Privacy policy

At Akro Las Palmas we take the protection of your personal data seriously, including any health data you may share with us. This page explains, in plain language, what data we process, what we use it for and what rights you have.

1. Who is the data controller

• Controller: SM Grupo Sanitario SLU (Akro Las Palmas)
• Tax ID (CIF): B76304575
• Registered address: C/ Mario César 37, 35010 Las Palmas de Gran Canaria
• Contact email: info@akrolaspalmas.com
• Data protection officer: Silvia Mejías Suárez (info@akrolaspalmas.com)

2. What data we process and where it comes from

The data we process comes directly from you, through the contact form on this Website, your phone calls, WhatsApp messages or emails, and your care relationship with the clinic. In the contact form we ask for your name, phone number (optional), email and the message you wish to send us.

3. What we use your data for (purposes)

• Responding to the enquiries you send us through the contact form, by phone, WhatsApp or email.
• Managing your appointment request and your care relationship with the clinic.
• Complying with our legal obligations as a healthcare centre.

We do not use your data to build automated profiles or for marketing purposes without your prior express consent.

4. Health data (special category data)

When you write to us through the contact form, your message may include information about your state of health (for example, the reason for your enquiry or the treatment you are looking for). This is special category data under Article 9 of the General Data Protection Regulation (GDPR), and we treat it with particular care:

• It is used solely to handle your enquiry or manage your appointment, never for any other purpose.
• It is not shared with third parties, unless there is a legal obligation requiring us to do so (for example, a court order).
• It is kept only for as long as necessary to handle your request and, where applicable, for the duration of the care relationship and the legal retention periods for clinical records.
• It is accessed only by the members of the team who need to know it in order to care for you.

5. Legal basis for processing

We process your data on different legal bases depending on the purpose:

• Enquiries via the web form, phone, WhatsApp or email: your consent (Art. 6.1.a GDPR). If your message includes health data, the basis is your explicit consent (Art. 9.2.a GDPR), given when you tick the box before submitting the form.
• Managing your appointment and the care relationship at the clinic: the performance of that relationship (Art. 6.1.b GDPR) and, for health data, the provision of healthcare by professionals bound by professional secrecy (Art. 9.2.h and 9.3 GDPR).
• Keeping your medical record and other obligations as a healthcare centre: compliance with legal obligations (Art. 6.1.c GDPR), in particular Act 41/2002.

Where the basis is your consent, you may withdraw it at any time without affecting the lawfulness of prior processing; withdrawal does not require us to erase data we must keep by legal obligation, such as your medical record.

6. Who we share your data with (recipients)

We do not share your data with third parties, except where legally required. We do work with providers who access data on our behalf in order to provide us with a service (data processors), in particular:

• IONOS SE: hosting of the Website and email. A data processing agreement (Art. 28 GDPR) is in place, governing access to the data and the provider's confidentiality and security obligations.

7. How long we keep your data

We keep contact form data for as long as necessary to handle your request; after that period, it is deleted or anonymised, unless it must be kept to comply with a legal obligation. Data arising from the care relationship (clinical records) is kept for the periods required by current healthcare legislation.

8. Your rights

You can exercise the following rights at any time and free of charge:

• Access: knowing what data of yours we process.
• Rectification: correcting inaccurate data.
• Erasure: requesting that we delete your data.
• Objection: objecting to a specific processing activity.
• Restriction of processing: asking us to restrict the use of your data.
• Portability: receiving your data in a structured format.
• Withdraw the consent you have given us, at any time.

To exercise these rights, write to us at info@akrolaspalmas.com, stating the right you wish to exercise and attaching a copy of your identity document. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security measures

We apply appropriate technical and organisational measures to guarantee the confidentiality, integrity and availability of your data, adapted to the risk of the processing (communications encrypted via HTTPS, restricted access to systems and oversight of the providers acting as data processors).

This privacy policy is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

In case of discrepancy, the Spanish version prevails.

Last updated: July 2026.