Privacy Policy & Data Protection

1. Commitment to privacy

This policy explains how the personal data of patients and users of drpedroyelamo.com is collected, used, protected and kept when we provide medical and telemedicine care.

It follows Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), Law 41/2002 on patient autonomy and Basque Country Decree 38/2012 on medical records. All use of health data is covered by medical secrecy.

2. Data controller

• Controller: Dr. Pedro Oscar Yelamo Vera, licensed physician no. 484814280, NIF/NIE Z2589067P.
• Professional address: Calle Arbolantxa 2, Bilbao, Bizkaia 48001 Spain.
• Privacy contact: drpedroyelamo@drpedroyelamo.com · +34 604 964 310.
• Data Protection Officer: none has been appointed, because this is a single doctor's practice (Art. 37 and Recital 91 GDPR). Any question is answered at the email above.

3. What data we use and where it comes from

We use these types of data:

• Identity and contact: first name, last name, date of birth, sex, place of residence, ID card or passport, phone number and email address.
• Appointments and messages: the date, time and type of your appointment, the messages you send us and the appointment emails we send you.
• Payment and billing: billing and payment details. Card payments are handled by Stripe. We never see or store your full card number.
• Health data (a special category with extra protection): your medical history, symptoms, diagnoses, treatments, tests, clinical images, reports, prescriptions and anything you tell us during a visit.
• Website use: only the data described in section 15 (cookies), and optional cookies only with your permission.

Where it comes from: from you, when you book, use the website form or the patient portal, or speak with the doctor. If you book through Doctoralia or Doctorsa, that platform sends us your contact and appointment details so we can see you.

Do you have to give us your data? Your identity, contact and health data are needed to care for you safely and to follow the law. Without them we cannot treat you.

4. Legal bases

We use your data on these legal grounds of the GDPR:

• Giving you your visit, managing your appointment and sending you the video link: the contract you ask for (Art. 6.1.b).
• Medical record, prescriptions, invoices and tax duties: a legal duty (Art. 6.1.c).
• Health data for diagnosis and treatment: health care given by a doctor bound by professional secrecy (Art. 9.2.h and 9.3).
• Running and protecting the practice: our legitimate interest (Art. 6.1.f). You can object to it.
• Information or marketing messages: your clear consent, which you can withdraw at any time (Art. 6.1.a).
• Optional cookies: your consent (Art. 22.2 LSSI and Art. 6.1.a GDPR).

Your data is not used for automated decisions with legal effects on you, or for commercial profiling.

5. What we use your data for

• To give you medical and telemedicine care.
• To create, update and keep your medical record safe.
• To manage your appointments: confirmations, reminders, changes, cancellations and sending the video link.
• To issue prescriptions, reports, certificates and referrals.
• To take payment, send invoices and meet tax and accounting rules.
• To answer your questions and your requests to use your rights.
• To send you information or marketing messages, only if you have clearly agreed. You can unsubscribe at any time.

AI support tool: to prepare and write up some visits, the doctor uses a clinical support tool with artificial intelligence (Glass Health). It receives only the clinical details needed. It makes no decisions: every clinical decision is made and checked by the doctor.

6. Video visits and appointment emails

Video visits take place on Google Meet (Google Workspace).

• Unique link: when you book, you get an email from drpedroyelamo@drpedroyelamo.com with a video link that is only for your appointment.
• Least data possible: that email holds only your name, the date and time of your appointment and the link. It never includes the reason for your visit or any clinical data.
• Data used: your name, email and appointment details, to perform the contract (Art. 6.1.b GDPR).
• No recording: video visits are not recorded. The relevant clinical notes go into your medical record.
• Controlled access: the connection is encrypted in transit, and the doctor must let you into the call before it starts.
• Your part: join from a private place and do not share the link with anyone.

Appointment confirmations and reminders are sent by email from the practice software (DriCloud), through the same email address.

7. Who we share your data with

Your data is never sold or shared for commercial purposes. It is only shared:

• With health, court or tax authorities, or the AEPD, when a law requires it.
• With other health professionals or pharmacies when your care needs it (for example, a prescription or a referral).
• With your insurer, only if you ask us to.

8. Data processors

We use technology providers that handle data only on our instructions, under a data processing agreement (Art. 28 GDPR) and a duty of confidentiality. They are:

• DriCloud (Massive Bionics), Spain: electronic medical record, appointment diary, patient portal, and appointment confirmation and reminder emails.
• Google Ireland Limited (Google Workspace), Ireland / USA: email (Gmail), calendar (Google Calendar, including the booking tool on this Website), video visits (Google Meet), and the measurement services in section 15.
• Glass Health, Inc., USA: clinical support tool with artificial intelligence, used to prepare and write up visits.
• Stripe Payments Europe, Ltd., Ireland / USA: card payments.
• Doctoralia Internet S.L., Spain: bookings and messages with patients who book through Doctoralia.
• Rempe, Spain: the approved system used to issue and check private electronic prescriptions.
• B2Brouter, Spain: electronic invoices.
• Tukonta.com, Spain: the practice's accounts and taxes.
• Vercel Inc., USA: hosting for this Website, and overall visitor and speed statistics that use no cookies.

9. International transfers

Some providers may handle data outside the European Economic Area, mainly in the USA. When they do, the transfer is protected by one of these safeguards of Chapter V of the GDPR:

• The European Commission's adequacy decision for the EU-US Data Privacy Framework, for certified providers.
• The Standard Contractual Clauses approved by the European Commission.

You can ask us which safeguard applies to each provider at drpedroyelamo@drpedroyelamo.com.

10. How long we keep your data

• Medical record and health data: at least five (5) years from the discharge of each episode of care (Law 41/2002 and Basque Decree 38/2012), or longer if a law or your care requires it.
• Billing and accounting data: the time tax and commercial law require (up to six (6) years, General Tax Law and Commercial Code).
• Appointment emails and video links: while you are our patient, and then up to five (5) years to deal with any claim.
• Marketing messages: until you withdraw your consent.
• Cookies: as set out in section 15.

When these periods end, the data is deleted or made anonymous. While it must be kept only to meet a legal duty, it is blocked: it is no longer used, but stays available to the authorities (Art. 32 LOPDGDD).

11. Security

We use technical and organisational measures suited to the risk of health data (Art. 32 GDPR):

• Data is encrypted in transit (SSL/TLS) and at rest in the cloud services we use.
• Only the responsible doctor can open medical records, with secure sign-in.
• Every provider in section 8 has signed a data processing agreement.
• Each message holds only the data needed for its purpose.

No system is perfect. If a security breach affects your data, we will tell the AEPD within 72 hours and, if it puts you at high risk, we will tell you without delay (Arts. 33 and 34 GDPR).

12. Your rights

You can use these rights at any time:

• Access: know what data we hold and get a copy, including your medical record.
• Correction: fix data that is wrong or incomplete.
• Deletion: ask for your data to be deleted, unless the law says we must keep it.
• Restriction: ask us to stop using it for a while.
• Objection: object to uses based on legitimate interest or for marketing.
• Portability: get your data in a structured, commonly used format.
• Withdraw consent: this does not change what was done before.

How: write to drpedroyelamo@drpedroyelamo.com and say which right you want to use. If we are unsure who you are, we may ask you to prove it. We reply within one month, or within three months in complex cases, and we tell you if we need the extra time (Art. 12 GDPR). It is free.

Complaints: if you are not happy, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid (www.aepd.es).

13. Minors

Patients under 16 are seen only with the involvement and consent of their parents or legal guardians, who use their rights on their behalf. From age 16, patients can give their own consent under Law 41/2002.

14. Changes to this policy

We may update this policy when our services, providers or the law change. The date of the last update is shown at the top. If a change is important, we will tell you by email or on this Website.

15. Cookies and Similar Technologies

On your first visit, a cookie banner lets you choose “Accept all”, “Essential only” or “Manage cookies”. “Essential only” refuses every optional cookie, and it is as easy to choose as accepting. Under “Manage cookies”, each optional type of cookie has its own switch, off by default, plus “Reject all”, “Save my choices” and “Accept all”.

Nothing optional is stored or loaded before you choose. Closing the banner or scrolling is not consent. Saying no does not limit your access to the Website or to the consultations.

Google tags run through Google Tag Manager with Google Consent Mode, which keeps analytics and advertising storage switched off unless you allow them. Your choice is kept on your device for 12 months. After that, we ask again.

• Essential (always on, no consent needed): your language, light or dark theme and cookie choice, stored by this Website. Also overall visitor and speed statistics from Vercel (our host), which use no cookies and do not identify you.
• Analytics (only if you allow them): Google Analytics (Google Ireland Ltd.), to count visits and see which pages are useful. Cookies such as _ga last up to 2 years.
• Advertising (only if you allow them): Google Ads, Meta (Facebook, Instagram), TikTok, OpenAI (ChatGPT ads) and Ryze. They measure whether our ads lead to appointments, and they show our ads to people who have visited this Website.

The advertising providers follow their own privacy policies. They may combine what they collect on this Website with other data they hold about you. They may also send it outside the European Union under the safeguards they use (such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework).

You can change or withdraw your choice at any time with the “Cookie settings” link at the bottom of every page. You can also delete or block cookies in your browser settings.