Privacy policy

Controller: FISIOBOX S.C.P. — Tax ID J42952713

Address: Carrer de Provença, 455, 08025 Barcelona, Spain

Data protection contact: DATA PROTECTION EMAIL

Data Protection Officer: DPO NAME AND CONTACT, or "not appointed" if not applicable

Identification and contact data: name, email address, telephone number and date of birth.

Health data: type of injury or problem, how long you have had it, any relevant medical history you choose to share, and clinical documents you voluntarily attach (reports, X-rays, MRI scans).

Availability preferences, used solely to propose an appointment time.

This website uses no analytics, advertising or third-party cookies.

Purpose: to handle your appointment request, contact you to confirm it, and where applicable prepare your first clinical assessment.

Health data is a special category of data (GDPR art. 9). The legal basis is your explicit consent, given by ticking the box on the form, together with art. 9(2)(h) GDPR for the provision of healthcare.

For all other data the legal basis is pre-contractual measures taken at your request (GDPR art. 6(1)(b)).

We do not carry out automated decision-making or profiling with your data.

If you do not go on to become a patient, we keep your request for PERIOD, e.g. 12 months and then delete it.

If you begin treatment, your clinical record is kept for a minimum of 15 years from the discharge of each episode of care, under article 12 of Catalan Law 21/2000 on health information rights.

We do not share your data with third parties except where legally required.

We use providers acting as data processors under art. 28 GDPR contracts: Supabase (database and document storage) and Vercel (website hosting). The map on the contact page is served by OpenStreetMap, which receives your IP address when it loads but sets no cookies.

Server location and safeguards for international transfers: HOSTING REGION — confirm the instance is in the EU; if not, state the applicable standard contractual clauses

ADD ANY OTHER PROVIDER: clinic management software, payment gateway, booking platform (Doctoralia), email marketing service

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent at any time without affecting the lawfulness of prior processing.

To do so, write to DATA PROTECTION EMAIL stating the right you wish to exercise and enclosing a copy of an identity document.

If you believe your request was not handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the Catalan Data Protection Authority.

We apply appropriate technical and organisational measures to protect your data. Clinical documents you upload are held in a private store that is not publicly accessible, and only authorised clinic staff can view them.