Policy on information protection

In accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR); Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights and Law 41/2002, of 14 November, on the Basic Regulation of Patient Autonomy and Rights and Obligations in the Field of Clinical Information and Documentation, Patients, users and the general public are informed about:

Introduction

This document is the privacy policy of the health centers of Quirónsalud Group about the processing of personal data of its patients and/or representatives thereof.

For any question in this matter, the patient can contact the Data Protection Officer of the Quirónsalud Group with postal address at Calle Zurbarán, Núm. 28, 28010 of Madrid. You can also contact the Data Protection Officer by sending an e-mail to the following address: DPO@quironsalud.es.

Who is the data controller of your personal data?

A) In case you are patient of any of the health centers of the Group, the data controller of your personal data is the company of the center that provides health care:

B) If we have your data because you have subscribed to the newsletter or requested information about any of the services and/ or products offered through the websites of the Quirónsalud Group, the controller of your data is the company IDCQ HOSPITALES Y SANIDAD S.L.U., with registered office in calle Zurbarán 28, 28010 (Madrid).

What personal data do we process and where does it come from?

The following categories of personal data may be processed in connection with your relationship with us:

• Identifying data, contact details of patients or their representatives (including signature, image, voice, health card, social security number or mutual insurance number)
• Health data integrated into the patient’s medical record;
• Personal characteristics, social circumstances;
• Transactional data (payments, receipts, transfers, debits)

Data can come from the person concerned (patient) himself or, where appropriate, his legal or voluntary representative and/or medical personnel.

For what purpose do we process your personal data?

Personal data may be processed by the data controllers for the following purposes:

1. Provision of healthcare: your personal data is processed for the purpose of providing you with the healthcare that you require, as well as to properly manage the health and hospital administration services required for it, for example:
   • Remind you of your appointments and reviews;
   • Issue evidence of their attendance at the health center in favor of relatives or people related to you who request it, within the framework allowed by the regulations;
   • Take care of any communication with the health center reported by the patient;
   • Manage any incident or complaint submitted by the user and/ or patient;
   • Carry out surveys with the aim of knowing your opinion on the care received and that will be used only to improve and develop our assistance services and management;
   • Dissemination of information and health promotion and prevention activities.
   • Recording of calls
   • Improvement in the effectiveness and efficiency of the healthcare provided: if you give your consent, in certain processes, a recording of the consultation conversation will be made that will subsequently be transcribed and anonymized, between doctor and patient.
2. Scientific research: your data may be processed for scientific purposes, complying with the specific regulations in this regard
3. Anonymization and pseudonymization procedures: certain procedures may be applied to your data so that they are not identifiable or no longer identifiable, or so that they can no longer be attributed to a data subject without using additional information listed separately, for scientific or statistical research purposes, for teaching purposes and/or to improve processes for the benefit of the services provided.
4. Handling of requests o information complaints, suggestions, claims, exercise of data protection rights, etc.: in these cases, your data will be processed for the purpose of managing and processing the request, by any means, including telephone and/or electronic communications.
5. Recording of calls: the calls made by patients can be recorded for quality purposes
6. Compliance with legal obligations: it may be necessary to process personal data to comply with relevant legal requirements. To comply with the legislation on data protection, tax, health, etc.
7. Conclusion and execution of the contract: personal data are processed for the purpose of managing the contractual relationship with the patient
8. Video surveillance: Some health centers have a video surveillance system that collects real-time images of the users of the facility. The processing of this data is done exclusively for security purposes and access control to the facilities.
9. Newsletter sending: if you explicitly consent, your data may be used for sending, by electronic means, of newsletters to which you have subscribed.
10. Sending commercial communications by any means in case of additional consent: if you explicitly consent, your data may be transferred to the entities of the Quirónsalud group (quironsalud and quironprevencion) in order to inform you by any means for promotional and advertising purposes about the centers, services, products or events related to the health sector and/ or health of Quirónsalud Group companies (in no case your data will be used to send you advertising content other than Quirónsalud).

The data collected will be processed for specified purposes and in no case in a way incompatible with those purposes. We remind you that processing for scientific or statistical research purposes is not considered incompatible with the original purpose. In any case, we process your data to always serve you with the same quality of care, regardless of the channel you use to communicate with us (health center, website of the center, mobile applications either face-to-face, telephone or telematics).

What is the legitimacy for processing your data?

For how long will we keep your data?

In general, your data will only be kept for the time strictly necessary for the purpose for which they were collected.

The personal data provided, as well as those derived from the healthcare provided shall be kept for the time appropriate to each case (taking into account medical and legal criteria), and at least five years from the date of discharge of each care process, unless the autonomous and/ or specific regulations set a minimum retention period longer than indicated, in which case it will comply with the provisions of the applicable legislation.

If consent is given for the voice recording of the consultation and its subsequent transcription, the voice recording will be kept until the transcript of the conversation and at most for a period of 4 hours; the transcript of the recording will be kept for a maximum period of 14 days in order to ensure support of possible incidents and subsequently anonymized for quality purposes.

After the minimum period, and having terminated the care and contractual relationship, the controller will keep your data for the duration of the periods corresponding to the legal prescription (fifteen years).

Personal data processed for the purpose of scientific research shall be kept for a period appropriate to each case, depending on the type of research study in which it participates and considering the regulations applicable thereto. Regarding the data processed for scientific research purposes, the Control Authorities of the Autonomous Communities may, at the request of the controller and in accordance with the procedure established by regulation, agree to the full maintenance of certain data, considering historical, statistical or scientific values in accordance with the legislation applicable to each case.

Personal data provided for the purpose of managing any request for information, complaint, suggestion, complaint, complaint, exercise of data protection rights, etc., will be kept for as long as necessary to process the request, and in any case during the time legally established, as well as during the period necessary for the formulation, exercise or defense of claims.

Call recordings will be kept for a maximum of 6 months.

Data processed for the fulfilment of legal obligations will be kept for the time set out in the applicable law.

The data collected for the conclusion and execution of the contract will be kept for the duration of the contractual relationship, as well as for the period necessary for the formulation, exercise or defense of claims, at least five years.

Images captured through video surveillance systems will be kept for a maximum period of 30 days, unless the controller is aware of any fact that could be relevant to a subsequent legal action.

The data processed for sending newsletters to which you have subscribed will be kept until the user revokes their consent, unsubscribes from the newsletter and/or exercises their rights of opposition and/or deletion.

The data processed for sending commercial communications will be kept until the interested party revokes the consent and/or exercises its rights of opposition and/or deletion.

To which recipients will your data be disclosed?

To ensure proper service provision, it is necessary that certain service providers and/or entities of the group process data on behalf of the controller and as processors their personal data. These entities may be, for example, providers of medical services, diagnosis, clinical analysis, audit, physical security, archiving, storage or digitization of information, destruction of documentation, legal advice, IT services, etc. In some of these cases, we inform you that certain medical treatments may involve international transfers of data. However, they should always be carried out in accordance with the appropriate safeguards laid down in data protection legislation (either through standard contractual clauses approved by the European Commission or based on an adequacy decision by the Commission). If you would like more information or to obtain a copy of these guarantees, please contact the data protection officer.

Your personal data will not be communicated to third parties except legal obligation, vital interest, legitimate interest, or with the consent of the interested party, as well as in the following cases and recipients:

1. Patient data may be visible to other health centers of the Quirónsalud Group, based on the legitimate interest of the controller, in order to guarantee and/or improve its affiliation, as well as healthcare provision by the Quirónsalud Group, in such a way that health centers can have a true and up-to-date knowledge of patients' health data, thus ensuring an integral and effective care provision.
2. Since the patient may have an insurance contract under which he or she is a third party (for example, insurers, mutuals, public administrations, including those of a third party in the case of civil liability insurance) the person liable to pay for health services provided by the healthcare institution, as long as the patient so informs us, we may communicate your data to these entities, for the purpose of managing, to validate, verify and control the payment of healthcare services provided on the basis of the legitimacy of the management of health care systems and services and Law 50/1980 of the Insurance Contract.
   Where the patient has taken out insurance with an entity located outside the European Economic Area[1] (hereinafter EEA) whose legislation does not provide a level of data protection equivalent to that of the European Union, it may be necessary to carry out an international transfer of data, subject to the patient’s explicit consent after being informed of the possible risks. We inform you that these transfers only occur for the purpose of collaborating with the patient and facilitating the payment of the care services provided; in short, only these transfers take place, for the management and verification as fast as possible with the insurer, of payment for services in cases where the patient has an insurance policy with an entity located outside the E.E.E.
   If you object to the communication of your data, these entities may refuse to pay for the care services provided, and you are responsible for paying them, as they do not have the possibility to verify, check, validate or control the correct billing by the health center of each of its care processes.
3. The data processed for scientific research may involve international transfers of data; in such cases, you will be informed of this possibility as well as the guarantees so that it can be carried out or, failing this, your consent will be requested.
4. We also inform you that your personal data may be communicated to suppliers of medical equipment, prostheses and implants by legal obligation, or ambulances based on a vital interest of the patient himself.

All information provided to us will be treated confidentially and in strict compliance with the security obligations necessary to prevent access by unauthorized third parties.

What are your rights when you provide us with your data?

You may exercise your rights of access; rectification of inaccurate data; request deletion, among other reasons when the data is no longer necessary for the purposes for which it was collected; in certain circumstances you may also request limitation of processing of your data, in which case we will only retain them for the exercise or defense of claims; finally, and for reasons related to your particular situation, you may also exercise the right of opposition and portability. You can also revoke your consent to the processing of your data at any time.

The exercise of the rights, as well as the revocation of consent for the processing of your data are free of charge, except in the cases of art. 12.5 of Regulation (EU) 679/2016.

To exercise your rights, you may complete the following form: download here

1. If you are a patient of one of the health centers of the Quirónsalud Group, you can exercise your rights in person before the patient care service of the health center that provides assistance, by postal mail addressed to "Patient Care Service" of your health center (see postal address), with the reference "data protection rights" indicating the right you wish to exercise.
   We also inform you that Quironsalud offers you the Patient Portal service, through which, once registered, you can access your personal medical records via a remote, direct, and secure system, among other services. This grants you the right of access as established in Article 13.2 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights
2. In the event that the exercise of your rights is related to any of our newsletters or requests for information about products and/ or services offered on the websites of the group, you can exercise your rights by postal mail addressed to Grupo Quirónsalud, calle Zurbarán 28, 28010 (Madrid) with the reference "data protection rights- newsletter/information" indicating the right you wish to exercise.
3. In the case of participating in a research study, for the exercise of your rights you may contact the Principal Investigator of the research study in which you participate, whose contact details are on the participant information sheet which was given to him prior to his consent to participate in the study.

In addition, we inform you of the possibility of lodging a complaint with the competent supervisory authority, according to the appropriate procedure for each specific case.

Updating the Privacy Policy

This privacy policy may be amended or updated to reflect changes in applicable law, case law, industry practices, or changes in how we handle your data. For this reason, we advise users to visit our privacy policy periodically.

Privacy Policy updated in August 2025