PROSPERITAS MED, S.L.P. may process personal data for the following purposes:

​

a) To respond to requests for information, inquiries, or communications received through the website, contact forms, email, telephone, WhatsApp, Instagram, Facebook, or other communication channels.

b) To manage appointments, consultation requests, bookings, confirmations, reminders, modifications, or appointment cancellations.

c) To provide healthcare, medical aesthetic, gynecological, diagnostic, laboratory, clinical follow-up, and general medical services.

d) To create, maintain, and manage medical records, informed consent forms, medical reports, test results, clinical photographs, patient progress records, and any other healthcare documentation required.

e) To manage contractual or pre-contractual relationships with patients, clients, suppliers, collaborators, and healthcare professionals.

f) To comply with the legal, healthcare, tax, accounting, administrative, regulatory, and professional obligations applicable to PROSPERITAS MED, S.L.P.

g) To manage payments, invoicing, quotations, receipts, complaints, warranties, incidents, and administrative communications.

h) To send informational or marketing communications relating to the clinic's services, treatments, promotions, news, or activities, only where there is an appropriate legal basis and, where required, the prior consent of the data subject.

i) To manage the corporate presence of PROSPERITAS MED, S.L.P. on social media platforms, including Instagram and Facebook, respond to direct messages, comments, or inquiries received through these channels, and analyze user interaction with the company's social media profiles.

j) To analyze the operation of the website, improve the user experience, generate statistical analyses, measure the effectiveness of marketing campaigns, and optimize website content, always in accordance with the Cookie Policy and the user's consent preferences.

k) To ensure the security of the company's facilities, systems, digital communication channels, communications, and documentation.

l) To establish, exercise, or defend the legitimate rights and interests of PROSPERITAS MED, S.L.P. in connection with potential claims, administrative proceedings, judicial or extrajudicial actions, or audits.

4. Legal basis for the processing

The legal bases for the processing of personal data are as follows:

​

a) The data subject's consent, where the user voluntarily contacts PROSPERITAS MED, S.L.P. through contact forms, email, WhatsApp, Instagram, social media, or other communication channels, or where the user consents to the use of non-essential cookies or to receiving marketing communications.

b) The performance of a contract or the implementation of pre-contractual measures, where processing is necessary to manage appointments, quotations, the provision of services, the patient care relationship, payments, invoicing, or relationships with patients, clients, suppliers, or collaborators.

c) Compliance with legal obligations applicable to PROSPERITAS MED, S.L.P., particularly those relating to healthcare, taxation, accounting, administration, employment, regulatory requirements, occupational risk prevention, and compliance with requests from competent public authorities.

d) Processing necessary for the purposes of preventive medicine, medical diagnosis, the provision of healthcare or medical treatment, or the management of healthcare systems and services, pursuant to Article 9(2)(h) of the General Data Protection Regulation (GDPR), where health-related personal data are processed.

e) The legitimate interests of PROSPERITAS MED, S.L.P., where applicable, including the ordinary management of its business activities, fraud prevention, security, complaint handling, legal defense, service improvement, internal analysis, and the maintenance of professional or commercial relationships, provided that such interests are balanced against the rights and freedoms of the data subject.

f) The establishment, exercise, or defense of legal claims, where processing is necessary to protect the legitimate rights and interests of PROSPERITAS MED, S.L.P., its patients, healthcare professionals, or third parties.

5. Processing of health data

Health data constitute a special category of personal data and will be processed with an enhanced level of confidentiality and security.

​

PROSPERITAS MED, S.L.P. will process health-related personal data only where necessary for the provision of healthcare, medical aesthetic, gynecological, diagnostic, laboratory, clinical follow-up, or other medical services, or for the proper management of medical records and related healthcare documentation.

​

Access to health data shall be restricted to authorized personnel, healthcare professionals, collaborators, or data processors who require such access to provide the relevant services, and who are bound by strict confidentiality obligations and applicable legal requirements.

​

Users and patients should avoid sending particularly sensitive medical information through communication channels that are not specifically intended for such purposes, such as social media platforms or Instagram direct messages. Where the processing of medical information is necessary, PROSPERITAS MED, S.L.P. may redirect communications to more appropriate and secure channels.

6. Communications via WhatsApp, Instagram and social media

PROSPERITAS MED, S.L.P. may respond to inquiries, requests for information, appointment requests, or general communications through WhatsApp, Instagram, Facebook, or other messaging services or social media platforms.

​

The use of these communication channels implies that the personal data provided by the user may also be processed by the relevant technology providers, such as WhatsApp Ireland Limited, Meta Platforms Ireland Limited, or other entities within the Meta group, in accordance with their own terms of service, privacy policies, and user settings.

​

PROSPERITAS MED, S.L.P. recommends that users do not send particularly sensitive medical information, clinical documentation, intimate images, test results, medical reports, or personal data relating to third parties via Instagram, Facebook, public comments, direct messages, or WhatsApp, unless this is strictly necessary and expressly requested by the clinic.

​

Communications through social media platforms do not constitute or replace a medical consultation, diagnosis, in-person assessment, or emergency healthcare service. In the event of a medical emergency, users should immediately contact the appropriate emergency medical services.

7. Data recipients

Personal data will not be disclosed to third parties unless there is a legal basis permitting such disclosure or a legal obligation requiring it. However, where necessary for the proper provision of services, personal data may be disclosed or made accessible to the following recipients:

​

a) Healthcare professionals, including physicians, nurses, technicians, laboratories, diagnostic centers, collaborating healthcare professionals, or healthcare institutions involved in providing the requested services.

b) Providers of technology services, including web hosting, IT maintenance, email services, appointment management systems, messaging services, CRM platforms, cloud storage providers, web analytics services, communication platforms, social media platforms, payment gateways, or administrative support services.

c) Accountants, tax advisors, payroll providers, legal advisors, auditors, or insurance companies, where necessary for the ordinary management of the business or the establishment, exercise, or defense of legal rights.

d) Banks, payment service providers, or invoicing service providers, where necessary to process payments, collections, or invoices.

e) Public authorities, healthcare authorities, the Spanish Tax Agency, courts and tribunals, law enforcement authorities, professional associations, or other competent bodies, where disclosure is required by law or pursuant to a valid legal request.

​

Service providers that process personal data on behalf of PROSPERITAS MED, S.L.P. shall act as Data Processors and will be required to provide sufficient guarantees that they implement appropriate technical and organizational measures in compliance with the General Data Protection Regulation (GDPR).

8. International data transfers

Some of the technology service providers used by PROSPERITAS MED, S.L.P. may involve international transfers of personal data outside the European Economic Area (EEA). Such transfers will only take place where there is a valid legal basis, including an adequacy decision issued by the European Commission, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or any other safeguards recognized under the applicable data protection legislation.

​

In particular, international data transfers or access to personal data from third countries may occur in connection with:

​

a) Google services, including email services, cloud storage, analytics, advertising services, business tools, and cloud infrastructure.

b) Meta services, including Instagram, Facebook, WhatsApp, Meta Business Suite, Meta Pixel, and related advertising and analytics tools.

c) Web hosting providers, website development platforms, online forms, automation services, analytics providers, messaging platforms, CRM systems, and other technology providers involved in the operation of the website or in communications with users.

d) Third-party cookies, pixels, online identifiers, and similar technologies, as described in the Cookie Policy.

​

PROSPERITAS MED, S.L.P. periodically reviews the technology providers it uses and endeavors to select providers that offer appropriate safeguards for the protection of personal data.

9. Data retention

Personal data will be retained for as long as necessary to fulfill the purposes for which they were collected and, thereafter, for the periods required under applicable laws or for as long as necessary to address any potential legal liabilities. In particular:

​

a) Contact details and general inquiry data will be retained for the time necessary to respond to the request and, where applicable, for the period required to demonstrate that the request was handled or to address any potential legal claims.

b) Patient data, including medical records, informed consent forms, medical reports, test results, clinical photographs, and healthcare documentation, will be retained in accordance with the retention periods established by applicable healthcare legislation and for as long as necessary to ensure appropriate medical care and the defense of potential legal claims.

c) Billing, accounting, and tax-related data will be retained for the periods required under applicable tax, commercial, and accounting legislation.

d) Personal data processed for marketing purposes will be retained for as long as valid consent or another appropriate legal basis exists, and until the data subject requests their deletion or objects to such processing.

e) Data collected through cookies will be retained for the periods specified in the Cookie Policy or in the user's consent management settings.

​

Once the applicable retention periods have expired, personal data will be securely deleted, blocked, or anonymized, unless their continued retention is necessary for the establishment, exercise, or defense of legal claims.

10. Commercial communications

PROSPERITAS MED, S.L.P. may send informational or marketing communications regarding its services, treatments, news, promotions, or activities where the data subject has given their consent or where another valid legal basis permits such communications.

​

Users may object to or unsubscribe from these communications at any time by contacting info@sermedclinica.com or by using the unsubscribe mechanism included in each communication, where available.

​

PROSPERITAS MED, S.L.P. will not send electronic marketing communications unless the requirements established by the applicable data protection legislation and information society services regulations have been fully complied with.