Agradecemos el apoyo de …
Privacy policy
1. Who processes your data
| Controller | Coralva Inversión, S.L. |
| Tax ID (NIF) | B09635327 |
| Trading name | Instituto de Cirugía Plástica del Mediterráneo (ICPM) |
| Registered address | Calle Ángel Villena 36, bajo — 46013 Valencia (Spain) |
| administracion@institutodecirugiaplastica.es | |
| Telephone | 960 488 161 · 644 430 539 |
| Data Protection Officer | Consenur, S.L.U. (Tax ID B86208824), Data Protection Department. Contact: protecciondedatos.sanitarios@urbaser.com |
2. What data we collect and where from
Through this website:
- Contact and appointment request forms: first name and surname, telephone, email (optional) and the content of the message. Where that message describes a reason for consulting us, it may contain health data, which the legislation treats as a special category.
- WhatsApp button: pressing it opens a conversation in WhatsApp; from that point the processing is described in section 5.
- Browsing data: IP address, device and browser type, pages visited and the source of the visit, through cookies and similar technologies, in accordance with the Cookie Policy.
Away from the website, in the clinical setting, we also process the data you give us at the consultation and the data generated during your care (medical records, tests, informed consents, clinical images).
We do not collect data from minors through this website without the involvement of whoever holds their legal representation.
3. What we use them for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Dealing with your enquiry or request for information | Your consent and the taking of steps prior to a contract at your request (art. 6(1)(a) and 6(1)(b) GDPR) |
| Managing and confirming your appointment | Steps prior to a contract and performance of the care relationship (art. 6(1)(b) GDPR) |
| Providing you with healthcare and keeping your medical records | Art. 6(1)(c) and art. 9(2)(h) GDPR (preventive medicine, medical diagnosis and the provision of health care), read together with Law 41/2002 |
| Complying with legal obligations (healthcare, tax and accounting) | Art. 6(1)(c) GDPR |
| Sending you commercial or informational communications | Only with your express consent, which you may withdraw at any time (art. 6(1)(a) GDPR and art. 21 LSSI) |
| Analysing how the website is used in order to improve it | Your consent to the analytics cookies |
We take no automated decisions producing legal effects concerning you or significantly affecting you, and we do not carry out profiling for that purpose.
4. How long we keep them
- Enquiries that do not lead to treatment: for as long as is needed to deal with them and, afterwards, blocked for as long as liabilities may arise, until they become time-barred.
- Clinical records: for at least five years from the last episode of care in which you were treated, or from death, in accordance with the legislation of the Comunitat Valenciana (Law 1/2003 of the Generalitat) and article 17 of Law 41/2002. Particularly relevant documents are kept indefinitely, and medical records that are evidence in judicial or administrative proceedings are kept until those proceedings end.
- Accounting and tax data: for the periods required by commercial and tax legislation.
- Consent to commercial communications: until you withdraw it.
5. Who we share them with
We do not sell your data and we do not pass it to third parties for their own purposes. We do use suppliers who process data on our behalf (processors), who access your data solely in order to provide us with the service indicated and in accordance with our instructions:
| Supplier | Purpose |
|---|---|
| SiteGround | Hosting of the website and its associated email |
| Google (Google Ireland Limited) | Analytics of site use (Google Analytics), only if you accept the analytics cookies |
| Callbell | Management of WhatsApp conversations with the clinic |
| eFirma | Electronic signature of informed consents and other documentation |
| Clinic Cloud | Clinic management software: diary, medical records and invoicing |
The full corporate details of each processor may be requested at the address given in section 7.
Your data may also be accessed by public authorities, courts and tribunals, insurers and other healthcare professionals, where there is a legal obligation or where it is necessary for your care.
When you use the WhatsApp button, the messaging service itself processes your data in accordance with its own terms, as an independent controller. If you would rather not use it, you can contact us by telephone, by email or through the web form.
6. International transfers
Some of the services above may involve the processing of data outside the European Economic Area:
- Google: we contract with Google Ireland Limited, in the European Union. Google states that it covers transfers to the United States under the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission.
- Resources served by third parties: when the site loads, typefaces and other resources hosted on external servers are requested. Those requests transmit your IP address to the server concerned, which may be outside the EEA. This is set out in the Cookie Policy.
- WhatsApp: if you decide to write to us through that channel, the service is provided by Meta as an independent controller, with its own transfer safeguards.
7. Your rights
You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and you may also withdraw any consent you have given, without this affecting the lawfulness of the processing carried out beforehand.
To exercise them, write to administracion@institutodecirugiaplastica.es or to Calle Ángel Villena 36, bajo — 46013 Valencia, stating the right you are exercising and enclosing a copy of a document proving your identity. You may also contact the Data Protection Officer directly at protecciondedatos.sanitarios@urbaser.com.
Bear in mind that the right to erasure does not extend to clinical records for as long as the legal duty to keep them subsists.
If you consider that we have not dealt with your request properly, you may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
8. Security
We apply appropriate technical and organisational measures to protect your data, taking into account its nature —including the special protection that health data deserves— and the risks of the processing. These include encryption of the website’s communications, access control through individual credentials, the taking of backups and the duty of confidentiality of our staff, which continues even after their relationship with the centre ends.
9. Changes to this policy
We may update this policy to bring it into line with changes in the law or with new processing activities. The version in force is always the one published on this page.
Governing version: the Spanish one. The English translation of this page is provided for convenience and, in the event of any discrepancy between the two, the Spanish text prevails.
Last updated: 4 August 2026.
