Privacy Policy

This privacy policy provides information about the processing of personal data carried out by BIZIONDO, SL through this website, as well as other processing operations carried out by the company referenced in this privacy policy. Its content may be updated to reflect regulatory changes, new criteria adopted by supervisory authorities, or to adapt to modifications made to our services or activities.

The data collection forms available on this website will include basic data protection information, as well as a link to this privacy policy with additional, detailed information on data processing.

This information is provided in accordance with the principle of transparency established in current data protection regulations, the main provisions of which are the General Data Protection Regulation (Regulation (EU) 2016/679 or GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Responsible for the processing of your personal data

• Data controller: BIZIONDO, SL
• Address for notification purposes: Clínica Indautxu, 1st and 2nd floors, Calle Gordóniz, 9, 48010 – Bilbao (Bizkaia).
• Email address: info@biziondo.com
• Telephones: 946 941 347 (Bilbao Center) / 943 142 636 (San Sebastian Center) / 968 46 86 00 (Lorca Center).

BIZIONDO, SL informs that it has appointed a Data Protection Officer, whose

Contact details: dpd@biziondo.com

2. Purposes of processing and legitimacy

Las finalidades para las que tratamos sus datos personales, junto a las bases legales que legitiman el tratamiento de los datos, son las siguientes:

a. Contact / Online Consultation

The data received from individuals who contact BIZIONDO, SL to make inquiries or request information, including through social media, is used for management and monitoring based on our legitimate interest in providing customer service to data subjects (GDPR, Art. 6.1.f) or to implement pre-contractual measures at your request (GDPR, Art. 6.1.b). If you provide your data when using our online consultation service, the processing is based on the execution of the contractual relationship arising from said service (GDPR, Art. 6.1.b).

When data relating to health are processed for the purposes indicated, the legitimacy is

supports the provision of healthcare (GDPR, art. 9.2.h).

In the case of social media followers, processing is carried out within the framework of the chosen social network, in accordance with its terms and conditions, which are beyond our control and which we recommend you read.

b. Testimonies and images

To promote the activities and services of BIZIONDO, SL, we may publish on our website and social media accounts a review or testimonial from patients who expressly authorize it, including photographic and audiovisual images, based on their explicit consent (GDPR, art. 9.2.a).

c. Patients

We process the personal data provided by patients for medical diagnosis, the provision of healthcare, the management and maintenance of clinical documentation, and the management of healthcare services, including prescription control, related financial and administrative management, appointment management, and patient communication.

The legal basis for data processing is the execution of the contractual relationship (GDPR, Art. 6.1.b) in connection with the purposes of medical diagnosis, the provision of healthcare, and the management of healthcare services (GDPR, Art. 9.2.h), as well as compliance with legal obligations applicable to BIZIONDO, SL (GDPR, Art. 6.1.c). Where applicable, the processing of special categories of patient data, such as health-related data, may arise from the establishment, exercise, or defense of legal claims (GDPR, Art. 9.2.f).

En el caso de personas acompañantes de pacientes, podemos tratar sus datos para la emisión de justificantes, en base al interés legítimo de aquellas de obtener el correspondiente justificante de asistencia (RGPD, art. 6.1.f).

d. External relations

Data provided by persons associated with entities that are related to BIZIONDO, SL, such as lessors, suppliers, potential suppliers and other organizations, will be processed for commercial, economic, accounting and tax management, based on our legitimate interest in maintaining relations (RGPD, art. 6.1.f), the execution of the contractual or pre-contractual relationship (RGPD, art. 6.1.b) and compliance with legal obligations applicable to BIZIONDO, SL (RGPD, art. 6.1.c).

e. Job candidates

If we initiate a recruitment process or if we retain the CVs submitted spontaneously by individuals interested in working at BIZIONDO, SL, we will process your data for application management purposes, based on the application of pre-contractual measures with a view to possible recruitment (GDPR, art. 6.1.b). If a candidate who is not selected in a recruitment process wishes us to retain their data for future processes, the legal basis for further retention would be their consent (GDPR, art. 6.1.a).

f. Cookies

This website uses cookies to process users' personal data, provided that they have given their consent or if they are not necessary, under the conditions indicated in our Cookie Policy. Processing is legitimized by Article 22.2 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSICE), in conjunction with the user's consent.

3. Data retention periods

Generally, we will retain personal data for as long as necessary to fulfill the purposes for which it was processed, as well as for the legal retention periods and the statute of limitations for legally applicable liabilities.

En particular, se aplicarán los siguientes criterios de conservación:

• Clinical documentation will be retained for the appropriate amount of time for each case to provide appropriate patient care, at the discretion of BIZIONDO, SL professionals, and for a minimum of 5 years from the date of discharge for each care process. After the legal retention periods have elapsed, the established legal limits will apply to the destruction of clinical documentation.
• Data related to compliance with accounting and tax obligations will be retained until any potential liabilities expire, for a minimum of 6 and 10 years, respectively.
• The data of job candidates will be retained for a maximum period of one year from the date the application is received. If the candidate is not hired after participating in a selection process, we will require your consent to continue retaining the data.
• When we process data based on the consent of the interested party, we will retain it indefinitely, until the interested party withdraws their consent.

consent or request the deletion of the data.

4. Obligation to communicate data

The provision of personal data by individuals who make inquiries or request information is not a legal or contractual requirement. However, such provision is necessary to process your requests.

Patients must provide their personal data, especially identifying information and information related to their health status, in a fair and truthful manner. Such communication to BIZIONDO, SL is necessary for the provision of healthcare, medical diagnosis, medical prescriptions, and the maintenance of their clinical records. Therefore, failure to provide such data will prevent them from receiving such care and services.

To comply with legal obligations in the areas of tax, accounting, and billing, the provision of the necessary personal data is a legal and/or contractual requirement, without which the services supporting said obligations cannot be provided.

5. Recipients of the data

In addition to when it is a legal obligation applicable to BIZIONDO, SL, we may communicate your personal data to third parties in the following cases:

a. To the following entities within the framework of the management of patient care processes:

I. To the hospital centers where BIZIONDO, SL is located, for the provision of health services.

II. To other hospital centers for emergency care.

III. To external healthcare professionals who collaborate with BIZIONDO, SL

IV. To external centers for the provision of health services such as clinical laboratories, radiodiagnostic centers or health services.

ambulances.

b. Where appropriate, to judicial bodies and legal professionals in the exercise, formulation or defense of claims.

c. The financing entities for the intermediation of patients of BIZIONDO,SL

d. To users of the website and social networks, as well as to social network providers, in the event of dissemination through said channels of testimonials

of patients, photographic images and audiovisual material.

Furthermore, service providers contracted by BIZIONDO, SL may have access to the data necessary for the proper provision of services, such as medical software licensing, email, instant messaging applications, cloud hosting, website hosting, or IT support.

International data transfer

BIZIONDO, SL carries out various data processing operations that involve international transfers of data to centers located in the United States and other third countries:

- To providers such as Meta Platforms Ireland Limited and Google Ireland Limited, for the dissemination on social networks such as Facebook, Instagram and YouTube of images and audiovisual material relating to patients, subject to their consent, for the purposes of promoting the activities and services of

BIZIONDO, SL

- To Google Ireland Limited for the use of the tools included in Google Workspace, such as email (Gmail) and cloud storage (Drive).

- To WhatsApp Ireland Limited, for the use of the WhatsApp Business instant messaging application.

These international transfers are based on standard data protection clauses adopted by the European Commission, pursuant to Article 46.2.c) of the GDPR. A copy of these clauses can be obtained at this link.

   6. Ejercicio de derechos

The interested party may exercise the rights related to the processing of their data indicated below, in the cases and under the conditions provided for in the GDPR, through our contact email address:

• Derecho de acceso: para conocer si estamos tratando sus datos o no.
• Right to rectification: to rectify inaccurate data.
• Right to erasure: to cease processing when, among other reasons, they are no longer necessary for the purposes for which they were collected.
• Right to object: to stop us from processing them in specific circumstances.
• Right to restriction of processing: to limit the scope of your processing in certain cases, while ensuring its retention.
• Right to data portability: to receive previously provided data or request its transmission to a third party in certain cases.
• Right to revoke previously granted consent at any time.

To do so, you can use the models available on the website of the Spanish Data Protection Agency (https://www.aepd.es/es/derechos-y-

duties/know-your-rights).

De igual modo, el interesado tendrá derecho a presentar una reclamación ante la Agencia Española de Protección de Datos, especialmente cuando no haya obtenido satisfacción en el ejercicio de sus derechos, mediante escrito dirigido a la siguiente dirección postal: C/Jorge Juan, 6, 28001 - Madrid, o a través de su sede electrónica (https://www.aepd.es).

Likewise, through our contact email address, the patient has the right to request access to their medical history documentation, within the limits provided for in health legislation.