Privacy Policy

1. Data controller

• Registered name: Podonexus S.L.
• NIF (Spanish tax number): B76628916
• Registered address: Avenida República Argentina nº 18, San Cristóbal de La Laguna, Santa Cruz de Tenerife
• Clinic: Calle José Clavijo y Fajardo nº 3, 38200 San Cristóbal de La Laguna, Santa Cruz de Tenerife
• Email: contacto@avanza-salud.com
• Telephone: +34 647 773 675

2. What data we collect and why

This website provides information, contact channels and certain digital features. We collect data directly in two places only: (a) the Patient Area waiting list form, where, if you ask us to, you give us your name and your email address for the sole purpose of letting you know when the service is available; and (b) the Garoé conversational assistant (see section 6), which only works once you have accepted the "Preferences" cookie category.

Waiting list data is processed by Podonexus, S.L. (Avanza Salud) on the basis of your consent (Article 6(1)(a) of Reglamento (UE) 2016/679, the General Data Protection Regulation or GDPR). It is not used for advertising and it is deleted when the service opens or when you ask us to delete it. You can unsubscribe or exercise your rights at any time by writing to contacto@avanza-salud.com.

If you contact us by telephone, WhatsApp or email, the data you give us (name, telephone number, reason for your enquiry) will be processed only to:

• Handle your appointment request or enquiry
• Communicate with you in connection with the services you have asked about
• Do not send reports, photographs or clinical documentation via WhatsApp or email: they are administrative channels for appointments, not a clinical channel. Where clinical documentation needs to be handled, a secure channel will be used and it will be added to your clinical record.

Clinical records and the Patient Area. The clinical data of the clinic’s patients is documented in their clinical record in accordance with Ley 41/2002 and the applicable Spanish healthcare legislation. The Patient Area (pacientes.avanza-salud.com) has its own privacy information and a specific informed consent, both shown within the portal itself before you use it.

3. Legal basis for the processing

We process your data on the basis of the consent you give when you contact us (Article 6(1)(a) GDPR) and on the performance of the contractual relationship arising from the provision of healthcare services (Article 6(1)(b) GDPR).

Where the processing involves health data in the context of a care relationship, it is also based on Article 9(2)(h) GDPR: the processing is necessary for medical diagnosis and the provision of healthcare, and is carried out by healthcare professionals bound by professional secrecy (Article 9(3) GDPR and the seventeenth additional provision of the LOPDGDD).

4. How long we keep your data

Data is kept for as long as necessary to deal with your request and, where there is a care relationship, for the minimum period required by Spanish healthcare legislation: at least five years from the date of discharge of each episode of care, under Article 17.1 of Ley 41/2002, the Spanish law on patient autonomy. That period is a legal minimum: certain documentation may be kept for longer for judicial, epidemiological or healthcare organisation reasons (Article 17.2 of the same law).

5. Sharing data with third parties, analytics and advertising measurement

We do not share the personal data you give us by telephone, WhatsApp or email with third parties, except where the law requires it.

To measure how well our online advertising works we use Google Ads, and to understand how the website is used in aggregate (most visited pages, traffic sources, devices) we use Google Analytics 4. To understand how visitors interact with the website (heatmaps and usage recordings linked to pseudonymous identifiers) we use Microsoft Clarity. Microsoft Clarity only loads once you accept the Statistics category (technically verified: no contact is made with Clarity beforehand). The Google tags (Analytics and Ads) use Consent Mode v2 in its advanced form: they load with consent denied by default and, until you accept, they install no cookies and allow no personalised advertising, although they do send cookieless technical signals to Google (including the IP address and the page visited) for aggregate measurement. They collect pseudonymised browsing data (click identifiers, country, device), the clicks you make on the contact buttons (WhatsApp, telephone, email), aggregated usage statistics and, in the case of Clarity, pseudonymised recordings of how you interact with the website (in its default mode, Clarity automatically masks numbers, email addresses and the content of form fields; masking of other text depends on configuration). Google states that in Analytics 4 the IP address is used transiently and is not logged or stored.

Legal basis: express consent (Article 6(1)(a) GDPR), which you can withdraw at any time from the Cookie Policy.

Providers and recipients (their exact role, controller or processor, depends on each product and contract):

• Google Ads and Google Analytics: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Microsoft Clarity: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

International transfers: both Google and Microsoft may transfer data to the United States under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Google's policy · Microsoft's policy.

Web fonts: this site downloads its fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so Google receives the visitor's IP address on every visit, regardless of cookie consent. No cookie is set by this service.

6. AI conversational assistant (Garoé)

The Avanza Salud website includes a conversational assistant based on artificial intelligence called Garoé, available both on the main pages (home, podiatry, physiotherapy, return to sport) and on the blog. Its job is to help you find information about the clinic's services and about the published articles that answer your question. It does not diagnose, it does not recommend treatments and it does not replace a healthcare consultation.

Garoé only loads if you have first accepted cookies in the banner. Until you accept, the assistant neither loads nor starts any communication. It works in two modes: text chat and voice. If you turn on voice mode, your audio is sent to the provider so that it can be transcribed and an answer generated.

Data processed: the text of the questions you type, the audio of your questions if you turn on voice mode, and technical session identifiers. Do not enter identifying personal data, sensitive clinical data, your DNI number or information about other people in the chat. The assistant is not a clinical channel.

Data processor: Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016 (United States). It acts as a data processor under Article 28 GDPR.

What is kept: the full transcript of the text chat, the audio captured if voice mode is turned on (the user's voice and the agent's synthesised reply), technical session identifiers, IP address, browser, device, length of the conversation and operational logs.

Why it is kept: (1) to operate the service (transcribe audio and generate answers), (2) for review by the person responsible for the clinic, from the ElevenLabs control panel, in order to assess the quality of the assistant and identify questions where the content needs improving, (3) technical support and debugging, (4) improvement of the provider's AI models under the ElevenLabs terms of service.

Retention period: the period is set by ElevenLabs according to the terms of the plan contracted. The provider's default retention period is two years, and it can be reduced by configuration (the exact period applied to Garoé will be published here once set); Enterprise plans offer "Zero Retention Mode" (the conversation is not stored) and "No Training Mode" (it is not used to train models). The exact period in force is set out in the ElevenLabs privacy policy.

Key notice: by starting a conversation with Garoé you accept that your interaction (text, and audio if you turn on voice) will be kept by ElevenLabs for that period and may be reviewed by the person responsible for the clinic. If you do not want your conversation to be kept, do not start a chat with Garoé and use the conventional channels instead (telephone, WhatsApp with our team, or an in-person consultation).

International transfers: data is transferred to the United States under the Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914) and under the EU-US Data Privacy Framework, in which Eleven Labs Inc. (the provider's US entity) is currently certified; the certification does not cover its other entities, to which the standard contractual clauses apply.

Legal basis and withdrawal: the user's express consent (Article 6(1)(a) GDPR), given by accepting the "Preferences" cookie category and by starting a conversation with the assistant. You can withdraw your consent at any time from the "Cookie settings" link in the footer (or in the cookie banner) by unticking the "Preferences" category in the panel.

7. Your rights

Under Reglamento (UE) 2016/679 (GDPR) and Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD), you can exercise the following rights at any time:

• Access: find out what data we process about you
• Rectification: correct inaccurate data
• Erasure: ask us to delete your data
• Objection: object to the processing
• Portability: receive your data in a structured format
• Restriction: ask us to restrict the processing

To exercise your rights, send an email to contacto@avanza-salud.com stating which right you wish to exercise. Only if there is reasonable doubt about your identity will we ask you for a document that confirms it (DNI, NIE or passport).

These rights apply where the GDPR so provides: erasure will not extend to clinical or administrative documentation whose retention is required by law.

You can also lodge a complaint with the Agencia Española de Protección de Datos (the Spanish Data Protection Agency, AEPD) at www.aepd.es.

8. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction, in accordance with Article 32 GDPR.

9. Changes to this policy

We reserve the right to update this policy to reflect changes in the law or in our services. The version in force will always be available on this page.