Legal

Privacy Policy

This policy describes processing connected with this static website and its contact channels. Care provided by hospitals or clinics is also governed by the privacy information of the relevant centre.

Last updated: 10 August 2026

1. Controller and contact details

Public identification of the controller is limited to the following minimum details:

Francisco Javier Abellan Martinez
francisco.abellan.co@quironsalud.es

2. Scope and special-category data

drfranciscoabellan.com is a static information site: it has no user accounts, contact form, patient database or online appointment booking. The guide search runs only on the device and does not transmit the entered text.

A visit creates the technical communications with Vercel needed to deliver the page. Montserrat and Poppins are served from this same site. Google Analytics 4 and Google Maps remain blocked until the visitor enables their categories in the consent settings.

Health data is special-category data. Processing is not always based on explicit consent: Article 9(2)(h) GDPR may apply within healthcare, together with the relevant Article 6 basis and professional secrecy. Outside that context, the basis is determined by the purpose and contact channel.

The website does not make automated decisions or create patient profiles.

3. Processing that may take place outside or following use of the website

3.1. Website browsing and delivery

Purpose: Browsing and access to public information. The site receives no written enquiries or documents.
Data: IP address and technical connection data handled by hosting to serve and protect the site; consent preference in a first-party cookie.
Legal basis: The controller’s legitimate interest in publishing, maintaining and protecting the site (Article 6(1)(f)). The necessary preference is stored to remember the choice requested by the visitor.
Recipients: Vercel Inc. and its subprocessors as hosting, network and security providers.
Retention: The consent preference is retained for 6 months. The site uses Vercel Pro. Request and security logs follow the periods of the settings and products enabled on that plan; the configuration will be reviewed when services change or exports and integrations are enabled.
Transfers: Vercel is a US provider and may use subprocessors in different countries. Its Pro terms incorporate a data processing agreement and transfer mechanisms, including standard contractual clauses where applicable. Its documents and subprocessors will be reviewed when the service changes.
Required or voluntary: Minimum technical data is necessary to deliver the site. Non-essential categories are voluntary.

3.2. Optional analytics and campaign measurement with Google Analytics 4

Purpose: Measure audience, navigation, acquisition and campaigns; assess content and understand how many visitors click the administrative contact channels.
Data: Page path and title; referrer; standard campaign parameters such as UTM, GCLID, GBRAID or WBRAID; browser, operating system, device, approximate location and a random client or session identifier. Language and click events include the section and path. Telephone or WhatsApp clicks generate a generate_lead event, but the number, message contents, names and clinical information are not sent.
Legal basis: Visitor consent (Article 6(1)(a) GDPR), which may be refused or withdrawn at any time through the cookie settings.
Recipients: Google Ireland Limited, Google LLC and providers that apply under the Google Analytics and Google Ads terms.
Retention: The _ga and _ga_<identifier> cookies have a default lifetime of up to 2 years, subject to browser limits. User and event data retention in the property will remain at 2 months unless a change to 14 months is documented first; standard aggregate reports may remain available for longer under the Google Analytics configuration.
Transfers: Google may process data on global infrastructure and apply the transfer mechanisms in its data-protection terms. Account access will be limited to authorised people. Google Signals, ads personalisation, remarketing and user-provided data collection are not enabled.
Required or voluntary: Voluntary. Refusing or withdrawing consent does not prevent use of the website.

3.3. Requests for information

Purpose: Replying to administrative questions about availability, centres or appointment management.
Data: Identity, contact details and content voluntarily communicated. Clinical data is not requested through this channel.
Legal basis: Steps requested before a potential service (Article 6(1)(b)) or consent to reply through the selected channel (Article 6(1)(a)).
Recipients: The secretary and authorised staff at the selected centre; the telephone operator or WhatsApp also intervenes when that channel is used.
Retention: Until the enquiry has been answered and closed. Afterwards, only information needed for applicable legal limitation periods is retained.
Transfers: Depend on the chosen channel; WhatsApp may involve international processing by Meta companies.
Required or voluntary: Voluntary, although a reply through that channel requires contact details.

3.4. Appointment requests

Purpose: Identifying the person and arranging, changing or cancelling an appointment.
Data: Name, telephone, centre/professional, availability and minimum administrative details; the context may reveal health information.
Legal basis: Article 6(1)(b) to manage the request; Article 9(2)(h) and healthcare law when data forms part of care. The selected centre explains its role and responsibilities during admission.
Recipients: Secretary and relevant healthcare centre; others only under a legal duty or healthcare need.
Retention: Until the appointment has been managed. If information enters administrative or clinical systems, it is retained under the centre’s policy and applicable healthcare law.
Transfers: Those of the selected channel and, where applicable, providers used by the responsible centre.
Required or voluntary: Minimum administrative data is necessary; additional data is voluntary unless justified.

3.5. Contact through WhatsApp

Purpose: General information and administrative appointment management initiated by the user.
Data: Number, profile/name, metadata and message content. Reports, images and particularly sensitive clinical information should not be sent unless necessary and agreed in advance.
Legal basis: Consent to use the channel or requested steps (Article 6(1)(a)/(b)). Article 9(2)(h) may apply when healthcare makes health-data processing necessary; outside that context Article 9(2)(a) explicit consent may be required.
Recipients: The secretary and people authorised by the relevant controller or centre may access the message through the WhatsApp Business account used for work. WhatsApp Ireland Limited processes account, device, connection, usage and metadata under its service.
Retention: While needed for the requested administration. Messages will be reviewed and deleted when the task is complete and they are no longer needed; information that must be retained is moved to the centre’s system where appropriate. Access on linked devices and backups will be limited and reviewed under the account settings, subject to legal obligations.
Transfers: WhatsApp Ireland Limited describes transfers outside the EEA using adequacy decisions, the EU-US Data Privacy Framework and standard contractual clauses, depending on the operation. The current WhatsApp Business terms and privacy policy apply.
Required or voluntary: Voluntary. Telephone or another channel confirmed by the organisation may be used.

3.6. Communications with the secretary

Purpose: Administrative support, reminders, diary changes and coordination with the centre.
Data: Identity, contact, appointment and strictly necessary administrative notes.
Legal basis: Article 6(1)(b) and, where applicable, 6(1)(c); necessary health data in care must be assessed under Article 9(2)(h).
Recipients: The secretary, professional and authorised staff at the relevant centre, according to the requested administration.
Retention: For the administrative process and afterwards for periods applying to the centre’s obligations and potential liabilities.
Transfers: Those associated with WhatsApp when that channel is chosen. Each centre’s internal tools are governed by its own privacy information.
Required or voluntary: Minimum data is necessary for the requested management; the remainder is voluntary.

3.7. Voluntary submission of symptoms, reports, images or medical information

Purpose: Not an ordinary purpose of the website or WhatsApp. If receipt is agreed, it is for assessment or entry into the indicated healthcare pathway.
Data: Health information, images, reports, medication and other sensitive data, potentially including third-party information.
Legal basis: Context-specific: Article 9(2)(h) when necessary for healthcare under professional secrecy, or Article 9(2)(a) explicit consent where appropriate. Sending information does not automatically settle the basis.
Recipients: Only authorised healthcare staff and the responsible centre; third-party data must not be sent without a lawful basis.
Retention: If information arrives through an unsuitable channel, the correct route will be indicated and it will be deleted when no longer needed. If it must enter the clinical record, the centre’s periods and healthcare law apply.
Transfers: Avoid unevaluated channels; WhatsApp considerations above apply if it is used.
Required or voluntary: Voluntary unless requested through a suitable channel by the healthcare team. Do not send it spontaneously through WhatsApp.

3.8. Clinical data within a healthcare relationship

Purpose: Diagnosis, treatment, follow-up, continuity of care, healthcare management and clinical/legal duties.
Data: Clinical history, background, examinations, images, diagnosis, treatment, progress and other necessary data.
Legal basis: The Article 6 basis depends on the service and centre; Article 9(2)(h) may apply to health data processed by professionals under secrecy, together with Spanish healthcare law.
Recipients: Lawfully involved professionals and centres, contracted processors and authorities where legally required.
Retention: Clinical documents are retained under Law 41/2002, applicable regional law, healthcare needs and legal liabilities. The responsible centre states its specific periods; this website stores no clinical records.
Transfers: Depend on the relevant controller’s clinical systems; they do not occur through this static website.
Required or voluntary: Data needed for safe care is required; unnecessary data should not be requested.

3.9. Data processed by external hospitals or clinics

Purpose: Managing and providing care at each centre where the physician practises.
Data: As described by the centre in its privacy information and healthcare pathway.
Legal basis: As communicated by each centre according to its role as controller, processor or joint controller and the care provided.
Recipients: Hospital Universitario de La Princesa/Madrid Health Service, Hospital Quirónsalud San José and authorised providers, depending on the actual centre of care.
Retention: As stated by each centre and required by healthcare law.
Transfers: As stated by each centre. Current policies should be linked or made available at admission.
Required or voluntary: Data required to arrange and provide care is mandatory; other data is voluntary as explained by the centre.

4. Analytics, maps and external links

The Google Analytics 4 tag is downloaded only after “Analytics and campaign measurement” is enabled. Consent Mode v2 starts with analytics_storage, ad_storage, ad_user_data and ad_personalization denied. After acceptance, only analytics_storage is granted; ad_storage, ad_user_data and ad_personalization remain denied, while Google Signals and ads personalisation stay disabled. When consent is withdrawn, the states are denied again, accessible measurement cookies are removed and the page reloads.

Google Maps iframes load only after “External content” is enabled, on the basis of consent under Article 6(1)(a) GDPR. Google receives at least technical data such as the IP address and may use cookies or similar technologies under its policies. Links to Maps, WhatsApp, LinkedIn, or the Google profile and review form do not load the destination provider until the user opens them. If analytics has been consented to, telephone, WhatsApp and Google review-button clicks record only the click type, section and path.

5. Your rights

You may request access, rectification, erasure, objection, restriction and portability; withdraw consent without affecting earlier lawful processing; and complain to the Spanish Data Protection Agency. Requests should be sent to francisco.abellan.co@quironsalud.es, with identity evidence where necessary. Some rights may be limited by clinical-record retention or other legal duties.

Agencia Española de Protección de Datos

6. WhatsApp and emergencies

Do not use WhatsApp for emergencies or diagnosis requests. Do not send particularly sensitive clinical information, reports or images unless necessary and agreed in advance with the centre or professional. For severe pain, sudden loss of vision or other worrying symptoms, contact the healthcare centre indicated to you or attend an emergency service.

7. Security and updates

Technical and organisational measures proportionate to the risk and type of information are applied. The controller and relevant centres must keep their records of processing, processor agreements, risk analyses, breach procedures and internal protocols up to date. This policy will be reviewed when processing, channels or providers change.