Privacy Policy

Last updated: 20 October 2026

This privacy policy explains how OsteoPalma collects and uses your personal data when you visit www.osteopalma.eu, book an appointment, receive treatment or subscribe to our newsletter. We process your data in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).

1. Who is responsible for your data

Controller: OsteoPalma CB trading as OsteoPalma
Tax ID (NIF/CIF): E57934226
Address: Carrer de Gilabert de Centelles, 19, 07005 Palma, Illes Balears, Spain
Email: go@osteopalma.eu
Phone: +34 670 384 130
Website: osteopalma.eu

We have not appointed a Data Protection Officer, as this is not required for our clinic. For any question about your data, please contact us at the email address above.

2. Which personal data we collect

When you book an appointment: your first name, last name, email address, phone number and date of birth.
When you receive treatment: information about your health that you share with your osteopath, such as your complaints, medical history, lifestyle and treatment notes. This is health data, a special category of personal data, and is protected by professional secrecy.
When you subscribe to our newsletter: your email address
When you contact us by email, phone or WhatsApp: your contact details and the content of your message.
When you visit our website: data collected through cookies, only with your consent where required. See our Cookie Policy.

If you book an appointment for a child, the parent or legal guardian provides the child’s data and is responsible for it.

3. Why we use your data and on which legal basis

Purpose	Data	Legal basis (GDPR)
Managing your bookings, confirmations and appointment reminders	Name, email, phone, date of birth	Performance of a contract or steps before entering into one (Art. 6.1.b)
Providing osteopathic treatment and keeping your treatment record	Health data, contact details	Performance of a contract (Art. 6.1.b) and provision of health care under professional secrecy (Art. 9.2.h)
Invoicing and accounting	Name, contact details, invoice data	Legal obligation under Spanish tax and commercial law (Art. 6.1.c)
Answering your questions	Contact details, message	Your request and our legitimate interest in replying (Art. 6.1.b and 6.1.f)
Sending our newsletter	Email address	Your consent (Art. 6.1.a), which you can withdraw at any time via the unsubscribe link
Analysing website use and measuring advertising	Cookie data	Your consent (Art. 6.1.a), see Cookie Policy
Keeping our systems secure and preventing fraud	Booking and technical data	Our legitimate interest (Art. 6.1.f)

We do not use your data for automated decision-making or profiling. We will not send you commercial communications unless you have given your consent.

4. Do you have to provide your data?

Your name, contact details and date of birth are needed to book and confirm an appointment. Information about your health is needed to treat you safely. If you do not provide this data, we cannot offer you treatment. Subscribing to the newsletter is optional.

5. How long we keep your data

Treatment records: [retention period to be confirmed by the clinic, for example 5 years after your last treatment].
Booking and contact data: 1 year after your last appointment, for security and fraud prevention.
Invoices and accounting records: 6 years, as required by Spanish commercial law.
Newsletter: until you unsubscribe.
Messages and questions: as long as needed to answer them, and no longer than 1 year.

After these periods, we delete or anonymise your data. We may keep data blocked for longer only where the law requires it, for example to deal with legal claims.

6. Who we share your data with

We do not sell your data. We only share it with service providers that process data on our behalf and under a data processing agreement, or with authorities when the law requires it:

Provider	Service	Location of data
Cliniko (Red Guava Pty Ltd)	Online booking system and patient records	Australia
Mailchimp (Intuit Inc.)	Newsletter	United States
Google (Google Ireland Ltd / Google LLC)	Website analytics, only with your consent	EU and United States
Meta (Meta Platforms Ireland Ltd)	Social media and advertising cookies, only with your consent	EU and United States
Internet Today	Website hosting	EU
[Name of accountant or gestoría]	Invoicing and accounting	Spain

7. Transfers outside the European Union

Some of our providers store data outside the European Economic Area:

Australia (Cliniko): there is no EU adequacy decision for Australia. The transfer is protected by the European Commission’s Standard Contractual Clauses, included in Cliniko’s data processing addendum.
United States (Mailchimp, Google, Meta): these companies are certified under the EU-US Data Privacy Framework and/or use the Standard Contractual Clauses.

You can ask us for more information about these safeguards.

8. Your rights

You have the right to:

access the personal data we hold about you;
have incorrect or incomplete data corrected;
have your data deleted, unless we must keep it by law;
object to the processing of your data;
ask us to restrict the processing of your data;
receive your data in a structured, commonly used format (data portability);
withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, send an email to info@osteopalma.eu or a letter to our address, stating which right you wish to exercise. We may ask you to confirm your identity. We will reply within one month.

If you believe we have not handled your data correctly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).

9. Children

In Spain, children under 14 cannot give consent to the processing of their data themselves. For children under 14, we only process data provided by a parent or legal guardian.

10. Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Our website uses a secure (HTTPS) connection, access to patient records is limited to the clinic’s staff, and all staff are bound by professional secrecy. We keep as little data as possible.

11. Privacy policies of our providers

12. Changes to this policy

We may update this privacy policy, for example when the law or our services change. The current version is always published on this page, with the date of the last update. If the changes are significant, we will inform you by email where possible.

13. Contact

For questions about this privacy policy or your data, please contact us at go@osteopalma.eu or via our contact page. More information about how we handle cookies can be found in our Cookie Policy.