Data controller
- Controller: Mesomedic Estetica SL, Tax ID (CIF) B16600272
- Address: C/ Bisbe Teodor Úbeda, 2, 07014 Palma (Balearic Islands)
- Telephone: 971 905 777
- Email: info@mesomedic.es
- Data protection officer: you can contact them at info@mesomedic.es
This policy applies to the data we collect through www.mesomedic.es. Data in your medical records is processed separately, and we give you the relevant information during your consultation.
What data we process and why
- Contact form: your name, telephone number, email, chosen clinic and message, to reply to your enquiry and, if you ask, to book you an appointment.
- Telephone, email and WhatsApp: the data you give us, to assist you and manage your appointments.
- Online booking: bookings are made on the Clínica en la Nube platform, which processes the data on behalf of Mesomedic to manage the appointment diary.
- Web analytics: only if you accept it in the cookie notice, Google Analytics 4 collects aggregated browsing data so we can see how the website is used. We explain this in the cookie policy.
- Advertising: only if you accept it in the cookie notice, Google Ads records whether a visit comes from one of our ads and ends in a call, WhatsApp message or form, and lets us show ads to people who have visited the website. We do not send the content of the form to Google.
Please do not include detailed health information in the form. If you do, we will process it only to deal with your enquiry, with your explicit consent.
Legal basis
- Consent (art. 6.1.a GDPR): when you submit the form or accept analytics or advertising cookies. You can withdraw it at any time, without affecting processing carried out beforehand.
- Pre-contractual measures (art. 6.1.b GDPR): to manage the appointment you request.
- Explicit consent (art. 9.2.a GDPR): for any health data you choose to share with us.
How long we keep it
Contact data is kept for as long as needed to deal with your enquiry and, at most, one year from the last contact if you do not become a patient. If you do, the retention periods set by healthcare regulations apply. Analytics data is kept for 14 months.
Recipients
We do not share your data with third parties unless required by law. The following providers work with us to deliver the service. They process data on our behalf under a data processing agreement:
- Vercel Inc. (website hosting and form submission).
- Resend (sending the email with your message to the clinic).
- Clínica en la Nube (appointment diary and online booking).
- Google Ireland Ltd. (Google Analytics 4 and Google Ads, only with your consent).
Vercel, Resend and Google may process data in the United States. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses.
Your rights
You can access, rectify and erase your data, object to its processing, restrict it and request its portability. Write to us at info@mesomedic.es or at our postal address, stating which right you are exercising, with a copy of your identity document if we cannot identify you in another way.
If you feel we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
Security
We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), restricted access to data and providers that offer sufficient guarantees.
Legislation
This policy is based on Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (Ley Orgánica 3/2018, LOPDGDD) and Spanish Law 34/2002 on Information Society Services (Ley 34/2002, LSSI-CE).