PRIVACY POLICY
Dr Veronika Strauchs
veroDENT • International Functional Dentistry
In this policy we explain how we process your personal data when you visit our website, contact us, request an appointment or receive dental care, as well as the rights you may exercise.
We apply Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), and applicable health and information society services regulations.
1 Who is the data controller
Controller: Dr Veronika Strauchs, a professional practising under the trade name veroDENT • International Functional Dentistry
Dr Veronika Strauchs, who operates under the trade name veroDENT • International Functional Dentistry, at the following address: Calle Pintor Sorolla 19, 46002 Valencia, Spain.
Phone: +34 962 324 155
WhatsApp: +34 613834469
Email for enquiries and data protection: hola@vero-dent.es
Website: vero-dent.es
You may contact the controller using these contact details for any matter concerning your personal data: Dr Veronika Strauchs
2 What data we process and its source
We process the data necessary for each procedure. Depending on your relationship, it may include:
• Identification and contact data: full name, telephone, email, address, date of birth and, where necessary to identify you or to comply with legal obligations, DNI, NIE, passport or another identity document.
• Enquiry and appointment data: information you provide, date and time of the appointment, communications and contact preferences.
• Health data: medical history, anamnesis, medication, allergies, symptoms, examinations, diagnoses, treatments, progress and clinical consents. Where your care requires it, also reports from other professionals, X-rays, clinical photographs, intraoral scans and digital models.
• Financial data: estimates, invoices, payments and the data needed to manage payment.
• Representation data: identity, contact details and authority of the person legally acting on behalf of the patient.
• Technical browsing data: IP address, date and time of access, resource requested, browser and device information and logs necessary for the operation and security of the website.
The data comes mainly from you, your representative and the care provided. We may also receive documentation from healthcare professionals or centres involved in your care, where a legal basis allows its disclosure. If we receive data from another source, we will provide the information required on its origin and processing within the time limits of Article 14 GDPR, unless a legal exception applies.
We do not need your medical history to answer an administrative enquiry. Avoid including diagnoses, clinical photographs or reports in the general form or on WhatsApp. If needed, we will tell you a suitable way to send them.
3 How we use your data and the legal basis
3.1 Enquiries and information requests
We use your contact details and the content of your message to respond to your request and carry out related procedures. If your enquiry concerns an appointment or services you wish to contract, the legal basis is the application of pre-contractual measures at your request or the performance of the contractual relationship, in accordance with Article 6(1)(b) GDPR.
For other non-contractual enquiries, we rely on our legitimate interest in responding to communications addressed to us, in accordance with Article 6(1)(f) GDPR, respecting your rights and reasonable expectations. Requests to exercise rights are processed to comply with our legal obligations, in accordance with Article 6(1)(c) GDPR.
3.2 Appointment management and care communications
We process your data to arrange, confirm, change or cancel appointments and to send the communications necessary for your care and follow-up. The legal basis is Article 6(1)(b) GDPR and, for applicable healthcare obligations, Article 6(1)(c). Where information reveals health data, Article 9(2)(h) also applies, with the professional secrecy safeguards of Article 9(3).
Appointment reminders contain the minimum information necessary. A communication about an appointment or an agreed care follow-up does not constitute authorisation to send you advertising.
3.3 Dental care and clinical records
We process your data to assess your health, make a diagnosis, plan and provide dental care, document it and carry out follow-up. Where applicable, this includes functional assessment, bruxism, temporomandibular joint disorders, occlusion and orofacial pain, as well as the preparation of splints or other individualised devices.
The legal basis is the provision of the healthcare services requested, in accordance with Article 6(1)(b) GDPR, and compliance with healthcare and documentation obligations, in accordance with Article 6(1)(c), in conjunction with Law 41/2002 and Law 10/2014 on Health of the Valencian Community. The processing of health data is based on Article 9(2)(h) GDPR and is carried out under the safeguards of Article 9(3).
Using the data necessary for your care does not depend on a general authorisation for any use of your data. Informed consent for a clinical procedure is different from consent for optional processing of personal data, such as advertising or the publication of images.
3.4 Estimates, invoicing and payments
We process the data necessary to prepare estimates, issue invoices, manage payments and comply with tax and accounting obligations. The legal bases are Article 6(1)(b) and Article 6(1)(c) GDPR. We limit the clinical information included in administrative documentation to what is necessary.
3.5 Complaints and legal obligations
We may process the data necessary to handle complaints, respond to requests from authorities and establish, exercise or defend legal claims. Depending on the case, the legal bases are compliance with a legal obligation, Article 6(1)(c) GDPR, or our legitimate interest in defending legal claims, Article 6(1)(f). If health data is required for a claim, Article 9(2)(f) also applies.
3.6 Advertising and images for publication
Requesting an appointment, sending a form or receiving treatment does not imply consent to advertising or publication of images or testimonials.
If we propose sending you promotional communications, we will ask for a specific, voluntary and separate authorisation. In that case, the legal basis will be your consent, Article 6(1)(a) GDPR, and Law 34/2002 on electronic communications will apply. You may unsubscribe through the method indicated in each communication or by writing to us. Refusal or withdrawal will not affect your healthcare.
Publishing identifiable photographs, videos or testimonials will require a specific authorisation stating the materials, purpose and means of dissemination. If they reveal health data, explicit consent under Article 9(2)(a) GDPR will also be necessary. Photographs and scans used for diagnosis or treatment are not published merely because they form part of your clinical record.
4 Required and voluntary data
Forms mark the fields essential for each request. Additional information is voluntary. Without the necessary contact details, we may be unable to respond or manage your appointment.
Clinical data needed for safe, appropriate care, and data required by law, must be provided so the procedure can take place. If essential information is missing, we will explain the consequences. Your care is not conditional on advertising consent.
If you act on behalf of another person, you must have valid representation or authorisation. Provide only the necessary data and, where appropriate, inform that person.
5 Appointment management and coordination in collaboration with Medicality
Dr Veronika Strauchs, who operates under the trade name veroDENT • International Functional Dentistry. The contact details published by this entity for privacy matters are rsanz@medicality.es and +34 626 344 238.
This collaboration covers receiving and processing appointment requests, coordinating schedules, confirming, changing or cancelling appointments and the administrative communications needed to organise the requested care. It applies to requests sent to veroDENT by telephone, email, WhatsApp, web forms and other enabled channels, including those handled by Medicality staff on behalf of veroDENT.
Data processed and access restrictions
For these purposes, identification and contact data, scheduling availability, appointment data and the information strictly necessary to process the request may be processed. Where essential to organise healthcare, limited information about the reason for the visit may also be processed.
Access by administrative staff will be limited to the data necessary for their duties. Collaboration in appointment management does not allow general or indiscriminate access to the clinical record, nor does it authorise the use of data for purposes unrelated to the assigned service.
Responsibility, processing agreement and confidentiality
When managing appointments on behalf of veroDENT, Dr Veronika Strauchs acts as controller and CLÍNICA KUNZE, S.L.P. as processor, following the documented instructions of the controller.
Both parties have entered into a data processing agreement in accordance with Article 28 of Regulation (EU) 2016/679 —General Data Protection Regulation, GDPR—, which governs the processing of data and the applicable confidentiality and secrecy obligations.
Medicality and authorised staff must respect the confidentiality of information, legal secrecy obligations and, where applicable, professional healthcare secrecy. These obligations continue after the collaboration ends. Appropriate technical and organisational measures proportionate to the risk must also be applied, and access must be restricted to authorised persons.
Data processed on behalf of veroDENT may not be used for Medicality's own advertising, be included in commercial campaigns or be used for other independent purposes under this agreement.
Legal basis
The processing necessary to handle an appointment request and organise the requested care is based on Article 6(1)(b) GDPR, concerning the application of pre-contractual measures at the request of the data subject or the performance of the contractual relationship. Where it is necessary to process health data to organise or provide healthcare, Article 9(2)(h) GDPR also applies, with the confidentiality safeguards provided in Article 9(3).
Medicality privacy information
You can consult Medicality's published information in its Privacy Policy.
This information supplements the identification of the partner entity but does not replace this policy or change the instructions and restrictions applicable to Medicality's processing on behalf of veroDENT.
Communication channels, retention and rights
Using WhatsApp is voluntary; you may also request an appointment by telephone or email. For administrative purposes, provide only the necessary information. If you need to send reports, images or other clinical documentation, please request the appropriate channel for sending it in advance. Data will be retained in accordance with the periods and criteria set out in this Privacy Policy. When the agreement ends, Medicality must return or delete the data following veroDENT's instructions, unless a legal retention obligation applies.
You may exercise your data protection rights with Dr Veronika Strauchs through the channels set out in this Privacy Policy. Medicality will assist in handling requests affecting data processed on behalf of veroDENT.
6 Communication via WhatsApp
You may voluntarily contact us on the number for administrative enquiries and appointment management. You also have telephone, email and in-person contact.
We process your phone number, the name or identifier it displays and the content of your messages to respond to your request. The legal basis is that of the procedure you request (section 3). For optional later messages, such as WhatsApp reminders, we will record your choice, which you may change at any time.
WhatsApp is a service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The provider carries out its own processing of account, usage and connection data in accordance with its privacy policy. Processing functions and conditions depend on the type of service used.
This service may involve transfers outside the European Economic Area. WhatsApp reports transfers to the United States and the use of the EU-U.S. Data Privacy Framework for covered recipients and services, as well as standard contractual clauses for other transfers. Details applicable to our configuration are set out in section 9.
WhatsApp is not our channel for routine clinical documentation or urgent matters. If you send health information, we will limit its processing to what is necessary to manage your care and, where appropriate, add it to your clinical record through our procedures. We will tell you a suitable channel to continue.
Stopping WhatsApp use does not require deleting information we must keep in the clinical record or under another legal obligation.
7 Browsing, hosting and website security
When you access the website, technical data is processed as necessary to deliver its content, maintain the connection, detect incidents and prevent abusive access. The legal basis is our legitimate interest in providing a functional and secure website, Article 6(1)(f) GDPR.
Logs linked to a specific incident may be kept as long as needed to investigate it and address related liabilities.
Providers that process data on our behalf must act in accordance with the instructions and contractual safeguards of Article 28 GDPR. Using external services does not authorise the use of enquiries or clinical data for purposes other than those disclosed to you.
8 Cookies and third-party services on the website
The use of cookies and similar technologies is governed by Article 22.2 of Law 34/2002. Those strictly necessary to transmit a communication or provide an expressly requested service may be used without consent. Other technologies requiring consent will only be activated after you have given it.
Information on the technologies used, their providers, purposes, duration and possible transfers is set out in the Cookie Policy. Where optional cookies exist, you may accept, reject or configure them and change your choice.
Maps, videos, measurement tools, booking systems or external controls against automated submissions may pass data to their providers. Before using an optional service, we will provide information on its purposes, data processed, legal basis, recipients, retention and transfers, and request your consent where necessary.
Ordinary links to third-party pages allow you to access sites subject to their own policies. Your visit to our website alone does not constitute authorisation to activate optional third-party services.
9 Who can access your data
Only persons and entities that need the data for a legitimate purpose may access it, subject to the corresponding confidentiality safeguards. Depending on the matter, the following may be involved:
• Healthcare professionals and diagnostic centres: where their involvement or a referral is necessary for your care and a legal basis exists for sharing the information. Access is limited to what is relevant to their intervention.
• Dental laboratories and custom device manufacturers: where they need prescriptions, measurements, scans or other data to carry out the requested work. Patient references or codes will be used wherever feasible, and no information unrelated to that purpose will be sent.
• Service providers: web hosting and maintenance, email and communications, appointment and clinical record management, storage, IT support and tax or accounting advice, to the extent they actually intervene and need access to data to provide their service.
• Banks and payment providers: to manage payments you make, with strictly necessary data only.
• Authorities, courts and competent administrations: where required by law or a legitimate request.
• Professional liability insurer and legal advisers: where necessary to process a claim or defend a complaint, with the corresponding legal basis and data minimisation.
Providers acting on our behalf are processors for the relevant operations. Other professionals or entities may act as independent controllers where they determine their own purposes and means; this status depends on the specific activity.
Sharing premises with other professionals does not allow them to access your clinical record. If a treatment involves joint controllership with another entity, joint controllers will be identified and the essential aspects of the arrangement under Article 26 GDPR will be provided to you.
We do not sell your personal data. Any disclosure to your health insurer for a procedure requested by you must have its own legal basis and information; it does not arise automatically from private care.
10 International data transfers
An international transfer occurs when data is disclosed or made accessible to a recipient located outside the European Economic Area under the GDPR. It may also occur through technical support or subcontracting, even if the main server is in Europe.
Where applicable, these transfers will rely on an adequacy decision of the European Commission or on safeguards under Article 46 GDPR, such as standard contractual clauses, together with any necessary supplementary measures. The EU-U.S. Data Privacy Framework may only be invoked for entities and processing covered by a current certification and for as long as it remains legally applicable.
You may request information and a copy of the applicable safeguards by email at the address given in section 1, subject to limits needed to protect confidential information and third-party rights. Choosing a communication channel does not mean waiving the legal safeguards on international transfers.
11 How long we keep data
Enquiries with no subsequent care relationship: for the time needed to respond and complete the procedures linked to the request. Afterwards they are deleted, subject to any legal blocking if liabilities may arise.
Appointments and care communications: for as long as needed to manage the appointment and care. Information of clinical relevance is added to the record and follows its retention rules. Copies and messages that are no longer needed are deleted in accordance with the applicable retention procedure.
Clinical record: for the period appropriate to your care and, as a minimum, five years from discharge from each episode of care, in accordance with Article 17 of Law 41/2002 and Article 46.12 of Law 10/2014 of the Valencian Community, which also provides for calculation from the patient's death. Longer retention may be necessary for continuity of care, legal obligations or legal liabilities. The lapse of the five-year minimum does not automatically result in deletion of the entire clinical record.
Invoices and tax documentation: for the periods required by tax legislation. The general limitation period for tax purposes is four years and is calculated in accordance with its legal rules, subject to possible interruptions and cases of longer retention. Where the commercial retention obligation applies, the six-year period from the last entry under Article 30 of the Commercial Code will also be observed.
Advertising and images for publication, if authorised: for the period and media stated in the authorisation or until its withdrawal, without prejudice to keeping evidence of the authorisation and its withdrawal to address possible liabilities. Withdrawing a publication authorisation does not delete images that must remain in the clinical record.
Web logs and cookies: for the periods set out in section 6 and in the Cookie Policy. Rights requests and proof of consent: during processing and for the periods needed to demonstrate compliance and address liabilities.
Where rectification or erasure applies and blocking under Article 32 LOPDGDD is required, the data will be reserved, not used ordinarily and made available only to competent authorities to enforce liabilities during the limitation periods. Afterwards, it will be destroyed.
12 Your rights
As provided by law, you may exercise the following rights:
• Access: confirmation of processing, information on it and a copy of your data.
• Rectification: correct inaccurate data and complete incomplete data.
• Erasure: request deletion where one of the legal grounds applies. It does not cover documents that must be kept by law or to defend claims.
• Restriction: request restriction of processing in the cases provided for by the GDPR.
• Portability: receive the data you have provided to us in a structured, commonly used and machine-readable format and transmit it to another controller, where the processing is based on consent or a contract and is carried out by automated means.
• Objection: object, on grounds relating to your particular situation, to processing based on a legitimate interest. We will stop unless there are compelling legitimate grounds or the processing is needed to establish, exercise or defend legal claims. You may object to advertising at any time, without justifying it.
• Withdrawal of consent: withdraw it at any time for purposes that depend on it, without affecting the lawfulness of prior processing.
To exercise your rights, write to hola@vero-dent.es or send your request to Dr Veronika Strauchs, Calle Pintor Sorolla 19, 46002 Valencia, Spain, stating which right you wish to exercise and how to reply. No specific form is required.
We request additional identity information only where there are reasonable doubts, and only as necessary. If you act through a representative, representation must be proven. We do not generally require a full copy of your identity document.
We will respond without undue delay and, in general, within one month of receiving your request. Where the complexity and number of requests allow, this period may be extended by up to two further months; we will inform you of the extension and its reasons within the first month. Exercising your rights is free of charge, subject to legal exceptions for manifestly unfounded or excessive requests and additional copies.
Access to the clinical record will be provided while respecting the rights of other persons and the limits provided by law for professionals' subjective annotations, without using those limits to generally refuse access to your data.
You may lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es. You may also contact the competent supervisory authority in your habitual residence, place of work or the place of the alleged infringement. You do not need to lodge a complaint with us first in order to approach the supervisory authority.
13 Data on minors and represented persons
When we treat a minor or a person who requires representation or support, we process the data necessary about the patient and about those who legitimately take part in their care. Information and the exercise of rights are adapted to the person's age, maturity and legal situation.
For processing based on a minor's consent, the rules of Article 7 LOPDGDD apply, including the involvement of their representatives where the minor is under fourteen and the legal exceptions. These rules do not replace those relating to healthcare consent, patient autonomy or representation under Law 41/2002 and other applicable regulations.
14 Confidentiality and security
Health data is subject to special protection and professional secrecy. We apply technical and organisational measures proportionate to the risks, to limit access to authorised persons and to protect the confidentiality, integrity and availability of information.
Security also requires using appropriate channels and procedures for each type of information. If a breach poses a high risk to your rights and freedoms, we will inform you as the GDPR requires.
15 Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly and significantly affect you.
16 Changes to this policy
We will update this information when our processing or applicable requirements change. The update date appears at the start. If a change requires new individual information or new consent, we will provide it or request it before carrying out the relevant processing. Merely browsing or reading this policy does not amount to consent to optional processing.