Privacy

This translation is provided for convenience; the Spanish version prevails.

Version 1.0 · Date: 22/10/2026

“[Nombre]” is management software used by physiotherapy, health and beauty centres. This policy explains what data we process as controller and refers you to the centre for the data we process on its behalf.

Summary (first layer)

1. Who is the controller

The controller of the processing described in section 3 is [titular], Tax ID (NIF) [NIF], with address at [domicilio profesional]. Privacy contact: [correo]. We have not appointed a data protection officer.

2. If you are a patient or client of a centre: the controller is the centre

When you request or book an appointment on the portal, when the centre registers you in its records or when a professional writes in your clinical record, the controller is the centre that looks after you. It decides what your data is used for, how long it is kept and who it is disclosed to, and you exercise your rights before it.

We are the processor: we host and run the tool on behalf of the centre, under a processing agreement (Art. 28 GDPR), and we do not use that data for our own purposes, except for the usage metrics and support summaries described in section 3. If you write to us about that data, we will forward your request to the centre.

The same applies to centre staff with regard to their work account in the application (user, photo, schedules, takings): the controller is their centre. This policy does affect you, as a professional, when you use the support assistant (section 3.6) and through the usage metrics (section 3.5).

The centre must give you its own privacy information on the portal and at the appointment.

3. Processing for which we are the controller

3.1 Website form and contact enquiries

• Purpose: presenting the software, handling requests for a place or for information, and replying to those who write to us.
• Data: what you type into the website form (your name, the name and sector of your centre, how many practitioners you have, your email, your phone number if you give it, and your message) or in your email. Do not type health data or data about your patients or clients. The website uses no analytics.
• Legal basis: if you request a place or information in order to sign up, applying measures prior to a contract at your request (Art. 6.1.b GDPR); if you only send us an enquiry, our legitimate interest in answering it (Art. 6.1.f).
• Retention: while we deal with your request and, if you do not sign up, up to 12 months; afterwards, blocked for 3 years solely to deal with possible liabilities. The message is not stored in the application’s database: it only remains in our email.
• Recipients: the form is received by our own server, hosted on Microsoft Azure in the European Union, which forwards the message to our email using Azure’s email service (European Union). No other providers are involved and there is no transfer outside the European Economic Area. Our mailbox is managed by [proveedor del buzón de correo]. The website is hosted by [proveedor del alojamiento del sitio web].

3.2 Attracting centres through social media and direct messages

• Purpose: making [Nombre] known to centres and professionals who may be interested.
• Data: name, public professional profile and centre name, as they appear on social media, and the messages we exchange.
• Status: we have not yet started this outreach; this section describes how we will do it.
• Legal basis: legitimate interest in business-to-business promotion (Art. 6.1.f GDPR). We always identify ourselves, do not insist if there is no reply and do not use bought lists.
• Your right to object: you may ask us at any time, by replying to the message or at [correo], not to contact you again, without giving reasons. We will add you to an exclusion list, which we keep for as long as needed to respect your decision.
• Retention: until you object and, if you do not reply, 12 months at most from the first message.
• Recipients: social networks (for example, Instagram, LinkedIn or TikTok) process the data on their platforms as independent controllers, under their own policies.

3.3 Client centres and invoicing

• Purpose: registering the centre, managing the contract, collecting payment, invoicing and providing contractual support.
• Data: company name, tax ID, address, contact persons, details of the centre’s data protection officer, plan taken and payments.
• Legal basis: performance of the contract (Art. 6.1.b) and compliance with legal accounting and tax obligations (Art. 6.1.c). For the data of contact persons of a centre that is a company, our legitimate interest in maintaining the relationship with it (Art. 6.1.f GDPR and Art. 19 LOPDGDD).
• Retention: during the contract and, afterwards, six years (Art. 30 of the Commercial Code) and whatever tax law requires; blocked in the meantime.
• Recipients: Microsoft (hosting), the tax adviser [asesoría fiscal], the payment gateway [pasarela de pago, cuando exista] and the Tax Agency where applicable.

3.4 Administration panel accounts

• Purpose: controlling access to the panel from which we administer the platform.
• Data: username, password hashed with a key-derivation algorithm (never in clear), second-factor secret (encrypted), session dates and access attempts.
• Data subjects: the owner and the people he or she authorises to administer the platform.
• Legal basis: legitimate interest in protecting the panel from which the platform is accessed and in being able to show who did each action (Art. 6.1.f), in connection with the security duty of Art. 32.
• Retention (planned): while the account is active and two years afterwards; session logs, one year.

3.5 Usage metrics per centre

• Purpose: sizing the service and detecting incidents.
• Data: number of appointments, sessions and amounts collected per centre and month (up to 36 months) and active accounts per centre. They do not include patient data. In centres with one or two people, these figures may relate to a specific professional.
• Legal basis: our legitimate interest in sizing the service and detecting incidents (Art. 6.1.f). We only use figures aggregated per centre and month, and centres know this because it is in their contract. You may object by writing to [correo].
• Retention: 36 months.

3.6 Support assistant for centre staff

Centre staff can type questions to the application’s support assistant. We want you to know exactly how it works:

• What it is: an artificial intelligence assistant that answers using the [Nombre] help documentation and summaries of earlier incidents. The AI service is provided, as our supplier, by Anthropic Ireland, Limited, and the data is then processed in the United States by Anthropic, PBC. Transfers to the USA rely on the standard contractual clauses approved by the European Commission (section 4). According to its commercial terms, Anthropic does not train its models on the content we send it. [retención cero: solicitada/concedida]
• Do not type patient or client data (names, phone numbers, diagnoses, reasons for consultation). The assistant does not need it to answer a question about how to use the software.
• There is a filter, but it is not foolproof: before your message is sent to the provider, the application automatically removes email addresses, DNI and NIE numbers written without separators, phone numbers, record numbers and the names and surnames of centre staff written with an initial capital. It does not detect health data, names written in another way or every document format.
• Real people also read the messages: your messages, as you type them (unfiltered), are stored on our systems while the conversation lasts and are read by the support team to help you.
• What is kept: when the conversation ends (by agreement or when the team closes it), the messages and your username are deleted, and the AI writes a summary of the incident and its solution, without names or contact details. The summary stays linked internally to your account and your centre (we plan to unlink it). If the conversation ended through inactivity (three hours without messages) or is urgent, it is deleted once the support team has read it.
• Reuse: incident summaries are used to pick similar cases only within your own centre: the text of the most similar ones, without identifiers, may be sent to the assistant as an example in other conversations of your centre. They are never used in conversations of other centres.
• Suggestions: improvement suggestions you send are stored with your user.
• Roles and legal bases: during the conversation we process the messages on behalf of your centre, to provide it with the service it has hired. The summary and its reuse are processing of our own, based on our legitimate interest in improving support (Art. 6.1.f); that is why it carries no names or contact details. You may object by writing to [correo].
• Retention (planned): summaries and suggestions, 24 months at most. [fecha de la purga automática]

3.7 Centre finder

• Purpose: showing you the centres that use [Nombre] near the place you type.
• Data: the text you type (centre name, address or place). The application does not store your IP address: it only uses it in memory, temporarily, to limit abuse. The server’s technical access logs keep it for 15 days for security.
• Geocoding: to convert the place into coordinates, our server sends only the text typed to the public CartoCiudad service of the Instituto Geográfico Nacional (Spain). CartoCiudad does not receive your IP or any data that identifies you. Responses are cached for one hour.
• Legal basis: legitimate interest in offering the public a finder of the centres that use [Nombre] (Art. 6.1.f).
• Do not type anyone’s personal data into the finder.

3.8 Administration access log

• Purpose: keeping a record of the actions we carry out from the administration panel on centres, to control privileged access and to be able to demonstrate it to the centre or an authority.
• Data: administration user, action, date and, for technical queries to the database, the shape and a fingerprint of the statement, not its literal text (planned; today the text is stored, and it may include a centre’s data).
• Legal basis: compliance with the duty of security and accountability (Arts. 6.1.c, 5.2 and 32 GDPR) and legitimate interest in defending ourselves against claims (Art. 6.1.f).
• Retention (planned): six years from the centre’s cancellation. [fecha de la auditoría sin SQL literal]

3.9 Commercial emails (future)

If in the future we send newsletters or news by email, we will do so only to those who have consented or, if you are already a client, about our own products or services similar to those you have hired and provided we offered you the chance to object when collecting your data. Every message will include a link to unsubscribe. We will keep your data until you unsubscribe and a record of unsubscribes to respect it.

4. Recipients, providers and international transfers

We do not sell data or hand it to third parties for their own purposes. We only disclose it to public authorities when the law requires it and to these providers, which act on our behalf (and, for centres’ data, as sub-processors authorised by each centre):

CartoCiudad (Instituto Geográfico Nacional, Spain) is not our provider: it only receives the text typed in the finder.

We will host patient and client data on Microsoft Azure, Spain region ([fecha de puesta en producción]). The support assistant involves a transfer to the United States of staff messages, once filtered. The website form involves no international transfer. You can ask for a copy of the safeguards at [correo].

5. Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw at any time any consent you have given, by writing to [correo]. State which right you are exercising; if we have reasonable doubts about your identity, we will ask you for the minimum needed to confirm it.

Objection. Where we process your data on the basis of legitimate interest (sections 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7 and 3.8) you may object at any time on grounds relating to your particular situation, and to commercial outreach (sections 3.2 and 3.9) without giving reasons.

We will reply within one month, extendable by two further months if the request is complex, and we will tell you about the extension within the first month.

If your request concerns data we process on behalf of a centre (for example, your clinical record or your appointments), we will pass it to the centre, which is the one that must deal with it.

If you consider that we have not handled your rights properly, you may complain to the Spanish Data Protection Agency (www.aepd.es).

6. Is it compulsory to give us the data? Automated decisions

Without a means of contact we cannot reply to you (3.1); without the centre’s details we cannot sign up or invoice (3.3). We take no automated decisions that affect you: the support assistant only suggests answers.

7. Minors

The website, the centres’ application and the administration panel are not aimed at minors. The booking portal is used by adults or by the adults responsible for a minor. The data of minors treated by a centre is that centre’s responsibility; it processes it for their care and asks for the permission of the responsible adult or of the minor, depending on age, only for what is optional.

8. Security

We apply, among others, these measures:

• Each centre’s data is separated in the database by row-level isolation: the staff of one centre cannot see another’s.
• Passwords are stored with Argon2id, an algorithm designed so that they cannot be recovered.
• Sessions use random identifiers that are only stored hashed (SHA-256), in cookies that the page’s code cannot access.
• The administration panel requires a second authentication factor and blocks access after several failed attempts.
• Every access to a clinical record is logged.
• Backups (planned in production from [fecha de las copias programadas]): an encrypted copy (AES-256-GCM) of each centre, daily, kept for seven days, and the Azure server’s copy, which allows restoring it to a given point in time for up to 35 days. Data we delete disappears from all copies after 35 days at the most.
• Microsoft Azure’s encryption at rest is planned in the production deployment.

No system is invulnerable. If a security breach affecting your data occurred, we would act in accordance with Articles 33 and 34 GDPR and, if the data belongs to a centre, we would tell it without delay.

9. Changes to this policy

We may update this policy when the processing or the providers change. We will publish the new version with its number and date and, if the change is significant, we will notify client centres in advance.