Privacy policy

Data controller

Controller: Agrupación de Especialidades Médicas Valcas, S.L. (Institut Mèdic Especialitzat La Ràpita)
Tax ID (NIF): B02726164
Registered address: Gran Via de Carles III, 61 bis, 3.º 4.ª, 08028 Barcelona, Spain
Centre: Av. del Dr. Ferran, 73, 43540 La Ràpita (Tarragona, Spain)
Privacy contact: admision@institutmedic.es

What data we process and when

This website has no forms and uses no analytics or advertising tools. We only process your data when you contact us:

By phone, email or WhatsApp: your name, contact details, the specialty or professional you need and, if you use one, your health insurer.
When you book on Doctoralia: Doctoralia processes your data under its own terms and privacy policy and sends us the appointment details.
When you attend a consultation: the data needed for your healthcare, which forms part of your medical record.
When you visit the website: the server logs technical data (IP address, date and page requested) to keep the service secure.

On WhatsApp, please give us only your name and the specialty you need. Do not send reports, photos or other health information through this channel: we will ask for them during your consultation.

Purposes

To manage your appointment request and answer your questions.
To provide you with healthcare and manage your medical record, in accordance with Spanish Law 41/2002 on patient autonomy and Catalan Law 21/2000 on patients’ rights to information and autonomy and on clinical documentation.
To manage invoicing and, where applicable, authorisation and payment with your health insurer.
To keep the website secure.

We do not carry out profiling or take automated decisions based on your data.

Legal basis

Taking steps at your request before providing a service, and providing the service you request (Art. 6(1)(b) GDPR).
Compliance with legal obligations, such as clinical documentation and tax requirements (Art. 6(1)(c) GDPR).
For health data, the provision of healthcare by professionals bound by professional secrecy (Art. 9(2)(h) GDPR and Art. 9 of Spanish Organic Law 3/2018, LOPDGDD).
Your consent, when you voluntarily give us data for a different purpose (Art. 6(1)(a) GDPR). You can withdraw it at any time.
Our legitimate interest in website security, for server logs (Art. 6(1)(f) GDPR).

Retention

Appointment requests that do not lead to a consultation: as long as needed to deal with the request.
Medical records: the minimum periods set by Law 41/2002 and Catalan Law 21/2000.
Invoicing data: the periods required by tax and commercial legislation.
Server logs: a limited period, for security purposes only.

Recipients

We do not share your data with third parties unless required by law or necessary for your care, for example with your health insurer to authorise or invoice a medical procedure. Some service providers (web hosting, IT systems, appointment management) access the data as processors, under contract and with appropriate safeguards.

If you message us on WhatsApp, the service is provided by WhatsApp Ireland Limited under its own terms, which may involve international data transfers covered by the safeguards set out in the GDPR.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to admision@institutmedic.es or by post to Av. del Dr. Ferran, 73, 43540 La Ràpita, Spain, stating the right you wish to exercise and providing proof of identity. Some medical-record data cannot be erased while there is a legal obligation to keep it.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Minors

Data relating to patients under 14 is provided by their parents or legal guardians, who exercise their rights on their behalf.

Changes to this policy

We may update this policy to reflect changes in the law or in our services. The date of the latest update is shown on this page.