This document governs the processing of personal data collected by AERETIC, S.L.
The purpose of this Personal Data Protection Policy (“Privacy Policy”) is to explain how we collect, process, and safeguard personal data obtained in the course of our activities.
Who is the data controller of your personal data?
The entity responsible for processing your personal data is AERETIC, S.L. (hereinafter, “AERETIC”), with Tax Identification Number (NIF) B05419197.
Contact details are as follows:
- Postal address: Av. Josep Tarradellas, 123-127, 08029 Barcelona, Spain
- Telephone: +34 93 495 44 44
- Email: aeretic@aeretic.cat
How can you contact AERETIC’s Data Protection Officer?
AERETIC informs you that it has appointed a Data Protection Officer (“DPO”), whom you may contact regarding any matter related to the processing of your personal data.
You may contact the DPO via the following email address: dpd@aeretic.cat
For what purposes and on what legal basis do we process your personal data?
Processing based on the performance of a contract (contractual necessity)
The purpose of processing your data is to ensure proper registration and monitoring of the healthcare services provided at our facilities. It also aims to guarantee continuity of care across different healthcare providers, facilitate accurate billing of services, maintain medical records, and enable coordination between clinical record systems.
Personal data processed by AERETIC are obtained.
We may also process your personal data during pre-contractual relationships at your request, for example, to manage your registration on our website, respond to inquiries submitted through it, or provide information about our services.
Processing based on your consent
We may collect and process your personal data where you have given your explicit consent, for example, for managing CVs, sending commercial communications, profiling (where expressly authorized), organizing events or activities, and managing registration as a medical professional or healthcare collaborator within our organization.
Processing based on legal obligations
We may process your personal data where necessary for AERETIC to comply with applicable legal obligations.
Processing based on public interest
We may process image data (of individuals accessing physical premises) through video surveillance systems in order to ensure security and control access to AERETIC’s facilities. Such data will be retained for a maximum period of one month before deletion.
We may also process your personal data on the basis of public interest, for example, when collaborating with law enforcement authorities or judicial bodies.
To whom will your data be disclosed?
Your data may be shared, in whole or in part, with entities within the Asistencia Group and associated companies (such as SCIAS or Asistencia Sanitaria Colegial, S.A.), or with third-party entities with whom we maintain contractual relationships, for purposes consistent with those described above, including the management of payments for healthcare services.
Additionally, your data may be accessed by public or private authorities where required by law or where necessary to ensure the proper provision of healthcare services or compliance with legal obligations.
Furthermore, in order to fulfill the purposes described above, your data may be disclosed to third-party service providers acting as data processors on behalf of AERETIC. AERETIC ensures that such processors comply with the highest standards of security and confidentiality.
International data transfers are not contemplated. Should personal data be transferred to third countries, we will ensure that such transfers comply with this Privacy Policy and applicable data protection regulations, relying, where appropriate, on European Commission adequacy decisions.
How have we obtained your data?
The personal data processed by AERETIC are obtained from the data subject, from entities within the Asistencia Group and associated companies (such as SCIAS or Asistencia Sanitaria Colegial, S.A.), or from third parties with whom we maintain contractual relationships.
Where necessary, we may access medical records held by SCIAS.
How long will we retain your data?
The data provided will be retained in accordance with applicable healthcare legislation, currently Law 21/2000 on patients’ rights regarding health information and clinical documentation. This law provides for a retention period of fifteen years from the date of discharge for relevant documentation, and five years for all other records.
What are your rights regarding your data and how can you exercise them?
In accordance with European data protection regulations, you have the following rights:
Right of access
You have the right to access the personal data processed by AERETIC and to obtain information regarding how your data are processed.
Right to withdraw consent
You may withdraw your consent at any time where processing is based on your authorization. Withdrawal does not affect the lawfulness of prior processing.
Right to rectification
You have the right to have inaccurate personal data corrected and incomplete data completed.
Right to object
You have the right to object to the processing of your personal data, particularly where it is used for direct marketing purposes or based on public interest.
Right to erasure
You have the right to request the deletion of your personal data under certain circumstances (for example, where the data are no longer necessary, consent has been withdrawn, or you object to processing).
Right to restriction of processing
You have the right to request the restriction of processing in certain cases, for example, while your objection to marketing communications is being reviewed.
Right to data portability
You have the right to receive the personal data you have provided to AERETIC in a structured, commonly used, and machine-readable format and to transmit it to another controller, provided that:
- The processing is based on consent or a contract; and
- The processing is carried out by automated means.
Right not to be subject to automated decisions
You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
How to exercise your rights
You may exercise your rights by verifying your identity, specifying the right you wish to exercise, and indicating the relevant processing activity through the following channels:
AERETIC will respond within a maximum period of one month from receipt of the request. In particularly complex cases, this period may be extended by an additional two months.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) via its electronic office.
How do we protect your personal data? within a maximum period of one month
AERETIC processes your personal data with the utmost confidentiality and undertakes to maintain secrecy and implement all necessary measures to prevent unauthorized access, alteration, loss, or processing, in accordance with applicable legal obligations.
We are committed to maintaining appropriate security levels, taking into account technological developments, the nature of the stored data, and associated risks.
Use of email
AERETIC and its employees use corporate email with the highest level of diligence and confidentiality. If you need to provide documentation, we recommend doing so via the private area of our website. If this is not possible, please send it by encrypted by email and provide the password separately.
Cookie Policy
A cookie is a file that is downloaded onto a user’s device for the purpose of storing data that may be updated and retrieved by the entity responsible for its installation.
You may consult our Cookie Policy at the following link: https://www.assisportinternational.com/en/cookie-policy and configure your consent preferences accordingly.
AERETIC reserves the right to amend this Privacy Policy without prior notice, at its own discretion, in response to legislative, judicial, or regulatory changes issued by the Spanish Data Protection Agency. We recommend reviewing this Privacy Policy periodically.
May 2026
