| Privacy Policy

1. Identity and Contact Information of the Data Controller

In compliance with the provisions of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), we hereby inform you that the personal data collected through the website www.tdoctors.es (hereinafter, the “Platform”) will be processed by:

• Data Controller: Mallorca Doctor Now SLU, with Tax ID Number (CIF) B26874503, as the owner of the TDoctors private medical centers.
• Data Controller’s Address: Calle Victorio Luzuriaga 34, 1º–1ª, 07015 Palma de Mallorca, Balearic Islands, Spain.
• Centralized Management: The administrative, technological, and organizational activities of the TDoctors medical centers are carried out at the headquarters of Medical Response International S.L.U. (MRI)—of which Dr. Hernández is the CEO—located at Camí dels Reis, 308 – 1st Floor, 07010 Palma de Mallorca, Balearic Islands, Spain.
• General contact email: info@medicalresponse.es
• Data Protection Officer (DPO): rgpd@tdoctors.es

Users may contact any of the above channels to resolve questions regarding the processing of their personal data or to exercise the rights granted to them under current regulations.

Clarification: Certain medical services at TDoctors centers are provided by collaborating independent physicians, who act as independent data controllers with respect to the medical records they generate during the provision of healthcare; as such, they are also responsible for informing patients about the use and retention of such data.

2. Purposes and Legal Bases for Processing

Personal data collected through the www.tdoctors.es Platform will be processed exclusively for the purposes indicated below, in accordance with their respective legal bases under the GDPR and the LOPDGDD:

2.1. Management of medical appointments at centers, hotels, or patients’ homes

• Purpose: to organize and coordinate appointments at the various TDoctors centers, as well as home or hotel visits to the patient. This includes assigning a healthcare professional, managing schedules, and coordinating with the centers’ administrative departments.
• Legal basis: performance of a contract or implementation of precontractual measures requested by the user (Art. 6.1.b GDPR).

2.2. Provision of Healthcare and Creation of Medical Records

• Purpose: To provide medical care at the centers, at the patient’s home, or at a hotel, which involves the processing of clinical data and, where applicable, the creation of medical records.
• Legal basis: express consent of the data subject for the processing of health data (Art. 9.2.a GDPR).
• Special note: When care is provided by a collaborating independent physician, that physician will act as an independent data controller with respect to the medical records and will determine the purpose and means of such processing, and must directly inform the patient of their retention obligations (Law 41/2002).

2.3. Video Consultations (via drnear.online)

• Purpose: To facilitate the provision of remote medical consultations via video call, with the option to issue medical reports and electronic prescriptions.
• Legal basis: performance of a contract (Art. 6.1.b GDPR) and the user’s express consent to the processing of health data (Art. 9.2.a GDPR).
• Note: In this case, when redirecting the user to the www.drnear.online platform, the specific privacy policy published on that domain will apply.

2.4. Insurance Management and Coverage Verification

• Purpose: to process documentation related to travel insurance policies or private health insurance, verify the validity of coverage, and coordinate payment or authorization of medical services.
• Legal basis: performance of a contract (Art. 6.1.b GDPR); health data processed with explicit consent (Art. 9.2.a GDPR).

2.5. Billing and Accounting Management

• Purpose: Issuing invoices, managing collections and payments, and complying with tax and accounting obligations.
• Legal basis: compliance with legal obligations (Art. 6.1.c GDPR in relation to the Commercial Code and the General Tax Law).

2.6. Customer Service, Inquiries, and Complaints

• Purpose: To address general inquiries, issues, or complaints submitted by users via contact forms, email, or messaging channels.
• Legal basis: compliance with legal obligations (Art. 6.1.c GDPR) and legitimate interest in ensuring appropriate customer care and service (Art. 6.1.f GDPR).

2.7. Marketing Communications and Newsletters (Opt-In)

• Purpose: to send information about the medical services offered, prevention campaigns, and newsletters, provided that the user has expressly requested them.
• Legal basis: consent of the data subject (Art. 6.1.a GDPR).

2.8. Platform Security and Fraud Prevention

• Purpose: To maintain the technological security of the website, prevent misuse or unauthorized access, and protect data against cyber threats.
• Legal basis: the Data Controller’s legitimate interest in protecting its systems and users (Art. 6.1.f GDPR).

2.9. Geolocation (optional)

• Purpose: To help the user identify the TDoctors medical center closest to their location.
• Legal basis: the user’s express consent (Art. 6.1.a GDPR), obtained through the browser or device.

3. Types and Categories of Personal Data Processed

Depending on the user’s use of the www.tdoctors.es Platform and the medical services requested, the following categories of personal data may be processed:

3.1. Identifying and contact information

• Examples: first name, last name, email address, phone number, mailing address, language, and country of residence.
• Purpose: Necessary for managing appointments, communicating with the patient, handling administrative procedures, and addressing inquiries or complaints.

3.2. Health-related data (special categories)

• Examples: symptoms, reason for consultation, medical history, diagnoses, clinical reports, test results, and prescriptions.
• Note: Processing this data requires the user’s explicit consent (Art. 9.2.a GDPR) and is carried out with enhanced security measures.
• Special note:
  • If care is provided by physicians directly contracted by the center, the Data Controller is Dr. Mallorca Doctor Now SLU.
  • If care is provided by a collaborating self-employed physician, that physician acts as the independent data controller for the medical record they create, in accordance with Law 41/2002

3.3. Data Related to Insurance and Supporting Documentation

• Examples: insurance company, policy number, validity period, contract number, and any supporting documentation the user chooses to provide (e.g., a scanned policy).
• Purpose: to verify coverage for medical services and coordinate with the insurer or its representative.

3.4. Administrative, financial, and accounting data

• Examples: Tax ID/National ID for billing purposes, bank or card information processed via a payment gateway (Stripe), consultation fees, invoices issued, proof of payment.
• Note: Full card details (PAN, CVV) are not stored by the Data Controller but are processed directly by Stripe, a PCI DSS-certified provider.

3.5. Communications and Complaints Data

• Examples: Messages sent via the contact form, emails, communications via WhatsApp Business, as well as attached documentation provided by the user.
• Purpose: to address requests, issues, or complaints, and to ensure traceability of the actions taken.

3.6. Data for Marketing and Newsletters

• Examples: email address, subscription preferences, history of interaction with campaigns (opening emails, clicking on links).
• Purpose: To manage voluntary subscriptions to marketing campaigns and newsletters.

3.7. Technical and browsing data

• Examples: IP address, device and operating system used, browser type and version, session identifiers, access logs, cookies, and similar technologies.
• Purpose: to ensure the proper functioning and security of the Platform, as well as, if the user consents, to compile statistics using analytics tools (Google Analytics or others).
• Note: This processing is specifically governed by the Cookie Policy.

4. Retention of Personal Data

Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, as well as for the applicable statutory limitation periods.

In compliance with Art. 5.1.e of the GDPR (principle of storage limitation) and Art. 32 of the LOPDGDD (data blocking), the following criteria will apply:

4.1. Appointment Scheduling and Healthcare Services

• Duration: for the duration of the healthcare and administrative relationship.
• Subsequent retention: up to 5 years, in accordance with the general statute of limitations for claims arising from the provision of medical services (Art. 1964 of the Civil Code).

4.2. Medical Records

• Minimum retention period: 5 years from the date of discharge for each course of care (Art. 17 of Law 41/2002 on Patient Autonomy, and applicable regional regulations).
• Responsibility:
  • If care is provided by directly employed staff, responsibility lies with the Data Controller (Dr. Mallorca Doctor Now SLU).
  • If care is provided by a collaborating self-employed physician, the responsibility for retention lies with the physician themselves as an independent data controller.

4.3. Insurance Documentation

• Retention period: for as long as necessary to verify coverage and manage care with the insurer.
• Subsequent retention: up to 5 years, coinciding with the statute of limitations for claims arising from the insurance contract (Art. 23 of the Insurance Contract Law).

4.4. Administrative, Financial, and Accounting Data

• Retention period: for the duration of the contractual relationship and while payments are being processed.
• Retention period:
  • 6 years for commercial obligations (Art. 30 of the Commercial Code).
  • 4 years for tax obligations (Articles 66 et seq. of the General Tax Law).

4.5. Communications, Inquiries, and Complaints

• Retention period: for as long as the inquiry or complaint is being processed.
• Retention period: up to 3 years, in accordance with the general statute of limitations for violations related to information society services (Art. 43.1 LSSI).

4.6. Marketing and Newsletter Data

• Retention period: as long as the user does not revoke their consent or object to the processing.
• Retention after consent is withdrawn: Once consent is withdrawn, the data will be retained in a blocked state for 1 year, solely to verify the validity of the consent previously granted.

4.7. Technical Data and Cookies

• Retention period: Data will be retained in accordance with the type and lifespan defined in the Platform’s Cookie Policy, or until the user revokes their consent.

4.8. Blocking and Deletion of Data

• Once the above time periods have elapsed, the data will be blocked, remaining available only to judges, courts, the Public Prosecutor’s Office, or competent public authorities.
• Once the retention periods have expired, the data will be permanently and securely deleted.

5. Recipients of the Data

Personal data collected through the Platform www.tdoctors.es may be disclosed to the following recipients, always in accordance with the principle of data minimization and to the extent strictly necessary:

5.1. MRI Administrative and Management Staff

• Recipients: administrative, secretarial, and accounting staff at the headquarters of Medical Response International S.L.U. (MRI).
• Purpose: centralized management of appointments, administrative support for medical centers, billing, and financial oversight.

5.2. Healthcare professionals at the centers

• Directly hired staff: access the data necessary to provide healthcare, under the responsibility of Dr. Mallorca Doctor Now SLU as the Data Controller.
• Collaborating independent physicians: They access the data necessary to provide care and create medical records as independent data controllers, autonomously determining the purpose and means of clinical treatment (Law 41/2002).

5.3. Clinical Management Software (IONOS)

• Recipient: IONOS, the provider that hosts the dedicated clinical and administrative management software.
• Role: acts as a data processor (Art. 28 GDPR).
• Access: restricted to secretaries, physicians, and the group’s accounting staff, all of whom are subject to a duty of confidentiality.

5.4. Insurance Companies and Insurance Administrators

• Recipients: insurance companies and their representatives, to verify coverage and manage the authorization and payment of medical services covered by the policy.
• Legal basis: performance of the contract (Art. 6.1.b GDPR) and, in the case of health data, explicit consent (Art. 9.2.a GDPR).

5.5. External Data Processors

Certain vendors provide support services to the Data Controller and, as a result, access data in their capacity as data processors:

• Web hosting and maintenance provider.
• Messaging and corporate email services.
• Marketing and newsletter platforms (e.g., Mailchimp, Sendinblue).
• Payment gateway (Stripe), if online payments are enabled, with PCI DSS certification.
• External consultants and advisors, including the Data Protection Officer (DPO).

All these providers operate under contract in accordance with Article 28 of the GDPR, following instructions from the Data Controller.

5.6. Public Authorities and Judicial Bodies

• Recipients: Public Administrations, Law Enforcement Agencies, Judges, and Courts.
• Purpose: compliance with legal obligations or response to official requests.

5.7. Third-Party Tools and Services Integrated into the Platform

If external tools are used on the website, they may process user data in accordance with their own privacy policies:

• Google Maps: to display the locations of medical centers.
• Google Analytics (if enabled): analysis of website usage, subject to consent for cookies.
• WhatsApp Business: optional contact channel, subject to Meta’s privacy policy.
• Cookie consent manager (Complianz or another): recording of privacy preferences.

Key transparency note:
Under no circumstances will data be transferred to third parties for commercial purposes unrelated to medical care or the administrative management of the centers without the user’s prior and express consent.

6. International Data Transfers

In general, data from users of the www.tdoctors.es Platform is stored on servers located in the European Union.

However, international data transfers may occur in the following cases:

6.1. Healthcare Professionals and Insurers Outside the EEA

• Context: In certain cases, the management of medical care may require the disclosure of data to healthcare professionals or insurers based outside the European Economic Area (EEA), particularly in the area of travel insurance.
• Legal basis: performance of a contract (Art. 6.1.b GDPR) and, with regard to health data, the user’s explicit consent (Art. 9.2.a GDPR).
• Safeguards: Whenever possible, recipients located in countries with an adequacy decision from the European Commission (Art. 45 GDPR) or that have entered into Standard Contractual Clauses (SCCs) (Art. 46 GDPR) will be used.
• Exceptions: In the absence of such safeguards, the transfer will be based on the user’s explicit consent or on the exceptions set forth in Article 49 of the GDPR (performance of a contract, vital interests, or the establishment, exercise, or defense of legal claims).

6.2. Stripe (payment gateway)

• Context: If online payments are enabled, Stripe may transfer data to the U.S. and other countries where it has infrastructure.
• Safeguards: Stripe applies Standard Contractual Clauses, implements additional security measures, and is certified under the international PCI DSS standard.

6.3. Technology Providers (Google, Meta, Mailchimp, etc.)

• Google Analytics, Google Maps, and other Google services: possible transfer to the U.S. and other countries.
• Meta (WhatsApp Business): Voluntary communications through this tool involve the transfer of data to Meta’s servers in the U.S. or other countries.
• Email marketing platforms (e.g., Mailchimp, Sendinblue): may transfer data to the U.S. or other territories outside the EEA.

In all these cases, transfers are based on Standard Contractual Clauses (SCCs) entered into by the providers and on additional security measures implemented by them.

6.4. General Safeguards Applied

The Data Controller guarantees that all international transfers:

• Is based on an adequacy decision (Art. 45 GDPR) or on Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).
• Includes additional technical and organizational measures (encryption, data minimization, access controls).
• When it is not possible to apply adequate safeguards, the user’s express consent will be obtained, and the user will be informed in advance of the risks, applying, where applicable, the exceptions under Article 49 of the GDPR.

7. Third-Party Tools and Services

The www.tdoctors.es platform integrates certain third-party services and technological tools that may involve the processing of personal data. Depending on the case, these third parties act as data processors (processing data under the instructions of the data controller) or as independent data controllers, in accordance with their own privacy policies.

7.1. Clinical Management Software (IONOS)

• Purpose: recording of medical cases and administrative management of patients at the centers.
• Role: Acts as a data processor under a contract in accordance with Article 28 of the GDPR.
• Security: Servers located in the European Union, with access restricted to authorized personnel (secretaries, physicians, accounting staff).

7.2. Stripe (payment gateway) – if online payments are enabled

• Purpose: To securely process payments for medical services.
• Role: Acts as a data processor.
• Security: Complies with the PCI DSS standard; the Data Controller does not retain full card details.
• Transfers: Stripe may transfer data to the U.S. under Standard Contractual Clauses (SCCs).

7.3. Google Analytics (if active)

• Purpose: statistical analysis of website usage and improvement of the user experience.
• Data processed: IP address (anonymized), cookies, browser, device, pages visited.
• Role: Google acts as an independent data controller.
• Legal basis: user consent (Art. 6.1.a GDPR), obtained via the cookie banner.
• Transfers: Possible to the U.S., under SCCs and additional security measures.

7.4. Google Maps

• Purpose: to display the locations of TDoctors medical centers.
• Data processed: IP address, geolocation data (if the user permits it).
• Legal basis: user consent (Art. 6(1)(a) GDPR).
• Role: Google acts as an independent data controller with respect to this data.

7.5. WhatsApp Business (Meta)

• Purpose: An optional channel of communication between patients and the center to answer questions or schedule appointments.
• Data processed: phone number, messages, and communication metadata.
• Role: Meta Platforms acts as an independent data controller with respect to the information processed on its platform.
• Transfers: Data may be transferred to the U.S. and other countries under Meta’s contractual clauses.

7.6. Email Marketing and Newsletter Platforms

• Purpose: To send informational campaigns and newsletters to users who have voluntarily subscribed.
• Examples: Mailchimp, Sendinblue, or other equivalent platforms.
• Role: They act as data processors.
• Transfers: In some cases, transfers may be made to the U.S. under SCCs.

7.7. Cookie Consent Manager

• Purpose: To allow users to configure, on a granular basis, whether to accept or reject cookies.
• Role: acts as a data processor (e.g., Complianz or another equivalent plugin).
• Note: The settings are explained in the Cookie Policy.

7.8. Transparency and User Control

Users will be informed of the use of all these tools through:

• The cookie banner that appears when accessing the website.
• The Cookie Policy, which details the types of cookies and technologies used, their purpose, duration, and how to disable them.

8. Rights of Data Subjects

Users who provide their personal data through the www.tdoctors.es Platform have the right to exercise, at any time, the rights recognized by the GDPR (Articles 15–22) and the LOPDGDD (Articles 12–18).

8.1. Right of Access

This right allows you to obtain confirmation as to whether or not the Data Controller is processing your personal data, as well as detailed information regarding the purposes of processing, categories of data, recipients, retention periods, and your rights.

8.2. Right to Rectification

This right allows you to request the correction of inaccurate or incomplete data, ensuring that the information processed is always correct and up-to-date.

8.3. Right to erasure (“right to be forgotten”)

This right allows you to request the deletion of your personal data when:

• It is no longer necessary for the purpose for which it was collected.
• The consent on which the processing was based is withdrawn.
• The data has been processed unlawfully.

This right does not apply when processing is necessary to comply with legal obligations, to establish, exercise, or defend legal claims, or for reasons of public interest in the field of health.

8.4. Right to Object

The user may object, at any time and for reasons related to their particular situation, to the processing of their data based on the Data Controller’s legitimate interest.

In particular, the user may object to processing for direct marketing purposes, including related profiling.

8.5. Right to Restriction of Processing

You may request that the Data Controller restrict the processing of your data in the following cases:

• When the accuracy of the data is contested.
• When the processing is unlawful and the user objects to erasure.
• When the Data Controller no longer needs the data, but you require it for the establishment or defense of legal claims.
• When the user has objected to the processing while it is being verified whether the Data Controller’s legitimate grounds prevail.

8.6. Right to Data Portability

This entitles the user to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit it to another data controller, provided that the processing is based on consent or a contract and is carried out by automated means.

8.7. Right to Withdraw Consent

When processing is based on consent (e.g., health data, marketing communications, geolocation), the user may withdraw consent at any time, without this affecting the lawfulness of the processing carried out previously.

8.8. Right not to be subject to automated individual decision-making

The user has the right not to be subject to a decision based solely on automated processing, including profiling, unless permitted by law, necessary for the performance of a contract, or where the user has given explicit consent.

8.9. Channels for Exercising Rights

The user may exercise their rights by submitting a written and signed request, accompanied by a document proving their identity, through the following channels:

• General email: info@medicalresponse.es
• Data Protection Officer (DPO): rgpd@tdoctors.es
• Mailing address: Medical Response International S.L.U. – Attn: Privacy, Camí dels Reis, 308 – 1st Floor, 07010 Palma (Balearic Islands), Spain

8.10. Response Timeframe

The Data Controller will respond to requests within a maximum of 1 month from receipt. This period may be extended by up to 2 additional months in particularly complex cases, in which case the data subject will be notified within the first month.

8.11. Right to File a Complaint with the Supervisory Authority

If you believe that your rights have not been adequately addressed, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

This is without prejudice to any other administrative remedy or legal action to which you may be entitled.

9. Data Security and Confidentiality

The Data Controller undertakes to ensure the confidentiality, integrity, and availability of the personal data processed on the www.tdoctors.es Platform by implementing appropriate technical and organizational measures in accordance with Articles 24, 25, and 32 of the GDPR and Article 32 of the LOPDGDD.

9.1. Security Principles Applied

• Confidentiality: The data is accessible only to authorized personnel at the centers, MRI’s administrative team, collaborating physicians, and technology providers contracted as data processors.
• Integrity: Protection mechanisms are in place to prevent accidental or malicious alteration of the information.
• Availability: Backup and recovery systems are implemented to ensure access to data in the event of a technical or security incident.
• Data Minimization: Only the data strictly necessary for each purpose is processed.
• Privacy by Design and by Default: All processes, both administrative and clinical, have been configured to limit the collection of and access to personal data to what is strictly necessary.

9.2. Technical and Organizational Measures

Among other measures, the following are implemented:

• Encryption of communications between the user and the Platform using the TLS/SSL protocol.
• Access management and differentiated permissions based on user profiles (administrative, medical, accounting).
• Logging and auditing of access to clinical software and databases.
• Regular backups and disaster recovery plans.
• Intrusion detection and prevention systems, firewalls, and antivirus software.
• Logical segregation of data based on its type and sensitivity.
• Internal confidentiality policies and ongoing data protection training for staff.

9.3. Enhanced Protection of Health Data

Since these facilities handle special categories of data (health), additional measures apply:

• Access restricted solely to healthcare professionals and authorized administrative staff.
• Encryption of clinical records in transit and at rest within the management software hosted on IONOS.
• Strict application of the principle of data minimization: only clinical data essential for patient care is collected.
• Data is locked once the care-related purpose has been fulfilled (Art. 32 LOPDGDD).

9.4. Security in Payment Transactions

• If online payments are enabled, they are processed through Stripe, a provider certified to the international PCI DSS standard.
• The Data Controller does not store full credit card numbers or CVV codes.
• Stripe applies advanced encryption and anti-fraud controls to all transactions.

9.5. Impact Assessments and Risk Management

• When processing may pose a high risk to the rights and freedoms of data subjects (e.g., large-scale health-related processing using electronic systems), the Data Controller will conduct a Data Protection Impact Assessment (DPIA) in accordance with Article 35 of the GDPR.
• A risk management system is maintained, reviewed periodically, and updated in light of technological and regulatory developments.

9.6. Incident and Security Breach Management

• The Data Controller has an internal protocol for detecting, reporting, and responding to security incidents.
• In the event of a personal data breach, the Spanish Data Protection Agency (AEPD) will be notified within a maximum of 72 hours after becoming aware of the breach, and, where applicable, the affected users will also be notified (Articles 33 and 34 of the GDPR).

10. Modifications and Updates to the Privacy Policy

This Privacy Policy may be amended at any time in order to:

• Adapt to legislative or jurisprudential changes regarding data protection and information society services.
• Incorporate criteria, guidelines, or resolutions from the Spanish Data Protection Agency (AEPD) or other competent supervisory authorities.
• Address changes in the services provided by TDoctors medical centers or in the administrative management carried out by Medical Response International S.L.U. (MRI).
• Introduce technical or organizational improvements that enhance data security and privacy.

In the event of substantial changes that affect the processing of personal data or that require new consent, users will be informed in a clear and visible manner through the Platform, and, where appropriate, their authorization will be requested again.

Users are encouraged to review this Privacy Policy periodically to stay informed about how their personal data is processed and about their rights.

11. Affiliated Sites of the Group

The business group to which the TDoctors medical centers belong also manages other digital platforms linked to international healthcare services, such as:

• www.drnear.me (appointment scheduling and medical care management via geolocation).
• www.drnear.online (provision of video consultations and telemedicine services).
• www.doctor-abroad.eu (recruiting international patients interested in treatments in Spain).

When a user is redirected to any of these platforms from the website www.tdoctors.es, the specific privacy policy published on those domains will apply, and the purposes of data processing and the status of the Data Controller may vary depending on the service contracted.