Legal

Privacy Policy

This policy describes processing connected with this static website and its contact channels. Care provided by hospitals or clinics is also governed by the privacy information of the relevant centre.

Last updated: 29 July 2026

1. Controller and contact details

Public identification of the controller is limited to the following minimum details:

Francisco Javier Abellan Martinez
francisco.abellan.co@quironsalud.es

2. Scope and special-category data

drfranciscoabellan.com is a static information site: it has no user accounts, contact form, patient database or online appointment booking. The guide search runs only on the device and does not transmit the entered text.

A visit creates the technical communications with Vercel needed to deliver the page. Plausible Analytics and Google Maps remain blocked until the visitor enables their categories in the consent settings.

Health data is special-category data. Processing is not always based on explicit consent: Article 9(2)(h) GDPR may apply within healthcare, together with the relevant Article 6 basis and professional secrecy. Outside that context, the basis is determined by the purpose and contact channel.

The website does not make automated decisions or create patient profiles.

3. Processing that may take place outside or following use of the website

3.1. General use of the website

Purpose: Browsing and access to public information. The site receives no written enquiries or documents.
Data: IP address and technical connection data handled by hosting to serve and protect the site; consent preference in a first-party cookie.
Legal basis: The controller’s legitimate interest in publishing, maintaining and protecting the site (Article 6(1)(f)). The necessary preference is stored to remember the choice requested by the visitor.
Recipients: Vercel Inc. and the subprocessors identified in its official list, as hosting, network and security providers.
Retention: The consent preference is retained for 6 months. Technical logs follow the periods applicable to the Vercel service and configuration; the site owner does not retain an additional copy for this website.
Transfers: Vercel is a US provider and may use subprocessors in different countries. Applicable safeguards are described in its data processing agreement and subprocessor list.
Required or voluntary: Minimum technical data is necessary to deliver the site. Non-essential categories are voluntary.

3.2. Requests for information

Purpose: Replying to administrative questions about availability, centres or appointment management.
Data: Identity, contact details and content voluntarily communicated. Clinical data is not requested through this channel.
Legal basis: Steps requested before a potential service (Article 6(1)(b)) or consent to reply through the selected channel (Article 6(1)(a)).
Recipients: The secretary and authorised staff at the selected centre; the telephone operator or WhatsApp also intervenes when that channel is used.
Retention: Until the enquiry has been answered and closed. Afterwards, only information needed for applicable legal limitation periods is retained.
Transfers: Depend on the chosen channel; WhatsApp may involve international processing by Meta companies.
Required or voluntary: Voluntary, although a reply through that channel requires contact details.

3.3. Appointment requests

Purpose: Identifying the person and arranging, changing or cancelling an appointment.
Data: Name, telephone, centre/professional, availability and minimum administrative details; the context may reveal health information.
Legal basis: Article 6(1)(b) to manage the request; Article 9(2)(h) and healthcare law when data forms part of care. The selected centre explains its role and responsibilities during admission.
Recipients: Secretary and relevant healthcare centre; others only under a legal duty or healthcare need.
Retention: Until the appointment has been managed. If information enters administrative or clinical systems, it is retained under the centre’s policy and applicable healthcare law.
Transfers: Those of the selected channel and, where applicable, providers used by the responsible centre.
Required or voluntary: Minimum administrative data is necessary; additional data is voluntary unless justified.

3.4. Contact through WhatsApp

Purpose: General information and administrative appointment management initiated by the user.
Data: Number, profile/name, metadata and message content. Reports, images and particularly sensitive clinical information should not be sent unless necessary and agreed in advance.
Legal basis: Consent to use the channel or requested steps (Article 6(1)(a)/(b)). Article 9(2)(h) may apply when healthcare makes health-data processing necessary; outside that context Article 9(2)(a) explicit consent may be required.
Recipients: Authorised secretary staff and WhatsApp Ireland Limited/Meta companies under the service.
Retention: While needed for the requested administration. Information that must be retained is moved to the centre’s system where appropriate; the remainder should be deleted periodically, subject to legal obligations.
Transfers: WhatsApp describes global operations and providers in third countries. Use of the service is subject to the information and safeguards published by WhatsApp Ireland Limited.
Required or voluntary: Voluntary. Telephone or another channel confirmed by the organisation may be used.

3.5. Communications with the secretary

Purpose: Administrative support, reminders, diary changes and coordination with the centre.
Data: Identity, contact, appointment and strictly necessary administrative notes.
Legal basis: Article 6(1)(b) and, where applicable, 6(1)(c); necessary health data in care must be assessed under Article 9(2)(h).
Recipients: The secretary, professional and authorised staff at the relevant centre, according to the requested administration.
Retention: For the administrative process and afterwards for periods applying to the centre’s obligations and potential liabilities.
Transfers: Those associated with WhatsApp when that channel is chosen. Each centre’s internal tools are governed by its own privacy information.
Required or voluntary: Minimum data is necessary for the requested management; the remainder is voluntary.

3.6. Voluntary submission of symptoms, reports, images or medical information

Purpose: Not an ordinary purpose of the website or WhatsApp. If receipt is agreed, it is for assessment or entry into the indicated healthcare pathway.
Data: Health information, images, reports, medication and other sensitive data, potentially including third-party information.
Legal basis: Context-specific: Article 9(2)(h) when necessary for healthcare under professional secrecy, or Article 9(2)(a) explicit consent where appropriate. Sending information does not automatically settle the basis.
Recipients: Only authorised healthcare staff and the responsible centre; third-party data must not be sent without a lawful basis.
Retention: If information arrives through an unsuitable channel, the correct route will be indicated and it will be deleted when no longer needed. If it must enter the clinical record, the centre’s periods and healthcare law apply.
Transfers: Avoid unevaluated channels; WhatsApp considerations above apply if it is used.
Required or voluntary: Voluntary unless requested through a suitable channel by the healthcare team. Do not send it spontaneously through WhatsApp.

3.7. Clinical data within a healthcare relationship

Purpose: Diagnosis, treatment, follow-up, continuity of care, healthcare management and clinical/legal duties.
Data: Clinical history, background, examinations, images, diagnosis, treatment, progress and other necessary data.
Legal basis: The Article 6 basis depends on the service and centre; Article 9(2)(h) may apply to health data processed by professionals under secrecy, together with Spanish healthcare law.
Recipients: Lawfully involved professionals and centres, contracted processors and authorities where legally required.
Retention: Clinical documents are retained under Law 41/2002, applicable regional law, healthcare needs and legal liabilities. The responsible centre states its specific periods; this website stores no clinical records.
Transfers: Depend on the relevant controller’s clinical systems; they do not occur through this static website.
Required or voluntary: Data needed for safe care is required; unnecessary data should not be requested.

3.8. Data processed by external hospitals or clinics

Purpose: Managing and providing care at each centre where the physician practises.
Data: As described by the centre in its privacy information and healthcare pathway.
Legal basis: As communicated by each centre according to its role as controller, processor or joint controller and the care provided.
Recipients: Hospital Universitario de La Princesa/Madrid Health Service, Hospital Quirónsalud San José and authorised providers, depending on the actual centre of care.
Retention: As stated by each centre and required by healthcare law.
Transfers: As stated by each centre. Current policies should be linked or made available at admission.
Required or voluntary: Data required to arrange and provide care is mandatory; other data is voluntary as explained by the centre.

4. Analytics, maps and external links

Plausible Analytics loads only after “Analytics” is enabled. According to its official documentation, it uses no cookies or persistent identifiers, creates aggregate metrics and processes data in the European Union.

Google Maps iframes load only after “External content” is enabled. Google receives at least technical data such as the IP address and may use cookies or similar technologies under its policies. Ordinary links to Maps, WhatsApp, LinkedIn or Doctoralia do not contact the provider until the user opens them.

5. Your rights

You may request access, rectification, erasure, objection, restriction and portability; withdraw consent without affecting earlier lawful processing; and complain to the Spanish Data Protection Agency. Requests should be sent to francisco.abellan.co@quironsalud.es, with identity evidence where necessary. Some rights may be limited by clinical-record retention or other legal duties.

Agencia Española de Protección de Datos

6. WhatsApp and emergencies

Do not use WhatsApp for emergencies or diagnosis requests. Do not send particularly sensitive clinical information, reports or images unless necessary and agreed in advance with the centre or professional. For severe pain, sudden loss of vision or other worrying symptoms, contact the healthcare centre indicated to you or attend an emergency service.

7. Security and updates

Technical and organisational measures proportionate to the risk and type of information are applied. The controller and relevant centres must keep their records of processing, processor agreements, risk analyses, breach procedures and internal protocols up to date. This policy will be reviewed when processing, channels or providers change.