Privacy policy for patients

Affidea is a provider of ethical healthcare services. "Affidea" ("we" or "us" or "our") refers to the Affidea entity in Spain that operates the center you visit and associated legal entities within the group, jointly responsible for the processing of your personal data....

1. Legal basis for the processing of your personal data

We are committed to protecting your personal data during the processing of your personal data and are obliged to do so by law. Our medical professionals are subject to a professional and contractual duty of confidentiality.

1. It is necessary for us to use your personal and health data to provide the requested medical service.

The processing of your basic personal data (e.g. name and contact data) is necessary for scheduling your appointment and for the provision of the requested medical services. The medical services agreement constitutes the legal basis for the processing of your basic personal data.

Your health data covers health-related information (e.g., information about the requested diagnosis/treatment and report on your health). Providing you with a medical diagnosis and/or medical treatment forms our legal basis for processing your health data. Affidea is subject to a legal obligation to process (especially to retain) your health data (see Clause 3 and Schedule 1 for more information).

We inform you that, for a better medical diagnosis, we manage your Medical History in a Unique way, so that the different entities of the Affidea Group in Spain, can access your Medical History, always in order to provide a more accurate medical service.

If you are in vital emergency conditions in our facilities, we will use your health data in order to preserve your health and well-being on the basis of the protection of your vital interests.

2. We are constantly improving our services.

At Affidea, we are always looking for better ways to provide our services.

1. Inform you about opportunities to participate in clinical trials. Affidea is committed to healthcare and the advancement of medical science. We have trusted partners who assist pharmaceutical companies or medical device manufacturers in conducting clinical studies in strict compliance with applicable laws. If you might be interested in participating in such clinical studies, we will be happy to inform you about those that potentially fit your needs (based on the health data we maintain about you). We may use all available communication channels to communicate with you. Your consent means that we have no authorization to disclose your data to any third party, nor any authorization to use your data in a specific clinical trial; these require your separate informed consent, if you express interest after our initial information about the opportunity.

2. Patient Survey

We believe that feedback on our patients' experience is essential to understanding how we can better serve you. Therefore, we invite you to participate in our satisfaction survey and thank you in advance for your input. Participation is optional and will not affect the service we provide you. If you prefer, we will refrain from contacting you.   

3. Statistical analysis of aggregated data

We want to analyze some of your personal data in aggregate form to obtain valuable statistical information for our marketing and sales teams, for example, to understand which services are of most interest in specific regions. If you prefer, we will exclude your data from our analyses.

4. Quality assurance

We believe it is critical to learn from unanticipated events that take place in our clinics. We record and analyze near misses (prevented incidents) and events that may cause harm of any kind in order to ensure health and safety. We limit such processing of patient data to the extent necessary and do not normally use directly identifiable personal data for this purpose.

We carry out the above for our legitimate interest in understanding how to improve our service and its quality. See clause 7.6. about your right to object.

3. If you wish, you can consent to the following additional processing activities by Affidea.

By ticking the relevant box in the part "Your data protection consent", you can give your consent to the following at no additional cost. If you do not wish to give your consent, this will in no way affect the medical services provided to you.

1. We believe that consulting previous medical records provides a broader clinical understanding of specific health conditions. For any examination requested by public bodies (e.g. Mutual Insurance Companies and Public Hospitals) that has the power to grant rights or establish responsibilities of individuals, we need your consent so that we can consult and compare your results with previous ones contained in the Affidea Group Medical Records and provide our diagnosis on the basis of all relevant information we hold about you.

2. In order to avoid any possible labor infraction of unjustified attendance of your companion at your workplace, we need your consent to be able to provide you with proof that you were with you in our health center. The certificates or supporting documents that we issue will respect the requirements of the principle of minimization, being the data contained therein adequate, relevant and limited to what is necessary, not including more information than that necessary to prove that the circumstances that enable obtaining the paid leave for attendance at the center as a companion are met.

3. We need your consent to be able to call you by your first and last name in the waiting room when it is your turn if there is no ticketing system in our health center. If you do not consent, you will be given a number at the reception desk by which you will be called.

4. Anonymization of a copy of your data

We are committed to the continuous improvement of medicine and to contributing to research and development efforts, whether led by Affidea or third parties (including, but not limited to, hospitals, universities and health insurers). Research and development refers to the work of innovation, introduction and improvement of products, procedures and the provision of affordable healthcare. It includes a range of research activities to improve current products and procedures or to guide the development of new products and procedures.

We kindly ask you to support us by allowing us to anonymize a copy of your personal data for the retention period determined by legislation (see clause 3). The set of data subject to anonymization includes the health data we collect when providing you with our medical services. Anonymization of personal data consists of a process applied to personal data (or a set of personal data) that makes it impossible for the person using the anonymized data to identify the person to whom the personal data originally related. In this way, your anonymity is maintained when using your anonymized data. 

We would like to use your anonymized data for educational, statistical, marketing, and research and development purposes, or share it with others unrelated to us. We diligently select our partners and the method of anonymization in order to minimize the risks associated with the use of your anonymized data.

If you change your mind at a later date, you may withdraw your consent at any time and free of charge and this will not affect the medical service you borrow from us in any way. You can withdraw your consent by contacting our data protection officer (see contact details in clause 9 below). Please note that withdrawing your consent will not affect the lawfulness of the processing on the basis of your prior consent.

2. Data we process

During your relationship with Affidea, we obtain your personal data from three sources: (1) from you personally, (2) from third parties and (3) from our medical activity.

(1) In order to provide you with our medical service, we ask you to provide us with your basic personal data (especially your personal identification data), your payment and insurance data (data necessary to pay for our service) and your health data (especially information about your health condition). If you choose to share past medical images and reports for our use, we will store and process them in our systems for your medical diagnosis and/or medical treatment. If you voluntarily provide contact information of your relatives or family members, the data will only be used when we are unable to contact you directly, or in case of an emergency.

(2) We request your personal data from third parties in the following cases:

1. To your prescribing physician or referring hospital who refers you to our center, in case it is necessary in order to identify the most appropriate medical service for you.

2. If a health insurer (whether public or private) pays for the health care we provide to you, we need to collect information about this insurer's coverage in order to provide the health care to you.

(3) In providing health care services to you, we create health information about you. As a provider of medical services, Affidea is required by law to thoroughly document these services.

For more information about the data we process, please see the Appendix to this Privacy Policy or ask one of our receptionists.

3. Data retention period  

Affidea retains your personal data for as long as necessary to provide our medical services and to comply with any applicable medical, tax, accounting or legislative requirements. If our legal obligation to retain your data expires, we will delete your data or anonymize it. Affidea will not delete your data if there is an alternative processing purpose for retaining such data. For example, in case of legal action or defense. If this is the case, we will retain your data for as long as necessary for this alternative processing purpose. In case of complaints, we will retain it until the complaint handling has been completed.

For more information about how long we keep your data, please see the Appendix to this Privacy Policy or ask one of our receptionists.

4. With whom we share your information

During your relationship with Affidea, we share your personal data with three types of recipients: (1) with our professionals, (2) with independent third parties and (3) with other people if you request it.

(1) Consultation of your medical and previous medical records facilitates the medical diagnosis and/or medical treatment you requested from Affidea. For that reason, Affidea may collect your previous relevant Medical Records from (an) other data controller(s) belonging to the Affidea group. Please note that in the case of medical examinations requested by public bodies (e.g. Mutual and Public Hospitals), the use and comparison of your historical medical records is only carried out if you specifically gave your consent as described in section 1.3.

(2) We employ service providers (so-called processors) to assist us in processing the personal information we receive and create (e.g., financial software providers and contracted medical professionals). Processors act on Affidea's behalf based on our written instructions. We will only share your data to the extent absolutely necessary.

(3) We share your personal data with third parties (independent recipients) in the following cases:

1. If we are required to do so by law.

2. If required by a contract to which you are a party (for example, your health insurance contract). We inform you that in case of objection the service will be provided as a private patient.

3. With other health care professionals in case of a life-threatening emergency (e.g., an emergency).

We will only share your data to the extent absolutely necessary.

(4) You may request that we send your health data and results to your prescriber or family physician. The processing activities of third party recipients are beyond our control and responsibility. Therefore, we recommend that you first ask this third party how they will treat your personal data. If you would like us to share your health data with other medical professionals, we will ask you to fill out a special consent form available at the front desk.

For more information about the recipients of your personal data, please see the Appendix to this Privacy Policy or ask one of our receptionists.

5. International data transfers

It may be necessary to share your personal data with recipients located outside the European Economic Area ("EEA"). Some countries are considered Adequate Level Countries by the European Commission and are therefore treated the same as those within the EEA. Before transferring your data outside the EEA (or outside an Adequacy Country), your data will be anonymized or protected, usually using standard contractual clauses approved by the European Commission. The Annex to this Privacy Policy contains information about actual data transfers and the steps we take if any data is transferred in an identifiable format. You can find more information about the standard contractual clause here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en. More information about countries with an adequate level of protection can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en.

6.  Data Security

Keeping your data secure is our priority. We store your personal data securely through carefully selected service providers. When our service providers process health data on our behalf, we require a level of security, also stipulated in a written agreement with them. We ensure that we implement stringent safeguards to keep your personal data secure against loss and misuse, as well as against unauthorized access or transfer.

7. Rights of data subjects

Under data protection legislation, you may exercise the following rights.

1. Right to request access to his/her personal data: The patient has the right to know that his/her data is being processed by Affidea, as well as the right to access his/her personal data and to be provided with information about the processing of his/her personal data by Affidea.

2. Right to request the rectification of their personal data: The patient has the right to have their personal data corrected or completed if they are incorrect or incomplete.

3. Right to request deletion of personal data: The patient has the right to have his or her personal data deleted in specific circumstances if Affidea does not have a lawful reason to continue the processing.

4. Right to request restriction of processing: You have the right to ask Affidea to "block" the processing of your personal data by Affidea in specific circumstances. Your request will allow us to store your personal data, but not to further process it.

5. Right to data portability: The patient has the right to access and reuse the personal data he or she has provided to Affidea so that he or she can continue to use such data for his or her own purposes, with different service providers. The patient has the right to receive an electronic copy of his or her personal data and to ask us to transfer it to another data controller.

6. Right to object to the processing of your personal data. You have the right to object at any time, based on your particular situation, to the processing of your personal information based on our legitimate interest (see Section 1.2. of this Privacy Policy). You may also object to the use of your personal data for direct marketing purposes.

If you wish to exercise your rights or if you would like more information about the above rights, please ask one of our receptionists or contact our data protection officer (see contact details in clause 9 below).

8. Automated individual decision-making, profiling

Affidea does not process your personal data for automated individual decision-making. We only elaborate profiles (automated processing of personal data consisting of the use of personal data to evaluate certain aspects related to a natural person) if the reading of the diagnostic image by a radiologist is based on an algorithm (e.g. in the case of post-processing of MRI images). Your medical problem is always diagnosed with the involvement of a radiologist, no medical diagnosis is made solely with automated processing of diagnostic images.

If you have any questions or would like more information, please do not hesitate to contact our data protection officer by e-mail: dpo.es@affidea.com, postal address: c/ Recondo s/n (Estación de Ferrocarril), 47007. Valladolid, telephone number: 983216120 or ask one of our receptionists for more information. If you are dissatisfied with the way in which we handle your data, you may lodge a complaint with the supervisory authority, usually the supervisory authority of your place of work or usual residence. The contact details of the supervisory authority are Agencia de Protección de Datos Española, calle Jorge Juan, 6 28001 Madrid. However, we would like you to contact us first to discuss any problems.