Privacy Policy

Effective Date: September 29, 2025

1) About Us (Data Controller)

Contact Person: Cecilia (independent osteopath)
Address: c. Mateo de Sosa 53, Puerto de la Cruz, 38400, Tenerife, Spain
Privacy Email: info@ceciosteopata.com
Website: https://www.ceciosteopata.com

Since the company is based in Spain, data processing is governed by Regulation (EU) 2016/679 (GDPR) and the LOPDGDD (Organic Law 3/2018).

2) What data we process and how we collect it

We collect only the information you voluntarily provide to us:

  • Contact and Appointments: name, phone number, email, WhatsApp or email messages, date and time of appointment.
  • Osteopathic care details (if applicable): symptoms/medical history as described by you, professional observations, and progress.
  • Billing information: name/business name, tax ID number (if applicable), address for tax purposes, amounts, and payment methods (we do not store card information).
  • Web browsing data: only the data strictly necessary for the website to function; if we add analytics or non-essential cookies, we will ask for your consent.

Source: You provide them to us via WhatsApp, email, the web form, or during your appointment.

3) Purposes and Legal Bases

We process your data to:

  1. Manage your request/appointment and provide you with osteopathic care
    • Legal basis: performance of a contract or pre-contractual measures (Art. 6.1.b of the GDPR) and/or legitimate interest in responding to inquiries (Art. 6.1.f).
  2. Osteopathic Care (Health Information You Share)
    • Legal basis: explicit consent (Art. 9.2.a of the GDPR). You may refuse to give consent or withdraw it at any time; assistance can be provided without collecting sensitive data beyond what is strictly necessary.
  3. Billing, Accounting, and Legal Obligations
    • Legal basis: compliance with legal obligations (Art. 6.1.c).
  4. Informational communications or reminders About your appointment
    • Legal basis: legitimate interest (Art. 6.1.f).
  5. Business Communications (only if you sign up voluntarily)
    • Legal basis: consent (Art. 6.1.a), which may be revoked at any time.

Note about WhatsApp: Please do not send sensitive medical information via WhatsApp. If you need to share health information, please do so during your appointment or through a secure channel that we agree upon.

4) Data processors and service providers

We use service providers that process data on our behalf, under data processing agreements and with appropriate security measures in place:

  • Web Hosting/CDN: Zenbox sp. z o.o. (Poland) – hosting for the website and the form.
  • Email and Cloud: (Google Workspace) – email, documents, and storage.
  • Messaging: WhatsApp Business (Meta Platforms) – scheduling appointments.
  • Calendar (if applicable): (Google Calendar).
  • Payment gateway (if applicable): (Stripe). We do not store card information on our systems.

The list may be updated; we will keep this section up to date.

5) International transfers

Some services may be located outside the European Economic Area (EEA), such as WhatsApp, Google, or Zoom. When international data transfers are made, we apply Standard Contractual Clauses (SCCs) and, where applicable, adequacy frameworks such as the EU–US Data Privacy Framework. You can request information about these safeguards by writing to info@ceciosteopata.com.

6) Retention periods

  • WhatsApp/email messages related to appointments: up to 12–24 months; after that, they are deleted or anonymized.
  • History/notes from osteopathic care (if any): typically 5 years since the last visit (or the timeframe recommended by the professional association or insurance company).
  • Tax and accounting records: for the period required by the tax authorities (usually5–6 years ).
  • Marketing consents: until you revoke them.

We retain the data only for as long as necessary for each purpose or as required by law.

7) Your Rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, data portability, and withdrawal of consent at any time.

We will process your request within 30 days (this period may be extended in complex cases).

8) Safety

We implement reasonable technical and organizational measures: devices with lock and encryption features, two-factor authentication for accounts, restricted access, secure backups, and data minimization. While no measure is foolproof, we work to protect your information in accordance with industry standards.

9) Minors

Our services are intended for adults. We do not process data from minors without valid consent from their guardians.

10) Cookies and Analytics

Our website may use cookies that are strictly necessary for its operation. If we incorporate non-essential cookies (analytics, maps, video, etc.), we will display a cookie banner so you can accept or reject them, and we will publish a Cookie Policy with more details.

11) Communications

  • We use WhatsApp and email to schedule appointments and answer questions. You can ask us to stop sending you reminders at any time.
  • Avoid sending health information through these channels.

12) Changes to This Policy

We may update this Privacy Policy. We will post the current version on this page with a new effective date. Significant changes will be clearly communicated.

How to Contact Us

For any questions regarding privacy or to exercise your rights:
Email:info@ceciosteopata.com
Mailing address: c. Mateo de Sosa 53, Puerto de la Cruz, 38400, Tenerife, Spain

Privacy Policy