Privacy Policy
Last updated: 08/07/2026
1. Data Controller
The controller responsible for the personal data collected through this website is:
• Full name: ÚRSULA CASADO VÁZQUEZ
• Professional activity: Psychiatry (self-employed professional)
• Tax ID (NIF): 76733798W
• Professional address: Rúa Sinfónica de Galicia, 3, 1, A, 15004 A Coruña
• Registration in Spain: member 15/1512919 of COLEGIO OFICIAL DE MÉDICOS DE A CORUÑA
• Registration in Ireland: IRISH MEDICAL COUNCIL (IMC) 509478
• Contact email: drursulacasado@gmail.com
The professional practises in both Spain and Ireland under the same professional name and the same tax ID
(NIF), and therefore acts as the sole data controller for the data collected through this website, regardless
of the country from which it is accessed.
2. Data we collect
Through the website's contact form, only the following data is collected, voluntarily provided by the user:
• Name
• Contact email and/or phone number
• Free-text message written by the user
This website does not provide clinical consultations or collect clinical/medical history through the form.
The sole purpose of the form is administrative contact to request information or arrange an appointment,
not to communicate clinical data.
3. Note on the context of processing
The form does not request or collect health data. However, since this is the website of a psychiatry
professional, users are advised not to include clinical information in their message, precisely to avoid the
context of the enquiry inadvertently resulting in the disclosure of special category data (Article 9 GDPR).
If, despite this notice, a user voluntarily includes health data in the message, that data will be treated with
due confidentiality and with the enhanced safeguards required for special categories of data.
4. Purpose of processing
The data provided through the form is used exclusively to:
• Respond to the request for information or an appointment.
• Manage communication prior to a possible first consultation.
This data is not used to build profiles, nor to send marketing communications, unless the user has given
separate, explicit consent for that purpose.
5. Legal basis for processing
The legal basis that legitimises the processing of the data is the consent of the data subject (Article 6.1.a
GDPR), given through a non-pre-ticked consent checkbox next to the form, worded along the lines of: "I
agree that my contact details will be processed to handle my request for information or an appointment."
This checkbox is simple and costless to implement, and strengthens the validity of the consent compared to
treating mere submission of the form as consent.
6. Retention period
Data provided through the form will be kept only for as long as necessary to handle the contact request,
and for a maximum of 6 months from the last contact, unless a longer legal retention obligation applies.
After that period, the data will be securely deleted or anonymised.
7. Appointment booking system: Doctoralia and Cliniko widgets
This website does not directly manage appointments or store scheduling data itself: the booking calendar is
displayed through an embedded widget provided by a third party, which differs by country:
• For patients in Spain: Doctoralia (Docplanner) widget.
• For patients in Ireland: Cliniko widget.
These two providers play different roles from a data protection perspective:
• Doctoralia (Docplanner) acts as an independent controller with respect to the management of your
account and the booking platform itself (for example, your Doctoralia user profile, cookies set by its
own widget, or communications relating to the use of the platform). For that part, Doctoralia's own
privacy policy applies: https://www.doctoralia.es/politica-de-privacidad-del-paciente,
https://www.doctoralia.es/privacidad. Regarding the appointment data itself (date, time, contact
details provided to book it), Doctoralia acts as a technology support provider to the professional, who
remains the controller for that part of the processing.
• Cliniko acts as a data processor (under Article 28 GDPR) on behalf of the professional, who is the
controller of the appointment data managed through this widget. Cliniko processes the data solely in
accordance with the professional's instructions and under the safeguards set out in its data processing
agreement (DPA).
When using the appointment booking widget, Doctoralia or Cliniko may set their own cookies or similar
technologies in the user's browser, separate from the rest of the website. This is described in the site's
cookie policy.
Data provided when booking an appointment through these widgets (name, contact details and, where
applicable, reason for the appointment) is used solely to manage the requested appointment, and is not
combined with data collected through this website's contact form, unless it concerns the same person
managing their own request.
8. Recipients and data processors
To provide the website service and manage the contact form, the following providers are used, acting as
data processors under Article 28 GDPR:
• Web hosting provider: IONOS
• Email provider where messages are received: SOLUCIONES CORPORATIVAS IP, S.L.
• Cliniko (appointment scheduling for patients in Ireland), acting as a data processor.
• Web analytics tool: Google Analytics
A data processing agreement, as required under Article 28 GDPR, is or will be in place with each provider
acting as a processor that has access to personal data. Doctoralia, for the part in which it acts as an
independent controller, is governed by its own privacy policy, referenced in the section above.
9. International data transfers
Should any of the providers listed in the sections above (including Cliniko, based outside the European
Union) store or process data outside the European Economic Area, such transfer is carried out on the basis
of the appropriate safeguards provided for under the GDPR (such as the European Commission's Standard
Contractual Clauses, or an applicable adequacy decision, where relevant to that provider).
10. Rights of data subjects
Any person has the right to:
• Access their personal data.
• Request rectification of inaccurate data.
• Request erasure of their data where, among other reasons, it is no longer necessary.
• Request restriction of the processing of their data.
• Object to the processing of their data.
• Request data portability.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before
withdrawal.
These rights may be exercised by sending a request to drursulacasado@gmail.com, stating the right to be
exercised and enclosing a copy of a document proving the identity of the requester. Where a request relates
to appointment data managed through Doctoralia or Cliniko, it will still be handled by the professional,
who will forward the request to the relevant provider where appropriate.
11. Right to lodge a complaint
If a data subject believes that the processing of their data does not comply with applicable law, they have
the right to lodge a complaint with the relevant supervisory authority:
• In Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es
• In Ireland: Data Protection Commission (DPC) — www.dataprotection.ie
Data subjects may contact the supervisory authority of their habitual country of residence, regardless of
where the controller is established.
12. Security measures
Appropriate technical and organisational measures have been implemented to ensure a level of security
appropriate to the risk, including, among others: encrypted connection via HTTPS/SSL across the entire
website, restricted access to emails received through the form, and regular updates to the content
management system (WordPress) and the plugins used.
13. Minors
This website, the contact form, and the appointment booking system can be used by individuals aged 16
and over, the age from which applicable law in Spain and Ireland recognises capacity to consent to one's
own healthcare. If the user is under 16, contact or booking should be made through their parent or legal
guardian.
14. Changes to this privacy policy
This privacy policy may be updated to reflect legislative developments or changes to the operation of the
website. Users are encouraged to review this page periodically. The date of the last update appears at the
beginning of this document.
15. Contact
For any query relating to this privacy policy, please write to drursulacasado@gmail.com.