This notice describes how SARA ALCALA processes and protects your personal health data, and what your rights are under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Your rights
When it comes to your personal health data, European and Spanish regulations recognize the following rights:

• Access: You can request access to your personal data and obtain a copy (electronic or paper) of the information we process about you.

• Rectification: You can ask us to correct any data you consider inaccurate or incomplete. If we cannot fulfill your request, we will inform you in writing with the reasons.

• Limitation: You can request that we restrict the use of your data in certain cases (for example, while we verify its accuracy).

• Opposition: You may object to the processing of your data when it is based on legitimate interest, unless there are compelling legitimate grounds or it is necessary for the formulation, exercise or defense of claims.

• Portability: You can request that we deliver your data in a structured, commonly used and machine-readable format, or that we transmit it to another controller.

• Suppression (Right to be forgotten): You can ask us to delete your personal data when it is no longer necessary for the purpose for which it was collected or in other cases provided for in the regulations.

• Claim: You can file a claim with the Spanish Data Protection Agency (AEPD) if you believe your rights have been violated: www.aepd.es.

Purposes of processing
Your personal health data may be processed for:

• Provision of health services and specialized nutrition.

• Administrative management and billing of services.

• Compliance with legal and regulatory obligations in the area of health, social security or taxation.

• Communication with you in relation to the care provided.

• Improvement of the quality of the service through internal analysis (always with duly protected data).

Data transfers and communications
Your data may be communicated to:

• Health professionals involved in your diagnosis or treatment.

• Health insurance entities, when applicable.

• Public administrations and health authorities, when required by regulations.

• Courts and tribunals, when legally required.

No international data transfers will be carried out unless there is a legal obligation or express consent with adequate guarantees in accordance with the GDPR.

Data security
We are legally obligated to protect the confidentiality, integrity, and availability of your data. We implement appropriate technical and organizational measures to ensure your security. In the event of a security breach that affects your rights, we will notify you immediately.

Legal basis of the processing
The processing of your personal health data is carried out in accordance with the following legal bases of the GDPR:

• Article 6.1.b): execution of a service provision contract.

• Article 6.1.c): compliance with applicable legal obligations.

• Article 9.2.h): processing necessary for the purposes of preventive medicine, medical diagnosis, assistance or health treatment.

Data retention
Your data will be kept for the time necessary for the provision of the service and, subsequently, for the legal periods required by health, tax and accounting regulations.

Contact
For inquiries or to exercise your rights:
SARA ALCALA
Email: sara@healthybitesfertility.com