Clínica Pierde Peso
Back to home

Legal

Privacy Policy

Last updated: October 7, 2026.

1. Data controller

Excelvion, SLU, with tax ID L-721597Y. Registered in the companies register under number 26506 (book S-510, folios 51-60), reachable through our contact form (hereinafter, "Clínica Pierde Peso", the "Controller").

2. What data we process

  • Identification and contact data: name, surname, email, phone number, ID document.
  • Health data (special category of data, GDPR art. 9): answers to the medical questionnaire, relevant clinical history, messages with the medical team and, where applicable, the prescription or guidance issued.
  • Payment data: handled directly by our payment provider (Stripe); we do not store your full card details on our servers.
  • Technical data: IP address, browser language and site usage data necessary for it to work.

3. Purpose and legal basis

  • Providing the medical service (assessment, prescription, follow-up): legal basis is the patient's explicit consent to the processing of health data (GDPR art. 9.2.a) and the necessity of processing for the purposes of preventive or occupational medicine, medical diagnosis, or the provision of health care (GDPR art. 9.2.h).
  • Managing the contractual relationship and billing: performance of the contract (GDPR art. 6.1.b) and compliance with legal obligations (GDPR art. 6.1.c).
  • Handling enquiries through the contact form: consent of the data subject when submitting the form (GDPR art. 6.1.a).
  • Improving and securing the website: legitimate interest (GDPR art. 6.1.f).

4. Data retention

Health and clinical history data are kept for the periods required by applicable healthcare regulations (generally, a minimum of 5 years from the last visit, unless a longer period is required by law). Billing data is kept for the periods required by tax regulations. Contact form data is kept for as long as necessary to handle the enquiry, and for a maximum of 12 months.

5. Recipients and data processors

We do not share your data with third parties except where legally required. To provide the Service, we work with providers who act as data processors under contract in accordance with GDPR art. 28, including:

  • Supabase (database and authentication).
  • Stripe (payment processing).
  • Resend (sending email communications).
  • Vercel (web application hosting).

Some of these providers may process data outside the European Economic Area. In such cases, we ensure an adequate safeguard is in place (such as the European Commission's Standard Contractual Clauses) that offers a level of protection equivalent to the GDPR.

6. Your rights

You can exercise the following rights at any time, free of charge:

  • Access: find out what data of yours we process.
  • Rectification: correct inaccurate data.
  • Erasure: request deletion of your data, where applicable.
  • Portability: receive your data in a structured format.
  • Objection and restriction: object to a specific processing activity or restrict its scope.
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You can exercise these rights by writing to us through our contact form. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you consider that the processing of your data does not comply with the regulations.

7. Security

We apply appropriate technical and organisational measures to protect your data, especially health data, against unauthorised access, loss or alteration: encryption in transit, role-based access control, and separation between the medical panel and the rest of the application.

8. Minors

The Service is aimed exclusively at people aged 18 or over. We do not knowingly collect data from minors.

9. Cookies

We only use the technical cookies necessary for the site to work (for example, to remember your chosen language). We do not use advertising or third-party tracking cookies.

10. Changes to this policy

We may update this Privacy Policy to reflect legal or Service changes. We will publish the current version on this same page with the date of the last update.