Skip to content
972 30 65 65
Centre Mèdic Palafrugell

Privacy policy

Last updated: 23 October 2026

1. Data controller

  • Company name: Centre Mèdic Palafrugell, S.L. (the “Controller”)
  • Tax ID (NIF): B17844515
  • Registered address: Plaça de Catalunya, 5, baixos, 17200 Palafrugell (Girona)
  • Telephone: 972 30 65 65

1.1. Data protection officer (DPO)

Our data protection officer is SIB TRAINING, S.L.U. (Sib Prodasa). For more information, you can contact them through their website: sibprodasa.es.

1.2. Applicable law

This policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR), and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

The Controller may amend this policy to reflect changes in legislation or case law, the guidance of the Spanish Data Protection Agency or changes to the website. The current version is always the one published on this page, with the revision date shown at the top. It is complemented by the Legal notice and the Cookie policy.

2. Purposes of processing

We process your personal data for the following purposes:

  • To answer the enquiries you send us through the contact form, by email or by phone, and to give you information about the centre's services, including physiotherapy and dental care.
  • To manage appointment requests and the care relationship: to provide, manage and invoice our services, including when you come through a health insurer.
  • To protect the contact form against spam and automated use.
  • To produce usage statistics for the website: with Google Analytics, only if you accept analytics cookies, and with our own cookie-free analytics (Rybbit), which counts visits in aggregate.
  • To send you news about the centre by email, only if you have given us your express consent.

2.1. Retention period

We keep data only for as long as each purpose requires:

  • Enquiries via the form or by email: as long as needed to answer them and for a maximum of one year, unless they lead to a care relationship.
  • Patient data and clinical records: for the duration of the care relationship and, afterwards, for the periods set by health law (Spanish Law 41/2002 and Catalan Law 21/2000) and tax law.
  • Marketing communications: until you withdraw your consent.
  • Analytics data: a maximum of 13 months for Google Analytics; cookie-free statistics are kept in aggregate.

3. Legal basis

The legal bases for processing are:

  • Consent (art. 6.1.a GDPR), which you give when you send the form or an email, tick the box accepting this policy before going to the booking portal, accept analytics cookies or subscribe to our communications. You can withdraw it at any time, without affecting the lawfulness of prior processing.
  • The care relationship (art. 6.1.b GDPR) and, for health data, the provision of healthcare (art. 9.2.h GDPR).
  • The centre's legal obligations (art. 6.1.c GDPR), for example in health and tax matters.
  • Legitimate interest (art. 6.1.f GDPR) in protecting the website against fraudulent use and in understanding, in aggregate, how it is used in order to improve it. You can object by writing to us.

3.1. Categories of data

We process identification and contact data (name and surname, telephone, email and, where applicable, postal address), the content of your enquiry and technical connection data, such as the IP address from which you send the form.

Health data is a special category of data. Please do not include detailed clinical information in the contact form: we will treat it with due confidentiality, but it is better discussed at your appointment, by phone or on the booking portal.

4. Security measures

We have adopted the technical and organisational measures needed to ensure the security and confidentiality of your data and to prevent its alteration, loss, processing or unauthorised access, taking into account the state of the art, the nature of the data and the risks to which it is exposed (art. 32 GDPR). The centre's staff are bound by professional secrecy.

5. Recipients

We do not share your data with third parties, except with health insurers when you come through them, with public authorities and courts when required by law, and in the other cases provided for in tax and health legislation.

The providers that work for us process data on our behalf, as data processors (art. 28 GDPR):

  • Online booking portal (citas.cloudgesmed.com): a platform of the provider of the centre's management software. We process the data you enter there as controller.
  • Netlify, Inc.: website hosting and receipt of contact form messages.
  • Google Ireland Ltd.: Google Analytics (only if you accept analytics cookies) and reCAPTCHA (contact form protection).
  • Somia Digital: website maintenance and cookie-free analytics (Rybbit), which uses the IP address to infer the country and city and generates an encrypted identifier that does not reveal who you are. It stores nothing on your device and does not share data with third parties.

5.1. International transfers

Some of these providers (Netlify and Google) may process data outside the European Economic Area. Such transfers are covered by the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

6. Your rights

You have the right to know whether we process personal data about you and to access it, to rectify inaccurate data, to request its erasure when it is no longer needed, to request restriction of processing (in which case we will keep it only for the exercise or defence of legal claims), to object to processing on grounds relating to your particular situation and to data portability. You can also withdraw any consent you have given us at any time.

If you believe we have not processed your data in accordance with the law, you can lodge a complaint with the Spanish Data Protection Agency or the Catalan Data Protection Authority.

6.1. How to exercise your rights

Write to us at info@medicpalafrugell.com, call 972 30 65 65 or come to our address, stating the right you wish to exercise and enclosing a copy of a document that allows us to identify you. If you prefer, we will give you the relevant form. We will reply within one month.

7. Electronic communications

In accordance with Law 34/2002 (LSSI-CE), we will only send you information about the centre by email or other electronic means if you have given us your express consent. You can withdraw it at any time using the unsubscribe link in each message or by writing to info@medicpalafrugell.com.

Call