Privacy Policy

1. Data Controller

• CAPIL SOLUTIONS, S.L
• Company Name: CAPIL SOLUTIONS, SL (hereinafter, the “Company” or the “Controller”).
• Tax ID (NIF/CIF): B66946138
• Address: C. AMIGO 11, 3 - 08021 - BARCELONA - BARCELONA (Spain)
• Phone: 932713346
• Email for Data Protection communications: info@capilclinic.es

1.1 Applicable Regulations

Our Privacy Policy has been designed in accordance with the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), and Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.

By providing us with your data, you declare that you have read and are aware of this Privacy Policy, providing your unequivocal and express consent to the processing of your personal data according to the purposes and terms expressed herein.

The Company may modify this Privacy Policy to adapt it to legislative, jurisprudential, or interpretation developments of the Spanish Data Protection Agency. These privacy conditions may be supplemented by the Legal Notice, Cookie Policy, and General Conditions that, where appropriate, are collected for certain products or services, if such access involves any specialty in terms of personal data protection.

1.2. Data Protection Officer

To communicate with the designated Data Protection Officer: anavarro@capilclinic.es

2. PURPOSE AND LAWFULNESS OF PROCESSING

The personal data provided through the web form will be processed by CAPIL SOLUTIONS, S.L. for the following purposes and legal bases:

Purpose	Legal Basis	Operational Description
a) Attending to your request for information or contact.	Consent of the data subject (Art. 6.1.a GDPR)	Managing and responding to queries, quote requests, or appointments received via the web form or associated contact methods.
b) Sending commercial communications and promotions regarding CapilClinic services or treatments (optional).	Express consent of the data subject via independent checkbox.	Sending information about news, promotions, and offers, only if the user authorizes it by checking the corresponding box.
c) Participating in giveaways or other promotional actions organized by CapilClinic (optional).	Express consent of the data subject via independent checkbox.	Using contact details to manage participation in giveaways and sending related communications.

No automated decisions will be made, and no profiles will be created based on the data collected through this form.

Use of WhatsApp: Should the user choose to communicate via WhatsApp, processing will be limited to administrative tasks (appointment confirmation or reminders). No clinical data or medical images will be exchanged through this channel. The service is provided by Meta Platforms Inc. (USA), whose international transfers are covered by Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

Retention period: Data will be kept as long as the relationship or valid consent is maintained. Otherwise, they will be deleted after three years of inactivity or request for cancellation, keeping strictly necessary data blocked during legal limitation periods. Inactivity is considered the absence of interactions with our communications, services, or website for a continuous period of 3 years.

Data Processors: Data may be processed by providers rendering web hosting, appointment management, IT maintenance, or electronic communication services, all under a processor contract pursuant to Article 28 GDPR and with adequate guarantees of confidentiality and security.

2.1. Retention Period of your data

Personal data will be kept only for the time necessary to fulfill the purposes for which they were collected or as long as valid consent from the data subject exists, according to the following criteria:

• Health data and clinical records: They will be kept for a minimum of 5 years from the discharge date of each care process, in accordance with Article 17 of Law 41/2002. In Catalonia, clinical records are kept for up to 20 years from the patient's death, according to Law 21/2000 and development regulations. After these periods, the data will be deleted or anonymized, unless further retention is required by legal obligations.

• Administrative and fiscal data: 6 years, in compliance with tax and commercial obligations (Art. 30 of the Commercial Code).

• Data for commercial communications, promotions, and giveaways: From obtaining consent until the data subject revokes it or requests deletion, or up to three years from the last interaction or sign of activity (opening emails, web access, or response to communications). After this period of inactivity, data will be blocked and subsequently securely deleted.

• Basic contact data: While a legitimate interest or active consent is maintained to preserve the communication relationship.

In all cases, once the purposes are fulfilled or the aforementioned periods expire, the data will remain blocked (accessible only to the DPO or internal managers for legal purposes or defense against claims) during the applicable legal limitation periods and will subsequently be deleted or irreversibly anonymized.

3. LAWFULNESS AND COLLECTED DATA

The lawfulness for processing your data is the express consent granted through a positive and affirmative act (filling out the corresponding form and checking the acceptance box of this policy) at the time of providing us with your personal data.

3.1. Consent to process your data

By filling out the forms, checking the box "I accept the Privacy Policy" and clicking to send the data, or by sending emails to the Company through the accounts enabled for this purpose, the User declares to have read and expressly accepted this privacy policy, and grants their unequivocal and express consent to the processing of their personal data according to the indicated purposes.

3.2. Categories of data

The data collected refers to the category of identifying data, such as: First and Last Name, Phone, Postal Address, Company, Email, as well as the IP address from which the data collection form is accessed.

4. SECURITY MEASURES

With the aim of guaranteeing the security and confidentiality of communications, especially when sensitive personal data may be involved according to Article 9 of Regulation (EU) 2016/679, the user is informed that the WhatsApp Business channel enabled by the Company is intended to facilitate the management of appointments, quotes, and administrative reminders.

For any query or submission of clinical information, images, diagnoses, or medical documentation, the Company provides specific and secure channels that ensure the proper processing of such data. It is recommended not to use WhatsApp for this type of content in order to properly protect the shared information.

Should the user require sharing health-related information, they may request the team for access to the channel enabled for this purpose, thus ensuring compliance with current regulations on personal data protection.

4.1. International data transfers

In general, CAPIL SOLUTIONS, S.L. does not perform international data transfers.

However, if the user chooses to communicate through the WhatsApp Business channel, the service is provided by Meta Platforms, Inc. (USA), which may involve an international data transfer.

Such transfers are covered by Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), which guarantee an adequate level of protection.

This channel is used exclusively for administrative tasks (appointment confirmations or reminders), and no clinical data or medical images will be exchanged via this medium.

In no other case will personal data be transferred outside the European Economic Area.

5. Data Disclosure and Data Processors

CAPIL SOLUTIONS, S.L. will not disclose your personal data to third parties, except by legal obligation or requirement by a competent authority.

For the proper provision of its services, the company has providers acting as data processors, with limited access to personal data and contractually bound to maintain confidentiality and adopt appropriate technical and organizational measures according to Article 28 of the GDPR.

The main processors are:

– Web hosting and maintenance providers.

– Appointment and patient management software.

– Email marketing services (only if the user has authorized it).

– Accounting and tax consultancy.

– Partner clinical laboratories.

None of these processors perform international transfers, except for Meta Platforms, Inc. (USA) for the WhatsApp channel, according to the regime described in section 4.2.

5.1 DATA PROCESSORS

To provide our services, we have various providers acting as data processors with access to personal data:

• Cloud storage and services providers (storage of clinical records).

• Clinic and appointment management software.

• Email marketing services (for consented commercial communications).

• Accounting and billing services.

• Partner laboratories (for clinical analysis when necessary).

All our processors guarantee adequate technical and organizational measures according to Art. 28 of the GDPR, and have signed the corresponding processor contracts.

6. USER RIGHTS

Any data subject has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. In certain circumstances, data subjects may request the limitation of the processing of their data, in which case we will only keep it for the exercise or defense of claims. For reasons related to their particular situation, data subjects may object to the processing of their data. The Data Controller will stop processing the data, except for compelling legitimate reasons, or the exercise or defense of possible claims.

In accordance with current legislation, you have the following rights: the right to request access to your personal data, the right to request its rectification or deletion, the right to request the limitation of its processing, the right to object to the processing, the right to data portability, and likewise, to revoke the consent granted. Furthermore, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

6.1. How to exercise my rights?

To exercise your rights, you must contact the controller, requesting the corresponding form for the exercise of the chosen right. Optionally, you may go to the competent Supervisory Authority to obtain additional information about your rights. The contact details for exercising your rights are telephone 932713346 and email: INFO@CAPILCLINIC.ES. Remember to attach a copy of a document that allows us to identify you.

7. CONSENT FOR SENDING ELECTRONIC COMMUNICATIONS

Likewise, and in accordance with the provisions of Law 34/2002, of July 11, on Services of the Information Society and Electronic Commerce, by completing the data collection form and checking the corresponding box "I accept the sending of electronic communications", you are granting express consent to send information about the Company to your email address, telephone, fax, or other electronic means.

Update date: November 2025