Privacy policy.

This English version is provided for information. In case of discrepancy, the Spanish version prevails.

1. Data controller

Dr Idaira Sánchez Santos, ophthalmologist (Tax ID 54092767X; licence no. 390905425, Medical Association of Cantabria), professional address at Hospital Santa Clotilde, Paseo de Altamira 35, 39006 Santander, Spain. Contact: idairaoftalmo@gmail.com · +34 942 21 77 11.

2. Why we process your data

To provide healthcare: consultations, procedures and follow-up.
To manage the electronic signature of informed consent forms.
To answer information or appointment requests sent through the contact forms.
To provide online consultations: receiving and reviewing the clinical documents you send, managing payment, booking the appointment and holding the video call.
To comply with the legal and professional obligations that apply to healthcare.

3. Categories of data

Identification data: name, ID or passport number, date of birth, address, email, telephone.
Health data: ophthalmic medical history, diagnostic tests, treatments, signed consent forms and the digital image of your signature.
Online consultation data: reason for consultation, description of symptoms, questions, reports, images and tests you attach, country and time zone, proof of payment and, if provided, invoicing details.
Browsing data: aggregated website usage statistics, only if you accept analytics cookies (see the cookie policy).
Technical data: IP address and browser information when a consent form is signed, for legal audit purposes.

4. Legal basis

Your explicit consent (art. 6.1.a and 9.2.a GDPR) for online consent forms, contact forms and the health data you send when requesting an online consultation.
The performance of the contract for healthcare services (art. 6.1.b GDPR).
Your consent (art. 6.1.a GDPR) for website analytics.
Compliance with legal healthcare obligations (Spanish Law 41/2002; art. 9.2.h GDPR).
Vital interests in medical emergencies (art. 9.2.c GDPR).

5. How long we keep your data

Medical records and consent forms are kept for at least five years from the end of each episode of care, as required by article 17 of Spanish Law 41/2002, and longer where required by law or for your care.

6. Who receives your data

Your data is not shared with third parties except:

Where required by law (health or judicial authorities).
With your own insurer, when you authorise billing through them.
With laboratories or healthcare centres when strictly necessary for your care.
With technology providers acting as data processors: web hosting (Hostinger), email (Hostinger and Google Gmail), the video call service used for online consultations (Jitsi Meet, by 8x8 Inc.; calls are not recorded), Google Analytics 4 only if you accept analytics cookies, WhatsApp (Meta) only if you choose to write to us there, and the bank that receives the consultation fee.

Where any of these providers processes data outside the European Economic Area, this is done with the safeguards required by the GDPR (adequacy decision or standard contractual clauses). Online consultations are not recorded.

Please do not send health information through the general contact form or WhatsApp. To share medical reports, use the online consultation form, which is designed for it.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to idairaoftalmo@gmail.com with a copy of your ID or passport. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence in the EU.

8. Security

We apply the technical and organisational measures needed to protect the confidentiality, integrity and availability of your data: HTTPS encryption, documents stored outside the public area of the web server, access control, strong passwords and backups.

Last updated: 12 October 2026