Last updated: September 2026
1. Data controller
- Company name: Dignitas S.L.
- Tax identification number (N.I.F.): B53903720
- Registered and care service address: C/ Arc de Sant Martí, 16 Piso 1º1º, postal code 07011, Palma, Illes Balears, Spain
- Email: info@dignitasmallorca.es
- Contact telephone: +34 659 15 96 14
- Activity: Specialist medical care at home, comprehensive symptom support and accompaniment of patients with advanced illnesses and their families in Mallorca.
2. Applicable legal framework
The processing of personal data at DIGNITAS is governed by:
- Regulation (EU) 2016/679 (GDPR) on the protection of personal data.
- Spanish Organic Law 3/2018 (LOPDGDD) on Personal Data Protection and the Guarantee of Digital Rights.
- Law 41/2002 of 14 November, the basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation.
- Law 34/2002 (LSSI-CE) on information society services and electronic commerce.
- The Spanish Code of Medical Ethics and General Health Law 14/1986 regarding professional secrecy.
3. Types of data collected
3.1. Data voluntarily provided by the user or patient
- Enquiries and contact (“Tell us about your case”, telephone or WhatsApp): Name and surname, telephone number, email address and informational message.
- Patient data provided by relatives or carers: Where initial contact is made by a relative or representative, we collect the sender’s identifying details, their relationship to the patient and basic information about the patient’s health. The contact person declares that they are acting with the patient’s consent or, in the event of a subsequent physical or legal inability, as a representative in the interests of the patient’s health and wellbeing.
- Health data — Special categories (Art. 9 GDPR): Clinical diagnoses, medical history, hospital reports, current medication, symptom management and clinical progress, necessary to create the medical record and the appropriate home palliative care plan.
- Billing and administrative management: Name/company name, DNI/NIE, tax address and details for collecting medical fees.
- Applications and staff recruitment: CV and professional details voluntarily submitted by doctors, nurses or other healthcare professionals wishing to work with DIGNITAS.
3.2. Data collected automatically
- Browsing: IP address, device type, browser, operating system and duration of website visits.
- Cookies: Technical functionality and analytics cookies in accordance with our Cookies Policy.
4. Purposes of processing and legal basis
| Purpose | Legal basis (GDPR / Healthcare legislation) |
| Handling web, telephone or WhatsApp enquiries(Initial assessment of the request). | Art. 6.1.b GDPR: Pre-contractual measures at the data subject’s request.Art. 6.1.a GDPR: Consent given by voluntarily contacting us. |
| Home medical care and palliative care(Symptom management, medical treatment and ongoing support). | Art. 6.1.b GDPR: Performance of the contractual/care relationship.Art. 9.2.h GDPR: Processing necessary for preventive medicine, diagnosis and the provision of healthcare or treatment.Law 41/2002: Healthcare duty of care. |
| Custody of the medical record | Art. 6.1.c GDPR: Mandatory legal obligation (Articles 14 to 17 of Law 41/2002 on Patient Autonomy). |
| Administrative, accounting and tax management(Issuing invoices and tax compliance). | Art. 6.1.c GDPR: Compliance with legal obligations (Commercial Code and General Tax Law). |
| Clinical coordination with other healthcare services(Emergency services 061/112, Balearic Islands hospitals, health centres or pharmacies) | Art. 9.2.h GDPR and Law 41/2002: Ensuring continuity of care, or Art. 9.2.c GDPR: Protection of the patient’s vital interests. |
| Management of applications and CVs | Art. 6.1.a GDPR: The applicant’s express consent when submitting their CV for recruitment processes. |
5. Medical professional secrecy and third-party services
5.1. Professional secrecy
All doctors within DIGNITAS are bound by a strict ethical and legal duty of medical professional secrecy, extending throughout their lifetime to any information learned in the course of providing care. Support staff and collaborators undertake the same formal commitment to enhanced confidentiality.
5.2. Third-party services and tools
DIGNITAS does not trade personal data. Selected providers subject to confidentiality and data processing agreements (Art. 28 GDPR) are used to operate web and operational channels:
- WhatsApp (Meta Platforms Ireland Ltd.): A direct channel for brief enquiries from relatives. We recommend not sharing complete medical reports through open instant messaging, reserving such exchanges for specific clinical channels.
- Social networks (Instagram): Links to corporate profiles; processing is governed by the privacy policies of the relevant social network.
- Web hosting and email: Security-certified servers located within the European Economic Area (EEA).
6. International data transfers
As a general rule, data is stored and processed on infrastructure and servers located within the European Economic Area (EEA).
When using auxiliary telecommunications, email or digital analytics providers located outside the EEA (such as in the United States), we ensure that these entities operate under the adequacy framework of the EU-US Data Privacy Framework or, alternatively, through the signing of Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring a level of protection equivalent to that provided under EU law.
7. Data retention periods
- Medical records and care documentation: In strict compliance with Article 17 of Law 41/2002 and the regional healthcare regulations of the Balearic Islands, clinical documentation will be retained for a minimum of 5 years from the date of discharge from the care process or the patient’s death. After this period, the information will be duly restricted for the statutory limitation periods for liability, or securely destroyed or anonymised.
- Enquiries not resulting in medical care: Contact details collected through forms or by telephone that do not lead to the contracting or provision of care services will be deleted within a maximum of 1 year from the last interaction.
- CVs and applications: A maximum of 1 year from receipt, after which they will be destroyed unless the applicant expressly requests otherwise.
- Accounting and billing data: Retained for between 4 and 6 years to comply with commercial and tax obligations (Article 30 of the Commercial Code and the General Tax Law).
- De-identified or anonymised data: Non-identifiable statistical information will be retained without a time limit solely for care analysis or historical and scientific research.
8. What are your rights and how can you exercise them?
Patients or, where applicable, their legal representatives or expressly entitled relatives may exercise the rights granted by the GDPR at any time and free of charge:
- Access: Find out what personal data we process and request copies of medical record documentation and reports (in accordance with the terms and limits of Art. 18 of Law 41/2002).
- Rectification: Request the correction of inaccurate data or completion of incomplete data.
- Erasure (“Right to be forgotten”): Request the deletion of your data when it is no longer necessary for the purposes for which it was collected, except where it must be retained under healthcare legal obligations (mandatory custody of medical records) or tax obligations.
- Restriction of processing: Request the precautionary suspension of processing in the cases provided for by law.
- Portability: Receive your personal data in a structured, commonly used, machine-readable format to transfer it to another healthcare data controller on request.
- Objection and withdrawal of consent: Object to processing based on legitimate interests or withdraw previously given consent at any time, without affecting the lawfulness of earlier processing.
Procedure for exercising rights:
Send a written request with the reference "Exercise of Rights - Data Protection" to:
- Postal address:
Dignitas S.L.
C/ Arc de Sant Martí, 16 Piso 1º1º, CP 07011, Palma, Illes Balears, Spain - Email: info@dignitasmallorca.es
Your request must include a photocopy or digital copy of your identity document (DNI, NIE or passport) to verify your identity. When acting on behalf of the patient (as a relative or carer), you must also attach reliable documentation proving your representation (express signed authorisation with the identity documents of both parties, power of representation, a curatorship/guardianship order or proof of relationship, as appropriate).
If you believe that your rights have not been properly addressed, you also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) through its electronic office: www.aepd.es.
9. Security measures
DIGNITAS applies proportionate and rigorous technical and organisational security measures specifically designed to safeguard the confidentiality of health-related data (a special category of data):
- Secure SSL/TLS encryption (HTTPS) active throughout the website to prevent interception of form submissions.
- Logical access controls restricted exclusively to authorised medical staff through complex passwords and differentiated authentication.
- Regular backups and storage on encrypted devices or environments to ensure the availability and integrity of information in the event of disasters or system failures.
10. Changes to the Privacy Policy
DIGNITAS reserves the right to amend or update this Privacy Policy to reflect future legislative developments, interpretations by supervisory authorities or changes to its operational care model. The version in force will always be the one published on the website.