Privacy policy

Data controller

Podonexus, S.L. (Avanza Salud), company tax ID (CIF) B76628916, Avenida República Argentina 18D, 38208 San Cristóbal de La Laguna, Santa Cruz de Tenerife, Spain. Privacy contact: contacto@avanza-salud.com.

What data we process and why

• Account and subscription (name, email, DNI/NIE or passport, date of birth, town and country, encrypted password, subscription level, payment status): to provide the service you have subscribed to, identify you correctly as a patient (Spanish Law 41/2002), verify that you are an adult and apply the correct taxation according to your residence. Basis: performance of the contract and legal obligations.
• Use of the private area (assigned programmes, viewing progress, reviews you send to your clinician, video consultation requests): for your therapeutic follow-up by healthcare professionals. Basis: performance of the contract and, as regards the healthcare purpose, Article 9.2(h) GDPR (provision of healthcare by professionals subject to confidentiality).
• Security (IP addresses, device and browser, access attempts, verification codes): to protect your account and prevent unauthorised access and account sharing. Basis: legitimate interest in the security of the service and fraud prevention.
• Registration checks: to make sure the service is provided to the right person, we may check the information you provide when registering against publicly available sources. Basis: legitimate interest in the correct provision of the service.
• Transactional emails (verification, device codes, notices about your subscription and consultations): necessary to operate the service. We do not send advertising. Every email includes a footer with data protection information and how to exercise your rights.

The clinical record of your treatment is managed at the clinic through its usual care channels; this platform contains exercise instructions and follow-up communications.

Who accesses your data (data processors)

• IONOS (IONOS Cloud S.L.U. / IONOS SE, EU): web hosting and database.
• Bunny (BunnyWay d.o.o., Slovenia, EU): storage and protected delivery of the videos. The videos carry identifying marks.
• Stripe (Stripe Payments Europe, Ltd., Ireland): payment and subscription management. Your full card details are processed only by Stripe; they never reach our servers. Stripe may carry out international transfers under its standard contractual clauses.
• Whereby (Video Communication Services AS, Norway, EEA): video consultation room.

We do not sell or pass on your data to third parties for commercial purposes. Technical note: the pages load fonts from Google Fonts, which means your browser sends your IP address to Google; we are working on serving them from our own servers.

How long we keep your data

While your account is active and, after you leave, for the legal limitation periods (tax and contractual obligations). Security logs are kept for as long as strictly necessary for their purpose. Documentation with healthcare relevance is kept in accordance with the applicable healthcare regulations.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to contacto@avanza-salud.com (attach something that allows us to verify your identity). You can also complain to the Spanish Data Protection Agency (aepd.es).

Cookies

This platform uses essential technical cookies only, which are necessary for the service and exempt from consent: the session cookie (to keep you signed in), the trusted device cookie (so we do not ask you for a code on every access) and the language preference cookie (to remember whether you prefer the portal in Spanish or English). We do not use analytics or advertising cookies.

Security

We apply appropriate technical and organisational measures: encrypted communications (HTTPS), passwords stored with robust algorithms, verification of new devices, a limit on simultaneous sessions, security event logging and two-factor authentication on administration accounts.