1. Data controller
| Controller | DUA CLINIC BIO, S.L. |
| Tax ID (NIF) | B75520791 |
| Registered address | Avenida Santander 21, ground floor, unit 3 — 03540 Alicante, Spain |
| info@duaclinic.es | |
| Telephone | +34 966 395 486 · +34 611 559 150 |
| Website | https://www.duaclinic.es |
| Data Protection Officer | David Ivorra González — info@duaclinic.es |
DUA CLINIC BIO, S.L. is a medical and driver assessment centre authorised by the Regional Health Department (Conselleria de Sanitat) and by the Spanish Directorate-General for Traffic (DGT).
This policy explains how we process the personal data of those who visit our website, book an appointment, contact us or use our services. We comply with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD), and applicable healthcare legislation, in particular Law 41/2002 on patient autonomy.
2. What data we process and why
2.1 Online appointment booking
Data: first name, surname, email address, telephone number, service requested, date and time selected.
Purpose: to manage your booking, confirm it and send you reminders.
Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Where the request reveals information about your health, processing is additionally based on Art. 9(2)(h) GDPR (preventive medicine, medical diagnosis and the provision of health care).
Retention: for the duration of the care relationship. Once care has been provided, the data becomes part of your medical record. If you do not attend the appointment, the booking data is kept for one year.
2.2 Health care and medical records
Data: identification details, contact details and health data arising from the care provided (medical examinations, psychometric assessments, laboratory tests, nursing, general medicine).
Purpose: to provide the health care requested, issue reports and certificates, and comply with the centre’s legal obligations.
Legal basis: Art. 6(1)(c) and Art. 9(2)(h) GDPR, in conjunction with Law 41/2002.
Retention: five years from the date of discharge for each episode of care, in accordance with Article 17 of Law 41/2002, without prejudice to longer periods established by regional legislation.
2.3 Laboratory test results
Your results are delivered in one of two ways: as a password-protected document, with the password provided through a channel other than email, or as a notification to download them from the secure platform of the Eurofins Megalab laboratory. We never send readable clinical results in the body of an email. As a healthcare provider, Eurofins Megalab processes your data as an independent controller, with its own legal obligations under Articles 14 and 17 of Spanish Law 41/2002, and therefore does not act as our processor. You may contact its data protection officer at dpd@megalab.es.
Legal basis: Art. 6(1)(b) and Art. 9(2)(h) GDPR.
2.4 Contact form and email
Data: whatever you provide in your message.
Purpose: to respond to your enquiry.
Legal basis: our legitimate interest in replying to those who contact us (Art. 6(1)(f) GDPR). You may object at any time under Article 21 GDPR.
Retention: one year from the last communication, unless the enquiry leads to a care relationship.
2.5 WhatsApp virtual assistant
We provide an automated conversational assistant on WhatsApp that handles administrative enquiries: services, prices, opening hours, required documentation and the processing of requests. We state explicitly that you are talking to an automated system, not to a person, and you may ask to be attended by a member of our team at any time. The assistant does not provide clinical assessments or diagnoses.
As required by the platform, if more than 24 hours have passed since your last message, the centre may only resume the conversation using message formats previously approved by Meta.
Data: your telephone number and the content of the messages you send us.
Purpose: to handle administrative enquiries and process requests efficiently.
Legal basis: your explicit consent, given when you continue the conversation after the information notice you receive on starting it (Arts. 6(1)(a) and 9(2)(a) GDPR).
Technology: messages are processed using artificial intelligence models from Anthropic PBC (United States), acting as a processor. This international transfer is carried out with the safeguards provided for in Article 46 GDPR.
Messaging platform: the channel runs on the WhatsApp Business Platform (Cloud API) provided by Meta Platforms Ireland Limited, acting as a processor under the terms of that platform, which incorporate its data processing terms. Meta processes the content of the messages, your telephone number and the conversation metadata for as long as necessary to deliver them, and retains undelivered messages for a maximum of 30 days. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
Retention: conversations and messages are automatically deleted from our server after 180 days without activity. Backups are rotated every 14 days.
Important: the virtual assistant is an administrative channel. Please do not send health information, symptoms, diagnoses or medical results via WhatsApp. For any clinical matter, contact the centre by telephone or in person. WhatsApp is a service provided by Meta Platforms Ireland Ltd. and is not an appropriate channel for health information.
2.6 Website browsing
Data: IP address, browser type, pages visited and data derived from cookies.
Purpose: website operation, statistical analysis and, where applicable, advertising.
Legal basis: your consent for non-essential cookies (Art. 6(1)(a) GDPR and Art. 22.2 of Spanish Act 34/2002). Strictly necessary cookies are exempt from the consent requirement under that same Art. 22.2.
See the details in our Cookie Policy.
2.7 Job applications
Data: the information included in your CV.
Purpose: to take part in recruitment processes.
Legal basis: consent (Art. 6(1)(a) GDPR).
Retention: one year, unless you tell us otherwise.
2.8 Request for a laboratory test quote
Data: full name, email address, telephone number and the test profiles or parameters you request. The form does not allow documents to be attached.
Purpose: to prepare and send you the quote requested and to guide you on booking your blood draw.
Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR). The analytical parameters you request constitute health data, so that part of the processing is based on your explicit consent (Art. 9(2)(a) GDPR), given by ticking the specific checkbox on the form, which you may withdraw at any time. If the request leads to healthcare, the subsequent processing is then based on Art. 9(2)(h) GDPR.
Where it is stored: on our own server with restricted access, separate from the website.
Retention: the quote is deleted after 180 days. If you send us clinical documentation by WhatsApp, it is deleted after 30 days. If the request leads to healthcare, the data becomes part of your medical record.
Security check: the form uses the Turnstile service provided by Cloudflare, Inc. to verify that the request does not come from an automated system. Cloudflare processes your IP address and technical browser data as a processor, with the safeguards of Art. 46 GDPR.
2.9 Whether providing your data is mandatory, and where it comes from
Mandatory nature: the fields marked as required in each form are necessary in order to provide the service you have requested. If you do not provide them, we will not be able to manage your appointment, issue the corresponding report or certificate, or deal with your request.
Source: as a general rule you provide the data to us directly. Where the examination or test is requested by a company, mutual insurer or insurance company, we may receive your identification and contact details from that organisation, together with the data needed to provide the service (Art. 14 GDPR).
3. Recipients of your data
Your data may be disclosed to:
- Clinical laboratories (Eurofins Megalab and other partners), to carry out the tests requested. They act as independent controllers, with their own legal obligations as healthcare providers.
- Competent public authorities where there is a legal obligation: the Regional Health Department, the Directorate-General for Traffic (for fitness-to-drive reports), and judicial authorities.
- Insurance companies and mutual insurers, where you authorise this or where they cover the cost of the service.
- Technology service providers acting as processors under contract:
- Meta Platforms Ireland Limited — messaging through the WhatsApp Business Platform.
- Anthropic PBC (United States) — generation of the assistant replies using artificial intelligence.
- IONOS — server hosting (European Union) and email.
- Cloudflare — anti-fraud verification of the quote request form.
- Google Ireland Limited — checking calendar availability, with no access to patient data.
We do not share your data with third parties for commercial purposes.
International transfers
Some of our providers are located outside the European Economic Area:
| Provider | Service | Safeguard |
|---|---|---|
| Anthropic PBC (USA) | Virtual assistant processing | Standard contractual clauses |
| Meta Platforms (Ireland / USA) | Messaging (WhatsApp Business Platform) | EU-US Data Privacy Framework |
| Google LLC (USA) | Analytics and advertising | EU-US Data Privacy Framework |
| Cloudflare, Inc. (USA) | Anti-fraud verification of the quote request form | Standard contractual clauses |
4. Your rights
You may exercise the following rights at any time:
| Right | What it means |
|---|---|
| Access | Find out what data we hold about you |
| Rectification | Correct inaccurate data |
| Erasure | Request deletion, subject to healthcare law limits |
| Objection | Object to certain processing activities |
| Restriction | Request that we suspend processing |
| Portability | Receive your data in a structured format |
| Withdraw consent | At any time, without retroactive effect |
How to exercise them: write to info@duaclinic.es or to our postal address, stating the right you wish to exercise. We will only ask for proof of identity if there are reasonable doubts as to who is making the request. We will respond within one month at the latest.
Complaints: if you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid).
The right to erasure has limits in the healthcare context: medical records must be kept for five years under Law 41/2002, even if you request their deletion.
When we act on an erasure request, the data is removed immediately from our live systems. Deletion is completed once the corresponding backup expires, on a 14-day rotation.
5. Security of your data
We apply technical and organisational measures appropriate to the risk, including:
- Encryption of communications using an SSL/TLS certificate
- Password protection of results documents and delivery through the laboratory secure platform
- Access control by role with individual credentials
- Regular backups
- Firewall and website monitoring
- Staff duty of confidentiality, which continues after employment ends
These measures are reviewed periodically. In the event of a security breach posing a risk to your rights and freedoms, we will notify you in accordance with Articles 33 and 34 GDPR, and we will also report it to the Spanish Data Protection Agency within 72 hours where applicable.
6. Minors
We do not collect data from children under fourteen without the consent of those holding parental responsibility or guardianship. The provisions of Law 41/2002 apply to the health care of minors.
7. Automated decision-making
We do not take decisions based solely on automated processing that produce legal effects concerning you or significantly affect you. The virtual assistant provides information but does not carry out clinical assessments or replace professional judgement.
8. Changes to this policy
We may update this policy to reflect legal developments or changes to our services. The version in force will always be the one published on this page, with its update date indicated.