicable healthcare legislation.
12. Data subject rights
Data subjects may exercise, where applicable, their rights of access, rectification, erasure, objection, restriction and portability.
Requests relating to processing for which Dr Fernando Casals Seoane is the controller may be sent to: citas@doctorcasals.com
Requests concerning the medical record or processing under the responsibility of Hospital Ruber Juan Bravo should be addressed to the hospital through its privacy channels.
Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD).
13. Automated decision-making
No decisions producing legal or similarly significant effects are taken solely on the basis of automated processing or profiling.
14. Security
Appropriate technical and organisational measures are applied to protect the confidentiality, integrity, availability and resilience of personal data, including access controls, encryption and protection of administrator credentials.
15. Changes
This Privacy Policy will be updated whenever the processing activities, providers or website functionalities materially change.