Privacy policy

Controller and contact

Dra. Ana Karen Sandoval Talamantes · ICOMEM n.º 282894727 · NIF/NIE 60500660B.

Calle de Ayala 93, Bajo A, 28006 Madrid, España. For privacy requests: dra.ana.talamantes@hotmail.com.

Data and purposes

The online booking form requests first and last name, email, optional phone number, appointment time, location and consultation format. Do not enter symptoms, reports or genetic results there. The practice uses these details to check availability, record the appointment and manage necessary communications and changes.

If you later provide clinical information through a channel indicated by the practice, it is handled separately for care. AnaOS also displays calendar event times and titles from the Google calendars selected by the practice; a title from Doctoralia may contain a name or phone number. Those events are used to identify availability and possible scheduling conflicts.

Optional patient reviews

After an appointment is marked as attended, the practice may send a private, single-use review invitation to the contact email on record. If you decide to submit a review, AnaOS stores your chosen public name, rating, comment, country of the appointment and publication authorisation, linked privately to that appointment to verify attendance. Only your chosen public name, rating, comment, country and review date appear on the website after a privacy check. Do not include diagnoses, test results or other people’s details. You may request removal through the privacy contact above.

Legal bases

Booking and responding to a patient's request rely on pre-contractual steps or performance of the care agreement (GDPR Art. 6(1)(b)). Legal record-keeping duties may rely on Art. 6(1)(c). Where health data are processed for diagnosis or care under professional secrecy, Art. 9(2)(h) may apply together with the relevant Art. 6 basis. This is not a blanket request for GDPR consent to medical care. Separate optional uses, such as publicity or teaching with clinical photographs, require their own assessment and specific authorisation.

Recipients and international access

Technical providers may process data on the practice's instructions: hosting, email and Google Workspace Calendar. AnaOS publishes its own appointments to Google with a reference and time, without patient name, phone number or clinical details. Incoming external calendar titles may nonetheless contain identifying details. Doctoralia remains an external service with its own privacy notice.

Independent technical support may access AnaOS remotely from Mexico. That access, and any transfers by cloud providers, require documented safeguards and contracts before live use. The exact providers, locations and transfer mechanisms are still being validated.

Retention

Booking, clinical, audit and backup records require separate retention and deletion schedules, taking account of applicable Spanish and, where relevant, Mexican duties. AnaOS does not yet have a verified operational retention matrix, so a specific deletion date cannot be stated. That matrix still needs to be defined and implemented before live patient use.

Your rights

You can request access, rectification, erasure, restriction, objection and portability where applicable, and ask about decisions based solely on automated processing. Write to dra.ana.talamantes@hotmail.com. We may need to verify your identity. You may complain to the Spanish Data Protection Agency (AEPD). Clinical records may be subject to legal retention duties.

Other channels

If you choose to open WhatsApp, Doctoralia or another external site, the destination processes data under its own terms. Do not send reports, clinical photos or genetic results in an initial WhatsApp message or this booking form; ask the practice for its appropriate channel.