This Privacy Policy governs the processing of personal data collected by ARQÉA S.L.P. via its website and the various contact channels provided, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data (hereinafter, the GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, the LOPDGDD).
As ARQÉA S.L.P. is a medical clinic specialising in facial surgery, some of the data processed may be classified as health data and, therefore, as a special category of data in accordance with Article 9 of the GDPR. Such data is processed in accordance with the enhanced safeguards required by the regulations for this type of information.
We recommend that you read this Policy carefully before providing your personal data via any form or communication channel belonging to ARQÉA S.L.P.
In accordance with Article 13 of the GDPR, we hereby inform you that the data controller responsible for processing your personal data is:
- Company name: ARQÉA S.L.P.
- Trading name: ARQÉA
- Tax Identification Number (N.I.F.): B27567973
- Registered office: Carrer de Victor Hugo, 24, 08174 Sant Cugat del Vallès, Barcelona
- Email: info@arqea.clinic
- Telephone: +34 659 801 717
- Website: www.arqea.clinic
- Registration details: Registered with the Barcelona Commercial Register.
Data Protection Officer (DPO)
ARQÉA S.L.P. has appointed a Data Protection Officer, whom data subjects may contact regarding any matter relating to the processing of their personal data or the exercise of their rights:
- MEDICONSULTING ETL GLOBAL, S.L.
– Data Protection Service
– Passeig de la Bonanova, 47, 5th floor · 08017 · Barcelona
– Telephone: 93 567 88 15 / 93 567 88 88
– Email: mediconsulting@med.es
Due to the nature of ARQÉA S.L.P.’s activities — a clinic specialising in facial surgery — it is necessary, within the framework of the healthcare and pre-contractual relationship with patients, to collect and process data relating to the data subjects’ health.
This data is classified as a special category of data in accordance with Article 9(1) of the GDPR. The processing of health data by ARQÉA S.L.P. is carried out on the following legal bases:
– The patient’s explicit consent (Article 9(2)(a) of the GDPR), obtained through the signing of the relevant informed consent form prior to any medical procedure or intervention.
– Necessity for the purposes of preventive or diagnostic medicine, the provision of healthcare or medical treatment, in accordance with Article 9(2)(h) of the GDPR and Article 9 of the LOPDGDD.
– Compliance with legal obligations in the field of healthcare, including Law 41/2002 of 14 November, the basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation. Health data processed in the context of the care relationship are subject to a duty of confidentiality and shall not be used for any purpose other than medical care, unless required by law or with the express consent of the data subject.
Set out below are the main processing activities carried out by ARQÉA S.L.P., together with the categories of data involved, the legal basis for each processing operation and the applicable retention period.
In general, personal data will be retained for the duration of the relationship between the data subject and ARQÉA S.L.P. and, once this relationship has ended, for as long as is necessary to comply with applicable legal obligations or to address any potential liabilities arising from the processing.
In particular, with regard to clinical records, the following minimum retention periods apply:
- Medical records: fifteen (15) years from the date of discharge for each course of treatment, in accordance with Law 16/2010 of 3 June, amending Law 21/2000 of 29 December on the rights to health-related information and patient autonomy, and clinical documentation, applicable in Catalonia.
– Informed consents: linked to the medical record, with the same minimum retention period.
– Accounting and tax documents: six (6) years, in accordance with Article 30 of the Commercial Code. Once the applicable retention periods have elapsed, the data will be securely deleted or, where appropriate, irreversibly anonymised.
As a general rule, ARQÉA S.L.P. does not disclose or transfer users’ personal data to third parties, except in the following circumstances:
– Where there is a legal obligation or a request from a competent authority (public authorities, courts and tribunals, and state law enforcement agencies).
– Where necessary for the provision of healthcare services, in particular: diagnostic centres and laboratories for carrying out pre-operative tests (such as IM Clinic or other partner centres), under data processor agreements as provided for in Article 28 of the GDPR.
– Technology service providers (hosting, CRM, email platforms, web analytics) acting as data processors under a contract entered into in accordance with Article 28 of the GDPR, with access strictly limited to what is necessary for the provision of the service.
– In the case of communications to the patient’s insurer or medical funding bodies, this will only take place with the prior and express consent of the data subject. ARQÉA S.L.P. does not sell, rent or transfer personal data to third parties for commercial or advertising purposes.
Generally speaking, ARQÉA S.L.P. does not intend to carry out international transfers of personal data to countries outside the European Economic Area (EEA).
However, some of the technology providers used (for example, cloud storage services, email marketing platforms or analytics tools) may involve data transfers to third countries. In all such cases, ARQÉA S.L.P. ensures that these transfers are carried out with the appropriate safeguards required by the GDPR, whether through standard contractual clauses approved by the European Commission, the EU-US Data Privacy Framework, or other equivalent safeguards.
For specific information on transfers relating to the use of cookies, please see the Cookies Policy
In accordance with the GDPR and the LOPDGDD, the data subject may exercise the following rights at any time:
– Right of access: to obtain confirmation as to whether ARQÉA S.L.P. is processing their personal data and, where applicable, to access such data.
– Right to rectification: to request the correction of inaccurate or incomplete data.
– Right to erasure (‘right to be forgotten’): to request the deletion of their data when, amongst other reasons, it is no longer necessary for the purposes for which it was collected, or when they withdraw their consent.
– Right to restriction of processing: to request that the processing of your data be restricted to its storage, in certain circumstances provided for by the regulations.
– Right to data portability: to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another data controller, where the processing is based on consent or a contract.
– Right to object: to object to the processing of your data, in particular for direct marketing purposes or where the processing is based on the data controller’s legitimate interests.
– Right not to be subject to automated decision-making: not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or significantly affect you.
How to exercise your rights
To exercise any of the above rights, the data subject may contact ARQÉA S.L.P. via the following channels:
– By email to: info@arqea.clinic, stating in the subject line: “Exercise of GDPR rights — [relevant right]”.
– By post to: C/ Pedro i Pons 14, Pta. 03, 08034 Barcelona, Spain, enclosing a copy of your identity document (DNI, passport, NIE or equivalent).
ARQÉA S.L.P. will respond to the request within a maximum of one (1) month from receipt, which may be extended by up to two additional months depending on the complexity or number of requests, subject to prior notification to the data subject. If the data subject considers that their rights have not been satisfactorily addressed, they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority, via its website: www.aepd.es. However, we invite you to contact ARQÉA S.L.P. first to try to resolve any issue directly.
ARQÉA S.L.P. may take photographs and clinical images of patients (before and after procedures) for clinical care and clinical documentation purposes and, with the patient’s express consent, for promotional or informational purposes on the website, social media or other media.
Under no circumstances will identifiable images of patients be published without obtaining explicit, informed written consent, signed by the patient themselves, specifying the specific authorised use. This consent is separate from the informed consent for surgery and may be revoked at any time.
Photographs published for informational purposes on the Website may be accompanied by anonymisation measures (partial face obscuring, pixelation) where required by the nature of the content or at the patient’s request.
ARQÉA S.L.P. may maintain active profiles on social media (Instagram, LinkedIn or other platforms). The processing of data relating to followers and users who interact with these corporate profiles will be carried out in accordance with the terms permitted by each platform for business profiles, for the purpose of communicating ARQÉA S.L.P.’s activities and services, as well as responding to enquiries received through these channels.
ARQÉA S.L.P. will not extract or process personal data from the private profiles of social media users without their express consent. The processing of data by the social media platforms themselves is governed by their respective privacy policies, which are beyond the Provider’s control.
ARQÉA S.L.P., in compliance with the provisions of Article 32 of the GDPR, has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk posed by the processing, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the particular sensitivity of the health data being processed.
The measures adopted include, but are not limited to:
– Encryption of personal data in transit (HTTPS/TLS protocol) and, where applicable, at rest.
– Control of access to data processing systems through robust authentication and the principle of least privilege.
– Regular backup procedures and an incident recovery plan.
– Staff training and awareness-raising on data protection and confidentiality.
– Regular assessment of the effectiveness of the security measures in place.
– Signing of confidentiality agreements and data processor contracts with all suppliers who access personal data.
However, ARQÉA S.L.P. informs the user that security measures on the Internet are not entirely foolproof, and that unlawful behaviour by third parties beyond the Provider’s control may occur.
In the case of processing operations where the legal basis is the data subject’s consent, ARQÉA S.L.P. will obtain such consent in advance, expressly, in an informed manner and, in the case of health data, explicitly, through the mechanisms provided for that purpose (tick boxes on web forms, signing of informed consent documents, etc.).
The data subject has the right to withdraw their consent at any time, without this affecting the lawfulness of the processing carried out prior to such withdrawal. To withdraw consent, please contact ARQÉA S.L.P. via the means set out in section 7 of this Policy.
In the case of electronic marketing communications, you may unsubscribe at any time by using the unsubscribe link included in each communication, or by sending an email to the address provided with the subject line: “UNSUBSCRIBE FROM ARQÉA COMMUNICATIONS”.
ARQÉA S.L.P. reserves the right to amend this Privacy Policy at any time, for legal, technical, organisational or business reasons. Any amendments will be published on the Website and, where they are substantial, will be communicated to the users concerned through the appropriate channels. We recommend that you review this Policy from time to time.
ARQÉA S.L.P. — Tax Identification Number (NIF) B27567973
Carrer de Victor Hugo, 24, 08174 Sant Cugat del Vallès, Barcelona.
Last updated: 16/09/2026