1. Data Controller

CAPIL SOLUTIONS, S.L
Company Name: CAPIL SOLUTIONS, SL (hereinafter, the “Company” or the “Controller”).
Tax ID (NIF/CIF): B66946138
Address: C. AMIGO 11, 3 – 08021 – BARCELONA – BARCELONA
Telephone: 932713346
Email for Data Protection communications: info@capilclinic.es

1.1 Applicable Regulations

Our Privacy Policy has been designed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights.

By providing us with your data, you declare that you have read and understood this Privacy Policy and give your unequivocal and express consent to the processing of your personal data in accordance with the purposes and terms stated herein.

The Company may modify this Privacy Policy to adapt it to legislative, case-law or interpretative developments issued by the Spanish Data Protection Agency. These privacy conditions may be supplemented by the Legal Notice, Cookie Policy and General Terms and Conditions that may apply to certain products or services where access involves specific personal data protection requirements.

1.2 Data Protection Officer

To contact the appointed Data Protection Officer: anavarro@capilclinic.es

2. PURPOSE AND LEGAL BASIS FOR PROCESSING

The personal data provided through the website form will be processed by CAPIL SOLUTIONS, S.L. for the following purposes and on the following legal bases:

Purpose	Legal basis	Operational description
a) To respond to your request for information or contact.	Consent of the data subject (Art. 6.1(a) GDPR)	To manage and respond to enquiries, quotation requests or appointment requests received through the website form or associated contact channels.
b) To send commercial communications and promotions regarding CapilClinic services or treatments (optional).	Express consent of the data subject through a separate checkbox.	Sending information about news, promotions and offers only if the user authorises it by selecting the corresponding checkbox.
c) To participate in prize draws or other promotional activities organised by CapilClinic (optional).	Express consent of the data subject through a separate checkbox.	Use of contact details to manage participation in prize draws and to send communications related to them.

No automated decisions will be made and no profiles will be created based on the data collected through this form.

Use of WhatsApp: If the user chooses to communicate via WhatsApp, processing will be limited to administrative matters such as appointment confirmations or reminders. No clinical data or medical images will be exchanged through this channel. The service is provided by Meta Platforms Inc. (USA), whose international transfers are covered by Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

Retention period: Data will be retained while the relationship or valid consent remains in force and, otherwise, will be deleted after three years of inactivity or upon a request for removal, while strictly necessary data will remain blocked for the applicable statutory limitation periods. Inactivity is understood as the absence of interactions with our communications, services or website for a continuous period of 3 years.

Data processors: Data may be processed by providers offering web hosting, appointment management, IT maintenance or electronic communications services, all of whom operate under data processing agreements in accordance with Article 28 GDPR and with appropriate confidentiality and security safeguards.

2.1 Data Retention Period

Personal data will be retained only for the time necessary to fulfil the purposes for which it was collected or while valid consent from the data subject remains in force, according to the following criteria:

Health data and medical records: They will be retained for a minimum of 5 years from the discharge date of each healthcare process, in accordance with Article 17 of Law 41/2002. In Catalonia, medical records are retained for up to 20 years after the patient’s death, pursuant to Law 21/2000 and its implementing regulations. Once these periods have elapsed, the data will be deleted or anonymised unless additional retention is required by law.
Administrative and tax data: 6 years, in compliance with tax and commercial obligations (Art. 30 of the Commercial Code).
Data for commercial communications, promotions and prize draws: From the time consent is obtained until the data subject withdraws consent or requests deletion, or for up to three years from the last interaction or indication of activity (email opening, website access or response to communications). After this inactivity period, the data will be blocked and subsequently securely deleted.
Basic contact details: For as long as there is a legitimate interest or active consent to maintain the communication relationship.

In all cases, once the purposes have been fulfilled or the above periods have expired, the data will be blocked and accessible only to the DPO or authorised internal personnel for legal purposes or the defence of claims during the applicable statutory limitation periods. It will subsequently be permanently deleted or anonymised.

3. LEGAL BASIS AND DATA COLLECTED

The legal basis for processing your data is the express consent granted through a positive and affirmative action, namely completing the corresponding form and selecting the checkbox accepting this policy when providing us with your personal data.

3.1 Consent to Process Your Data

By completing the forms, selecting the “I accept the Privacy Policy” checkbox and clicking to submit the data, or by sending emails to the Company through the designated email accounts, the User declares that they have read and expressly accepted this Privacy Policy and grants unequivocal and express consent to the processing of their personal data in accordance with the stated purposes.

3.2 Categories of Data

The data collected relates to identifying information such as: First Name and Surname, Telephone Number, Postal Address, Company, Email Address, as well as the IP address from which the data collection form is accessed.

4. SECURITY MEASURES

In order to guarantee the security and confidentiality of communications, particularly where sensitive personal data under Article 9 of Regulation (EU) 2016/679 may be involved, users are informed that the WhatsApp Business channel provided by the Company is intended to facilitate appointment management, quotations and administrative reminders.

For any consultation or transmission of clinical information, images, diagnoses or medical documentation, the Company provides specific and secure channels that ensure the proper processing of such data. Users are advised not to use WhatsApp for this type of content in order to adequately protect the information shared.

If the user needs to share health-related information, they may request access from the team to the channel provided for this purpose, thereby ensuring compliance with current personal data protection regulations.

4.1 International Data Transfers

In general, CAPIL SOLUTIONS, S.L. does not carry out international data transfers.

However, if the user chooses to communicate through the WhatsApp Business channel, the service is provided by Meta Platforms, Inc. (USA), which may involve an international transfer of data.

Such transfers are covered by Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), which ensure an adequate level of protection.

This channel is used exclusively for administrative matters such as appointment confirmations or reminders, and no clinical data or medical images will be exchanged through this means.

In no other case will personal data be transferred outside the European Economic Area.

5. Data Disclosure and Data Processors

CAPIL SOLUTIONS, S.L. will not disclose your personal data to third parties unless required by law or requested by a competent authority.

For the proper provision of its services, the Company works with providers acting as data processors, with limited access to personal data and contractually required to maintain confidentiality and implement appropriate technical and organisational measures in accordance with Article 28 GDPR.

The main data processors include:

Web hosting and maintenance providers.
Appointment and patient management software providers.
Email marketing services, only if authorised by the user.
Accounting and tax advisory services.
Partner clinical laboratories.

None of these processors carry out international transfers, except Meta Platforms, Inc. (USA) for the WhatsApp channel, in accordance with the framework described in Section 4.1.

5.1 DATA PROCESSORS

To provide our services, we work with various providers acting as data processors with access to personal data:

Storage and cloud service providers for medical records.
Clinic and appointment management software providers.
Email marketing services for consented commercial communications.
Accounting and billing services.
Partner laboratories for clinical tests when required.

All our processors guarantee appropriate technical and organisational measures in accordance with Article 28 GDPR and have signed the corresponding data processing agreements.

6. USER RIGHTS

Any data subject has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Data subjects have the right to access their personal data and to request the correction of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Under certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will retain it only for the establishment, exercise or defence of legal claims.

For reasons related to their particular situation, data subjects may object to the processing of their data. The Controller will cease processing the data unless there are compelling legitimate grounds for the processing or for the establishment, exercise or defence of possible legal claims.

In accordance with current legislation, you have the following rights: the right to request access to your personal data, the right to request its rectification or deletion, the right to request restriction of processing, the right to object to processing, the right to data portability and the right to withdraw the consent previously granted.

You also have the right to lodge a complaint with the Spanish Data Protection Agency.

6.1 How Can I Exercise My Rights?

To exercise your rights, you must contact the Controller and request the corresponding form for the right you wish to exercise. Alternatively, you may contact the competent Supervisory Authority for further information about your rights.

The contact details for exercising your rights are telephone number 932713346 and email address: INFO@CAPILCLINIC.ES.

Please remember to include a copy of a document that allows us to identify you.

7. CONSENT TO RECEIVE ELECTRONIC COMMUNICATIONS

Likewise, and in accordance with Law 34/2002 of 11 July on Information Society Services and Electronic Commerce, by completing the data collection form and selecting the corresponding checkbox “I agree to receive electronic communications”, you expressly consent to receiving information about the Company at your email address, telephone number, fax number or through another electronic means.

Last updated: November 2025