Privacy Policy
Last updated: October 2026
At Neurospine International we treat your personal data — and in particular your health data — with the same care we apply to clinical practice. This policy explains what data we collect, why, how long we keep it and what rights you have, in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).
1. Data controller
- Controller: [Neurospine International Healthcare S.L.], trading as Neurospine International
- Tax ID (NIF/CIF): [B88760848]
- Registered address: [Urb. Huerta Alta Finca Don Pedro n5, Mijas, Málaga, 29650]
- Email: info@neurospineinternational.es
- Phone: +34 600 778 831
2. What data we collect
- Contact and appointment requests: name, email address, phone number and the content of your message, submitted through our website forms, by email, by phone or via WhatsApp.
- Health information: any clinical details, reports or imaging you choose to share with us, and the information generated during your medical care.
- Billing data: name, tax ID and payment details needed to invoice our services.
- Browsing data: technical data such as IP address, device and browser type, collected through cookies and similar technologies. See our Cookie Policy.
Please do not send detailed clinical information through the website forms unless we ask you to. We will indicate a secure way to share reports and imaging when needed.
3. Why we use your data and legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiries and managing appointments | Your consent (Art. 6.1.a GDPR) and steps taken at your request before providing care (Art. 6.1.b GDPR) |
| Providing medical assessment, diagnosis and treatment | Provision of healthcare (Art. 9.2.h GDPR) and, where applicable, your explicit consent (Art. 9.2.a GDPR) |
| Keeping your clinical record | Legal obligation under Spanish Law 41/2002 on patient autonomy (Art. 6.1.c GDPR) |
| Invoicing and accounting | Legal obligation under tax and commercial law (Art. 6.1.c GDPR) |
| Keeping our website secure and working properly | Our legitimate interest (Art. 6.1.f GDPR) |
We do not use your data for automated decision-making or profiling, and we never sell it.
4. How long we keep your data
- Enquiries that do not lead to medical care: for the time needed to handle your request, and no longer than 12 months.
- Clinical records: for at least five years from each episode of care, or longer where required by applicable law.
- Billing records: for the periods required by tax and commercial legislation (generally six years).
When these periods end, data is securely deleted or anonymised.
5. Who we share it with
We only share your data when necessary and with appropriate safeguards:
- Healthcare centres where your consultation, tests or surgery take place, and other healthcare professionals involved in your care.
- Your insurer or mutual, only if you ask us to bill them.
- Service providers that process data on our behalf under a data processing agreement: web hosting (Spain), professional email (Google Workspace) and messaging (WhatsApp, Meta) if you choose to contact us that way.
- Public authorities and courts, when required by law.
Some of these providers (Google, Meta) may process data outside the European Economic Area. In those cases, transfers are covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
6. Your rights
You can at any time:
- access your personal data;
- ask us to correct or delete it;
- object to or restrict its processing;
- request a copy in a portable format;
- withdraw your consent, without affecting processing carried out before.
To exercise any of these rights, email info@neurospineinternational.es stating which right you wish to exercise. We may ask you to verify your identity. We will reply within one month.
Some rights are limited by law for clinical records — for example, we cannot delete a clinical history before the legal retention period ends.
If you believe your data has not been handled correctly, you can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. Security
We apply technical and organisational measures appropriate to the sensitivity of health data, including encrypted connections (HTTPS), restricted access and confidentiality obligations for everyone involved in your care.
8. Minors
Enquiries or appointments for patients under 18 must be made by a parent or legal guardian.
9. Third-party links and translation
Our website links to our social media profiles (Instagram, Facebook). Those platforms have their own privacy policies. The website language selector uses an automatic translation service. It translates page content and does not require you to provide personal data.
10. Changes to this policy
We may update this policy to reflect legal or operational changes. The date at the top shows the latest version.