Patients

DATA PROCESSING ACTIVITY – PATIENTS

Who is the controller in charge of processing your personal data?

Company name: EQUIPO MÉDICO CRESPO VALENCIA, S.L.U.

Tax identification number: B56859432

Headquarters: Avda. General Avilés, N.º 90 bajo 46015 Valencia

Delegation: Calle Llandells, 2-4 Bajo 12598 Peñíscola Castellón

Telephone: 961042557 Headquarters / 964489132 Peñíscola Office

Email: lopd@juanacrespo.es

Contact our Data Protection Officer (DPO): dpo@juanacrespo.es

For what purpose will we process your personal data?

Your persona data will be used to manage specialised medical treatment and diagnostic tests related to gynaecology, assisted reproduction, fertility and donations, and to provide healthcare treatment, systems and services, that will include, private electronic prescriptions, economical administrative management and the necessary communication with patients.

How long will we keep your personal data for?

Your personal data will be stored for the duration of the established relationship. Once this is finished, it will be duly blocked based on the legal retention periods established by national and/or autonomous healthcare regulations for a maximum of 5 years (this retention period may be affected by changes to regulations).

What is the legitimation for the processing of my personal data?

The legal base for the processing of your personal data is based on:

Execution of a contract (principal)In compliance witharticle 9.2.h) of the GDPR

The processing of your personal data bases its legitimacy on the contractual relationship established between the parties to provide medical/care services.

In compliance with article 9 h) of the GDPR, data corresponding to sensitive categories of data, in particular related to health, may be processed when necessary for medical diagnosis purposes, to provide care or healthcare treatment or to manage healthcare systems and services, based on Union Law or Member State Law in virtue of a contract with a healthcare professional.

Personal data can be processed in compliance with the purposes stated when treatment is given by a professional subject to the obligation of professional secrecy, or under their responsibility in accordance with Union Law or Member State Law or with the regulations established by competent national organisations or by any other person also subject to the obligation of professional secrecy in accordance with Union Law or Member State Law or with the regulations established by competent national organisations

As a consequence of the contractual/care relationship, the controller is obliged to comply with the sectoral health legislation to develop, maintain and conserve their clinical coursewhich includes:

LAW 41/2002, of the 14th November, basic regulation on the autonomy of the patient and the rights and obligations regarding information and clinical documentation.

LAW 14/2006 on Assisted Reproduction Techniques.

Royal Decree-Law 9/2014, of the 4th of July, which establishes the regulations of quality and security for donation, extraction evaluation, processing, preservation, storage and distribution of human cells and tissue, and approves the regulations of coordination and functioning for their use in humans.

LAW 1/2003, of the 28th of January of the Town Hall of Rights and Information of the Patient in the Valencian Community.

Royal Decree-Law 1718/2010, of the 17th of December, about medical prescription and dispensing orders developed on the articles 19.6 and 77.6 and 8 of Law 29/2006, of July 26, on guarantees and rational use of medicines and health products.

Consent of the data subject

Certain processing of specific data, such as:

1. Collection of DNA samples will base their legitimacy on the express written consent of the patient, and will be formalised at the time of the data/sample collection.
2. The voluntary participation in biomedical investigations will base its legitimacy on the express written consent of the patient, and will be formalised at the time of the data collection.
3. If data concerning sexual orientation and racial or ethnic origins is necessary for the healthcare procedure, processing will be based on express consent.

Necessary to protect vital interests

1. In certain cases of medical emergency, your data may be disclosed to other medical professionals who are also subject to the obligation of secrecy to protect your vital interests.

Am I obliged to provide my personal data?

Contractual requirement: necessary identifying and contact information to establish contractual/care relationships with patients.

Necessary requirement: Patient history, previous reports, diagnostic, analysis, pathological or genetic tests, medical reports, prescription of treatment etc. Until the discharge report are all elements that make up your clinical course and as controllers we are obliged by law to document it, in accordance with Article 15 of Law 41/2002

Necessary requirement: any other personal data requested by our medical professionals that they consider as necessary to make a medical diagnosis.

What will happen if I do not provide it?

It will not be possible to offer you the requested service

Will we disclose your personal data?

Recipients or categories of recipients.

In cases of emergency and based on vital interests, we may disclose personal data to the emergency services to facilitate your care.

In cases of treatment that requires surgical interventions, your personal data will be processed by the external team of professionals responsible for anaesthesia, which are necessary for the development of their professional tasks.

In certain cases we will recommend disclosure of your data to external professionals for specific treatment and private electronic prescription. If this is the case, we will inform you and ask for your consent.

In all cases we believe that these disclosures are necessary for your medical assistance and the correct development of your healthcare treatment.

What rights do I have when I provide my personal data?

Right of Access: You have the right to know whether we are processing your data and to receive this information in writing via the requested means.

Right to Rectification: You have the right to request the rectification of your data if it is inaccurate or incomplete.

You have the right to request the erasure of your data. However, remember that the right to deletion remains limited when there is a legal obligation to retain or block your data.

In certain circumstances, the data subjects may request the restriction of processing of their data. In this case we will only keep it for the exercise or defence of legal claims, protect third parties or for significant public interest reasons.

In certain circumstances and for reasons related to a particular situation, you may object to the processing of your data. The controller will stop processing your data, unless there are superior legitimate grounds for the processing, or for the exercise or defence of legal claims

When the processing of data is based on consent or on a contract or pre-contract, and it is carried out by automated means, you have the right to data portability. This means that it will be provided in a structured, commonly used and machine-readable format, including providing it to a new responsible figure..

Any interested party may lodge a complaint with the competent data protection supervisory authority, especially when they are not satisfied with the exercise of their rights. They can be contacted in writing at Spanish Personal Data Protection Agency (Agencia Española de Protección de DatosPersonales) at C/Jorge Juan n.º 6, 28001 Madrid or online at www.agpd.es

The models to request the exercise of your rights can be found in the Privacy Policies/rights of our website. You may also request them in writing from our management team, or online on the supervisory authority’s website www.agpd.es . These must be sent to the manager’s postal or email address.