Privacy policy

This policy explains how personal data of patients and visitors are processed under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

Martín Cuesta Hernández · Tax ID 50322197Z · Calle Marcenado 49, 28002 Madrid (Clínica INMEQ) · Email: info@drmartincuesta.com.

What data we process and why

  • Booking online consultations: first name, surname, email, phone and any optional comment, to manage your appointment and send the confirmation, Google Meet link, reminders and change notices.
  • Payment: payments are processed by Stripe; this website never receives or stores your card details.
  • Healthcare: health data collected during the consultation are part of your medical record.
  • Satisfaction survey and reviews: after your visit you may receive a short survey. You can unsubscribe using the link in that email.

Legal basis

  • Performance of the healthcare relationship you request (Art. 6.1.b GDPR).
  • Provision of healthcare (Art. 9.2.h GDPR) for health data.
  • Compliance with legal obligations, such as keeping medical records and invoicing (Art. 6.1.c GDPR).
  • Legitimate interest for quality surveys, which you may object to at any time (Art. 6.1.f GDPR).

Retention

Booking data are kept for the duration of the healthcare relationship and afterwards for the applicable legal periods. Medical records are kept at least for the period required by Spanish Law 41/2002 and regional regulations; invoicing data for the periods required by tax law.

Recipients and processors

Data are not disclosed to third parties unless required by law. The following providers process data under a contract compliant with Art. 28 GDPR:

  • IONOS SE: web hosting (European Union).
  • Google Ireland Ltd.: Google Calendar and Google Meet for online consultations. Any international transfers rely on the EU-US Data Privacy Framework and standard contractual clauses.
  • Stripe Payments Europe Ltd.: payment processing.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@drmartincuesta.com. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Security

The website uses an encrypted connection (HTTPS), service keys are stored encrypted, and consultations take place on Google Meet, whose traffic is encrypted.