Privacy Policy Spain

Data Protection Instituto Médico del Prado Madrid

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 (GDPR), Organic Law 3/2018, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), and Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE), HIRAM ABIF ESPINOSA CUSTODIO guarantees the protection and confidentiality of any personal data provided by users, patients, or visitors to our website, in accordance with current regulations.

The data protection policy of HIRAM ABIF ESPINOSA CUSTODIO is based on the principle of proactive accountability, under which the data controller assumes and demonstrates compliance with legal obligations before the competent supervisory authorities.

1.- DATA CONTROLLER

Name: HIRAM ABIF ESPINOSA CUSTODIO
Tax ID: 72003093Y
Address: C/ Matapiñoneras, 11 – Bloque 4 – Apto. 107, 28703 San Sebastián de los Reyes, Madrid
Phone: 627 39 63 22
Email: info@drespinosacustodio.com

2.- PURPOSE OF PROCESSING

The personal data you provide will be included in the records of processing activities owned by HIRAM ABIF ESPINOSA CUSTODIO and will be used for the following purposes:

  • Provision of medical services and patient care, including appointment management, treatments, and clinical follow-up.
  • Administrative and accounting management, including the issuance of invoices or payment receipts.
  • Handling of inquiries or requests for information received through forms, email, or telephone.
  • Communication with data subjects to maintain the existing professional or contractual relationship.

Our policy is not to create user profiles or make automated decisions with legal effects.

In the case of health-related data, processing is carried out in accordance with Article 9.2.h of the GDPR and Article 6 of Law 41/2002, on the basic regulation of patient autonomy and rights and obligations regarding clinical information and documentation.

3.- LEGAL BASIS FOR PROCESSING

The processing of your personal data is based on the following legal grounds:

  • Contractual relationship: when necessary for the provision of the requested services or the carrying out of medical treatments.
  • Legitimate interest: to handle inquiries, complaints, and manage payments or incidents.
  • Express consent: in the case of electronic communications or the sending of information not directly related to the contracted services.

4.- DATA RECIPIENTS

Personal data will not be disclosed to third parties, except where legally required.

Your data may be disclosed to:

  • Public administrations, judges, and courts, when required by applicable regulations.
  • Banks or collection agencies, when necessary for the performance of a contract.
  • The data controller’s tax or accounting advisor, exclusively for tax or accounting purposes.
  • In any other case, your informed consent will be requested in advance before any disclosure is made.

5.- INTERNATIONAL TRANSFERS

No international transfers of personal data outside the European Economic Area will be carried out, unless there is a legal obligation or the express consent of the data subject and adequate safeguards in accordance with the GDPR.

6.- RETENTION PERIOD

Personal data will be retained for as long as necessary to fulfill the purpose for which it was collected.

Once the contractual or healthcare relationship has ended, the data will be duly blocked for the limitation periods established by civil, tax, and healthcare legislation, solely for the purpose of addressing possible liabilities or judicial requirements.

Once blocked, the data will be inaccessible to HIRAM ABIF ESPINOSA CUSTODIO and will only be made available to the competent authorities.

7.- SECURITY MEASURES

HIRAM ABIF ESPINOSA CUSTODIO has adopted all necessary technical, organizational, and security measures to guarantee the integrity, confidentiality, and availability of the personal data processed, in accordance with Article 32 of the GDPR.

The data controller’s staff and collaborators are bound by confidentiality obligations and are duly trained in data protection matters.

If third-party services are contracted, they must guarantee compliance with the same measures and allow their verification.

8.- RIGHTS OF THE DATA SUBJECT

You may exercise the following rights, recognized in Articles 15 to 22 of the GDPR, at any time and free of charge:

  • Right of access: to know what personal data we process and for what purpose.
  • Right of rectification: to request the correction of inaccurate or incomplete data.
  • Right of erasure (“right to be forgotten”).
  • Right to restriction of processing: when the accuracy of the data or its processing is contested.
  • Right to object: when processing is based on legitimate interest.
  • Right to data portability: to receive your data in a structured format and transmit it to another data controller.
  • Right to withdraw consent at any time, without retroactive effect.

To exercise these rights, you may write to: info@drespinosacustodio.com or send a request by postal mail to the address indicated in section 1, attaching a copy of your identity document.

9.- COMPLAINTS AND SUPERVISORY AUTHORITY

If you believe your rights have not been duly addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD) through the following means:

Electronic office: https://www.aepd.es
Postal address: C/ Jorge Juan, 6, 28001 Madrid
Phone numbers: 901 100 099 / 912 663 517

Filing a complaint with the AEPD is free of charge and does not require a lawyer or attorney.

10.- POLICY UPDATES

HIRAM ABIF ESPINOSA CUSTODIO reserves the right to modify this Privacy Policy to adapt it to legislative or case-law changes.

Any modification will be published on this same website, indicating the date of the last update.

Last updated: May 8, 2026

Verified compliance:

  • GDPR (EU) 2016/679
  • LOPDGDD (Spain)
  • LSSI-CE 34/2002
  • AEPD best practices