Privacy Policy

Effective date: 29/09/2025

1) Who we are (Data Controller)

Responsible: Cecilia (self-employed osteopath)
Contact address: c. Mateo de Sosa 53, Puerto de la Cruz, 38400, Tenerife, Spain
Privacy email: info@ceciosteopata.com
Web: https://www.ceciosteopata.com

As it is established in Spain, the processing of data is governed by Regulation (EU) 2016/679 (GDPR) and the LOPDGDD (Organic Law 3/2018) .

2) What data do we process and how do we obtain it

We only collect the data that you provide to us voluntarily:

  • Contact and appointments: name, phone number, email, WhatsApp messages or mail, date and time of appointment.
  • Osteopathic care data (if applicable): symptoms/history you tell us, professional observations and evolution.
  • Billing information: name/company name, tax ID (if applicable), tax address, amounts and payment methods (we do not store card details).
  • Web browsing data: only those strictly necessary for the website to function; if we add analytics or non-essential cookies, we will ask for your consent.

Origin: You provide them to us via WhatsApp , email , web form or during the consultation .

3) Purposes and legal bases

We process your data for:

  1. Manage your request/appointment and provide you with osteopathy services
    • Legal basis: performance of a contract or pre-contractual measures (Art. 6.1.b GDPR) and/or legitimate interest in responding to inquiries (Art. 6.1.f).
  2. Osteopathic care (health data you share)
    • Legal basis: explicit consent (Art. 9.2.a GDPR). You can refuse or withdraw it at any time; assistance can be provided without recording sensitive data beyond what is strictly necessary.
  3. Billing, accounting and legal obligations
    • Legal basis: compliance with legal obligations (art. 6.1.c).
  4. Informative communication or reminders about your appointment
    • Legal basis: legitimate interest (art. 6.1.f).
  5. Commercial communications (only if you opt in voluntarily)
    • Legal basis: consent (art. 6.1.a), revocable at any time.

Note regarding WhatsApp: Please do not send sensitive medical information via WhatsApp . If you need to share health data, please do so during a consultation or through a secure channel we agree upon.

4) Data processors and suppliers

We use suppliers who process data on our behalf, with service agreements and appropriate security measures:

  • Web hosting/CDN: Zenbox sp. z oo (Poland) – hosting of the site and the form.
  • Email and cloud: (Google Workspace) – email, documents and storage.
  • Messaging: WhatsApp Business (Meta Platforms) – appointment communication.
  • Calendar (if applicable): (Google Calendar).
  • Payment gateway (if applicable): (Stripe). We do not store card data on our systems.

The list may be updated; we will keep this section up to date.

5) International transfers

Some services may be located outside the European Economic Area (EEA), such as WhatsApp, Google, or Zoom. When international data transfers occur, we apply Standard Contractual Clauses (SCCs) and, where appropriate, adequacy frameworks such as the EU-US Data Privacy Framework . You can request information about these safeguards by writing to info@ceciosteopata.com .

6) Storage periods

  • WhatsApp/email messages related to dates: up to 12–24 months , then they are deleted or anonymized.
  • History/observations of osteopathic care (if any): normally 5 years since the last visit (or the period recommended by the college/insurer).
  • Tax/accounting documentation: during the legal period required by the Tax Office (usually 5-6 years ).
  • Commercial consents: until you withdraw them.

We retain data only for as long as necessary for each purpose or as required by law.

7) Your rights

You can exercise, whenever you want, the rights of access, rectification, erasure, objection, limitation of processing, portability and withdrawal of consent .

We will process your request within a maximum of 30 days (extendable in complex cases).

8) Security

We implement reasonable technical and organizational measures: devices with locking and encryption , two-factor authentication on accounts, limited access, secure backups, and data minimization. While no measure is foolproof, we work to protect your information in accordance with industry standards.

9) Minors

Our services are intended for adults . We do not process data from minors without valid consent from their guardians.

10) Cookies and analytics

Our website may use cookies that are strictly necessary for its operation. If we incorporate non-essential cookies (analytics, maps, video, etc.), we will display a cookie banner so you can accept or reject them , and we will publish a more detailed Cookie Policy .

11) Communications

  • WhatsApp and email are used to manage appointments and answer questions. You can request that we stop sending you reminders at any time.
  • Avoid sending health data through these channels.

12) Changes to this policy

We may update this Privacy Policy. We will post the current version on this page with the new effective date . Significant changes will be prominently displayed.

How to contact us

For any questions about privacy or to exercise your rights:
Email: info@ceciosteopata.com
Postal address: c. Mateo de Sosa 53, Puerto de la Cruz, 38400, Tenerife, Spain

Política de Privacidad