GenesisCare Spain Privacy Policy

GenesisCare Spain (hereinafter, “GenesisCare”) has updated its Privacy Notice in compliance with the General Data Protection Regulation (GDPR), the Data Protection and Digital Rights Guarantee Act (current and future), and any secondary legislation and guidance implemented or issued pursuant to them.

Data Controller: GenesisCare is the trading name of GenesisCare España Holdings S.L. We are specialist providers of cancer diagnostic and treatment services in Spain. Our company registration number is B87492344, and our registered office is at C/ de Emilio Vargas, 16, 28043 Madrid. GenesisCare is registered with the Madrid Commercial Registry.

This Privacy Notice applies to anyone who requests information about, purchases or uses our services through any means (for example, by email, through our website or by telephone). We take privacy very seriously and want you, as a user of our services, to understand what information we collect about you, how we process and protect information relating to you and third parties, how we ensure that such information is used securely and appropriately, and what rights you have in relation to your personal data.

When we refer to “we”, “us” and “our”, we mean GenesisCare Spain.

What information do we collect and use?

We will collect personal information which may include:

name
date of birth
contact details
details of your GP
financial information, such as the details of the credit or debit card used for payment
emergency contact details
family, lifestyle and social circumstances, where necessary for your care
information recorded by CCTV (closed-circuit television)

The contact details we collect include your telephone number so that we can call you, send you text messages or leave you a message, and your email address so that we can contact you, send you billing information where appropriate and send you confidential medical information, unless you have told us otherwise.

We will ask you for your bank card details to pay for treatment for which you are personally responsible or to cover any shortfall in funding provided by insurers.

We will ask you to provide details of an emergency contact with whom we may share information about the progress of your treatment and whom we may contact in an emergency. By providing us with your emergency contact’s details, you are giving us permission to keep that person informed. It is your responsibility to notify us of any changes to your emergency contact details so that we can ensure they remain accurate and up to date. Where you provide us with information about other individuals, you must ensure that they have read a copy of this Privacy Notice and are comfortable with you providing us with their information.

At some GenesisCare locations, CCTV recording is carried out solely to ensure the security of property and premises and for the prevention and investigation of crime. Areas monitored by CCTV are clearly signposted. The information processed may include images, physical appearance and behaviour. Where necessary or requested, this information may be shared with you, employees and agents, service providers, law enforcement agencies, security authorities and other authorised requestors.

GenesisCare will collect information about your ethnicity when you register with us. We use this information in an anonymised format to:

identify any ethnicity-related congenital risk factors, as certain ethnic groups may have a higher associated risk of developing specific diseases;
support the clinical management of disease;
provide ethnicity-related information that may assist in diagnosis;
understand the specific needs of patients from different ethnic groups;
audit and ensure equality of access to our services; and
continuously improve our services.

We are constantly exploring new and innovative methods of caring for and treating our patients. If you require radiotherapy treatment, we have a system that captures an image of your palm print. This image is used to uniquely distinguish you from other patients and help ensure the accuracy of the treatment provided. This biometric data is necessary for your treatment and will be retained as part of your medical record in accordance with the applicable medical records retention period.

Access to and use of information concerning your physical or mental health is strictly controlled to ensure compliance with applicable data protection legislation and medical confidentiality guidelines issued from time to time.

In many cases, we pseudonymise or anonymise your information before sharing it with others, or when the information is no longer required in an identifiable form.

Anonymisation is the process of converting data into a format that does not identify individuals and where identification is unlikely to occur.

Pseudonymisation is the processing of information in such a way that it can no longer be attributed to you without the use of additional information that is stored separately. This enables the information to be used much more widely for statistical or other purposes.

Where do we obtain information from?

1. Directly from you

Information may be obtained directly from you to support your direct care and treatment. This information may be collected when you:

register to receive healthcare from GenesisCare;
use our services;
complete enquiry forms on GenesisCare websites;
submit an enquiry to us through our website, by email or via social media;
communicate with us by letter, email, telephone (calls to or from patients may be recorded for staff training, customer service development and quality improvement purposes) or social media, including when you refer to GenesisCare in a social media post;
participate in our marketing activities; or
are referred by other healthcare providers.

2. From your GP’s records

We may obtain information from:

records held by other healthcare providers that have previously treated you, which may include private organisations and the National Health System;
records held by your specialist, including records provided through their medical secretary; and
other healthcare providers working with us in connection with the diagnosis, care and treatment provided to you.

3. From other third parties

We may collect information about you from third parties when:

you are referred to us to receive healthcare;
we contact current or previous service and support providers;
we contact your emergency contact or family;
we communicate with your health insurance provider;
we instruct debt collection agencies; or
we communicate with government agencies, such as social and welfare organisations, where information is legally required to ensure the safety and safeguarding of the person concerned.

What do we use your information for?

We use your information for a number of purposes. Whenever we use your information, we must have a lawful basis for doing so under data protection law. The lawful basis will depend on the purpose for which we intend to use your information.

The lawful basis for processing your Personal Data will generally fall within the following categories:

The need to provide you with healthcare services.
The need to comply with the law, where we have a legal or regulatory obligation to use your personal data.
The need to pursue our legitimate interests, meaning that our business interests justify our use of your information and that this business need does not unfairly prejudice your rights as an individual.
The need to establish, exercise or defend legal claims.
The need to perform a task carried out in the public interest, such as under a contract with the National Health Service.

Below, we provide information about the lawful basis applicable to each processing purpose. We have set out separately the purposes for which we will use your personal information, together with the lawful bases that allow us to do so. In addition to identifying the lawful basis, we also explain any additional legal requirements applicable to the use of special categories of personal data.

Failure to provide your information, where this is required under a contract with us or with a specialist, may mean that we are unable to accept you as a patient or provide healthcare to you through GenesisCare systems.

Purpose 1: Provision of healthcare and related services

When you come to us for care and treatment, we need to use your personal information in order to provide those services.

Purpose 2: Payment and accounting

We use your personal information to ensure that our accounting and billing records are accurate and up to date. This supports the provision of your healthcare.

Purpose 3: Clinical audit, research and clinical trials

Clinical audit

We are responsible for ensuring that safe clinical and operational practices are implemented and maintained. We carry out regular compliance audits to ensure treatment and quality standards are met, to ensure that our services continue to meet patients’ needs in the future and to assess compliance with policies and procedures.

We may also receive requests to share information with public authorities where specific approval is not necessarily required but where disclosure forms part of our statutory reporting obligations.

We may do this without your consent where the relevant public authority or registry has received the appropriate legal approval or where the information is provided in a fully anonymised form. Otherwise, your consent will be required.

Research

GenesisCare also participates in medical research and shares data with ethically approved third-party research organisations.

We will only share your personal information to the extent necessary to support the research and as permitted by law. Certain research projects and/or registries may have received legal approval meaning that your consent to the use of your personal data may not be required.

Where your consent is required, either we or the relevant research organisation will ask you to provide it.

GenesisCare works with other organisations to support the development of technological innovations in patient treatment and to monitor patient and organisational outcomes. We will only share your personal information to the extent necessary and where appropriate safeguards are in place.

Clinical trials

You may be advised or recommended to participate in a clinical study. Your specialist will explain how your data will be shared with the organisation conducting the trial and, as part of your enrolment in the trial, you will be asked to agree to the sharing of this data.

Purpose 4: Communicating with you and resolving enquiries, concerns or complaints

You may raise enquiries, concerns or complaints with GenesisCare, and we take these communications very seriously. It is important that we resolve such matters appropriately and conclusively to the satisfaction of all parties concerned, and we will need to use your personal information in order to do so.

Purpose 5: Communicating with people you authorise us to keep informed about your care and informing other healthcare professionals

When you register to receive care or treatment, we will ask you to provide details of an emergency contact with whom we may share information about the progress of your treatment and whom we may contact in an emergency. By providing us with the emergency contact’s details, you are giving us permission (consent) to keep that person informed.

Other healthcare professionals or organisations may need to know about your treatment in order to provide you with safe and effective care. We may therefore need to share your personal data with them. Further information about third parties who may need access to your data is provided below.

Purpose 6: Compliance with legal and regulatory requirements and the establishment, exercise or defence of legal claims

As a healthcare provider, we are subject to a wide range of legal and regulatory responsibilities. Where the law or regulators require us to provide personal information, we have a legal obligation to do so.

In the unlikely event that GenesisCare or its specialists are subject to legal proceedings or claims, it may be necessary to access your personal information in order to investigate and respond to those proceedings or claims, limited to what is necessary and relevant to the matter concerned.

Purpose 7: Quality, training and safety

This includes, for example, calls received through our contact numbers that may be recorded or monitored, as well as post-treatment surveys.

GenesisCare is an organisation committed to quality.

Wherever possible, we want to learn from your experience to improve that of future patients. We will use your personal information to identify areas for improvement, for example by reviewing recorded calls to assess what can be learnt from them and by asking you for feedback on your experience with GenesisCare.

Purpose 8: Managing our business operations

This includes maintaining accounting records, analysing financial performance, conducting internal audits and seeking and obtaining professional advice, such as tax or legal advice.

Who do we share your data with?

It is important that you understand that we may share your data with others. We may share your personal information within the GenesisCare group of companies and with third parties.

1. Within the GenesisCare group

We may share your personal data within the GenesisCare group of companies.

2. With your specialist

As a GenesisCare patient, your treatment may be provided by a specialist doctor. Specialists treating you are legally required to maintain records relating to your health and any treatment or care you have received. They also make decisions about what information is collected about you and may maintain their own medical records relating to the treatment provided, as well as sharing records relating to your care and treatment that are held by GenesisCare.

Specialists control this information and must therefore individually comply with applicable data protection legislation and relevant guidance when handling your personal data.

In relation to your care and treatment, GenesisCare and your specialist are joint controllers of your information. This means that, as joint controllers, we jointly determine the means and purposes of processing your data for your care and treatment.

Specialists working at GenesisCare, including members of their teams, are expected to handle your personal data in accordance with the principles set out in this Privacy Notice. This means that whenever they use your personal data, they will do so in accordance with this Privacy Notice.

Specialists working at GenesisCare, including members of their teams, may process your personal information at a facility that is not operated by GenesisCare.

If you would like further information about the arrangements between GenesisCare and its specialists for handling your information, please contact our Data Protection Officer (DPO).

3. With your private health insurer

Where your insurance covers the cost of your care and treatment, we will share your information with your insurer or the relevant insurance administrator.

Both GenesisCare and your insurer are controllers of this personal information. This means that each of us may independently determine the means and purposes of processing the information we hold.

Generally, we share information to enable both parties to exercise their rights or fulfil their obligations under the applicable healthcare services agreement and, in the case of the insurer, to manage claims and administer policyholders’ plans.

More specifically, your information may be used for the following shared activities:

providing clinical quality information;
obtaining pre-authorisation for treatment on your behalf;
billing for services provided;
reporting any serious incidents;
assisting and cooperating in the investigation of complaints involving a partner; and
allowing your insurer to inspect and audit our facilities.

You may exercise your rights against either GenesisCare or your insurer where both parties are responsible for the same information for the same processing purpose.

Where either party independently holds additional information or processes information for purposes beyond the shared purposes described above, you should direct any request relating to your rights to the relevant data controller.

4. With third parties

We may share your personal information with the following third parties for the purposes identified in this Privacy Notice:

doctors, nurses, carers, pharmacists, pathology and radiology staff involved in analysing and reporting diagnostic tests, and any other healthcare professionals involved in your treatment;
other support staff involved in your care, such as receptionists and medical secretaries;
anyone whom you ask us to contact or whom you provide as an emergency contact;
National Health System organisations;
other private-sector healthcare providers;
your primary care doctor;
voluntary organisations providing ongoing support;
ancillary and support service providers where you choose to use such services, for example counsellors and therapists;
taxi service providers where transport assistance is provided as part of the treatment of insured patients; and
national and other professional research/audit programmes and registries, as described under Purpose 3.

5. With government bodies and local authority departments

This may include:

our regulators, such as the Health Inspectorate;
the police and other third parties where reasonably necessary for the prevention or detection of crime;
our insurers;
debt collection agencies;
third parties where required by law, regulation, court orders or lawful requests for information;
service providers that support our business operations. These processors are trusted partners who work with us and are authorised to use your personal information only where necessary to provide services to us. We require such third parties to comply strictly with our instructions and with data protection legislation, and we ensure appropriate safeguards are in place. We enter into written contracts with all our processors;
our external service providers, such as auditors, lawyers, marketing agencies and tax advisers; and
selected third parties in connection with any sale, transfer or disposal of our business.

We may communicate with these third parties in various ways, including by email, post, fax and telephone.

How long do we keep your personal information?

We retain information in accordance with our legal obligations and recognised national good practice. We monitor compliance through regular audits and ensure that information is securely deleted once the applicable retention period has expired.

We apply different retention periods to different categories of personal data and/or different processing purposes, including archive periods where applicable.

We will only retain your personal information for as long as reasonably necessary to comply with our legal and regulatory obligations. Our retention periods are aligned with recognised good practice. GenesisCare’s retention policy for most medical records is 30 years. A copy of this policy will be provided upon request.

International transfers of your personal information

GenesisCare is part of an international organisation. We, or third parties acting on our behalf, may store or process information collected about you in countries outside the European Economic Area (“EEA”).

Your information may be transferred, processed and stored outside the country in which it was collected, including in countries where the level of data protection may not be considered adequate by the relevant legal or regulatory authority in the country from which the data originated.

Where we transfer your personal information outside the EEA, we will take the necessary steps to ensure that your personal information is appropriately protected.

In general, if your permanent address is outside the EEA, or if your treatment continues outside the EEA, we may send information relating to your treatment to the individuals specifically responsible for continuing your care.

We also process personal information within the GenesisCare group of companies for administrative and management purposes. Group companies are located in the United Kingdom and Australia. This processing is based on our own or a third party’s legitimate business interests, and the following safeguards are in place to ensure that data is securely protected:

the country to which we send personal information may have been approved by the European Commission; or
the recipient may have entered into a data-sharing agreement or contract based on Standard Contractual Clauses approved by the European Commission, requiring it to protect your personal information.

In other circumstances, the law may permit us to transfer your personal information outside the EEA. In all cases, however, any transfer of your personal information will comply with applicable data protection legislation.

Your rights and your personal information

Under data protection law, you have a number of specific rights in relation to the personal information we hold about you. These include the right to know what information we hold about you and how it is used.

You may exercise these rights at any time by contacting us using the information set out in this Privacy Notice.

We will not normally charge you for handling a request to exercise your rights.

If we are unable to comply with your request to exercise your rights, we will normally explain why.

Special rules apply to the exercise of these rights in relation to medical information, as provided for under applicable legislation, including the Data Protection Act, the General Data Protection Regulation and any secondary legislation governing the use of personal information.

If you make a large number of requests or it is clear that a request is unreasonable, we may not be required to respond or we may charge a fee for responding.

Right to be informed: this is fulfilled through this Privacy Notice.
Right of access to your personal information: generally, you have the right to receive a copy of the personal information we hold about you and information about how we use it. Your information will generally be provided in writing unless you request otherwise. If you make the request electronically, for example by email, the information will be provided electronically where possible. Please note that in some circumstances we may not be able to comply fully with your request, for example where doing so would involve providing you with another individual’s personal data and this would adversely affect that individual’s rights.
Right to rectification: this allows you to request that incomplete information be completed or inaccurate information corrected. This helps ensure that your information remains accurate and up to date.
Right to erasure: this is also known as the “right to be forgotten”. In certain circumstances, you have the right to ask us to delete personal information that we hold about you. The broad principle underpinning this right is that you may request the deletion or removal of your personal data where there is no compelling reason for its continued processing.

Where we have disclosed the relevant personal data to third parties, we will inform them of the erasure unless doing so is impossible or would involve disproportionate effort. However, there are exceptions to this right and, in certain circumstances, we may refuse to delete the information concerned.

For example, we are not required to comply with your request where:

it is necessary to retain your information to perform tasks carried out in the public interest, including public health;
it is necessary for the establishment, exercise or defence of legal claims;
our legitimate business interests in processing the information override the request, or processing is necessary for medical diagnosis, the provision of health or social care, or the management of healthcare or social care systems or services, where the data is being processed by, or under the responsibility of, a professional who is subject to a legal obligation of professional secrecy, such as a healthcare professional; or
the request is manifestly unfounded or excessive, including where it is repetitive in nature.

Right to restriction of processing: in certain circumstances, you have the right to “block” or restrict the processing of personal data. Where processing is restricted, we are permitted to store the personal data but not otherwise process it. We may retain sufficient information about you to ensure that the restriction continues to be respected in the future.
Right to data portability: where you have provided information to us and the processing is carried out by automated means on the basis of your consent, you have the right to obtain the information GenesisCare processes about you and use it for your own purposes. This means that you have the right to receive your personal information or, where technically feasible, have it transferred to an individual or organisation of your choice, and we must provide the information in electronic format.
Right to object: you have the right to object to processing based on our legitimate business interests, including profiling, and to direct marketing, including profiling. Your objection must be based on grounds relating to your particular situation.
Right not to be subject to automated decision-making: you have the right not to be subject to decisions made solely by automated means, i.e. by a computer without human involvement, where those decisions have legal or similarly significant effects on you. No automated decisions will be made in relation to your treatment or other decisions producing legal or similarly significant effects. If our policy in this respect changes, we will update this Privacy Notice.
Right to withdraw consent: in certain cases, we require your consent in order to use your personal information in compliance with data protection legislation.

This is explained in the section entitled “What do we use your information for?”, where we rely on your consent. Where we do so, you have the right to withdraw your consent to our continued use of your personal information. You may do this by contacting our Data Protection Officer using the details provided at the end of this Privacy Notice.

Right to lodge a complaint with the supervisory authority.

Further information

Website: www.genesiscare.com
Telephone: 91 515 20 00

Making a complaint will not affect any other legal rights or remedies available to you.

Keeping your data secure

We have implemented appropriate technical and organisational security measures to protect your personal information. These include:

ensuring that our staff complete regular training;
ensuring that personal information is accessible to and shared only with individuals who need access to it;
implementing physical access controls at our premises;
using information about you that does not uniquely identify you, where appropriate; and
where personal information is transferred outside the European Economic Area, ensuring that appropriate safeguards are implemented to protect the data in accordance with applicable Data Protection Laws.

All our employees are subject to a duty of confidentiality. This means that they have a legal obligation to keep your information confidential and secure.

Enquiries

If you have any questions, wish to exercise your rights or want to confirm which rights apply to your particular circumstances, please speak to the GenesisCare healthcare professional responsible for your care.

You may also contact our Data Protection Officer (DPO):

Email: [email protected]
or by writing to the address shown at the beginning of this Privacy Notice.

Telephone: 91 515 20 00

Updates to this Privacy Notice

We may update this Privacy Notice periodically to ensure that it remains accurate. Where any changes result in a material change to the way in which we process your personal data, we will provide you with an updated copy of the Policy setting out the specific changes.