This Privacy Policy explains how Traumatology Team by Artroflow handles personal data. It applies to patients and website visitors in Spain and the EU. It is provided for transparency and does not constitute legal advice.
1. Data Controller
The data controller responsible for your personal data is:
- Entity
- [TO COMPLETE — legal entity name]
- Commercial name
- Traumatology Team by Artroflow
- Tax ID (NIF/CIF)
- [TO COMPLETE — tax identification number]
- Registered address
- [TO COMPLETE — registered address in Spain]
- artroflop@gmail.com
- Phone
- +34 602 99 22 22
If a Data Protection Officer (DPO) is appointed, their contact details will be shown here: [TO COMPLETE — DPO name and contact, if applicable].
2. Personal Data We Collect
We collect the following categories of personal data:
- Website contact form: first name, last name, email, phone, preferred language, main problem, preferred location, preferred appointment time and how you heard about us — provided voluntarily by you.
- Meta lead forms (Facebook/Instagram): the personal data you submit through Meta-owned lead-generation forms (for example, name, email and phone), as permitted under Meta's terms and your own privacy choices at the point of submission.
- WhatsApp, telephone and email enquiries: the contact details and messages you share with us when requesting information or arranging a consultation.
- Booking and clinical enquiry: information you provide to arrange an appointment, such as your name, contact details and a brief description of your orthopaedic concern.
We do not collect special category health data through the website contact forms or Meta lead forms. Please do not send clinical reports or medical images through these channels; such data is handled only through the appropriate clinical pathway.
3. Purposes and Legal Basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and arranging a consultation | Consent (Art. 6(1)(a) GDPR) |
| Processing leads submitted through Meta lead forms | Consent (Art. 6(1)(a) GDPR) |
| Providing and managing requested services | Pre-contract / contract performance (Art. 6(1)(b) GDPR) |
| Communicating with you by WhatsApp, phone or email | Consent and legitimate interest (Art. 6(1)(a)/(f) GDPR) |
4. Data Retention
Personal data collected through contact forms and Meta lead forms is retained only for as long as necessary for the purposes described above, and in accordance with applicable legal retention requirements.
- Pending enquiries: retained for [TO COMPLETE — number] months from last contact, then deleted unless a service relationship is established.
- Active patient relationships: retained for the duration of the relationship and the statutory limitation period thereafter, in line with Spanish healthcare and data protection requirements.
5. Recipients of Your Data
Your personal data is not sold. It may be shared, where strictly necessary, with:
- Clinical partners and facilities involved in your care;
- Service providers acting as data processors (for example, hosting, messaging and analytics), bound by confidentiality and data processing agreements;
- Meta Platforms, in connection with lead forms you submit through Meta-owned products; and
- Public authorities where required by law.
Complete list of processors: [TO COMPLETE — processor categories or specific providers, as applicable].
6. International Transfers
Some service providers (for example, Meta) may process data outside the EU/EEA. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses and applicable EU Commission adequacy decisions, and we apply the additional measures required by Spanish and EU law.
7. Your Rights
Under the GDPR you may exercise, free of charge, the following rights:
- Access your personal data;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict or object to processing;
- Data portability; and
- Withdraw consent at any time, without affecting prior lawful processing.
To exercise these rights, contact us at artroflop@gmail.com. You may also lodge a complaint with the Spanish Data Protection Authority (AEPD) if you consider your rights have been affected.
8. Security
We apply appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. These include access controls, encryption in transit and limited need-to-know access.
No system is fully secure. In the event of a personal data breach, we will notify the competent authority and affected individuals as required by Articles 33 and 34 of the GDPR.
9. Contact
For any question regarding this Privacy Policy or the handling of your personal data, you can reach us at:
- artroflop@gmail.com
- Phone
- +34 602 99 22 22
- 34602992222
Last updated: October 2026 · Traumatology Team by Artroflow.