Privacy Policy

1. Responsible for the processing

In compliance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 41/2002 (Law on the Autonomy of the Patient), it is reported that the personal data provided through this website will be processed by:

Dr. Gregorio José León García
Professional address: C/ Dr. Severo Ochoa, 20, 35550 San Bartolomé, Lanzarote (Las Palmas) – Spain
Phone: +34 638 516 851
Email: contacto@drgregorioleon.com
Number of member: 353508816 (Honorable Official College of Physicians of Las Palmas)
Website: https://www.drgregorioleon.com

2. Purpose of the processing

The data that the user provides through the contact form (name, phone number and email address) are processed for the following purposes:

• Manage your request for information or medical appointment (in person or online).

• Coordinate previous communications to offer scheduling availability and facilitate the payment link for the first consultation.

• Issue a confirmation of the appointment once payment has been received.

⚠ Important limitation:
In this initial phase No medical data should be included. Only after the appointment and payment are confirmed, the patient will be able to voluntarily provide clinical information, through secure means expressly indicated by the responsible party.

The health data They will be treated solely for diagnostic purposes and the provision of healthcare, and will be included in the patient's medical history in accordance with Law 41/2002 and applicable health regulations.

3. Legitimation of the treatment

• Initial contact details: the interested party's consent (Article 6.1.a of the GDPR).

• Health data after confirmation of appointment: processing necessary for medical diagnostic purposes, provision of healthcare and management of healthcare systems and services (Article 9.2.h GDPR and Article 6.1.c GDPR).

4. Data retention

• Contact information before the appointment: They are kept only for the time necessary to process the request and, in any case, a maximum of 12 months if the appointment is not formalized.

• Health data incorporated into the medical history: Minimum 5 years from the date of completion of each care process, or the longer deadlines established by the applicable autonomous regional legislation.

5. Recipients of the data

• Personal data will not be disclosed to third parties, except where required by law or for duly justified medical reasons.

• In the case of online consultations, the platform will be used. Zoom (or equivalent), which acts as the data controller under a contract of commission in accordance with Article 28 of the GDPR and with servers that meet appropriate security standards.

6. Rights of the interested parties

The patient or user may exercise the following rights at any time:

• Access to your personal data.

• Rectification of inaccurate data.

• Deletion (“right to be forgotten”), where applicable.

• Limitation of processing.

• Opposition to the treatment.

• Portability of the data to another healthcare professional.

Exercise of rights: The written request must be sent by post to the indicated address or by email to contacto@drgregorioleon.com.

In the event that you consider that your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

7. Security measures

The responsible person applies appropriate technical and organizational measures to protect personal data, in accordance with Articles 32 to 34 of the GDPR, including TLS encryption in electronic communications and access control for clinical information.

However, the user is warned that conventional email does not have end-to-end encryption, so clinical or particularly sensitive information should not be sent via this means before the appointment is confirmed.

8. Modifications

The responsible person may modify this Privacy Policy at any time to adapt it to legislative changes or changes in the provision of services. Any changes will be published on this same page.