At FISIOBOS we are committed to protecting the privacy of our website users, in compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

Data controller

Identity: Cristina Bosom Perea Address: Carrer de Provença 238, 2nd floor, door 2, 08008 Eixample, Barcelona Email: fisiobos@gmail.com Phone: +34 671 148 180

Purpose of processing

The personal data you provide through the contact form, online appointment booking or email will be processed for the following purposes:

• Handling your request for information or an appointment.
• Providing the healthcare service contracted (physiotherapy, osteopathy, massage therapy, INDIBA®).
• Creating and keeping the patient’s clinical record, where applicable.
• Sending commercial communications about our services, only if the user gives their express consent.

Health data

Where treatment requires collecting health-related data (medical history, injuries, previous treatments), such data is considered a special category of data under Article 9 of the GDPR. It is collected with the patient’s explicit consent, for the sole purpose of providing appropriate healthcare, and is subject to the duty of professional secrecy.

Legal basis

• The data subject’s consent (contact form, appointment booking, newsletter).
• Performance of the contractual/care relationship (provision of the healthcare service).
• Explicit consent for the processing of health data (Art. 9.2.a GDPR).

Data retention

Data will be kept for as long as the relationship with the patient continues and, thereafter, for the periods legally required regarding clinical documentation and liability (as a general rule, a minimum of 5 years from the last care provided, unless regional regulations establish a different period).

Recipients

Data will not be disclosed to third parties, except where legally required or where necessary for the provision of the service (for example, [hosting provider], [appointment booking tool: Calendly], or insurance companies when the patient requests reimbursement).

Some of these providers may be located outside the European Economic Area; in such cases, the transfer is covered by the safeguards provided for in the GDPR (standard contractual clauses or others).

Data subject rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw your consent at any time, by writing to fisiobos@gmail.com, attaching a copy of a document proving your identity.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with current legislation.

Security measures

FISIOBOS applies the technical and organisational measures necessary to ensure the security and integrity of personal data, preventing its alteration, loss, unauthorised processing or access.