1.Data controller
- Controller
- Jordi Zaragoza Bort
- Trade name
- Jordi Zaragoza Osteopatia
- NRT
- 334607J
- Address
- Carrer Sant Salvador, 10, Edifici Plaça, 2nd floor, office 9
AD500 Andorra la Vella, Principality of Andorra - Telephone
- +376 828 783
- Data protection contact
- secretaria@jordizaragoza.com
In this policy, “the practice”, “we” and “us” refer to the data controller.
2.Applicable law
We process personal data in accordance with:
- Law 29/2021 of 28 October on the protection of personal data (Llei 29/2021, del 28 d’octubre, qualificada de protecció de dades personals, “LQPD”), as amended by Law 12/2024 of 15 July;
- the Implementing Regulation of the LQPD, approved by Decree 391/2022 of 28 September and amended by Decree 45/2023 of 25 January;
- Law 20/2017 of 27 October on the rights and duties of health system users and professionals and on clinical records (Llei 20/2017, del 27 d’octubre), and the Regulation on clinical records of 19 December 2018;
- Law 20/2014 of 16 October on electronic contracting and operators carrying out economic activity in a digital space (Llei 20/2014, del 16 d’octubre);
- and, where applicable to individuals located in the European Union, Regulation (EU) 2016/679, the General Data Protection Regulation.
3.Data we process
We only process the data needed for each purpose:
- Contact and appointment request form: name, email address, telephone number (optional) and the reason for your visit, as you describe it.
- Communications by telephone, email or WhatsApp: your contact details and the content of the communication.
- Patients: identification and contact details, health data contained in the clinical record (history, assessment, treatment and progress), details of the legal representative where applicable, and billing data.
- Browsing: IP address and technical data about your device and browser recorded by the server for security purposes, and information from any cookies you accept.
We obtain the data from you or from your legal representative. If another healthcare professional refers you to the practice, we will receive the necessary clinical information from them, with your knowledge.
4.Purposes, legal bases and retention periods
| Purpose | Legal basis (LQPD) | Retention |
|---|---|---|
| Responding to enquiries and appointment requests received through the form, by email, by telephone or via WhatsApp. | Steps taken at your request prior to entering into a contract (art. 6.1.b). If you voluntarily include health information, your explicit consent (art. 9.2.a). | As long as needed to handle the request. If no treatment relationship begins, up to 12 months from the last communication. |
| Providing osteopathy and physiotherapy care and creating, keeping and managing the clinical record. | Performance of the service contract (art. 6.1.b), healthcare provided by a professional bound by professional secrecy (art. 9.2.h) and compliance with the obligations of Law 20/2017 (art. 6.1.c). | The minimum periods set by Law 20/2017 and the Regulation on clinical records: as a general rule, 10 years from discharge for each episode of care, and 20 years for the documents specified in the Regulation. |
| Managing the diary, confirming appointments and sending reminders and administrative notices. | Performance of the contract (art. 6.1.b). The use of WhatsApp or other instant messaging only with your consent (art. 6.1.a). | For as long as the treatment relationship continues. |
| Invoicing, accounting and compliance with tax obligations. | Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c). | The periods set by Andorran tax and commercial law. |
| Ensuring the security and technical operation of the website (server logs). | Legitimate interest in protecting the website against unauthorised access and fraudulent use (art. 6.1.f). | Up to 12 months, unless they need to be kept to investigate a security incident. |
| Placing non-technical cookies and loading third-party services. | Your consent (art. 6.1.a). | As stated for each cookie in the Cookie Policy. |
| Establishing, exercising or defending legal claims and responding to requests from the authorities. | Legal obligation (art. 6.1.c) and establishment, exercise or defence of legal claims (art. 9.2.f). | For the limitation periods of the relevant legal actions. |
Once these periods end, the data are blocked for as long as any liability may arise and are then securely deleted or anonymised.
We do not make decisions based solely on automated processing and we do not carry out profiling. We do not send commercial communications by electronic means without your prior consent, in accordance with article 19 of Law 20/2014.
5.Health data and professional secrecy
Health data are a special category of personal data. They can only be accessed by Jordi Zaragoza Bort and, to the extent strictly necessary to run the practice, by the staff who work with him. All of them are bound by the duties of professional secrecy and confidentiality laid down in Law 20/2017 and the LQPD.
Please do not send clinical information through the form or via WhatsApp. A brief reason for your visit is enough to request an appointment. Reports, test results and other clinical information are collected at the practice or through the secure channel we will indicate.
6.Recipients
We do not disclose your data to third parties unless required by law or with your consent. The following may receive data:
- Public authorities and bodies, where required by law: the Ministry of Health, the Andorran Social Security Fund (CASS) to manage any benefits you apply for, the courts, the Public Prosecutor’s Office and the Andorran Data Protection Agency. Clinical information may also be added to the shared clinical record of the public health system in the cases and under the conditions laid down in Law 20/2017.
- Other healthcare professionals or centres, when you request or authorise it, or when it is essential to protect your vital interests.
- Insurance companies or mutual societies, only at your request, to process reimbursements.
- Service providers to the practice (processors): website hosting and maintenance, clinical management and scheduling software, email, and accounting and tax advisers. They process the data on our instructions under a contract that complies with article 31 of the LQPD and may not use them for their own purposes.
- Third-party services embedded in the website, which act as independent controllers when you choose to use them: Google (Google Maps and Google reviews displayed through the Trustindex service) and WhatsApp.
7.International transfers
The European Commission recognises that the Principality of Andorra ensures an adequate level of data protection (Decision 2010/625/EU). We process data primarily in Andorra and in the European Union.
We only transfer data outside Andorra to countries that offer an adequate level of protection under the LQPD (European Union and European Economic Area states, countries covered by a European Commission adequacy decision, and countries effectively bound by Council of Europe Convention 108+), or subject to the appropriate safeguards provided for in the LQPD, such as standard contractual clauses.
Some services you may choose to use, such as WhatsApp or Google Maps, may process data in the United States. The EU-US Data Privacy Framework protects individuals in the European Union and does not apply directly to residents of Andorra, so the level of protection may not be equivalent to that in Andorra. For this reason, the map only loads if you accept third-party cookies, and we recommend that you do not share clinical information via WhatsApp.
8.Your rights
You may exercise the following rights at any time:
- Access: find out whether we process your data and obtain a copy.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: ask us to delete your data when they are no longer needed.
- Restriction: ask us to suspend processing in certain cases.
- Portability: receive the data processed by automated means in a structured format, or have them transmitted to another controller.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.
How to exercise them. Send your request to secretaria@jordizaragoza.com with the subject line “Data protection”, or by post to the practice address. State the right you wish to exercise and attach a copy of your passport or identity document (or proof of representation, if you are acting on someone else’s behalf). This copy will only be used to verify your identity and will be deleted once the request has been dealt with. We will reply within one month of receipt.
Clinical records. Rights relating to clinical records are exercised in accordance with Law 20/2017 and its implementing regulation. The rights to object, rectify and erase may be refused on grounds of public interest or to protect the health of the person concerned. The professional’s subjective notes do not form part of the clinical record.
Complaints. If you believe we have not handled your rights correctly, you can lodge a complaint with the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades, APDA): C/ Doctor Vilanova, 15-17, Nova seu del Consell General, floor -5, AD500 Andorra la Vella; telephone +376 808 115; www.apda.ad. If you live in the European Union, you may also contact the supervisory authority in your country.
9.Minors
The website is not aimed at children under 16, who should not send us any data without the permission of a parent or legal guardian.
When treating minors, information and consent are handled in accordance with Law 20/2017: under the age of 16, through the holders of parental authority or guardianship, always taking the child’s views into account; from the age of 16, with the minor themselves.
10.Accuracy of data
You confirm that the data you provide are true and up to date, and you agree to tell us of any changes. If you give us another person’s data, you must have their permission and inform them of the content of this policy.
11.Security measures
We apply technical and organisational measures appropriate to the risk of the processing, particularly as health data are involved: an encrypted connection on the website, access control with personal credentials, back-ups, secure storage of clinical records and secure destruction at the end of the retention period.
In the event of a security breach likely to pose a risk to your rights, we would notify the APDA and, where appropriate, the people affected, in accordance with articles 36 and 37 of the LQPD.
12.Social media
If you interact with the practice’s social media profiles, the processing of your data on those platforms is also governed by each network’s own terms and privacy policy. We will only use any data we can access to respond to your interaction and will not add it to your clinical record.
13.Changes to this policy
We may update this policy to reflect changes in the law or in the way we operate. We will always publish the current version with its update date and, if a change affects processing based on your consent, we will ask for it again where necessary.