1. Data Controller

• Identify: Dr. Rafael González de Gor Santos (Medical Centre)
• Tax ID (NIF/CIF): [25050527P]
• Postal address: Plaza Ginebra, 11, 29692, San Luis de Sabinillas (Málaga)
• Telephone: 952 89 35 35
• Contact email: [info@rgdg.es]

2. What categories of personal data may be processed?

Surname and first name, National ID number, gender, date of birth, postal address, email address, telephone number, and health information contained in the reports that make up your medical history.

3. For what purposes and on what legal basis do we process your data?

Through this website, we process the information you provide for the following healthcare-related purposes, based on Art. 6.1.a (consent) and Art. 9.2.h of the GDPR (management of health services):

• Appointment management: Processing and confirming appointment requests for medical consultations.
• Patient care: Responding to messages, inquiries, and requests for information sent via contact forms.
• Medical record management: Health data provided for the provision of medical care will be incorporated into your medical record for exclusively healthcare-related purposes.

4. How long will we keep your data?

• Data received via web forms solely for inquiries will be retained for the time strictly necessary to resolve your request.
• In the event that you receive medical care, the corresponding documentation and medical history will be incorporated into your medical record and retained —in compliance with Act 51/2019 of the Regional Government of Andalusia and national Law 41/2002— for a minimum period of 5 years, calculated from the date of discharge for each episode of care or from the patient's death.

5. To whom will your data be disclosed?

Your medical data is treated with absolute confidentiality. It will only be disclosed to third parties in circumstances strictly authorized by law:

• Insurance companies or health mutuals with which you hold medical coverage, provided you request that billing be directed to them.
• Public health authorities or bodies in cases where there is a legal obligation to report (such as notifiable diseases).
• Data Processors: Technology providers essential for the clinic's operation (web hosting, certified medical management software), who operate under a strict confidentiality agreement prohibiting the use of your data for their own purposes.

6. What are your rights when you provide us with your data?

You retain control over your personal data. You may exercise the following constitutional rights with the Data Controller:

• Access: To know if we are processing your data and to obtain a copy of your medical record.
• Erasure: To modify any inaccurate or incomplete data.
• Supresión ("Right to be Forgotten"): To request the deletion of your personal data, bearing in mind that this right is subject to the center's legal obligation to retain your medical record for the minimum periods required by health regulations.
• Restriction and Objection: To request the suspension of processing or to object to the use of data for non-medical purposes (such as internal communications).
• Portability: To request the transfer of your data to another professional or medical center in a structured electronic format.

To exercise these rights, you may send a written request to our postal address in San Luis de Sabinillas or to the email address [info@rgdg.es], providing a photocopy of your national ID card or passport to verify your identity.

Additionally, please be informed that you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) via its official electronic office if you believe your rights have been violated.