1. Who processes your data
The data controller —who decides why and how your data is used— is:
Controller: Salud En Ruta SL
Tax ID: B21724703
Registry details: Registro Mercantil de Madrid, sección 8, hoja M-849573, inscripción 1ª
Registered address: C. Tintín y Milú, 12, Portal F, 5ºD, 28042 Madrid
Data protection email: info@saludenruta.es
Data protection: Queries about this policy, including those addressed to the Data Protection Officer, and requests to exercise your rights are handled at the email address above.
2. What data we process
We process the data you give us, the data provided by whoever requests the visit on your behalf, and the data generated by the care itself or by the use of the website. We do not buy lists or obtain data from other sources.
Data you provide
- Visit request: name, phone number, email address if you give it, postcode and the reason for consultation that you write or tell us by phone, which may include health data. With each form submission we also store the date, the IP address and browser it was sent from, and the version of the privacy information you were shown.
- Visit: when the request becomes a visit, we add the data needed to identify and care for you, such as surnames, ID card or foreigner ID number (DNI/NIE), date of birth, full address and, where applicable, your insurer and policy number.
- Complaints channel: the facts you report, the details of the visit concerned and, if you choose to identify yourself, your name and email. Ethics and compliance reports can be submitted anonymously.
- Provider portal: if you access it on behalf of an insurer or intermediary, your name, email, organisation, role, two-step verification settings, notification preferences and session data.
Data we generate or receive from third parties
- Clinical record: the medical history, examination, diagnosis, treatment, tests, reports and progress recorded by the professionals who care for you.
- Prescriptions: the medicines prescribed and the data required for private electronic prescriptions.
- Insurers and intermediaries: if the visit is requested by your insurer or an intermediary, they send us your identification and contact details, your policy details and the reason for the request.
- Relatives or companions: if someone else requests the visit for you, they give us your details and whatever they know about your condition.
- Billing: the amounts, payment method and tax details needed to issue the invoice.
Data collected when using the website
- Cookieless measurement: aggregate visit data —pages viewed, country, device type and browser— that cannot identify you.
- Measurement with cookies: if we have enabled it and only if you accept analytics cookies, usage data from Google Analytics, as explained in the cookie policy.
- Form protection: when enabled, Cloudflare Turnstile receives your IP address and technical browser data to tell people apart from automated submissions.
- Maps: pages that show a map request the images from an external provider (Esri), which receives your IP address when serving them. It does not set cookies.
- Portal: if you sign in, we log your access and the operations you perform, for security purposes.
Health data: the reason for consultation, the clinical record and prescriptions are special category data (art. 9 GDPR). They are only processed by healthcare professionals and staff bound by secrecy, and only to the extent needed to care for you. Please write only what is strictly necessary in the website form for us to assess your request.
3. What we use it for and on what legal basis
Each purpose has its own legal basis and retention period:
| Purpose | Legal basis | Retention |
|---|---|---|
| Handling your visit request: reviewing it, calling you, carrying out the telephone assessment and, where appropriate, arranging the visit. | Pre-contractual steps at your request (art. 6.1.b GDPR). For health data, healthcare under professional secrecy (art. 9.2.h GDPR). | If it leads to a visit, it becomes part of the clinical record. If not, for as long as needed to handle it and then blocked for the limitation periods of any potential liability. |
| Providing you with medical or nursing care and creating and keeping your clinical record. | Performance of the service contract (art. 6.1.b) and legal obligation under Law 41/2002 (art. 6.1.c). For health data, art. 9.2.h GDPR and the seventeenth additional provision of the Spanish Data Protection Act (LOPDGDD). | At least five years from the discharge of each episode of care (art. 17 of Law 41/2002), or any longer period set by the regulations of the Community of Madrid. |
| Alerting the emergency services and giving them the necessary information if your life is at risk during the visit and you cannot consent. | Vital interests (arts. 6.1.d and 9.2.c GDPR). | It is added to the clinical record and follows its retention period. |
| Issuing private electronic prescriptions. | Legal obligation under prescription regulations (art. 6.1.c) and healthcare (art. 9.2.h GDPR). | The periods set by prescription regulations and, in any case, those of the clinical record. |
| Managing requests from your insurer or intermediary: confirming cover, reporting the outcome of the visit where the policy requires it, and invoicing the service. | Performance of your policy and of the contract with the organisation (art. 6.1.b). For health data, management of healthcare services (art. 9.2.h GDPR). | For as long as the relationship with the organisation lasts and then for the applicable limitation periods. |
| Collecting payment, issuing invoices and meeting accounting and tax obligations. | Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c GDPR). | Six years under the Commercial Code and four under the General Tax Law, from the end of the financial year. |
| Giving access to the provider portal and managing the accounts of people who use it on behalf of an insurer or intermediary. | Performance of the contract with the organisation (art. 6.1.b) and legitimate interest in managing access for the people it designates (art. 6.1.f GDPR). | For as long as the account is active and then for the applicable limitation periods. |
| Handling complaints about the service. | Legal obligation to handle consumer complaints (art. 6.1.c). If they include health data, art. 9.2.h GDPR. | For as long as needed to resolve them and then blocked for the limitation periods of any potential liability. |
| Handling ethics and compliance reports submitted through the complaints channel. | Legal obligation (art. 6.1.c GDPR and Spanish Law 2/2023). | Three months from receipt if no investigation is opened; if one is opened, for its duration and the time needed to justify it. |
| Logging access and operations to prevent and investigate security incidents. | Legitimate interest in protecting our systems and the data we hold (art. 6.1.f GDPR) and security duty (art. 32 GDPR). | Audit log, one year; portal access, six months; inactive sessions, 30 days; access to clinical data, five years. |
| Measuring website use in aggregate to improve it. | Without cookies: legitimate interest (art. 6.1.f GDPR). With cookies: your consent (art. 6.1.a GDPR and art. 22.2 of the Spanish Information Society Services Act, LSSI). | As stated in the cookie policy. |
| Preventing automated form submissions. | Legitimate interest in protecting ourselves against spam and abuse (art. 6.1.f GDPR). | As applied by the verification service provider. |
Professional secrecy: the healthcare professionals and the coordination and administrative staff who access your health data are bound by professional secrecy and confidentiality (art. 9.3 GDPR and art. 5 LOPDGDD), even after their relationship with Salud en Ruta ends.
Do you have to give us this data? Fields marked with an asterisk are required to handle your request. Without them, or if the information about your condition is not accurate, we cannot assess the case or provide care safely. The rest are optional.
Automated decisions: We do not make automated decisions or build profiles that produce legal effects on you or similarly significantly affect you. The assessment of your request and clinical decisions are always made by people.
Withdrawing consent: where the basis is your consent —on this website, only analytics cookies—, you can withdraw it at any time from the cookie preferences panel. Withdrawing it is as easy as giving it and does not affect the lawfulness of prior processing.
4. Who it is disclosed to
We do not sell or rent your data. We only disclose it when needed to care for you, to invoice the service or because the law requires it.
Disclosures of data
- Your insurer or the intermediary that sent the request: only what is needed to authorise, justify and invoice the care —your identification, the date and type of service and, where your policy requires it, the visit report—. They view it in the provider portal.
- Other healthcare professionals and centres: when needed for your care, for example if you must be referred to a hospital or the emergency services must be alerted.
- Pharmacies: through the private electronic prescription system (REMPE), the prescription data needed to dispense it.
- Public authorities and courts: health authorities, the Tax Agency, law enforcement or courts, when a legal provision requires it, such as mandatory public health notifications or a court order.
Providers processing data on our behalf
- Hosting and infrastructure: whoever hosts the website, the portal, the management applications and the database.
- Email delivery: the service used to send confirmations and notifications.
- Clinical and e-prescription software: the tools used to record the clinical record and issue prescriptions.
- Address geocoding: the service that converts the visit address into coordinates to plan routes.
- Form protection: Cloudflare, when verification is enabled.
- Website measurement: Vercel, without cookies; and Google, only if you accept analytics cookies.
All of them process data only on our instructions and under a data processing agreement in accordance with art. 28 GDPR. The map provider (Esri) is not a processor: it receives your IP address when serving the map images, like any server your browser requests a file from.
5. International transfers
As a general rule we process data within the European Economic Area. Some technical services are provided by companies based in the United States:
- Google (measurement with cookies): only if you accept analytics cookies. Google LLC participates in the EU-US Data Privacy Framework, which is covered by a European Commission adequacy decision, and also applies standard contractual clauses.
- Cloudflare (form protection): when verification is enabled. Cloudflare, Inc. participates in the same Framework and applies standard contractual clauses.
- Vercel (cookieless measurement) and Esri (maps): they receive technical connection data, such as the IP address, when providing their service. The transfer relies on the Data Privacy Framework where the provider participates in it or, failing that, on standard contractual clauses approved by the European Commission.
If any other provider needs to process data outside the European Economic Area, it will only do so with one of the safeguards in Chapter V of the GDPR. You can ask us for information about the safeguards applied by writing to the data protection email.
6. How long we keep it
The retention period for each processing activity is shown in the table in section 3. As a general rule, we keep data for as long as it is needed for the purpose it was collected for and then blocked for the limitation periods of any liability that may arise, available only to courts and competent authorities.
Clinical records have their own rules: Law 41/2002 requires them to be kept for at least five years from the discharge of each episode of care, and the regulations of the Community of Madrid may set longer periods. During that time we cannot delete them even if you ask us to, and we may also keep them for longer for judicial, epidemiological, research or healthcare-organisation reasons, as permitted by law.
Once those periods have passed, we delete the data or anonymise it so that you can no longer be identified.
7. Your rights
You can exercise these rights over your personal data free of charge:
- Access: find out what data of yours we process and obtain a copy.
- Rectification: correct inaccurate data or complete missing data.
- Erasure: ask us to delete it when it is no longer needed, unless the law requires us to keep it, as is the case with clinical records.
- Restriction of processing: ask us to keep it but stop using it while a challenge or objection is resolved.
- Portability: receive the data you gave us in a structured, commonly used format, or have us send it to another controller.
- Objection: object to processing based on our legitimate interest.
- Withdrawal of consent: withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.
Access to your clinical record: in addition, Law 41/2002 gives you the right to access your clinical record and obtain a copy of the data in it. This right does not extend to third-party data collected in your therapeutic interest or to professionals' subjective notes, and it can be exercised by you or by your duly accredited representative.
To exercise any of them, write to info@saludenruta.es stating which right you are exercising. Because we process health data, we will ask you to prove your identity, or the capacity in which you act on someone else's behalf, before providing any information.
Response time: one month from receipt of your request. If it is particularly complex or there are several requests, this period may be extended by two further months, and we will tell you so within the first month, explaining why.
Complaining to the supervisory authority: if you believe we have not handled your request properly or that we process your data unlawfully, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid). You do not need to complain to us first, although we would like the chance to resolve it. www.aepd.es
8. Minors
This website is not aimed at children under fourteen, who cannot provide their data to us themselves (art. 7 LOPDGDD). If we find that a child under that age has sent us data without the authorisation of their parents or legal guardians, we will delete it.
Paediatric care is requested by the child's parents or legal guardians, who provide the child's data and must be present during the visit. Information and consent in the care of minors are governed by Law 41/2002, which sets out when the legal representative decides and when the minor does so.
10. Security
We apply technical and organisational measures appropriate to the risk of processing health data (art. 32 GDPR):
- SSL/TLS encryption for all communications with the website and the portal.
- Encryption of stored health data, such as the reason for consultation, the clinical record and prescriptions.
- Passwords are not stored: we keep a cryptographic hash from which the password cannot be recovered.
- Two-step verification available in the provider portal, and viewing and closing of open sessions.
- Role-based access: each person can only access the information they need for their role.
- Logging of who views or changes what, with a specific log of access to clinical data.
- Duty of confidentiality for all staff and for the providers who access the data.
If something goes wrong: we keep a record of security breaches. If a breach poses a risk to your rights, we notify the Spanish Data Protection Agency within the 72 hours required by art. 33 GDPR and, where the risk is high, we also inform you.
To report a possible security incident, write to info@saludenruta.es.
11. Contact
For any question about this policy or to exercise your rights, write to us: