Tämä oikeudellinen teksti on saatavilla espanjaksi ja englanniksi. Ristiriitatilanteessa espanjankielinen versio on ensisijainen.
Last updated: 29 October 2026.
At Clínica Ginecológica M. Leonor Guerrero Mercader, we look after your data with the same rigour with which we look after your health. This policy explains clearly what data we process when you book an appointment, write to us, use the chat with our assistant María or receive our messages, what we use it for, who we share it with and what your rights are.
1. Who is responsible for your data
Controller: Clínica Ginecológica M. Leonor Guerrero Mercader, tax ID (NIF) 22960584Y.
Address: Gran Vía Escultor Salzillo, 32, Edificio Galerías, 2ª esc. 6ºD, 30005 Murcia.
Telephone: 968 71 44 17.
E-mail address for any privacy matter: citas@ginecologaleonorguerrero.com.
2. What data we process, why, and on what legal basis
Online appointment booking. When you book an appointment, we process your first name and surname, telephone number, e-mail address, the specialist, the date and time you have chosen and the payment details for the booking. We use them to manage your appointment, confirm it, remind you of it and notify you of any changes. Legal basis: performance of the service you request (art. 6.1.b of the GDPR (RGPD)).
Payment of the booking. Payment is made through Stripe. The clinic does not receive or store your card details: we only receive confirmation of the payment, its amount and the method used. Legal basis: performance of the service (art. 6.1.b).
Messages by WhatsApp and by e-mail. We send you appointment confirmations, reminders and notices of changes or cancellations by e-mail and by WhatsApp. By booking, you agree to receive these administrative messages; you may withdraw your consent at any time by writing to us. Legal basis: your consent (art. 6.1.a) and performance of the service (art. 6.1.b).
Contact form. If you write to us using the form, we process your name, e-mail address, telephone number (optional), the reason for your enquiry that you select and your message. The reason for your enquiry may reveal information about your health, so we ask you not to include detailed clinical information: this will be dealt with at the consultation. Legal basis: your explicit consent (art. 6.1.a and 9.2.a).
Virtual assistant María (website chat, WhatsApp and e-mail). When you write to us through these channels, your message may be handled by María, an assistant that uses artificial intelligence to inform you, check available appointment slots, help you make a booking and answer questions about the clinic. María does not give medical advice, does not make decisions about your health or decisions with legal effects on you, and passes your conversation to a member of our team when the situation requires it or when you ask. To generate its replies, the content of the conversation is processed by an artificial intelligence provider. We recommend that you do not share clinical data in the chat. Legal basis: your request for information or for an appointment (art. 6.1.b) and, where applicable, your consent (art. 6.1.a).
Security and prevention of abuse. To protect the forms and the chat from automated or abusive use, we process technical data, such as the IP address, for a short period. Legal basis: legitimate interest in the security of our services (art. 6.1.f).
Medical records. Healthcare provided in the consulting room and the medical record are governed by Ley 41/2002 (the Spanish Patient Autonomy Act) and the applicable health legislation. They are not managed through this website or the chat.
3. Who we share your data with
We do not sell your data or disclose it to third parties for commercial purposes. To provide the service, we work with providers that act as data processors, with whom we have the corresponding contract:
Supabase: database where appointments and messages are stored. Servers in the European Union (Ireland).
Vercel: hosting of the application and of this website. Running in the EU region (Dublin).
Stripe: processing of payment for the booking.
Meta Platforms Ireland (WhatsApp Business): sending and receiving messages via WhatsApp.
Resend: sending of confirmation e-mails and messages. EU region (Ireland).
Anthropic: artificial intelligence provider that generates the replies of the assistant María.
Arsys: hosting of the clinic's corporate e-mail.
We may also disclose data to public administrations and authorities where we are required to do so by law.
4. International transfers
Some of these providers (for example, the artificial intelligence, payment or messaging providers) may process data outside the European Economic Area, in particular in the United States. In those cases, the transfers are covered by the safeguards provided for by the GDPR (RGPD), such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
5. How long we keep your data
We keep appointment and communication data for as long as your relationship with the clinic lasts and, after that, for the periods necessary to deal with any potential legal liabilities. Contact details submitted through the form are kept for as long as necessary to handle your request. Your medical record is kept for the periods set by health legislation, which is a minimum of five years from the date of discharge for each episode of care.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without this affecting processing carried out previously. You may also object to your conversation being handled by the assistant and ask for a person to attend to you instead.
To exercise these rights, write to us at citas@ginecologaleonorguerrero.com or at our postal address, stating which right you wish to exercise and attaching a copy of your identity document. We will reply within a maximum of one month.
If you consider that we have not processed your data properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
7. Minors
If you are under 14, the processing of your data requires the consent of your parents or legal guardians. Patients who are minors must be accompanied by their legal representatives in accordance with health legislation.
8. Cookies and storage on your device
This website does not use analytics or advertising cookies. We only use technical storage that is necessary for it to function, such as the identifier of the chat conversation. You can see the details in the cookie policy.
9. How we protect your data
We apply technical and organisational measures appropriate to the risk: encrypted communications, role-based access control, activity logging, backups and limiting data to what is strictly necessary. If a security breach affecting your data were to occur, we will handle it and notify it in the terms required by law.
10. Changes to this policy
If we change the way we process your data, we will update this policy and the date shown at the beginning. We recommend that you review it from time to time.