Dental Glow Marbella
Dental Glow MARBELLA
DATA PROTECTION

Privacy Policy

Information regarding the processing of your personal data in accordance with the GDPR and Spanish LOPDGDD.

1. USER INFORMATION

Clínicas NBC, S.L., hereinafter the CONTROLLER, is the Data Controller of the User's personal data and informs you that these data will be processed in accordance with the provisions of Regulation (EU) 2016/679 of 27 April (GDPR) and Spanish Organic Law 3/2018 of 5 December (LOPDGDD).

2. IDENTITY OF THE DATA CONTROLLER

  • Controller: CLINICAS NBC S.L.
  • Tax ID (CIF): B93410330
  • Registered Address: Calle Sevilla n7 local c1, 29400, Ronda - Málaga, Spain
  • Email: info@dentalglow.es

3. PRINCIPLES APPLICABLE TO PERSONAL DATA PROCESSING

The processing of the User's personal data shall be governed by the principles set forth in Article 5 of the GDPR and Article 4 of the LOPDGDD:

  • Principle of lawfulness, fairness, and transparency: the User's consent or applicable legal basis shall be required at all times following completely transparent information regarding the purposes for which personal data are collected.
  • Principle of data minimisation: only data strictly necessary in relation to the purposes for which they are required shall be requested.
  • Principle of storage limitation: data shall be kept for no longer than necessary for the purposes of processing, depending on the specific purpose.
  • Principle of integrity and confidentiality: data shall be processed in a manner that guarantees their security and confidentiality.
  • Principle of accuracy: data provided shall be accurate and kept up to date.

4. PURPOSE OF PERSONAL DATA PROCESSING

Personal data provided by the User through the website or in person at the clinic will be used for the following purposes:

4.1. Healthcare and clinical management

  • Provision of dental and healthcare services requested by the patient.
  • Preparation and maintenance of the patient's clinical record.
  • Appointment scheduling and clinical treatment follow-up.
  • Diagnosis, prevention, and treatment of oral and dental conditions.

Legal basis: Vital interest of the data subject and compliance with legal healthcare obligations (Art. 9.2.c and 9.2.h GDPR).

4.2. Administrative and commercial management

  • Management of treatment estimates, invoices, and payments.
  • Handling of enquiries and requests for information.
  • Sending communications regarding clinic services (with prior express consent).
  • Management of patient feedback and reviews.

Legal basis: Performance of a contract, legitimate interest, and consent of the data subject.

4.3. Compliance with legal obligations

  • Compliance with tax and accounting obligations.
  • Responding to requirements from health and judicial authorities.

Legal basis: Compliance with legal obligations (Art. 6.1.c GDPR).

5. CATEGORIES OF PERSONAL DATA

The CONTROLLER may process the following categories of personal data:

  • Identification data: first name, surname, ID/NIE/Passport number, postal address, telephone number, email address, date of birth.
  • Health data: medical and dental history, diagnoses, treatments, X-rays, clinical photographs, allergies, medical background.
  • Financial data: bank details for direct debits and billing data.
  • Personal characteristics data: emergency contact details, legal guardian details (in the case of minors).

Important: Health-related data are considered special categories of personal data under Article 9 of the GDPR and receive enhanced protection.

6. DATA RETENTION PERIOD

Personal data shall be retained for the following periods:

  • Clinical records: a minimum of 15 years from the date of discharge of each care process, as established by Spanish Law 41/2002 regulating patient autonomy.
  • Billing data: 6 years from the issuance of the invoice (tax and commercial obligations).
  • Informed consents: throughout the entire retention period of the clinical record.
  • Marketing data: until the data subject withdraws consent or requests erasure.

Once the statutory retention periods have elapsed, the data will be blocked and subsequently securely deleted.

7. LAWFUL BASIS FOR PROCESSING

The legal basis for processing your data is:

  • Consent of the data subject: for sending commercial communications and using data for purposes other than healthcare delivery.
  • Performance of a contract: for the provision of requested dental services.
  • Vital interest of the data subject: for protecting vital interests in medical emergency situations.
  • Compliance with legal obligations: retention of medical records, tax, and accounting obligations.
  • Legitimate interest: for service quality improvement and administrative management.

The processing of health data for purposes of preventive medicine, medical diagnosis, provision of healthcare, or management of healthcare systems does not require explicit consent under Art. 9.2.h of the GDPR.

8. DATA RECIPIENTS

Personal data may be disclosed to:

  • Healthcare professionals: collaborating specialists, dental prosthetics laboratories, radiologists, and other professionals necessary for service delivery.
  • Tax and legal advisors: for compliance with tax and labour obligations.
  • Financial institutions: for payment and billing management.
  • Insurance companies: when the patient holds a dental insurance policy used at the clinic.
  • Health and judicial authorities: where a legal obligation exists.
  • Technology service providers: hosting and clinic management software providers (acting as data processors under GDPR-compliant agreements).

Under no circumstances will personal data be transferred to third parties for commercial purposes without the express consent of the data subject.

9. USER RIGHTS

Any data subject has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Data subjects have the right to:

  • Right of access: to know which personal data we are processing.
  • Right to rectification: to request the correction of inaccurate or incomplete data.
  • Right to erasure: to request the deletion of their data when they are no longer necessary or when processing is unlawful.
  • Right to object: to object to the processing of their data under certain circumstances.
  • Right to restriction of processing: to request the suspension of data processing in specific cases.
  • Right to data portability: to receive their data in a structured, commonly used format.
  • Right not to be subject to automated decision-making: including profiling.
  • Right to withdraw consent: at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

How to exercise these rights

You may exercise your rights by contacting the CONTROLLER via:

  • Email: info@dentalglow.es
  • Postal mail: Calle Sevilla n7 local c1, 29400, Ronda - Málaga, Spain

Please attach a copy of your ID card, passport, or equivalent identification document.

Right to lodge a complaint with the supervisory authority

If you consider that the processing of your data does not comply with current regulations, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD):

  • Website: www.aepd.es
  • Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
  • Telephone: +34 901 100 099 / +34 91 266 35 17

10. SECURITY OF PERSONAL DATA

The CONTROLLER has adopted appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, including:

  • Encryption of sensitive data.
  • Access control via individual user credentials and passwords.
  • Regular encrypted backups.
  • Staff training in data protection and medical confidentiality.
  • Security breach response protocols.
  • Confidentiality agreements signed by all clinic staff.

11. MINORS' DATA

Processing the personal data of children under 14 years of age requires the consent of their parents or legal guardians. In the provision of healthcare services, Spanish Law 41/2002 specifically regulates informed consent for minors.

12. CHANGES TO THIS PRIVACY POLICY

The CONTROLLER reserves the right to modify this Privacy Policy to adapt it to legislative or jurisprudential developments, as well as industry standards.

When significant changes occur to this Privacy Policy, users will be informed via the website or by email where applicable.

13. LINKS TO THIRD-PARTY WEBSITES

This Privacy Policy applies solely to our website. If you access other websites through links provided on this site, please consult the respective privacy policies of those websites, as we have no control over them.

14. CONTACT DETAILS

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us at:

  • CLINICAS NBC S.L.
  • Calle Sevilla n7 local c1, 29400, Ronda - Málaga, Spain
  • Email: info@dentalglow.es