PRIVACY POLICY
Last updated: September 29, 2026
1. DATA CONTROLLER
MALLORCA MEDICAL GROUP, S.L.
Tax ID Number: B57544611
Registered office: Calle Murcia, 40, 07013 Palma de Mallorca, Balearic Islands, Spain.
Customer Service Center and Customer Service Department: Camí de la Vileta, 46 C, 07011 Palma de Mallorca, Balearic Islands, Spain.
Email: info@mallorcamedicalgroup.com
Phone: 971 254 686
Website: www.mallorcamedicalgroup.com
Hereinafter, “MALLORCA MEDICAL GROUP SL ” or “THE OWNER.”
The purpose of this Privacy Policy is to provide information on how MALLORCA MEDICAL GROUP SL processes the personal data of users, patients, and other individuals who interact with the company through the Website, forms, email, telephone, booking systems, payment services, or other available channels.
The processing will be carried out in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights, applicable health regulations, and any other applicable provisions.
2. PERSONAL INFORMATION WE MAY PROCESS
Depending on the relationship with the User or patient, MALLORCA MEDICAL GROUP SL may process, among other things, the following data:
- first and last name;
- email;
- phone;
- identifying information;
- information needed to manage appointments and reservations;
- administrative and billing information;
- data related to payments and transactions;
- communications with the clinic;
- technical data derived from the use of the Website;
- and, when necessary for the requested care, health-related information.
The information marked as required on each form will be identified as such.
Failure to provide the information necessary to process an application or provide a service may prevent it from being processed properly.
3. HEALTH-RELATED DATA
Certain forms, communications, and appointment scheduling processes may allow the User to provide information regarding their health status, medical history, symptoms, reason for the visit, previous treatments, or other information necessary to properly manage or prepare for the requested health care.
Health-related data constitute a special category of personal data under Article 9 of the GDPR.
When processing is necessary for the purposes of preventive medicine, medical evaluation, diagnosis, the provision of medical care or treatment, or the management of health care services, such processing shall be carried out in accordance with Article 9(2)(h) of the GDPR, under the responsibility of professionals subject to the duty of professional confidentiality and in accordance with applicable health care legislation.
Consequently, the processing of health data necessary to provide the requested health care is generally not based on the patient’s consent, but rather on the specific legal basis established for health care.
MALLORCA MEDICAL GROUP SL will apply the principle of data minimization and will endeavor to collect only the data that is adequate, relevant, and necessary for each purpose.
4. PURPOSES OF THE PROCESSING
Personal data may be processed for the following purposes:
Handling Inquiries and Requests for Information
Respond to questions, requests, inquiries, comments, or complaints received via forms, email, phone, or other available channels.
Appointment and Reservation Management
Manage appointment requests, reservations, changes, cancellations, reminders, and communications related to the requested service.
Provision of Health Care
Manage the medical evaluation, diagnosis, treatment, follow-up, procedure, or any other healthcare activity requested by the patient.
Medical Record Management
Record and retain the information that must be included in the clinical documentation in accordance with applicable health regulations.
The primary purpose of the medical record is to facilitate health care, and it must include the information necessary to provide an accurate and up-to-date picture of the patient’s health status, in accordance with current health care regulations.
Administrative and Financial Management
Manage budgets, payments, billing, accounting, collections, and other administrative obligations arising from the relationship with the patient or user.
Online Payment Processing
Manage payments made through authorized payment platforms and service providers.
Business Communications
To send, when there is an appropriate legal basis, information regarding services, news, activities, or content from MALLORCA MEDICAL GROUP SL.
When such communications require consent, consent will be specifically requested and may be withdrawn at any time.
Website Security and Operation
To maintain the security, operation, and availability of the Website; to prevent fraudulent or unlawful use; and to manage technical issues.
5. LEGAL BASIS FOR DATA PROCESSING
The legal bases will depend on the specific purpose.
Request Management, Reservations, and Contracting
The processing of identifying, contact, administrative, and financial data necessary to manage a request, a reservation, or a contract will be based, as applicable, on Article 6.1.b) of the GDPR, as it is necessary for the implementation of precontractual measures requested by the data subject or for the performance of a contractual relationship.
Health and Healthcare Data
The processing of health-related data necessary to provide health care will be carried out in accordance with Article 9(2)(h) of the GDPR, together with the applicable legal bases under Article 6 and applicable health care legislation.
Legal Obligations
When processing is necessary to comply with legal obligations, the legal basis will be Article 6.1.c) of the GDPR.
Business Communications
When consent is required, the processing will be based on Article 6.1.a) of the GDPR.
Consent may be withdrawn at any time without affecting the lawfulness of the processing carried out prior to the withdrawal.
Legitimate Interests
Certain processing activities related to security, fraud prevention, legal defense, or internal management may be based, where appropriate and after a balancing test, on the legitimate interest provided for in Article 6(1)(f) of the GDPR.
6. ONLINE APPOINTMENT BOOKING
To process an online reservation, the following information, among others, may be requested:
- name;
- last names;
- email;
- phone;
- information needed to identify the reservation;
- and, if the User chooses to provide it, the reason for the inquiry.
When the reason for the inquiry reveals information regarding a person’s health status, such information will be considered health data and will be processed in accordance with the safeguards set forth in this Policy.
An identity document may be requested when necessary to correctly identify the patient or to link the request to an existing record; however, a complete copy of the document will not be requested unless it is necessary for a legitimate and proportionate purpose.
Appointments may be recorded in the management systems used by MALLORCA MEDICAL GROUP SL, including the clinical and administrative management software contracted by the entity, such as Ofimedic, to the extent necessary to manage the patient care relationship.
7. ONLINE PAYMENTS
MALLORCA MEDICAL GROUP SL uses different payment service providers depending on the service contracted.
In certain areas or for certain services, you can use the virtual POS terminal provided by Banco Bilbao Vizcaya Argentaria, S.A. (BBVA).
Appointments booked online can be processed through Stripe.
When the User makes a payment through Stripe, the full credit card information is entered directly into the provider’s payment environment. MALLORCA MEDICAL GROUP SL does not directly receive or store the full credit card information.
Stripe may receive and process certain data related to the transaction, such as:
- identification and contact information;
- transaction amount;
- technical specifications;
- information related to the transaction;
- IP address and device information, when applicable;
- and other information necessary to ensure security, manage the operation, and prevent fraud.
Stripe may act as a data processor when processing payments on behalf of MALLORCA MEDICAL GROUP SL and, with respect to certain operations, as a data controller, particularly for fraud prevention, regulatory compliance, risk management, and security.
MALLORCA MEDICAL GROUP SL will limit the information provided to payment service providers to what is necessary to process the relevant transaction.
The reason for the visit, medical history, diagnoses, clinical photographs, and other health information will not be disclosed to the payment service provider for the sole purpose of processing the transaction.
8. RECIPIENTS AND SERVICE PROVIDERS
Personal data will be processed by authorized personnel of MALLORCA MEDICAL GROUP SL and by the professionals who are required to participate in the provision of the relevant services.
MALLORCA MEDICAL GROUP SL may use external service providers necessary for the operation of its business, including, but not limited to:
- management software providers;
- clinical management platforms;
- web hosting and maintenance;
- IT services;
- communications providers;
- email services;
- appointment management systems;
- payment service providers;
- administrative, accounting, or legal services;
- and other vendors necessary to provide the contracted services.
When such providers process data on behalf of MALLORCA MEDICAL GROUP SL, they will act as data processors in accordance with Article 28 of the GDPR.
Certain providers may act as independent data controllers when they determine their own purposes and means of processing, particularly when they are required to comply with legal, regulatory, fraud prevention, or security obligations.
The data may also be disclosed to:
- Government Agencies;
- health authorities;
- judicial bodies;
- Law Enforcement and Security Forces;
- insurance companies, where appropriate and when there is a legal basis;
- hospitals, laboratories, or other healthcare professionals when necessary to provide the requested care;
- and other recipients when there is a legal obligation or a valid legal basis.
9. INTERNATIONAL DATA TRANSFERS
Some technology providers may process information from countries outside the European Economic Area.
When an international data transfer occurs, MALLORCA MEDICAL GROUP SL will adopt or require the safeguards set forth in Articles 44 and following of the GDPR, such as adequacy decisions, standard contractual clauses approved by the European Commission, or other legally recognized mechanisms.
In the case of Stripe, international transfers will be carried out in accordance with the mechanisms and safeguards established by applicable regulations and by the provider itself.
10. DATA RETENTION
Personal data will be retained for as long as necessary to fulfill the purposes for which it was collected and, thereafter, for the periods required to comply with legal obligations or address potential liabilities.
Data related to requests for information will be retained for as long as necessary to process and close the corresponding request and for the duration of any applicable legal retention periods.
Contractual, financial, and billing data will be retained for the periods established by tax, commercial, and other applicable laws.
Data used for commercial communications will be processed until the data subject withdraws consent or objects to the processing, as applicable.
Clinical Documentation
The documents that make up the medical record will be retained for the periods required by applicable health care laws.
As a minimum, and without prejudice to other periods that may be legally required, clinical records shall be retained for the period established by current health regulations, beginning on the date of discharge for each course of care.
11. MINORS
The online booking services offered directly through this Website are generally intended for adults.
When it is necessary to process the personal data of minors in the context of health care, such processing will be carried out in accordance with the health care, data protection, and legal representation regulations applicable in each case.
12. THIRD-PARTY DATA
When a User provides another person’s personal data, the User must have sufficient legal authority to do so and must limit the data provided to only what is necessary for the relevant purpose.
When appropriate, you must inform the data subject in advance that their data will be disclosed.
Health information regarding third parties shall not be disclosed unless there is an appropriate legal basis and such information is necessary for the relevant care or purpose.
13. RIGHTS OF DATA SUBJECTS
Data subjects may exercise the rights granted under data protection regulations, including:
- right of access;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to object;
- the right to data portability, where applicable;
- the right to withdraw consent when the processing is based on consent;
- and the right not to be subject to certain decisions based solely on automated processing, where applicable.
Applications may be sent to:
MALLORCA MEDICAL GROUP SL
Calle Murcia, 40
07013 Palma de Mallorca
Balearic Islands, Spain
or by email to:
The applicant must provide sufficient information to allow for the proper identification and processing of the request.
It will not be necessary to systematically provide a copy of your ID. If there are reasonable doubts regarding the applicant’s identity, MALLORCA MEDICAL GROUP SL may request additional information strictly necessary to verify it.
14. COMPLAINTS TO THE SUPERVISORY AUTHORITY
If the data subject believes that the processing of their personal data violates applicable regulations, they may file a complaint with:
Spanish Data Protection Agency (AEPD)
www.aepd.es
You may also contact MALLORCA MEDICAL GROUP SL in advance to try to resolve any issues related to the processing of your data.
15. SOCIAL MEDIA
MALLORCA MEDICAL GROUP SL may maintain corporate profiles on various social media platforms.
The User’s interaction with these profiles will be subject both to this Policy, insofar as it pertains to MALLORCA MEDICAL GROUP SL, and to the terms and privacy policies of each platform.
Data accessible through social media will be used to manage the company’s online presence, respond to communications, disseminate information related to the activities of MALLORCA MEDICAL GROUP SL, and maintain relationships with users of those platforms, within the limits permitted by applicable regulations.
Users should review the privacy policies of the relevant social media platforms to learn how those platforms handle their data.
16. COMMERCIAL COMMUNICATIONS
MALLORCA MEDICAL GROUP SL may send commercial communications by electronic means when there is a legal basis that permits it.
When consent is required, it will be requested through an explicit and separate action.
The User may withdraw such consent or request that marketing communications be discontinued at any time by using the methods indicated in each communication or by contacting:
The withdrawal of consent will not affect any processing that was lawfully carried out prior to that time.
17. SECURITY AND CONFIDENTIALITY
MALLORCA MEDICAL GROUP SL will implement appropriate technical and organizational measures to protect personal data against loss, alteration, unauthorized access, disclosure, or processing, taking into account the state of the art, the costs of implementation, the nature of the data, and the existing risks.
Employees who have access to clinical information or personal data will be subject to the corresponding confidentiality obligations.
Healthcare professionals will also be subject to the duty of professional confidentiality established by health and professional laws.
Although measures are in place to reduce risks, no system connected to the Internet can guarantee absolute security.
18. EMAIL AND CONFIDENTIALITY
Communications sent by MALLORCA MEDICAL GROUP SL may contain confidential information or information intended exclusively for the recipient.
If a person mistakenly receives a communication that was not intended for them, they must notify the sender and refrain from using, distributing, or disclosing its contents.
When it is necessary to transmit particularly sensitive information, MALLORCA MEDICAL GROUP SL may use additional protective measures or specific channels designed to ensure an adequate level of security.
19. COOKIES AND SIMILAR TECHNOLOGIES
The Website may use cookies and other technologies necessary for its operation, security, analytics, or other purposes.
When legally required, the User’s consent will be sought before installing non-essential technologies.
Detailed information is available in the Cookie Policy.
Certain payment service providers may use technologies necessary for authentication, transaction security, and fraud prevention.
20. CHANGES TO THE PRIVACY POLICY
MALLORCA MEDICAL GROUP SL may modify this Privacy Policy when necessary to adapt it to regulatory, technical, or organizational changes, or changes related to the services used.
The current version will be the one published on the Website and will include the date of its last update.