PRIVACY POLICY
Dr. Carlos Castellon, M.D.
General & Preventative Medicine
Ibiza, Spain
Last Updated: January 2025
1. INTRODUCTION
This Privacy Policy explains how Dr. Carlos Castellon, M.D. ("we," "us," or "our") collects, uses, stores, and protects your personal information in accordance with the European Union General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection (LOPD-GDD), and applicable Spanish healthcare regulations.
2. DATA CONTROLLER
Dr. Carlos Castellon, M.D.
Medical License No.: 072870415
Ibiza, Balearic Islands, Spain
3. PERSONAL DATA WE COLLECT
We collect the following categories of personal data:
a) Identity Data: Full name, date of birth, passport/ID number, nationality
b) Contact Data: Email address, telephone number, physical address
c) Health Data: Medical history, symptoms, diagnoses, treatment plans, prescriptions, laboratory results
d) Technical Data: IP address, browser type, device information (for telemedicine services)
e) Financial Data: Payment information, billing records
4. HOW WE COLLECT YOUR DATA
We collect personal data through:
- Direct interactions (appointments, consultations, intake forms)
- Telemedicine platforms
- Email and telephone communications
- Third-party platforms used for communication
5. LEGAL BASIS FOR PROCESSING
We process your personal data based on:
- Your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR)
- Performance of a medical contract (Article 6(1)(b) GDPR)
- Legal obligations (Article 6(1)(c) GDPR)
- Vital interests (Article 6(1)(d) GDPR) in emergencies
- Legitimate interests (Article 6(1)(f) GDPR)
For health data specifically, we rely on:
- Explicit consent for medical treatment
- Provision of healthcare (Article 9(2)(h) GDPR)
6. PURPOSE OF DATA PROCESSING
Your personal data is processed for:
- Providing medical consultations and treatment
- Managing appointments and scheduling
- Maintaining medical records as required by Spanish law
- Processing payments and billing
- Communicating about your healthcare
- Complying with legal and regulatory obligations
- Improving our medical services
7. DATA RETENTION
Medical records are retained for a minimum of 5 years following the last treatment, or longer as required by Spanish healthcare regulations (Law 41/2002). Financial records are retained for 6 years in accordance with Spanish tax law.
8. DATA SHARING
We may share your data with:
- Laboratories and diagnostic centers (with your consent)
- Other healthcare providers for referrals (with your consent)
- Spanish health authorities (when legally required)
- Payment processors (for billing purposes)
- Professional advisors (lawyers, accountants) under confidentiality
We do NOT sell your personal data to third parties.
9. INTERNATIONAL TRANSFERS
If data is transferred outside the EEA, we ensure appropriate safeguards through Standard Contractual Clauses or adequacy decisions.
10. YOUR RIGHTS
Under GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten") where legally permissible
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent at any time
- Lodge a complaint with the Spanish Data Protection Agency (AEPD)
To exercise these rights, contact us in writing.
11. DATA SECURITY
We implement appropriate technical and organizational measures including:
- Encrypted communications
- Secure storage systems
- Access controls and authentication
- Regular security assessments
- Staff confidentiality agreements
12. COOKIES AND TRACKING
Our website may use essential cookies for functionality. No marketing or tracking cookies are used without your explicit consent.
13. CHANGES TO THIS POLICY
We may update this Privacy Policy periodically. Changes will be posted on our website with the updated date.
14. CONTACT
For privacy-related inquiries or to exercise your rights:
Dr. Carlos Castellon, M.D.
Ibiza, Spain
15. SUPERVISORY AUTHORITY
You may lodge a complaint with:
Agencia Española de Protección de Datos (AEPD)
www.aepd.es