PRIVACY POLICY

 

This Privacy Policy aims to inform, in a clear, transparent, and accessible manner, about the processing of personal data carried out by FUNDACIÓ PUIGVERT, as well as the rights that correspond to the interested parties, in accordance with the current regulations on data protection.

  1. Data Controller

 

FUNDACIÓ PUIGVERT

Tax ID: G08294779

Postal Address: C/ Cartagena, 340-350 – 08025 Barcelona

Data Protection Officer (DPO): [email protected]

  1. General Principles of Processing

FUNDACIÓ PUIGVERT processes personal data in accordance with the principles of lawfulness, fairness, and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and proactive responsibility, established in Article 5 of the GDPR.

Personal data is processed exclusively for legitimate, explicit, and determined purposes, and is not subsequently used in a manner incompatible with those purposes.

  1. Categories of Personal Data Processed

Depending on the nature of the relationship established with the interested party, the channel used, and the purpose of the processing, FUNDACIÓ PUIGVERT may process the following categories of personal data:

 

  • Identifying and contact data, such as name and surname, identification document, postal address, email address, and phone number.

 

  • Administrative, economic, and billing data, necessary for the management of services, collaborations, donations, and compliance with legal obligations.

 

  • Professional, academic, and curricular data, including those contained in resumes, job applications, internships, teaching, training, or research activities.

 

  • Data related to complaints, suggestions, claims, or inquiries, including information provided through the channels enabled for their management and follow-up.

 

  • Health data, including special categories of data, when strictly necessary for the provision of healthcare, management of health services, or compliance with applicable legal obligations.

 

  • Data derived from the use of the website and corporate digital channels, such as browsing data, preferences, or interactions, in accordance with current regulations.

 

Personal data may be provided directly by the interested party or legitimately obtained within the framework of the care, administrative, professional, teaching, research, or institutional relationship maintained with FUNDACIÓ PUIGVERT.

 

 

  1. Purposes of Processing Personal Data

 

FUNDACIÓ PUIGVERT processes the personal data of interested parties solely for legitimate, determined, explicit, and appropriate purposes to its institutional activity, in accordance with current regulations on data protection.

 

In particular, personal data may be processed for the following purposes, depending on the nature of the relationship maintained:

 

4.1. Healthcare assistance and patient relationship: Manage, provide, and guarantee healthcare assistance, including the registration, monitoring, and continuity of the care process; the preparation, maintenance, and custody of the medical history; coordination between health and social devices; as well as the administrative, economic, and billing management associated with the services provided and compliance with legal obligations in healthcare.

 

4.2. Website users and communication channels: Address inquiries, requests for information, or communications made through the website or other corporate channels; manage administrative procedures related to services, activities, or institutional programs; and ensure the proper functioning, security, and continuous improvement of digital channels.

 

4.3. Administrative, economic, and institutional relationships: Manage relationships with suppliers, collaborators, entities, and individuals who collaborate financially with the Foundation, including the management of donations, agreements, and other forms of collaboration; as well as comply with the administrative, tax, accounting, and legal obligations that may apply.

 

4.4. Human resources, selection, and training: Manage personnel selection processes, spontaneous applications, and training internships; administer labor relations; and develop internal training, teaching, and professional development activities, in accordance with applicable regulations.

 

4.5. Teaching, training, and research activities: Organize, manage, and develop teaching, training, academic, and research activities, as well as scientific or knowledge transfer projects, within the framework of the functions of FUNDACIÓ PUIGVERT and applicable regulations.

 

4.6. Quality, user attention, and complaints: Manage suggestions, complaints, and claims; conduct satisfaction surveys or quality studies of the services provided; and contact interested parties to improve attention and services, always within the limits of applicable legal regulations.

 

4.7. Informative and institutional communications: Send informative, corporate, or institutional communications related to the activities, services, or initiatives of FUNDACIÓ PUIGVERT, and commercial communications only when the user has given their consent in the legally required terms.

 

Personal data will not be processed for purposes incompatible with the described purposes, except when necessary for compliance with a legal obligation or to respond to a request from a competent authority.

 

5. Legal Basis for Processing

The processing of personal data carried out by FUNDACIÓ PUIGVERT is based on the legal bases provided in Articles 6 and 9 of Regulation (EU) 2016/679 (GDPR), depending on the nature of the data processed, the specific purpose of the processing, and the context in which it occurs. In particular, the applicable legal bases are as follows:

  1. Consent of the interested party: When the processing of personal data requires it, FUNDACIÓ PUIGVERT will process the data based on the free, specific, informed, and unequivocal consent of the interested party, in accordance with Article 1.a of the GDPR. Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal.

 

  1. Execution of a contractual or pre-contractual relationship: The processing of personal data may be necessary for the execution of a contract or for the application of pre-contractual measures at the request of the interested party, in accordance with Article 1.b of the GDPR, especially within the framework of the provision of services, professional relationships, collaborations, personnel selection processes, or other legal relationships with FUNDACIÓ PUIGVERT.

 

  1. Compliance with legal obligations: Certain data processing is carried out to comply with legal obligations applicable to FUNDACIÓ PUIGVERT, in accordance with Article 1.c of the GDPR, especially in healthcare, administrative, tax, accounting, labor, security, and transparency matters.

 

  1. Provision of healthcare assistance and management of health systems and services: The processing of personal data, including special categories of health data, is carried out when necessary for purposes of preventive or occupational medicine, medical diagnosis, provision of assistance or treatment of a health or social nature, or management of health systems and services, in accordance with Article 2.h of the GDPR and applicable health regulations.

 

  1. Essential public interest in the field of public health: The processing of health data may also be carried out when necessary for reasons of public interest in the field of public health, such as protection against serious cross-border health threats, ensuring high levels of quality and safety of healthcare, medicines, or health products, in accordance with Article 2.i of the GDPR and the specific applicable regulations.

 

  1. For scientific, historical, or statistical research purposes: Certain processing of personal data, including health data, may be carried out for scientific, historical, or statistical research purposes, in accordance with Article 2.j of the GDPR, provided that the appropriate guarantees required by current regulations are applied, including, where appropriate, measures of pseudonymization, data minimization, and access limitation.

 

  1. Legitimate interest: In those cases where applicable, the processing of personal data may be based on the legitimate interest of FUNDACIÓ PUIGVERT, in accordance with Article 1.f of the GDPR, provided that the fundamental rights and freedoms of the interested party do not prevail. In these cases, FUNDACIÓ PUIGVERT has carried out the corresponding balancing of interests.

6. Retention Period for Personal Data

The personal data processed by FUNDACIÓ PUIGVERT will be retained for the strictly necessary time to fulfill the purposes for which they were collected and, subsequently, for the periods established by applicable regulations, in accordance with the principle of storage limitation provided in Article 5.1.e of the GDPR. In particular:

 

  • Health data and clinical information: Will be retained in accordance with current health legislation regarding patient autonomy and clinical documentation, as well as the regulations that develop it.

 

  • Administrative, economic, and billing data: Will be retained for the periods required by applicable tax, accounting, and administrative regulations.

 

  • Human resources data, selection, and resumes: Will be retained for the time necessary for the management of the corresponding processes and, subsequently, for the legally established periods or while a duly justified legitimate interest subsists.

 

  • Data related to inquiries, complaints, and claims: Will be retained for the time necessary for their processing and resolution, as well as during the limitation periods for possible legal liabilities.
  • Data processed for scientific or statistical research purposes: Will be retained for the time necessary for the purpose of the research, applying in all cases the guarantees required by current regulations.

 

Once the retention periods have expired, the data will be deleted, anonymized, or pseudonymized, as appropriate, with the adequate security measures.

 

7. Recipients of Personal Data.

The personal data processed by FUNDACIÓ PUIGVERT will not be communicated to third parties, except in the following cases:

 

  • When the interested party has given their express consent.

 

  • When the communication is necessary for public interest, especially in the field of public health and the provision of healthcare services.

 

  • When the communication is legally provided for or necessary for compliance with a legal obligation or a request from a competent authority.

 

  • When necessary to ensure continuity of care, including communication with other centers or health devices.

 

  • When necessary for the provision of services by providers acting as data processors, with whom FUNDACIÓ PUIGVERT has formalized the corresponding contracts in accordance with Article 28 of the GDPR.

 

In particular, data may be communicated to public administrations, health authorities, and competent bodies, as well as integrated into shared health information systems, such as the Shared Clinical History of Catalonia (HC3), in accordance with applicable regulations.

 

No international data transfers are made. In the event that, exceptionally, it is necessary to carry them out, the corresponding legal guarantees would be adopted in advance, in accordance with the provisions of Articles 44 and following of the GDPR.

 

8. Rights of Interested Parties

Interested parties may exercise, at any time and under the terms provided in the current regulations on personal data protection, the rights recognized by Regulation (EU) 2016/679 and Organic Law 3/2018, in relation to the processing of their personal data.

The exercise of these rights may be carried out by written request addressed to the Data Protection Officer (DPO) of FUNDACIÓ PUIGVERT, via email: [email protected]

FUNDACIÓ PUIGVERT will attend to requests for the exercise of rights in accordance with the deadlines and conditions established in the applicable regulations. Likewise, interested parties have the right to file a complaint with theCatalan Data Protection Authority (APDCAT), if they believe that the processing of their personal data does not comply with current regulations.

9. Record of Processing Activities

FUNDACIÓ PUIGVERT, in its capacity as an entity providing public healthcare services under a concert regime, has the corresponding Record of Processing Activities, prepared, maintained, and updated in accordance with the provisions of Article 30 of Regulation (EU) 2016/679 and Organic Law 3/2018.

This record is part of the governance and proactive responsibility system of the Foundation regarding personal data protection and is available to the competent control authority, without requiring its full publication.

10. Information Security

FUNDACIÓ PUIGVERT applies the appropriate technical and organizational measures to ensure an appropriate level of security relative to the risk, in accordance with the provisions of Article 32 of Regulation (EU) 2016/679, the nature of the data processed, and the risks associated with the processing.

In this regard, the information systems of FUNDACIÓ PUIGVERT comply with the requirements of the Royal Decree 311/2022, of May 3, which regulates the National Security Scheme, according to the audit carried out by the Catalonia Cybersecurity Agency.

Likewise, the information systems that support the processing of specialized healthcare services and management comply with the requirements established in the Specific Compliance Profile for Health (CCN-STIC 891), corresponding to a medium category, ensuring the confidentiality, integrity, availability, and traceability of the processed information.

Information regarding the level of compliance and, where appropriate, the corresponding certifications, is available through the official channels enabled by FUNDACIÓ PUIGVERT.

11. Data Processing through Social Networks

FUNDACIÓ PUIGVERT has institutional profiles on social networks (Facebook, Instagram, LinkedIn). The processing of personal data of individuals interacting with these profiles will be governed by this Privacy Policy and by the conditions and privacy policies of each platform, previously accepted by the user.

FUNDACIÓ PUIGVERT will use these channels exclusively for informative, institutional, and communication purposes regarding its activities and services, without assuming responsibility for the processing carried out by the corresponding platforms outside the scope of its management.

12. Use of Cookies

The website of FUNDACIÓ PUIGVERT uses own and third-party cookies, as well as other similar technologies, to ensure the proper functioning of the website, facilitate navigation, improve the user experience, and obtain statistical information about the use of its contents. Likewise, cookies may be used for functional purposes and, where appropriate, for measurement or communication, always in accordance with current regulations.

The use of cookies that are not strictly necessary requires the prior consent of the user, which can be granted, configured, or revoked at any time using the tools provided for this purpose.

FUNDACIÓ PUIGVERT does not use cookies to collect sensitive information or to create automated profiles with legal effects on users.

Detailed information about the cookies used, including their type, purposes, ownership, duration, as well as the mechanisms for configuration, acceptance, or rejection, is available in the Cookie Policy, accessible at any time through the corresponding link on the website.

13. Modification of the Privacy Policy

This Privacy Policy may be modified at any time to adapt it to regulatory, jurisprudential changes, or to criteria of the competent control authorities, as well as to modifications in the processing of personal data carried out by FUNDACIÓ PUIGVERT.

The current version will be available at all times through the corresponding corporate channels.

 

Last updated: January 28, 2026.