1. Data Controller

Controller:: Dr. Constanze Goetz
NIF (Tax ID):: Y95511564Y
Postal Address:: C/ Nou, 38 · 43340, Montbrió del Camp (Tarragona, Spain)
Email:: reservas@draconstanzegoetz.com
Phone:: +34 694 920 126

2. Purposes and Lawfulness of Processing

A. Management of Inquiries and Information Requests

We process data provided through forms, emails, phone, or instant messaging to answer inquiries and manage booking requests.

Legal basis: Consent of the data subject (Art. 6.1.a GDPR).

B. Provision of Healthcare and Medical Services

We process necessary data for:

Appointment management.
Creation and maintenance of clinical medical histories.
Healthcare monitoring.
Billing and administrative management.
Compliance with statutory medical obligations.

Legal basis:

Performance of the healthcare contract/relationship (Art. 6.1.b GDPR).
Compliance with legal obligations (Art. 6.1.c GDPR).
Processing of health data necessary for the provision of healthcare services (Art. 9.2.h GDPR).

C. Clinical Images and Before/After Photographs

The publication of identifiable clinical photographs will always require express, specific, informed, and revocable consent from the patient. Refusing to provide such consent will not affect the medical care received in any way.

3. Data Retention Period

Data will be kept for as long as necessary to fulfill the purposes for which they were collected, and for the periods required by applicable health, fiscal, administrative, and professional liability regulations.

Clinical documentation will be retained for the legally required periods in accordance with the health regulations in force in Catalonia (Spain), which mandate a minimum of 5 years from the end of the last treatment, and as long as legal responsibilities may arise from the healthcare provided.

4. Data Recipients

Personal data may only be communicated, when necessary, to:

Competent public administrations.
Judicial authorities.
Insurance companies, when applicable.
Laboratories or medical suppliers directly linked to the treatment.
Technology providers acting as data processors.

All of them are bound by corresponding confidentiality and data protection obligations under the GDPR.

5. International Data Transfers

Generally, no international transfers of data are carried out. If technology providers located outside the European Economic Area (EEA) are used, the strict safeguards required by the GDPR will be implemented.

6. Rights of Data Subjects

Users may exercise the following rights:

Access.
Rectification.
Erasure (Right to be forgotten).
Objection.
Restriction of processing.
Data portability.
Withdrawal of consent at any time.

The withdrawal of consent will not affect the lawfulness of processing carried out prior to its withdrawal.

7. Exercising Your Rights

Rights can be exercised by sending a written communication to:

Dr. Constanze Goetz
Address:: C/ Nou, 38 · 43340, Montbrió del Camp (Tarragona, Spain)
Email:: reservas@draconstanzegoetz.com

A copy of a valid identification document (DNI, NIE, or Passport) must be attached.

Furthermore, data subjects have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).