Privacy policy

01Data controller

For any question relating to the processing of your personal data, you may contact our Data Protection Officer (DPO) at the address indicated above.

02Data we collect

We may collect the following categories of personal data, depending on the service you request:

• Identification data: full name, DNI/NIE (Spanish national identity document) or passport.
• Contact details: postal address, telephone number and email address.
• Health data: clinical information, dental history, medical background and treatments carried out, necessary for the provision of healthcare.
• Financial data: billing information and, where applicable, payment details for the management of the services contracted.
• Browsing data: IP address, browser type, pages visited, duration of the visit and data collected through cookies. For more information, please see our Cookies Policy.
• Data provided in forms: any information you voluntarily provide to us through the appointment request form, the contact form or any other means of communication.

Health-related data has the status of a special category under the GDPR and is processed with the enhanced security measures that its nature requires.

03Purpose of the processing

Your personal data is processed for the following purposes:

• Healthcare management: scheduling, confirming and managing appointments and consultations; preparing and maintaining the clinical record; providing the dental treatments requested; and carrying out post-treatment follow-up.
• Communication with the patient: sending appointment reminders, notifications about the status of your treatment and information relevant to your oral health.
• Billing and administrative management: issuing invoices, managing payments and complying with accounting and tax obligations.
• Improvement of services: analysing use of the website for statistical purposes and the continuous improvement of the quality of care.
• Sending commercial communications: only if you have given your express consent, we may send you information about news, promotions and services of the clinic.
• Compliance with legal obligations: retaining clinical documentation in accordance with applicable healthcare legislation.

04Legal basis for the processing

The processing of your data is based on the following legal bases, in accordance with Article 6 of the GDPR:

• Consent of the data subject (Article 6.1.a GDPR): for sending commercial communications and for the use of non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Performance of a contract (Article 6.1.b GDPR): when the processing is necessary for the provision of the healthcare services requested or for the related administrative and billing management.
• Compliance with a legal obligation (Article 6.1.c GDPR): for maintaining clinical records in accordance with Ley 41/2002, básica reguladora de la autonomía del paciente (Spanish Basic Law regulating patient autonomy), and the regional healthcare regulations of Andalusia.
• Legitimate interest (Article 6.1.f GDPR): for the statistical analysis of website use and the improvement of internal processes, provided that the interests or fundamental rights of the data subject do not prevail.

In the case of health data (a special category), the processing is additionally based on Article 9.2.h of the GDPR, relating to purposes of preventive medicine or medical diagnosis, as well as on Article 9 of the LOPDGDD.

05Recipients of the data

As a general rule, Dentaláser 1987, S.L. does not disclose your personal data to third parties. However, the following may have access to it:

• Service providers: companies acting as data processors under a data processing agreement in accordance with Article 28 of the GDPR (for example, providers of clinical management software, communication platforms, hosting companies and dental laboratories). These providers will only process the data in accordance with the clinic's instructions and with the appropriate security guarantees.
• Public administrations and authorities: where there is a legal obligation, such as the disclosure of data to the Agencia Tributaria (Spanish Tax Agency), the Seguridad Social (Social Security), or the competent health authorities.
• Health insurance providers: at the patient's request, when necessary for the processing of benefits covered by their health insurance policy.

Under no circumstances will your data be disclosed to third parties for commercial purposes without your prior express consent.

06Data retention

Personal data will be retained for the time strictly necessary for the purpose for which it was collected and, in any case, in accordance with the legally established time limits:

• Data provided through the website's forms (contact and appointment request): twelve (12) months from submission. Once this period has elapsed without the request having led to a healthcare or contractual relationship, the data is deleted. If the request does lead to such a relationship, the data will then be retained in accordance with the applicable clinical record or billing retention periods indicated below.
• Clinical record: a minimum of five (5) years from discharge from the care process in accordance with Ley 41/2002 (Spanish Basic Law regulating patient autonomy), without prejudice to any longer periods established by the healthcare regulations of the Autonomous Community of Andalusia.
• Billing data: four (4) years, in accordance with applicable tax and accounting regulations.
• Commercial communications: until the data subject withdraws their consent or requests the erasure of their data.
• Cookies and browsing data: as indicated in the Cookies Policy.

Once the retention periods have elapsed, the data will be securely deleted or anonymised.

07Your rights

As a data subject, you are entitled to the following rights in relation to the processing of your personal data:

You also have the right to withdraw, at any time, any consent previously given, without this affecting the lawfulness of processing based on consent before its withdrawal.

08How to exercise your rights

To exercise any of the rights described in the previous section, you may contact Dentaláser 1987, S.L. through any of the following means:

• Email: privacidad@dentalaser.com, stating "Exercise of GDPR rights" in the subject line and identifying yourself with your full name and identity document.
• Postal mail: Dentaláser 1987, S.L., Avda. Mijas, 23 · 29640 Fuengirola, Málaga, enclosing a photocopy of your DNI (Spanish national identity document) or equivalent document.

We will respond to your request within a maximum period of one (1) month from its receipt, extendable by a further two (2) months in cases of particular complexity, of which we will duly inform you.

If you consider that the processing of your data infringes data protection legislation, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) (Spanish Data Protection Agency), the competent supervisory authority in Spain, through its electronic headquarters at www.aepd.es or at its address at C/ Jorge Juan, 6, 28001 Madrid.

09Data security

Dentaláser 1987, S.L. has implemented the technical and organisational measures necessary to guarantee the security of your personal data and to prevent its alteration, loss, unauthorised processing or access. These measures include:

• Access control systems with authentication and role-based permission management.
• Encryption of communications using security protocols (TLS/HTTPS).
• Regular backups of data and clinical records.
• Ongoing staff training and awareness on data protection matters.
• Confidentiality agreements with staff and with providers acting as data processors.
• Internal procedures for responding to security breaches and notifying the AEPD within the legally established time limits.

However, no system for transmitting data over the Internet can guarantee absolute security, and therefore the clinic cannot commit with complete certainty that no unauthorised access to your personal data by third parties will occur.

10Cookies policy

Our website uses its own technical or necessary cookies and storage technologies, essential for its proper functioning (for example, to remember the decision you make about cookies or to ensure the secure submission of forms). These do not require your prior consent.

In addition, only if you expressly authorise it, we use:

• Analytics cookies — Google Analytics 4 (Google Ireland Limited). These allow us to know, on an aggregated basis, how many people visit the website and which pages they view, in order to improve it. They are configured with the IP address anonymised and without advertising or ad personalisation purposes. Usual expiry: up to 24 months.
• Third-party embedded content: maps from Google Maps (Google Ireland Limited) on the contact, appointment and clinic-location pages, and videos from YouTube (Google Ireland Limited) on the home page and the patients page. These services may install their own cookies. Unless you accept, none of this content is loaded: instead, you will see a notice with a button to authorise it.

No analytics cookie or third-party content is activated before you accept it. If you decline, no request is sent to those providers.

You may change your mind at any time, both to give and to withdraw your consent, using the button below, the cookie icon located in the bottom-left corner of any page, or by configuring your browser to reject or delete cookies already installed. Please note that disabling them may affect the display of maps and videos.

11Changes to this policy

Dentaláser 1987, S.L. reserves the right to modify this Privacy Policy in order to adapt it to legislative or case-law developments, or to standard industry practice. Changes will be published on this same page, indicating the date of the last update in the header. When the modifications are significant, we will inform you by means of a prominent notice on the website or, where possible, through the contact details you have provided us with.

We recommend that you check this page periodically to stay informed about how we protect your data. Continued use of our services after the publication of the changes will constitute acceptance of the updated policy.

For any query relating to this Privacy Policy, you may contact us at privacidad@dentalaser.com.