Submitting medical evidence from Spain: employer privacy checks

If you are in Spain and your employer asks for medical evidence, you can protect your privacy by confirming the purpose, recipient and required document before sending anything. You do not need to begin by sharing your full medical history; an attendance note, formal sick-leave record and occupational assessment serve different purposes. This guide explains how to check the request calmly, choose the appropriate route and keep unnecessary clinical details out of workplace correspondence.

Why this matters

An email asking for medical proof can feel intrusive, especially when you are unwell and working in a second language. You can ask what the employer needs without explaining your diagnosis to everyone involved in the request.

The employer's administrative question and the doctor's clinical assessment are separate matters. Start with the document category. The guide to sick notes and justificantes médicos in Spain explains the documentation topic; this page focuses on checking access and disclosure before submission.

The privacy framework for this guide is the EU General Data Protection Regulation, particularly Articles 5 and 9, and Spain's occupational-health confidentiality rules. These rules do not make every workplace request unlawful. They require a defined purpose, an appropriate legal basis and limits on unnecessary disclosure.

How do I submit medical evidence to an employer privately in Spain?

Use these 5 privacy checks before sending a document. They help you separate what the employer needs to administer your absence from what a clinician needs to assess your health.

1. Confirm the purpose. Ask whether the request concerns appointment attendance, an absence, formal sick leave, an adjustment or occupational fitness. Do not assume that one document covers every purpose.
2. Confirm the document. Ask for the required document type and any applicable submission instructions. Establish whether a private GP document fits the process before arranging an appointment specifically for paperwork.
3. Confirm the recipient. Ask who is authorised to receive the evidence. A manager arranging cover, HR processing an absence and an occupational-health clinician have different roles.
4. Confirm the channel. Use the designated restricted channel. Check the address, attachment and recipient list before submitting anything.
5. Keep the submission record. Retain the document you sent and the acknowledgement. If further information is requested, ask what is missing rather than automatically sending your clinical records.

These checks apply to patients currently in Spain. If your employer is based elsewhere, identify the employment process that applies rather than assuming Spanish documentation will satisfy every overseas requirement.

Which document matches your employer's request?

Medical documents are not interchangeable. The table below compares their purpose and limits; it does not promise that an employer will accept a particular document.

Document or route	Best for	Useful feature	Important limit
Appointment attendance note	Confirming attendance at a consultation	Addresses a narrow administrative question	Does not by itself establish inability to work
Private GP medical report or certificate	A defined request supported by a clinical evaluation	Can address the specific question where appropriate	Issuance and acceptance are not guaranteed; it is not automatically formal sick leave
Formal temporary-incapacity process	Statutory sick-leave administration where applicable	Uses the official process for that purpose	A private attendance note is not a substitute
Occupational-health assessment	Job-specific fitness or workplace restrictions	Connects the assessment to work requirements	A general video GP consultation cannot replace a required occupational examination

Choose the document by its purpose, not by how detailed it looks. A lengthy report can expose more information while still failing to answer the employer's actual question.

Before your submission, ask HR to identify the required route in writing. If the request concerns formal sick leave, confirm the applicable official process rather than relying on a general certificate or an informal email.

Appointment attendance: keep the request narrow

If the employer only needs evidence that you attended an appointment, ask whether attendance confirmation is sufficient. Do not volunteer test results or treatment details to support a question about attendance alone.

The clinician decides what can accurately be documented. An attendance record cannot establish facts outside its scope or certify an unsupported period of incapacity.

Occupational fitness: use the designated clinical route

A request about whether you can safely perform particular duties belongs to the appropriate occupational-health process. Explain the role and the requested assessment before assuming an ordinary GP consultation is suitable.

Spain's Occupational Risk Prevention Act, Article 22, restricts access to personal medical information obtained through workplace health surveillance. Employers receive conclusions relevant to fitness and necessary protective measures, rather than unrestricted access to the underlying clinical findings.

Why employer privacy checks vary

Different requests need different handling. These factors explain why a colleague's submission process is not automatically the right one for you:

• Purpose: confirming an appointment differs from administering formal sick leave or assessing occupational fitness.
• Employment context: an employer abroad can have a different documentation process from a Spanish employer.
• Recipient: HR, a line manager and occupational health do not need identical information.
• Document scope: a focused attendance note contains different information from a clinical report.
• Required assessment: some requests require a designated professional, an official route or an in-person examination.
• Submission method: a restricted HR portal and a shared team inbox expose information to different audiences.

For a current request, use the current instructions supplied by the responsible employer team. Old templates and a colleague's previous experience do not establish what you must submit now.

Can my employer ask for my diagnosis?

A request for proof of absence is not, by itself, a reason to disclose your diagnosis. Under GDPR Article 5, personal data must be adequate, relevant and limited to what is necessary for the stated purpose. Article 9 gives health information additional protection and requires an applicable condition for processing it.

Ask the employer to explain why diagnostic detail is needed, who would receive it and what legal basis supports the request. Do not treat a blanket request for complete records as the default response to an absence query.

There are lawful employment and occupational-health uses of health information. The practical distinction is between a justified, defined request and unnecessary circulation of clinical details. If the explanation remains unclear, ask the employer's data-protection contact, your representative or an independent employment adviser before expanding the disclosure.

Can I remove information from a medical certificate before sending it?

Do not alter a signed medical certificate yourself. Removing wording can change its meaning, obscure its scope or create questions about authenticity.

Instead, tell the issuing clinician what the employer has requested and ask whether a separate, appropriately limited document is possible. Where clinically appropriate, following a genuine evaluation. The clinician must decide what can be stated truthfully; a request for less disclosure does not justify inaccurate wording.

For a supporting record that is not the certificate itself, agree any proposed redaction with the recipient first. Do not hide information that the relevant process legitimately requires.

What if HR asks for my complete medical records?

Ask HR to identify the specific question that the records are intended to answer. A request for a complete history needs a clear explanation; the amount of information requested should match the purpose.

You can acknowledge the request while asking whether a focused document would meet it. Keep any submission deadline in view and request clarification promptly rather than leaving the email unanswered.

If the request concerns an occupational assessment, ask whether supporting records should go directly to the designated clinician. That separates clinical review from routine absence administration without assuming the employer has no legitimate documentation needs.

How to send the evidence without unnecessary exposure

Before attaching a file, ask these 3 questions:

• What exact document and information are required?
• Who is authorised to receive and review it?
• Which submission channel should I use?

You can also ask how long the evidence will be retained and where the relevant employee privacy notice is available. GDPR Article 13 sets transparency requirements for information collected from you; Article 32 addresses appropriate security measures. A portal is not automatically suitable merely because it requires a login.

Keep 2 copies for your own administration: the original document and the exact version submitted. Store both privately, along with the acknowledgement. This is a practical record-keeping suggestion, not a legal retention period.

Check the filename as well as the contents. A filename containing a diagnosis can disclose information even when the document itself is appropriately limited. Avoid workplace group chats, broad copying lists and attachments bundled with unrelated reports.

If an incorrect recipient receives the file, contact the responsible HR or privacy team promptly. Explain what was sent and to whom, without forwarding the attachment again to a wider group.

When a bilingual video consultation can help

If you need a clinical evaluation as well as clarity about documentation, bring the employer's written request to the appointment. Include the purpose, relevant dates and required document type. The guide to preparing for an online GP consultation helps you organise information for the doctor rather than for your employer.

Dr. Pedro Yelamo Vera's bilingual GP consultations are best for patients in Spain who need to discuss their health and documentation concerns in English or Spanish. The practice offers unhurried video consultations with a GP licensed in Spain (Colegiado No. 484814280), and GDPR-conscious handling of patient information.

Dr. Pedro Yelamo Vera can assess the clinical question and discuss appropriate next steps. The limitation is clear: a consultation does not guarantee a certificate, employer acceptance or completion of a statutory or occupational-health process.

Treatment and prescriptions are issued solely at the doctor's discretion based on evidence-based clinical guidelines. Any certificate is considered only where clinically appropriate, following a genuine evaluation. Describe the request honestly; do not seek wording that the clinical evidence cannot support.

For medical emergencies, call 112 or attend the nearest local emergency department. This practice does not handle medical emergencies; do not wait for a video consultation or an employer's paperwork decision.

FAQ

One last thing

Check the cover email, not just the certificate. A carefully limited attachment loses its privacy benefit if your message adds the diagnosis, treatment history and unrelated personal details.

For your submission, keep the email administrative: identify the requested document, relevant absence or appointment, and any reference the recipient needs. Ask for confirmation of receipt without repeating clinical details. This page provides general information, not an individual legal assessment of your employment situation.

Related guides

• Pre-employment medical certificate requirements
• English-speaking GP care for expats in Spain
• Medical documentation for travel insurance claims