Personal data protection

INFORMATION FOR DATA SUBJECTS

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”) and in accordance with Law 18/2018 of December 13, on the protection of personal data and the amendment of certain laws, hereinafter “the Law”.

Trade name: FYZIO KLINIK, S.L.
Company name: RETRIET VACATION S.L.
Address: Avenida V Centenario 1, 38660 Playa de las Américas, Santa Cruz de Tenerife
CIF: B16852402
Contact details:
Phone: +34 675 423 062
Email: office@fyzioklinik.com
(hereinafter, “the Data Controller”)

The Data Controller processes the personal data of the following individuals:

• Clients of the Data Controller.
• Legal representatives and authorized representatives of the clients.
• Visitors and persons present on the premises of the Data Controller.
• Contractual partners who are natural persons.
• Employees of contractual partners.

(hereinafter, “the Data Subject”)

The Data Controller provides the Data Subjects, in accordance with the GDPR and the Law, with the following information related to the processing of their personal data in the Data Controller’s information systems, as well as information about the rights that they are entitled to.

Purposes of Personal Data Processing:

The Data Controller processes personal data for the following purposes:

1. Provision of healthcare and services related to healthcare.
2. Provision of other services.
3. Monitoring of Data Subjects on the premises of the Data Controller.
4. Marketing.

Legal Basis for Personal Data Processing:

The Data Controller processes personal data on the basis of the following legal grounds:

1. For the purpose mentioned in point 2 a): special legal regulations in accordance with Article 6(1)(c) of the GDPR, in particular:
   • Law 576/2004 on healthcare, services related to healthcare, and amendments to certain laws.
   • Law 362/2011 on medicines and medical devices.
   • Law 581/2004 on health insurance companies, supervision of healthcare, and amendments to certain laws.
   • Law 153/2013 on the national health information system.

1. For the purpose mentioned in point 2 b): execution of a contract to which the Data Subject is a party, in accordance with Article 6(1)(b) of the GDPR.
2. For the purpose mentioned in point 2 c): legitimate interest of the Data Controller in accordance with Article 6(1)(f) of the GDPR, related to the protection of public order and security, the detection of crime, protection of property and health.
3. For the purpose mentioned in point 2 d): consent of the Data Subject in accordance with Article 6(1)(a) of the GDPR.

Sharing of Personal Data:

The Data Controller is obligated and authorized to provide personal data of the Data Subjects to recipients, in particular to the persons mentioned in Article 24(4) and Article 25(1) of Law 576/2004, as well as to contractual partners with whom the Data Controller has signed a data processing agreement.

The Data Controller does not transfer and does not intend to transfer the personal data of the Data Subjects to third countries or international organizations.

Retention Period for Personal Data:

The Data Controller keeps personal data in a form that allows the identification of the Data Subject for as long as necessary for the purposes for which the personal data are processed. For example:

• Healthcare documentation of Data Subjects is kept for 20 years in accordance with Law 576/2004 on healthcare.
• Marketing documentation is kept for the duration of the consent given, or until revoked, or until the Data Subject expresses disagreement with the processing of data during the duration of the contractual relationship.
• Security camera recordings are archived for the shortest possible time, usually 15 days, or for the time necessary to process legal responsibilities.

Rights of Data Subjects:

When processing personal data, the Data Subject has the following rights:

1. The right to information about the processing of personal data and access to personal data.
2. The right to rectification.
3. The right to erasure or to be forgotten.
4. The right to restriction of processing of personal data.
5. The right to data portability.
6. The right to object.
7. The right to object to automated decision-making, including profiling.
8. The right to withdraw consent.
9. The right to file a complaint with the Spanish Data Protection Agency.

The exercise of these rights may be subject to certain conditions, as defined by the GDPR.

Provision of Personal Data:

The provision of personal data by the Data Subject for the purpose of receiving healthcare and services related to healthcare is a legal requirement. If personal data is not provided, it may be impossible to provide healthcare.

For the purpose of entering into and performing a contract, the provision of personal data is voluntary, but it is necessary for the contract to be concluded and executed. If the Data Subject has given consent for the processing of their personal data in accordance with Article 6(1)(a) of the GDPR, they have the right to withdraw it at any time. Withdrawing consent does not affect the lawfulness of the processing of personal data prior to the withdrawal.

The Data Controller has provided the Data Subject with information regarding the processing of their personal data and informed them about their rights regarding the protection of their personal data in accordance with applicable legislation.

The Data Controller has the right to modify, complement, or update this information for Data Subjects.

Date of Issue: June 5, 2025