Privacy policy

01Legal information

What this policy applies to

This policy explains how we process the personal data you provide on this website and when you contact the clinic on WhatsApp: when submitting the contact form, talking to the chat or WhatsApp assistant and, if you accept them, through analytics and advertising cookies. It has been prepared in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights (LOPDGDD).

Patients' medical records are not managed through this website and are governed by the specific healthcare legislation.

02Legal information

Controller and contact

Data controller: RINOCLINICS, SLP, tax identification number (NIF) B67246322, registered with the Barcelona Commercial Registry, volume 46537, folio 213, sheet B523211.

Address: Carrer del Mestre Nicolau, 19, 6th floor, Suite 1, Sarrià-Sant Gervasi, 08021 Barcelona.

Telephone: +34 669 57 00 45. Email, also for any data protection matter: info@rinoclinics.com.

03Legal information

What data we process

Contact form. First name and surname, email address, telephone number, preferred contact channel (email or telephone) and reason for contacting us. Your telephone number is required if you choose to receive a call. Fields marked with an asterisk are mandatory: without them, we cannot respond to your request.

Message and photographs (optional). You can write a message and attach up to three photographs of the area you would like assessed. Photographs and information about your health are health data, a special category of data (Article 9 of the GDPR). We only process them if you give explicit consent in the specific checkbox on the form. Providing them is voluntary and we will still handle your request if you do not.

Do not attach identity documents or data or images of other people.

Chat. The messages you write and contact details you choose to provide, such as your name, email or telephone number. If you wish to send photographs, use the form; we ask you not to share details of your medical history in the chat.

WhatsApp. If you write to the clinic’s WhatsApp number: your telephone number and the name shown on your WhatsApp profile, if WhatsApp shares it with us; the messages you write and the photographs, audio recordings or documents you send. Photographs and what you tell us about your health are health data, a special category of data (Article 9 of the GDPR). Providing them is voluntary. Please do not share details of your medical history or data or images of other people.

Technical data. Browsing data for analytics or advertising purposes are only collected if you accept the corresponding cookies, as explained in the cookie policy. The website server does not keep an access log. It only retains technical operational and security logs, which may include IP addresses, for a maximum of around 14 days.

Minors. If you are under 14, your request must be submitted by your mother, father or legal representative (Article 7 of the LOPDGDD).

04Legal information

What we use them for and on what legal basis

Handling your request. Responding to your enquiries, sending the information you request, contacting you through your chosen channel and managing a possible professional relationship, starting with the initial consultation. Legal basis: taking steps at your request before entering into a contract (Article 6.1.b of the GDPR).

Preparing for the consultation with your photographs and health data. The doctor and his team use them to guide the consultation; this does not amount to a diagnosis. Legal basis: your explicit consent (Article 9.2.a of the GDPR), which you may withdraw at any time.

Talking with you in the chat. Answering your questions and, if you request it or it is needed, transferring the conversation to a member of the team. Legal basis: handling your request (Article 6.1.b of the GDPR). If you share health information in the chat, the basis is your explicit consent (Article 9.2.a of the GDPR).

Responding to your WhatsApp messages. Replying to you through this channel: the assistant, who introduces herself as Claudia, answers your questions about the clinic, as a receptionist would, and can pass the conversation to a member of the team, who sees it in AimoovaChat. Legal basis: responding to your request (Article 6(1)(b) of the GDPR). If you share photographs or health information through WhatsApp, the basis is your explicit consent (Article 9(2)(a) of the GDPR).

Notifying the team of each request. We send an email notification to the clinic's inbox. This notification does not include photographs or health data. Legal basis: the same as for the request (Article 6.1.b of the GDPR).

Measuring website use and advertising results with Google Analytics and Google Ads. Legal basis: your consent (Article 6.1.a of the GDPR and Article 22.2 of the LSSI-CE), which you give or withdraw through the cookie notice.

We do not use these data to send you advertising or subscribe you to any list. Submitting a request does not amount to a confirmed appointment.

The message and photographs in the form are not sent to the artificial intelligence assistant or used to generate its replies. The photographs, audio recordings and documents you send through WhatsApp are seen by the team in AimoovaChat; the assistant only reads the text of your messages. The reviews shown are loaded from this website, without sending visitor data to Google.

05Legal information

Artificial intelligence assistant

The chat on this website and the clinic’s WhatsApp are handled by an artificial intelligence assistant, which tells you this in its first reply (Article 50 of Regulation (EU) 2024/1689 on artificial intelligence). It responds using the information provided by the clinic, does not diagnose or give medical advice and can pass the conversation to a member of the team.

If it detects a possible emergency, it will tell you and refer the conversation. Neither the chat nor WhatsApp is an emergency service: in a medical emergency, call 112.

To compose replies, the text of your messages, from the chat or WhatsApp, is sent to Claude, an Anthropic language model, without adding your name or contact details. The clinic’s information is searched on our own server. The assistant does not make decisions based solely on automated processing that produce legal effects concerning you or significantly affect you (Article 22 of the GDPR).

06Legal information

The clinic’s WhatsApp

You can write to the clinic through WhatsApp. The clinic’s WhatsApp number is linked to AimoovaChat as an additional device, just like WhatsApp Web, through Evolution API, a programme that runs on the clinic’s own server. The team sees the messages in AimoovaChat and the assistant or a member of the team replies.

WhatsApp is a service provided by WhatsApp Ireland Limited, part of the Meta group, which processes your data under its own privacy policy. What it does with them and how long it keeps them depend on that policy, not this one.

07Legal information

Who else processes the data

We do not disclose your data to third parties unless legally required. Providers acting as data processors are involved in delivering these services: they may only use data following our instructions and with the safeguards required by Article 28 of the GDPR.

Aimoova (Victorino Rodríguez Matos, self-employed professional, aimoova.com): provides and maintains AimoovaChat, the clinic’s customer service platform, its connection to the clinic’s WhatsApp (Evolution API) and its assistant, including Botmemory, the tool that supplies the assistant with information about the clinic.

Hostinger: hosting of the clinic's own server, on which this website and AimoovaChat run, in a data centre in Paris (France).

Anthropic (Claude): the language model that composes the assistant’s replies in the chat and on WhatsApp. Its commercial terms prohibit it from training models with these data.

Amazon Web Services (Amazon SES): sending email notifications from avisos@aimoova.es, without health data, from its Paris (France) region.

cdmon: the clinic's email provider, where the info@drgustavosuarez.com and info@rinoclinics.com inboxes are hosted.

Google (Google Analytics and Google Ads): only if you accept the corresponding cookies, as explained in the cookie policy.

In addition, if you contact us through WhatsApp, your messages pass through WhatsApp (WhatsApp Ireland Limited, part of the Meta group), the messaging service you use and which the clinic also uses on its mobile phone. It processes data under its own privacy policy.

08Legal information

International transfers

Anthropic processes the chat messages it receives in the United States. The transfer is covered by the standard contractual clauses approved by the European Commission and incorporated into its data processing agreement (Article 46 of the GDPR).

Google may process data in the United States. Google LLC is listed as a participant in the EU–US Data Privacy Framework, whose European Commission adequacy decision covers the transfer (Article 45 of the GDPR).

WhatsApp Ireland Limited may transfer data outside the European Economic Area, including the United States, under its own privacy policy.

Hostinger and Amazon Web Services process data in Paris (France). If either were to transfer them outside the European Economic Area, their processing agreements incorporate the European Commission's standard contractual clauses.

You can request information about these safeguards by writing to the controller.

09Legal information

How long we keep the data

Photographs from the form and WhatsApp attachments (photographs, audio recordings, videos and documents): they are deleted 30 days after receipt, or within any shorter period set by the clinic, and also earlier if you withdraw your consent or your data are erased.

Contact details and conversations, including WhatsApp conversations, of people who do not go on to request an appointment: 12 months from their last contact with the clinic.

Copy on the clinic’s mobile phone: WhatsApp also saves the conversation on the clinic’s mobile phone. That copy is not removed by automatic deletion: the team deletes it manually, together with its photographs, when handling an erasure request.

Evolution API does not store messages or photographs. It only retains the technical encryption keys for the WhatsApp session, which contain your telephone number in their name, for as long as the clinic’s number remains linked.

If you become a patient: the data needed for your care are incorporated into your medical record, which is managed outside this website and kept for the periods required by healthcare legislation.

Other data: for the time needed for the purpose for which they were collected and, afterwards, for as long as legal obligations require.

Photographs and contacts are deleted automatically when the period expires, with notification to the clinic’s team. When required by law, data are retained in a blocked state, available only to judges, courts and competent authorities during the limitation period for any potential liabilities (Article 32 of the LOPDGDD).

Cookies are kept for the periods stated in the cookie policy.

10Legal information

Session data

While you use the assistant, the browser keeps a session reference to maintain the conversation within the tab. The cookie policy explains its purpose and duration.

The form keeps the data used for its operation in the tab's memory. It does not add a persistent record to the browser.

11Legal information

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as the right not to be subject to decisions based solely on automated processing of your data, where applicable.

If processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. For cookies, you can do this through configure cookies.

To exercise your rights, write to info@rinoclinics.com or send a letter to the controller's address, stating which right you wish to exercise. If there are reasonable doubts about your identity, we may request additional information to confirm it. We will respond within one month, which may be extended in the cases provided for in Article 12 of the GDPR.

You can also lodge a complaint with the Spanish Data Protection Agency.

Last updated: 15 October 2026.