Privacy policy

Controller: FISIOBOX S.C.P. — Tax ID J42952713

Address: Carrer de Provença, 455, 3rd floor, 08025 Barcelona, Spain

Data protection contact: info@fisiobox.es

Data Protection Officer: not appointed

Identification and contact data: name, email address, telephone number and date of birth.

Health data: type of injury or problem, how long you have had it, any relevant medical history you choose to share, and clinical documents you voluntarily attach (reports, X-rays, MRI scans).

Availability preferences, used solely to propose an appointment time.

How you heard about us (search engine, AI, a friend, social media or other), used only to see which channels work and for nothing else.

This website uses no analytics or advertising cookies. Traffic measurement (Vercel Analytics) is aggregated, with no cookies or identifiers. The only third-party cookies are those Google Maps may set when the map on the booking page is displayed, and only if you allowed it.

First-party cookies: none. Your cookie choice is kept in your browser's local storage (not a cookie, never sent to a server) for 12 months or until you change it.

Traffic measurement: Vercel Analytics and Speed Insights set no cookies or identifiers; they only count page views and load times in aggregate.

Third-party cookies (optional): the Google Maps map on the booking page. It is shown only if you accept all cookies or switch on “Google map” in the settings. Google (Google Ireland Ltd.) may then set its own cookies for the purposes described at https://policies.google.com/technologies/cookies.

Changing your choice: tap “Cookies” at the bottom of any page to open the settings. You can also delete or block cookies in your browser; the site keeps working without them.

Purpose: to handle your appointment request, contact you to confirm it, and where applicable prepare your first clinical assessment.

Health data is a special category of data (GDPR art. 9). The legal basis is your explicit consent, given by ticking the box on the form, together with art. 9(2)(h) GDPR for the provision of healthcare.

For all other data the legal basis is pre-contractual measures taken at your request (GDPR art. 6(1)(b)).

We do not carry out automated decision-making or profiling with your data.

If you do not go on to become a patient, we keep your request for 12 months and then delete it.

If you begin treatment, your clinical record is kept for a minimum of 15 years from the discharge of each episode of care, under article 12 of Catalan Law 21/2000 on health information rights.

We do not share your data with third parties except where legally required.

We use providers acting as data processors under art. 28 GDPR contracts:

Supabase — database and storage of the clinical documents you attach. Servers are located in Madrid (Spain), within the European Union.

Vercel — hosting of the website and of the clinic management platform (app.fisiobox.es), on servers in the European Union (Frankfurt). Vercel Analytics and Speed Insights measure traffic and performance in aggregate, with no cookies or personal identifiers.

Resend — transactional email (appointment confirmations and receipts).

Twilio — the SMS verification code used to confirm your mobile number when you request an appointment. It only receives your phone number.

For providers based in the United States (Vercel, Resend, Twilio), transfers are covered by the EU-US Data Privacy Framework and, subsidiarily, by the European Commission standard contractual clauses.

The map on the booking page is Google Maps (Google Ireland Ltd., policy at https://policies.google.com/privacy): it is shown only if you allow it in the cookie settings; Google then receives your IP address and may set its own cookies. WhatsApp and Google Maps links only transfer data if you choose to tap them.

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent at any time without affecting the lawfulness of prior processing.

To do so, write to info@fisiobox.es stating the right you wish to exercise and enclosing a copy of an identity document.

If you believe your request was not handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the Catalan Data Protection Authority.

We apply appropriate technical and organisational measures to protect your data. Clinical documents you upload are held in a private store that is not publicly accessible, and only authorised clinic staff can view them.