Privacy Policy – HC Hospitales, S.L.
Privacy – Extended Information
The Privacy Policy forms part of the General Conditions governing this Website.
Who is responsible for the processing of your data?
HC Hospitales, S.L.
CIF: B79962122
Address: Calle Ventura del Mar 11, C.P. 29660, Nueva Andalucía, Marbella.
Phone: 952 908 628
Email: calidad@hcmarbella.com
You may contact us using any of the above methods.
Data Protection Officer:malaga@prodat.es or lopd@hcmarbella.com. You can contact them at the address provided above.
We reserve the right to modify or adapt this Privacy Policy at any time. We recommend reviewing it regularly, and if you are registered and access your account or profile, you will be informed of any modifications.
If you belong to one of the following groups, please consult the relevant information:
+ WEBSITE CONTACTS
What data do we collect through the Website?
We may process your IP address, operating system or browser type, and even the duration of your visit, anonymously.
If you provide us with data through the contact form, we will identify you so we can contact you if necessary.
For what purposes will we process your personal data?
• To respond to your enquiries, requests, or petitions.
• To manage the requested service, respond to your request, or process your petition.
• To provide information electronically related to your request.
• To send commercial or event-related information electronically, provided express authorization exists.
• To perform analyses and improvements on the Website, our products, and services, and improve our commercial strategy.
• To send you information by email, if you authorize it.
What is the legal basis for the processing of your data?
The acceptance and consent of the data subject.
When completing a form and clicking on the “send” button, you confirm that you have been informed and expressly consent to the clause attached to the form and the Privacy Policy. You may withdraw consent at any time.
All forms include the * symbol for mandatory fields. If you do not provide the required fields or do not check the privacy policy acceptance box, you will not be able to send the form.
Typical format: “I am over 18 and I have read and accept the Privacy Policy.”
+ NEWSLETTER CONTACTS
What data do we collect through the newsletter?
You may subscribe to our newsletter by providing an email address.
We will store only your email in our database and periodically send you emails until you unsubscribe or we cease to send emails.
The newsletter may include a web beacon to confirm statistically whether you opened it, when, and how many times. This helps us study optimal sending times and interests, but no personal information other than your email is collected.
The mailing application is based in the USA, meaning there may be an international data transfer to servers in that country.
You may unsubscribe at any time.
For what purposes will we process your personal data?
• To manage the requested service.
• To provide information electronically related to your request.
• To send commercial or event-related information electronically with express authorization.
• To perform analysis and improvements in mailing delivery to enhance commercial strategy.
What is the legal basis for processing your data?
Your acceptance and consent when subscribing by checking the acceptance box and clicking "send."
You may revoke your consent at any time.
+ PATIENTS
For what purposes will we process your personal data?
• Medical consultation management. Provision of healthcare services, including health data processing.
• Electronic communication related to your request. Appointment reminders via WhatsApp to the phone number provided by the patient.
• Commercial or event-related electronic communications with express authorization or legitimate interest.
• Administrative, communication, and logistics services.
• Application of discounts agreed with external associations when you prove your membership.
• Transactions, invoicing, taxes, control, and recovery procedures.
• Your medical history, if authorized, may be used to train professionals entering the center.
• Your medical history, if authorized, may be used for clinical research.
• Providing a client portal for appointments, information access, report downloads, and privacy preferences.
• COVID testing.
• Telemedicine video calls.
• Quality surveys based on legitimate interest to evaluate satisfaction and improve service.
Legal basis
Your consent and legitimate interest. Consent may be revoked at any time.
Patients referred by third parties
We process health data exclusively to perform the diagnostic tests requested and issue corresponding reports.
Legal basis: Article 9.2.h) of the GDPR.
Data will be retained according to healthcare legal requirements.
Patients are informed by the referring healthcare entity.
+ CLIENTS
Purposes:
• Preparation and follow-up of estimates.
• Electronic information related to your request.
• Commercial or event communications with express authorization.
• Administrative, communication, and logistics management.
• Transactions, invoicing, taxes, control, and debt recovery.
Legal basis:
Your consent, which may be revoked at any time.
+ SUPPLIERS
Purposes:
• Electronic information related to your request.
• Commercial or event-related electronic communications with express authorization.
• Administrative, communication, and logistics services.
• Transactions, invoicing, taxes, control, and debt recovery.
Legal basis:
A contractual relationship or, if absent, your consent when contacting us.
+ SHAREHOLDERS
Purposes:
• Organization of actions necessary to achieve corporate purposes.
• Internal management and legal compliance.
• Shareholder meeting notifications.
• Transactions.
• Tax compliance.
Legal basis:
Contractual relationship or participation in the company's incorporation.
+ SOCIAL MEDIA CONTACTS
Purposes:
• Responding to your enquiries or requests.
• Managing the requested service.
• Building a community of followers.
Legal basis:
Acceptance of a contractual relationship within the corresponding social network, according to its Privacy Policy:
Facebook, Instagram, Twitter, LinkedIn, Google/YouTube.
Data is processed as long as you follow us or interact with our content.
+ VIDEO SURVEILLANCE
Purposes:
• Surveillance of our facilities.
• Employee control.
• Possible communication to courts and tribunals.
• Viewing postoperative procedures with consent.
Legal basis:
Implicit consent upon entering our facilities and seeing the informational sign.
+ JOB APPLICANTS
Purposes:
• Organizing recruitment processes.
• Scheduling interviews and evaluating candidates.
• Retaining CVs for future vacancies with consent.
• Sharing CVs with partner companies to help you find employment, with consent.
Legal basis:
Your explicit consent when providing your CV and signing information forms.
+ WHISTLEBLOWING CHANNEL
Purposes:
Internal detection of potential criminal or administrative offenses affecting the company, compliance with the code of conduct, and management of reports, including anonymous ones.
Legal basis:
Public interest or legal obligation.
+ IMAGE GRANTORS
Purposes:
Use of images for social media, website publications, service promotion, or documentation of clinical cases.
Legal basis:
Your consent, revocable at any time.
Do we include third-party personal data?
Sometimes data of family members or doctors may be provided as contacts.
If images are granted, they may be used for:
- Reproduction, distribution, and public communication within the company.
- Reproduction and distribution in print or digital formats.
- Use of excerpts.
- No temporal or territorial limitations.
If you provide third-party data, you must inform them beforehand and obtain their consent.
Minors’ data
We do not process data of minors under 18 except in specific cases. Do not provide such data unless you have parental consent.
Electronic communications
• Only for managing your request if you provided that contact method.
• Commercial communications only with prior express consent.
• Other communications may include quality surveys or service-related messages.
Security measures
We have adopted optimal protection levels and implemented all technical measures to prevent loss, misuse, alteration, unauthorized access, or theft of personal data.
Data recipients
Data will not be transferred to third parties except under legal obligation.
May be shared with:
• Tax authorities
• Banks
• Processing service providers under contract
• Referring physicians with your authorization
• Clínica Neurogénesis, with prior consent
• Family members when authorized
• Web maintenance or hosting companies (bound by confidentiality)
International data transfers to the USA may occur through applications that comply with SCCs or legal requirements.
COVID test results may be communicated to employers under legal obligation.
Telemedicine service providers may access technical, statistical, and anonymous data.
Insurance companies may require verification of treatments.
Your Rights
You may:
• Know whether we process your data
• Access your personal data
• Rectify inaccurate data
• Request deletion
• Request processing limitation
• Port your data
• File a complaint with the Spanish Data Protection Agency
• Withdraw consent at any time
Forms for exercising rights
We provide forms upon request. Identification may be required depending on the communication method.
Response times
Maximum one month, extendable to two for complex cases.
Cookies
You may consult details at: https://www.hcmarbella.com/es/politica-de-cookies-y-almacenamiento-local/
Retention periods
(Complete table faithfully translated — let me know if you prefer it in a formatted table.)
Data is retained:
• As long as you remain connected with us.
• Afterwards, for legally required periods.
• Clinical history: up to 10 years, with specific regional regulations included.
Updated 12/03/2025
