Portal privacy policy
Version web-033 · 23 October 2026
What this document covers
This policy explains how we process your data on this portal: the account you sign in with, your email address and the appointments you request.
It does not cover the medical examination. The processing of your health data, your photograph, your signature and the report sent to the Dirección General de Tráfico (Spain’s Directorate-General for Traffic, DGT) is explained to you and consented to separately, at the centre and in writing, before your examination is carried out. They are different things and are decided separately.
In this policy, a client is the person who receives the centre’s services, including for the purposes of health legislation.
1. Who processes your data
C.R.C. Dr. Illueca — Juan Alberto Illueca Sanchis.
Healthcare centre listed in the Comunitat Valenciana health register under no. 19715.
Driver examination centre registered with the DGT, Jefatura Provincial de Tráfico de Alicante (Provincial Traffic Headquarters of Alicante), no. A-0173.
Calle Alicante nº 5, bajo. 03720 Benissa (Alicante).
Contact: 644 74 17 35 · privacidad@centromedicoillueca.com
Data Protection Officer: Ana Illueca Sala · privacidad@centromedicoillueca.com
All the centre’s staff, healthcare and non-healthcare, are bound by a duty of confidentiality regarding anything they learn through their work, and that duty continues indefinitely even after their relationship with the centre ends (art. 5 of the LOPDGDD and art. 7 of Law 41/2002).
2. What data we process on the portal
To register you and let you sign in, only your email address. We do not ask you for a password: we send you a single-use link, and opening it proves that the mailbox is yours.
Then, if you request an appointment, the data you yourself give us to arrange it, and, if you are already a client of the centre, the data already held in your record.
If your appointment is an examination that requires a photograph —driving, boating or firearms— also the photo you upload or take from the portal. How it is handled, step by step, is explained in the section «The photo for your examination».
The portal does not use advertising or analytics cookies. It stores only what is essential for it to work: the session cookie and, in your browser, the address you requested the link with, the page you were going to before signing in and whether you prefer to see it in light or dark mode. The details, with their duration, are in the legal notice (in Spanish).
And if you fill in the health questionnaire for diving —the one the school asks you for before a course— your email, your name, your identity document, your date of birth and your answers. For that you do not need to be a client or have an account, and it is not linked to any medical record.
And simply browsing this website does not send anything to anyone: there is no analytics, no social media pixels, and no fonts, maps or resources loaded from third-party servers. Everything that makes up these pages comes from our own domain, so your IP address does not reach any company outside the centre while you read them. The external services we do use —which are detailed further below— act as processors and only come into play when you do something specific: sign in with your email, or upload a document to be read.
Legal sex, sex assigned at birth and gender identity
In your record we distinguish three pieces of information that almost always match, but not always, because they serve different purposes and confusing them could harm you:
- Legal sex: the one shown on your identity document. It is the one that appears on the official documents we issue (certificates, prescriptions, communications to the DGT), because they must match your ID.
- Sex assigned at birth: a clinical item. Many medical calculations depend on it —the reference values of a spirometry or a blood test, kidney function, doses, screening or which protocol applies to you— and using another one could give you a wrong result.
- Gender identity: how you identify. We record it so that we treat you appropriately during your care. It is not used in any calculation and does not appear on any document.
Separately there is the tone: the grammatical gender in which we write our emails and messages to you —masculine, feminine or neutral wording that assumes no gender—. You can tell us which you prefer without having to give us your identity; if you do not, we use the one that matches your legal sex. It only changes the wording, it is not health data and you can change it whenever you like.
Sex assigned at birth and gender identity are voluntary: if you do not give them to us, we use your legal sex for everything, as until now, and for identity you can choose “I prefer not to say”. They are health data and specially protected data: they are processed only by the centre’s staff who look after you, on the same legal basis and with the same retention period as your medical record (section 3), they are not disclosed to anyone and they do not appear on official documents. You can ask us to correct or erase them whenever you want (section 10).
3. For what purpose, on what legal basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Creating and maintaining your portal access account | Art. 6.1.b GDPR — necessary to provide the service you request | For as long as you keep the account |
| Checking that the email address is yours (access link) | Art. 6.1.f GDPR — legitimate interest in ensuring that no one signs in with another person’s email | The link expires and can only be used once |
| Managing your appointment request | Art. 6.1.b GDPR — pre-contractual measures and provision of the service | For as long as the care relationship lasts |
| Service notifications: reminders of your appointment, time changes, cancellations and preparation instructions | Art. 6.1.b GDPR — necessary to provide you with the service. They do not require your consent. They do not include any clinical data: no specialty, reason or result is mentioned | For as long as the care relationship is maintained |
| Sending your prescriptions by email, as an attached PDF document, when the practitioner enables it after your visit | Art. 9.2.h GDPR — healthcare you request from us. Unlike the service notifications, this email does contain health information (your prescriptions). It is sent to the address in your record; keep it up to date | The portal does not keep the email; your prescriptions remain in your medical record |
| Sending the documents from your visit, only when you ask us to: they are sent by a member of the centre’s staff, never automatically, and they are attached. They may be administrative —certificates of attendance, the receipt or the invoice— or clinical —the declaration you sign, the signed health questionnaire, the medical certificates, the report on the visit, your prescriptions and any other document with data about your health—. We send them by email, to your confirmed address, or by WhatsApp, to your number, from the centre’s WhatsApp Business account (section 4). Clinical documents are protected with a password, unless you choose to receive them without one; the message that goes with them only contains your name, the date of the appointment and the link to your area. Your documents are also in your area, for you to view or download whenever you wish | Art. 9.2.h GDPR (healthcare, preventive or occupational medicine and assessment of your capacity), together with art. 6.1.b (the service you contract) and, depending on the document, art. 6.1.c (the legal obligation to give you the information and the copy of your clinical documentation, art. 18 of Law 41/2002). They are encrypted with the piece of your data that you choose —your identity document, your phone number or your date of birth—, and sent without a password only if you expressly choose so, which is recorded. The only exception is the appointment certificate, which is sent unencrypted because it is for you to hand to your employer and contains no clinical data. By email they are sent only to confirmed addresses, and the email subject line never says why you came | The portal does not keep the email sent. Your appointment records what was sent, to which address, when, how it was secured and who sent it; the documents remain in your file with their own retention period |
| What those files are opened with: we store which piece of your data you have chosen as the password —your identity document, your phone number or your date of birth—, or that you have preferred not to set one. We do not store any password of yours: you do not type it, you choose it from data you have already given us. If you have not yet chosen, we ask you before the first sending, and until then nothing is sent | Art. 6.1.b GDPR — it is your preference about how we send you your documents, and you can change or remove it whenever you wish from your area | For as long as you have an account |
| Public verification of the centre’s documents —prescriptions and, since 05/09/2026, signed declarations from the examination—: a log of the checks made at /verificar with the code (CSV) printed on the document — date, code checked, result, browser, whether it was reached by scanning the QR code or by typing, the IP address and an irreversible pseudonym of it. If your browser allows it, also how long the page was open and whether the centre’s phone number or email was clicked | Art. 6.1.f GDPR — legitimate interest in detecting attempts to guess codes, in being able to prove that a document was verified and in handling the issues raised with us from that page. The page does not show any health data: no medicine, no diagnosis, no client identity — for declarations it says only that the document exists, which procedure it concerns, when it was signed and whether it is intact. The person checking is usually a pharmacy or whoever receives the paper, not the client; the IP address is not cross-referenced with any other information nor used to profile anyone | Indefinitely. The log does not reveal who checked, what anyone was prescribed or what anyone declared, and its value —detecting abuse and being able to prove a verification years later— requires keeping it |
| Enquiries you send us by email or through the «Escribir al responsable» (write to the person in charge) form on the website (for example, from the verification of a document): your email address, your name or organisation if you give it, the message, any files you attach, the document you are asking about and our replies. We keep a copy of every email received and sent in the centre’s software, separately from the mailbox, so that we can prove what was asked and what was answered | Your own request when you write to us: Art. 6.1.b GDPR if you are a client and the enquiry is about the service, and Art. 6.1.f — legitimate interest in handling the enquiries addressed to us and in keeping a record of the answers given — in all other cases. We do not ask you for health data; if you give it to us, it is used only to reply to you, under the same duty of confidentiality. The emails are seen only by the person in charge of the centre | 5 years from the last message of the conversation (the time limit for bringing a claim, Art. 1964.2 of the Spanish Civil Code); after that, the email, its attachments and the replies are deleted. If an enquiry contains information that must go into your medical record, it is added to it and follows its retention period |
| Health questionnaire for diving (Annex I to Royal Decree 550/2020 (RD 550/2020)): generating the paper you hand to your school and keeping what you declared | Art. 9.2.a GDPR — your explicit consent, in the box you tick before starting. And, once given, the centre keeps it as proof of what you declared in case it needs to defend itself against a claim (art. 9.2.f GDPR) | It is kept, as proof and like the rest of the centre’s health data. You may ask for it to be erased once 6 years have passed since you filled it in. Withdrawing your consent prevents it being used for anything else, but does not erase it |
| Proving that you accepted this policy | Art. 5.2 and 7.1 GDPR — obligation to be able to demonstrate it | For as long as liabilities may arise |
| Renewal reminder: a notice when the expiry date of the permit or licence you renewed here approaches and, if we cannot reach you, a further reminder or two, never more than three. It is not advertising | Art. 6.1.f GDPR — legitimate interest, by way of art. 21.2 of the LSSI: you are already a customer and the notice concerns the same service you contracted. It does not require your consent: the question comes set to “Yes” and you can object with one tap on “No”, at any time: wherever you are asked, from your profile, at the front desk or with the link included in every notice. It contains no clinical data or results | Until you object, or until the date of the notice. A copy of the notice sent by email is kept for 5 years |
| The centre’s blog, which is the centre’s own advertising: each new article, by email or WhatsApp, whichever you choose, and access to read it on the portal | Art. 6.1.a GDPR — your consent (subscribing to the blog), and art. 21.1 of the LSSI. It is requested separately and is never included in this acceptance: the question comes set to “No”, and the blog is only sent to you if you choose “Yes”. Reading the blog requires a subscription, because that is what you subscribe to. You can unsubscribe whenever you like, including with the link in every article | Until you withdraw your consent |
Your health data —your medical record, your examinations and the photograph from your appointment, your questionnaires and surveys— is not erased automatically: it is kept for as long as you do not ask us to erase it, and that request can be granted once 6 years have passed since it was collected —the legal minimum is five (art. 17.1 of Law 41/2002)—. The only exception is the report from a driver examination, which the DGT requires to be kept for 10 years (art. 15.5 of Royal Decree 170/2010 (RD 170/2010)): until then it cannot be erased, even if requested.
The rest of your data, when its periods expire, is not erased all at once: it is blocked —set aside and available only to judges and courts, the Public Prosecutor’s Office and the competent authorities— for the limitation period of any possible liabilities (art. 32 of the LOPDGDD), and then securely destroyed.
4. Who else is involved
For the portal to work we rely on providers who access your data as processors, under a contract in accordance with art. 28.3 of the GDPR and without authorisation to use it for their own purposes:
| Who | What for |
|---|---|
| Hosting and database provider | Technical custody of the portal’s information |
| Google Ireland Ltd. (Firebase Authentication) | Verifying your identity and sending you the access link. It processes your email address and the dates of your sign-ins. It does not access any clinical data. |
| Email provider | Sending service notifications and the documents you ask us for, which travel encrypted unless you have chosen otherwise |
| ASETEC Ingeniería de Sistemas, S.L. (Mensatek, sending of text messages) | Sending you the centre’s text messages (SMS), which come from the sender name «CRC Illueca» (how to recognise them, just below this table). It processes your mobile number and the text of the message, which is one of two things: the code to check your phone —at the front desk or from «Mi perfil»—, or the notice that the prescriptions from your visit are available in your client area of the portal, with the date of the visit and the link. The text never includes the medicine, the diagnosis or the reason for the consultation. It is a Spanish company, the same one that provides the centre with time-stamping for signed documents; for that time-stamping it only receives a cryptographic digest of the document, never your data. |
| WhatsApp Ireland Limited (WhatsApp Business, messaging) | It is the messaging service the centre uses to write to you on WhatsApp. The messages are sent from the centre’s WhatsApp Business account —from its phone or from WhatsApp Web on the front-desk computer— by a member of the centre’s staff: the system only leaves the message written for them to check and send. We write to you on WhatsApp to:
The text of no message states the service, the reason for the consultation or a result: anything with data about your health goes inside the attached document, locked with your password if you have chosen one. WhatsApp processes your phone number, the messages and files we exchange and the usage data of the communication (for example, when each message is sent and delivered). If you would rather we did not write to you on WhatsApp, tell us: we will send it by email or you will find it in your area, and the service is the same. According to WhatsApp’s terms for the WhatsApp Business app, WhatsApp Ireland Limited, part of the Meta group, processes those data as the centre’s processor. Your own WhatsApp account, if you have one, is also governed by WhatsApp’s privacy policy. The safeguards for the transfer are in section 5. |
| Delonia Software, S.L. (eReceta) | Issuing your private electronic prescription when the consultation has been by video consultation. It processes the data the prescription needs: your name, your identity document, your date of birth and the medicine and dosage the doctor has prescribed for you. It is the platform that the Colegio Oficial de Médicos de Alicante (Alicante Official College of Physicians) makes available to its members. |
| Google Cloud (Vertex AI artificial intelligence service, Gemini models) | It supports care in the tasks explained in section 8, and among them at two points that are worth distinguishing because they process data about your health:
In both cases only the image is sent: not your name, not your identity document, not your record number. Google processes it, returns the result and does not keep it for its own purposes or use it to train its models. This is explained in the section «Artificial intelligence in your tests». It processes the data in Google Cloud’s europe-west1 region (Belgium), within the European Union, as a data processor: on behalf of the centre and following its instructions. |
| MONEI Digital Payments, S.L. (payment gateway) | Charging for the video consultation when you book it online and, where applicable, refunding you the amount. It is a Spanish payment institution, registered in Málaga, authorised and supervised by the Banco de España (no. 6911). It receives the amount, your appointment reference and your email address, and nothing else: your name is not sent to it. You type your card details on its secure page and they never pass through our server. No clinical data travels with the payment — it only sees a generic description of the service and the amount. Your payment data does not leave the European Union. |
| Twilio Inc. (video consultation relay) | Acting as a relay for the video consultation only when your connection and the practitioner’s cannot reach each other directly —for example, behind the firewall of a company, a hospital or some mobile operators—. If the direct connection works, the relay is not used. The relay is in Frankfurt (Germany), within the European Union. It only forwards packets that are already encrypted from one browser to the other: the keys are agreed between the two browsers and never pass through it, so it cannot see the image or hear the sound, nor does it receive your name or any data from the consultation. What it does process is the connection data: the IP addresses and ports of both ends, the time, the duration and the volume of data transmitted. It acts as a data processor, under Twilio’s data protection addendum (updated on 9 April 2026), which forms part of its terms. The transfer safeguards are in section 5. |
How to recognise a text message from the centre
Text messages from the centre always come from the sender name «CRC Illueca». That name is registered in the Registro de Alias (register of SMS sender names) of the Comisión Nacional de los Mercados y la Competencia (CNMC, the Spanish National Markets and Competition Commission), under CNMC Circular 1/2026 and Orden TDF/149/2025: the CNMC granted the registration on 9 October 2026.
If you receive a text message that claims to be from the centre but comes from a different sender —a phone number or any other name—, be wary: do not reply or tap its links, and if in doubt call us on 644 74 17 35.
Our text messages only ever contain one of two things: the code to check your phone, which you read out to us at the front desk, in person, or type in yourself in «Mi perfil» if you check it from there, and which you should not give to anyone else; or the notice that your prescriptions are available, with a link to your client area of the portal. If you are unsure about a link, do not tap it: go to the portal yourself by typing our address, centromedicoillueca.com. We never ask you by text message for passwords, PINs or bank or card details, nor to send them to us by replying to a message.
The pharmacy, when your prescription is electronic
A private electronic prescription is only useful if the pharmacy can read it. That is why, when your prescription is issued this way, it is stored in an approved repository and the pharmacy you choose can consult it —through Nodofarma, the system of the pharmacists’ professional association— so that it can dispense your medication anywhere in Spain.
The pharmacy is not one of our providers: it accesses the prescription in its own right, within the framework of the Sistema de Receta Electrónica Privada (Private Electronic Prescription System) established by the General Councils of Physicians, Pharmacists, Dentists and Podiatrists under art. 14.4 of Royal Decree 1718/2010 (RD 1718/2010). The legal basis remains the healthcare you request from us (art. 9.2.h GDPR).
In that system, the data controller for your prescription data is your prescribing doctor — Juan Alberto Illueca Sanchis, member no. 030308096, the same controller as for this policy—. They are accessed by the pharmacy you choose, in order to dispense to you, and by the pharmacists’ professional association, for the interoperability that allows you to collect your medication at any pharmacy in Spain and for the traceability of dispensations. The pharmacist only accesses your treatments with your consent, which you are asked for before the prescription is issued.
The Medication Sheet issued by that system gives as its contact the prescribing doctor’s personal email, because it is the one in his profile on the platform. If you write there to exercise your rights, your request is handled in the same way as if you send it to privacidad@centromedicoillueca.com, which is the centre’s address for data protection.
If your consultation was in person, none of this happens: your prescription is issued on the College’s official form, it is handed to you, and it is not stored in any external repository.
The photo for your examination
Driving, boating and firearms examinations must, under the regulations, include a photograph of you in the report. You can bring it on the day of your appointment or send it in advance through the portal, and if you send it in advance the process is as follows:
1. The one you upload is stored EXACTLY AS IT IS. We do not apply any filter, crop, colour change or background to it: what is archived is a faithful copy of what you submitted. The only thing we do on receiving it is strip the metadata it carries (location, date and camera model) and straighten it if your phone sent it sideways. If you applied a filter with your phone, it is your photo and we do not touch it.
2. And until the centre validates it, it carries a mark. Until someone has checked it, it is shown flagged as pending validation. The validation is done by the centre’s staff at the front desk, on the day of your appointment and with you present: they check that the photograph matches you, because that responsibility lies with the centre and cannot be settled by looking at a file. The date you uploaded it and the date it was validated are recorded.
3. Adjustments are made by the centre, not by you or the portal. If needed to meet the official format, the framing, colour or brightness are corrected at the front desk and a white background is added. This used to be done automatically on upload and has been deliberately removed: what goes into an official report must come from a photo that someone at the centre has seen and approved.
Those adjustments are about format: each public authority requires the photo with a particular size, a plain background, the head framed and a minimum quality, and the one submitted does not always meet those requirements.
The framing, colour and brightness are adjusted by hand by the centre’s staff, with the software’s editor. For the white background an artificial intelligence system is used that runs on the centre’s computer: the image is not sent anywhere for that step.
That AI separates the person from the background; it does not draw. They are adjustments of format, not of content: your features are not altered, your face is not retouched and no system generates a new image. The photo is still the one you submitted, adapted to what the official form or register accepts.
4. In your record. The photo stays in your medical record and becomes your profile photo on the portal (the latest one you upload always prevails; you can change it from your profile). For driving licence issues, having it uploaded in advance is also one of the conditions for the reduced price.
The photo from your appointment and your examination is part of your medical record: it stays with it, it is never deleted automatically and it can only be removed if you ask for it, once the retention period described in section 3 has passed. On the other hand, your profile photo —the one used to recognise you at the front desk— is kept for as long as you do not change it or deactivate it: the centre never deactivates it on its own. Old photos that are no longer your profile photo and are not linked to any appointment or examination are deactivated automatically when you have had no visits for 2 years.
5. To the DGT, only if your examination is for driving. The psychophysical fitness report is sent electronically to the Registro de Conductores (National Drivers’ Register) with your photograph included, because art. 15.2 of RD 170/2010 requires it — it is a legal obligation of the centre (art. 6.1.c GDPR), and since November 2024 that image is the one the DGT uses for your licence. For boating and firearms the photo goes only on the paper form that you take away; it is not sent to any public body.
Apart from the above, we do not disclose your data to anyone, except to health authorities and courts and tribunals where there is a legal obligation to provide it.
5. International transfers
The sign-in service is provided by a Google group company. Depending on the project’s configuration, authentication data —your email— may be processed outside the European Economic Area, under the standard contractual clauses approved by the European Commission. You can ask us for a copy of those safeguards.
The artificial intelligence that supports your care (sections 4 and 8) does not involve any international transfer: Google Cloud provides it in a fixed European region (europe-west1, in Belgium) and your data is processed within the European Union. Only some internal assistants that look up information on the internet —about foods or medicines, for example— use another Google service with no fixed region, and those searches carry none of your data.
The video consultation relay (sections 4 and 6) is provided by Twilio Inc., a United States company. The relay is fixed in Frankfurt (Germany), within the European Union, but the connection data it generates —IP, ports, time, duration and volume, never the image or the sound— may reach Twilio Inc. in the United States. That transfer is covered, in the order its contract applies them, by its participation in the EU-U.S. Data Privacy Framework, its binding corporate rules and the standard contractual clauses approved by the European Commission. You can ask us for a copy of those safeguards.
WhatsApp messages (section 4) are provided by WhatsApp Ireland Limited, in Ireland, but according to its terms the data may reach WhatsApp LLC and Meta Platforms, Inc., in the United States, and other WhatsApp sub-processors. That transfer is covered by their participation in the EU-U.S. Data Privacy Framework, and WhatsApp reserves the right to use other safeguards provided for in the GDPR, such as the standard contractual clauses approved by the European Commission. You can ask us for a copy of those safeguards.
6. Video consultations
Some services may be provided by video consultation. When you book one, the image and sound travel encrypted end to end, between your browser and the practitioner’s (WebRTC). We do not use any external video provider: no one but the two of you can see or hear the call.
For the two browsers to find each other, when the call starts each one asks a public Google server what its own internet address is. That server only sees your IP address, like any website you visit: it does not receive the image, the sound, your name or any data from the consultation.
Normally, once they have found each other, the two browsers talk directly. But if either connection does not allow it —a company or hospital firewall, some mobile networks—, the call goes through a Twilio relay in Frankfurt (Germany, European Union). That relay only forwards packets that leave your browser already encrypted: it does not have the keys, so it cannot see the image or hear the sound. It processes the connection data —IP addresses and ports, time, duration and volume of data—. You will find this in sections 4 and 5.
The video consultation is not recorded. Neither the image nor the sound is stored anywhere: when the call ends, it ceases to exist. The only thing that remains is what the practitioner notes in your medical record, exactly as in an in-person consultation. Only you and the practitioner assigned to your appointment can enter the room, each with their own portal session.
You, however, may record it. As a participant in the conversation, the law allows you to record your own video consultation for personal use — for example, to listen again to the practitioner’s instructions or to show them to a family member who cares for you. What the law does not protect is its dissemination: publishing or sharing it outside that private sphere may infringe the rights of the practitioner and of any other person who appears in it.
To hold it you need a camera and microphone, to grant permission when the browser asks you, and to enter through the portal’s secure address (https). The legal basis is the same as for any consultation: the healthcare you request from us (art. 9.2.h GDPR).
Payment for the video consultation
When you pay depends on how far in advance you book:
· If the appointment is less than 5 days away, the video consultation is paid when you book it, through a secure payment gateway (MONEI): while you complete the payment, your slot is held for 15 minutes; if payment is not received within that time, the booking expires automatically and the slot is offered again.
· If you book 5 or more days in advance, you do not pay at that moment: the payment window opens 7 days before the appointment and we notify you by email so that you can complete it. If 5 days (120 hours) before the appointment payment has not been made, the booking expires and the slot is released for another client. You can always pay before the window opens.
In both cases you enter your card details on the gateway’s page and they never reach our systems.
At the time of payment, the gateway sends you its payment receipt by email. The receipt and the invoice are issued after the visit, when the practitioner who saw you closes it, with their own invoice series, and with the tax details in your record.
If you cancel the appointment 24 hours or more in advance, we refund the amount in full and automatically, by the same method you paid with. With less notice there is no automatic refund — if there is a justified reason, call us and we will consider it. If the appointment is cancelled by the centre, the refund is always in full, without conditions.
7. Video consultation transcription assistant
This assistant is not active yet. We are telling you about it now because, once it is switched on, it will be part of the way the centre provides video consultations. Until then, the practitioner writes by hand, as always, and none of what follows applies.
What it will do. During the video consultation, an artificial intelligence tool will transcribe the conversation and propose a draft of the reason for consultation in your medical record: what is wrong, since when, and what you think it is due to. The AI proposes and the doctor decides: the draft does not enter your record on its own; the practitioner reviews it, corrects it or discards it, and it is the practitioner who signs it. The assistant makes no decision about your health.
It is part of the basic condition of the service. Once switched on, assisted transcription will be one of the ways in which the centre provides care by video consultation, and it will fall within the AI-supported care that is accepted when you sign up (the basic condition described in section 8), like the other tasks in that section. That is why no alternative video consultation without it will be offered: anyone who does not accept that condition cannot be cared for as a user of the centre. If you have any questions before accepting it, ask us and we will explain.
The audio is not stored: the conversation is transcribed and the voice is discarded immediately, so what section 6 says remains true: the video consultation is not recorded. Only the text survives, and of that, only what the practitioner reviews and signs goes into your record.
Legal basis and retention. Like the rest of the artificial intelligence in section 8, the processing is based on art. 9.2.h GDPR —healthcare provided by a professional bound by secrecy—. What the doctor adds to your record is kept for the same periods as the rest of your documentation.
8. Artificial intelligence in your tests
Care supported by artificial intelligence is a basic condition of the service. At the centre we work with the help of AI tools —to read certain tests, put data in order and prepare the consultation—; the AI never decides anything clinical, and what it needs to see is processed by Google Cloud (Vertex AI service, Gemini models) as a data processor, within the European Union. It is accepted when you create your account on the portal and when you sign the declaration at the centre. The full text (in Spanish) is at Atención con apoyo de inteligencia artificial.
Two of those tasks are explained in full here, because they work on images of your health.
Your electrocardiogram
When an electrocardiogram is done during your visit, the doctor may ask an automated system to measure it and propose findings: the rate, the rhythm, the axis, the intervals and anything notable in the tracing. For this, the image of the tracing is sent to Google Cloud (Vertex AI), which acts as processor and processes it within the European Union.
What is sent and what is not. The image of the tracing is sent, cropped at the top to remove the header where machines print the name, and —only if they have been written down— the reason for consultation, the examination findings and your medical history, because an electrocardiogram is not interpreted the same way with chest pain as without it. Your name, your identity document, your date of birth and your record number are not sent: only your age and sex, which change the normal values.
Screenshots from your watch or fitness band
If you wear a watch or an activity band and want your steps, your sleep and your pulse to be taken into account in your follow-up, you can send us a screenshot of your app. An automated system reads the figures from that image and records them in your follow-up. The image is sent to Google Cloud (Vertex AI), within the European Union, to be read, and without any data that identifies you.
This is voluntary and does not affect anything. Neither your care, nor your price, nor how you are treated depend on whether you do it. If you send nothing, nothing happens.
And they are not our measurements. They are estimates from a consumer device, read from an image. They are useful for seeing a trend and for discussing it in the consultation, and that is how they are marked in your record: separate from the vital signs measured at the centre.
If you send them to us by email, bear in mind that ordinary email is not end-to-end encrypted: it travels through servers we do not control. It is your decision to use it; you can also upload the screenshot from your client area, which uses a secure connection.
What applies in both cases
1. The machine proposes and the doctor decides. Nothing it returns goes into your record on its own. A practitioner reviews it, corrects it or discards it, and until they do so it is marked as an unconfirmed proposal. Who confirmed it and when is recorded.
2. It is not a diagnosis or a medical device. It is an aid to reading, just like the automatic measurement that any electrocardiograph already prints. The diagnosis is made and signed by the doctor, who is answerable for it.
3. It is part of the basic condition of the service. Assisted reading of the electrocardiogram is one of the ways in which the centre provides care, and it falls within the care supported by artificial intelligence that is accepted when you register (the basic condition described at the start of this section). For that reason no alternative care without it is offered: anyone who does not accept that condition cannot be cared for as a user of the centre. None of the above changes: the tool only makes proposals, and it is the doctor who reviews, decides and signs. If you have any questions before accepting it, ask us and we will explain. Sending the screenshot from your watch is still your decision: if you do not send it, nothing is read.
4. Legal basis and retention. The processing is based on art. 9.2.h of the GDPR —healthcare provided by a professional bound by confidentiality—, and the images are kept in your medical record for the same periods as the rest of your documentation. The provider is prohibited from using them for its own purposes or to train its models: Google Cloud’s terms —the «Training Restriction» clause of its service specific terms— prevent it from using the centre’s data to train or fine-tune artificial intelligence models without the centre’s prior permission or instruction.
9. Automated decision-making
The centre does not make automated decisions about you or profile you. The portal does not decide anything on its own: clinical assessments are always made by a healthcare professional.
10. Your rights
You may exercise at any time, free of charge, the rights of access, rectification, erasure, restriction of processing, data portability and objection, and also withdraw your consent as easily as you gave it, without giving a reason and at no cost (art. 7.3 GDPR). Withdrawing it does not affect the lawfulness of processing carried out before.
Two points specific to the healthcare setting: access to your medical record cannot be exercised to the detriment of the confidentiality of third parties or of the subjective notes made by practitioners (art. 18.3 of Law 41/2002), and erasure of your medical record and your examination file cannot be granted while the legal obligation to keep them remains (art. 17.3.b GDPR): in no case before 6 years since they were collected, nor before 10 years for the report from a driver examination. Deleting your portal account does not delete your medical record.
You do not need any form. Just ask us in person or by post at Calle Alicante nº 5, bajo, 03720 Benissa (Alicante), or by email to privacidad@centromedicoillueca.com. We will only ask you to prove your identity. We will reply within one month, which may be extended by up to two further months if the request is especially complex, in which case we will let you know within the first month (art. 12.3 GDPR).
If you consider that your rights have not been properly respected, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) — Edificio Cuzco IV, Paseo de la Castellana 141, planta 9, 28046 Madrid (www.aepd.es).
11. Changes to this policy
Each version of this text has its own number. When you accept, it is recorded which version you accepted and when, so that years later it can be known exactly what you read. If we change anything substantive, we increase the version number and ask you to accept it again.
Version web-033 · 23 October 2026