Privacy policy

2. What data we process

We only collect what we need for each purpose (the principle of data minimisation). Depending on your relationship with us, we may process:

• Identification and contact details: first name, surname, email address, telephone number, language and country.
• Health data (special category data, Article 9 GDPR): medical history, habits, medication, laboratory results, biomarkers, body measurements, diagnosis, indication and progress of treatment.
• Clinical images: follow-up photographs where the treatment requires them and you have given separate consent.
• Billing and payment data: the details necessary to issue an invoice. Your full card details are processed directly by the payment gateway; Rejuvelook does not store them.
• Data from your conversations with our assistant and with the team (chat, email, messaging).
• Browsing data: IP address, device and behaviour on the website, as set out in the cookie policy.

3. Purposes and legal bases

Each processing activity has a specific legal basis. Where the basis is consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal.

4. Artificial intelligence and automated decisions

We use artificial intelligence systems to guide you, organise the information in your case and prepare the groundwork for the medical team. We want to be explicit about their limits.

We do not adopt automated decisions that produce legal effects concerning you, or that similarly significantly affect you, within the meaning of Article 22 GDPR. No indication, diagnosis, prescription or treatment plan is generated automatically without review and validation by a qualified healthcare professional.

When you interact with our assistant, you are informed that you are speaking with an automated system. At any time you may request human intervention, express your point of view, and contest any decision that affects you.

5. Retention periods

• Clinical records: for a minimum of five years from the date of discharge of each course of care (Article 17(1) Ley 41/2002), and for any longer periods required by applicable regional regulations, or for as long as necessary for your care.
• Invoicing and accounting: for the applicable tax and commercial limitation periods.
• Information requests and leads that do not convert: until you withdraw your consent or, failing that, for a maximum period of [PLAZO] from the last contact.
• Marketing communications: until you unsubscribe.
• Browsing data: as set out in the retention periods in the cookie policy.
• Once these periods have elapsed, the data is blocked and remains available exclusively to judges, courts and competent authorities to address any potential liabilities, after which it is securely deleted.

6. Recipients and data processors

We do not sell your data or share it with third parties for commercial purposes. To provide the service, we work with providers who act as data processors, under a contract signed in accordance with Article 28 GDPR and acting solely on our instructions:

• Hosting and technology infrastructure.
• Payment gateway for collecting payment for services.
• Messaging, email and telephony providers for appointments and communications.
• Laboratories and diagnostic centres, where your plan requires tests.
• Artificial intelligence services that support the assistant, under agreements that prohibit the use of your data to train third-party models.
• Tax, accounting and legal advisers, and insurance companies, where necessary.
• In addition, we may disclose data to competent public authorities where there is a legal obligation to do so.

7. International transfers

We seek to ensure that your data is processed within the European Economic Area. Where any provider involves an international transfer, it is carried out under an adequacy decision of the European Commission or, failing that, under standard contractual clauses with such additional safeguards as are appropriate.

You may request information about the safeguards applied by writing to our contact email address.

8. Your rights

You may exercise the following rights at any time, free of charge, by writing to [email protected] or to our registered address, stating which right you are exercising and providing proof of identity:

• Access: to know what data of yours we process and to obtain a copy.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request that your data be deleted, subject to the limits imposed by the legal obligation to keep your clinical record.
• Restriction of processing: to ask us to suspend its use in certain circumstances.
• Portability: to receive your data in a structured, commonly used format, or to have us transmit it to another controller.
• Objection: to object to processing based on legitimate interest, including profiling for marketing purposes.
• To withdraw consent at any time, with no retroactive effect.
• Not to be subject to decisions based solely on automated processing, and to request human intervention.
• If you believe we have not properly addressed your rights, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), without prejudice to first contacting our Data Protection Officer.

9. Security measures

We apply technical and organisational measures appropriate to the risk involved in processing health data, reviewed periodically: encryption in transit and at rest, role-based access control under the principle of least privilege, isolation of data by patient, audit logging of access and changes, backups, and staff training and a duty of confidentiality that continues even after the relationship ends.

If a security breach occurs that poses a risk to your rights and freedoms, we will notify the supervisory authority within the legally required period and, where the risk is high, we will also notify you (Articles 33 and 34 GDPR).

10. Minors

Our services are not aimed at minors. We do not knowingly collect data from minors without the consent of those holding parental authority or guardianship. If we discover that we have processed a minor's data without the required authorisation, we will delete it.

The provision of care to minors, where applicable, is governed by Ley 41/2002 and requires the involvement of their legal representatives on the terms set out in that law.

11. Changes to this policy

We may update this policy to reflect changes in the law, in technology, or in our services. We will always publish the current version on this page with its date of update and, where a change is substantial and affects you, we will notify you through an appropriate channel.