Policies

About us

The controller of your personal data is EON LIFE LONGEVITY, SLU (Eonlife Clinic), with NIF L-722179-B, email address info@eonlifeclinic.lucusprueba.es and registered address at C. Prat de la Creu, 6, AD500 Andorra la Vella, Principality of Andorra.

Data Protection Officer (DPO): Jaume Diez.
DPD contact: DPDextern@win2win.ad

What data we collect

When you use this website, we may collect the following categories of data, in accordance with the purposes described in this policy:

- Contact and request details: the information you provide when making an information request to us (for example, your first and last name, email address, telephone number if provided, and the content of the message).
Cookie consent preferences: your choices regarding the use of cookies and similar technologies, which we manage through our own consent management system (Trustwards).
- Technical device and connection data: IP address, browser type and version, technical identifiers and information necessary to enable communication with the website and ensure its operation and security.
- Usage data for analytics: information about how you browse and interact with the website when you accept cookies or analytics technologies (for example, pages visited, time spent visiting, interactions and events).
- Advertising data: identifiers and information relating to the delivery of advertising and the measurement of its performance when you accept cookies or advertising technologies.
- Data for commercial email communications: your email address and, where applicable, communication preferences, when you authorise us to send you commercial information.

Special categories of data (health and genetic data): we process health data and clinical information necessary for healthcare, including medical history, symptoms, diagnoses, tests, medical imaging, treatments and follow-up. Where the service requires it, we may process genetic data, information associated with biological samples and clinical transcriptions. Where this processing is based on your explicit consent, you may withdraw it at any time; the withdrawal will not affect the lawfulness of the processing carried out prior to its withdrawal.

Data sources:
- Directly from you: when you contact us or send us a request for information through the channels available on the website.
- Automatically: when browsing the website, through technical logs and connection data necessary for operation and security.
- Via cookies and similar technologies: only in the case of non-essential cookies, when you give us your consent.

Mandatory or optional nature of the data: the data you provide us to process a request for information are necessary in order to reply to you. The remaining data based on non-essential cookies (analytics, advertising and, where applicable, related preferences) are optional and depend on your consent; you can reject them or withdraw your consent at any time from the cookie settings.

How we use your data

We process your personal data for the following purposes and on the indicated legal bases:

- Responding to your requests for information and managing communication with you: we process contact details and the content of the request in order to handle it and provide a reply. Legal basis: performance of pre-contractual measures or a contract.

- Measure user behaviour on the website using analytics services that use cookies or identifiers: we process usage data to understand how the website is used and to improve its performance and content. Legal basis: consent.

- Advertising and measurement of advertising performance through advertising networks and similar technologies: we process data associated with advertising identifiers to show advertising and measure its results. Legal basis: consent.

- Sending of commercial communications by email: we use your email address to send you commercial information when you authorise us to do so. Legal basis: consent.

- Website security and protection: we use technical data and logs to prevent, detect and manage security incidents and misuse. Legal basis: legitimate interest.

Who we share your data with

Based on the information available, we have not identified any specific third-party providers integrated into the website beyond the proprietary systems necessary for its operation. Where necessary to provide the service or manage the described purposes, we may use categories of providers acting as data processors, such as web hosting and maintenance providers, forms, CRM, email and messaging, clinical management, electronic signature, backups, tracking platforms and clinical artificial intelligence tools. In such cases, we share only the data necessary to provide the service, under contracts requiring confidentiality and security measures, and in accordance with their privacy policies.

In addition, we can share data with healthcare professionals, laboratories, diagnostic centres, cell banks, financial institutions, consultancies and competent authorities when necessary and where there is a legal basis that permits it.

Cookie consent management: we use our own consent management system (Trustwards) to record and manage your cookie preferences. This data is processed internally and is not shared with third parties.

International data transfers

We do not have information indicating international data transfers associated with specific third-party providers integrated into this website. If, depending on the processing, providers located outside the EEA or in countries that do not offer an equivalent level of protection are used, we will apply the appropriate safeguards provided for by regulations, such as standard contractual clauses approved by the European Commission or, where applicable, recognised international transfer mechanisms.

Our consent management system (Trustwards) is based in Spain (EU), meaning that cookie consent preference data is not transferred internationally.

How long we keep your data

We retain data only for as long as necessary for the purpose for which they were collected and, subsequently, for the applicable legal periods of retention, prescription and liability. When it is no longer necessary to keep them active, we will appropriately delete, anonymise or block them.

The specific criteria for each type of processing are set out in the section «Retention periods by type of processing» of this policy. Withdrawal of consent or a request for erasure does not entail the deletion of information that we are required to retain due to a legal obligation or in order to fulfil our responsibilities.

Cookie consent logs: 10 years (to demonstrate compliance and handle potential claims within the applicable limitation periods).

Security logs and technical records: 12 months.

Consent-based analytics data: until you withdraw consent or in accordance with the analytics tool's retention settings.

Consent-based advertising and marketing tracking data: until consent is withdrawn.

Data for commercial email marketing: until consent is withdrawn or you unsubscribe.

His rights

If data protection regulations apply to you, you have the right to:

- Access your personal data and obtain information about how we process it.
- Rectify inaccurate or incomplete data.
- Request the erasure of your data where appropriate.
- Request the restriction of processing in certain circumstances.
- To receive the data you have provided to us in a structured, commonly used and machine-readable format, and to request its portability where applicable.
- Object to processing in certain circumstances.
- Withdraw consent at any time when processing is based on consent.
- Not to be subject to automated individual decisions which produce legal effects or similarly significantly affect them.

To exercise your rights, you can contact us at info@eonlifeclinic.lucusprueba.es. We may request additional information to verify your identity. We will respond within a maximum period of one / month from receipt of the request, except in cases where regulations permit an extension due to the complexity or number of requests.

Automated decisions

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Child privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, please contact us immediately.

Data security

We apply appropriate technical and organisational measures to protect personal data and reduce the risks of loss, misuse, unauthorised access, disclosure or alteration. However, no internet transmission or storage system is completely secure; therefore, we cannot guarantee absolute security, but we adopt reasonable precautions in accordance with the nature of the data and the risks.

Security breach notification

In the event of a personal data security breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. The communication will include, where possible, the nature of the incident, the probable consequences, and the measures adopted or proposed to address it. We have procedures in place to detect, report, and investigate security incidents. If you suspect a security issue, you can contact us at info@eonlifeclinic.lucusprueba.es.

How to make a complaint

You have the right to lodge a complaint with the competent supervisory authority in your jurisdiction. Given that the controller is established in Andorra, the competent authority may vary depending on your place of residence and the context of the processing. In any case, we recommend that, before lodging a complaint, you contact us so that we can try to resolve the matter swiftly.

Updates to this policy

We review and update this policy periodically to reflect changes on the website, in processing activities or in applicable requirements. The “Last updated” date indicates when the most recent changes were made. If we make significant changes, we will notify you via a notice on the website or, where appropriate, by email. Changes take effect from the date indicated at the beginning of this policy. Where a processing activity is based on consent, we will request new consent if necessary.

Scope of application, regulations and data protection officer

Through this Privacy Policy, EON LIFE LONGEVITY, SLU (hereinafter, «Eonlife Clinic», «we» or «the Clinic») informs you of which personal data we process, for what purposes, the applicable legal bases, with whom we may share them, how long we retain them and what rights you have in relation to your personal data.

Applicable regulations

• Law 29/2021, of 28 October, qualified on the protection of personal data of the Principality of Andorra (LQPD).

• Decree 391/2022, of 28 September 2022, approving the Regulation for the application of the LQPD.

• Decree 45/2023, of 25 January 2023, approving the Regulation amending the Regulation for the application of the LQPD.

• Where applicable due to the territorial context of the processing, Regulation (EU) 2016/679 (GDPR).

Summary

• Our objective is to limit the information we collect to that necessary to provide our services and fulfil our obligations.

• Given the healthcare nature of our activity, we apply enhanced safeguards to the processing of health data, genetic data, biological samples and clinical information.

• We do not use your data for purposes incompatible with those we have communicated to you, nor do we share it with third parties unless there is a necessity, a legal basis, or an obligation that justifies it.

• You can exercise your data protection rights at any time.

This Policy applies to individuals who interact with Eonlife Clinic via our website or our contact channels, potential patients and patients, family members or representatives where applicable, healthcare professionals, suppliers and partners, candidates and personnel, facility visitors and, in general, anyone whose personal data is processed within the scope of the activities described in the section «Purposes and legal bases of processing».

We have an external Data Protection Officer, Win2Win, SLU, whom you can contact via the email address DPDextern@win2win.ad.

We are not responsible for the processing carried out by other websites or independent entities, even if you can access them via links or services integrated into our website. When a third party acts as a data controller or joint controller for a specific service, we will inform you of their identity and role.

How we obtain your personal data

Generally, we obtain data directly from you, when you contact us, complete a form, request an appointment, contract or use a service, participate in a programme, provide us with clinical documentation or exercise a right. We may also obtain data from the following sources when necessary to provide you with the service or comply with an obligation:

• Family members, representatives or persons acting legitimately on your behalf.

• Healthcare professionals, medical centres, laboratories or diagnostic centres involved in your care or whom you authorise to share information with us.

• Technology providers or platforms that we use to provide services, always within the corresponding role and instructions.

• Video surveillance or access control systems, if installed on the premises.

• Website cookies and similar technologies, in accordance with the preferences you have set.

• Information generated during the provision of care, including tests, results, professional notes, functional follow-up and, where applicable, validated clinical transcripts.

• Contact and professional data provided to us by the entities with which you maintain a professional or representative relationship.

When we receive data from a third party, we will apply the principles of necessity, minimisation and transparency that correspond to the context of the processing.

Purposes and legal bases of processing

Below we describe the processing purposes that Eonlife Clinic carries out as a controller, in accordance with our Record of Processing Activities. A single relationship with us may involve several processing operations, depending on the services you request or use.

1. Website management, forms and expression of interest list

We collect the data you provide when you request information through the website or sign up to the interest list to find out about the opening, services and news of Eonlife Clinic. We may process your first and last name, email address, data you voluntarily provide and technical form metadata, such as the date and time of the request or the IP address.

The legal basis is your consent when you sign up to receive information and, when your request is aimed at contracting a service, the application of pre-contractual measures at your request.

2. Handling of enquiries, requests for information and contact channels

We process the data you provide us with in order to handle general or administrative medical queries, appointment requests and questions regarding services, prices, availability or treatments. The consultation may include identifying and contact data and, if you provide them, health-related information.

The legal basis may be the implementation of pre-contractual measures, consent or our legitimate interest in properly handling enquiries. Where the enquiry includes health data, we will apply the specific basis and authorisation that corresponds to the processing of these special categories of data, including the provision of healthcare or explicit consent where necessary.

3. Informative communications, newsletters and sales prospecting

If you have subscribed or agreed to receive communications, we may use your name, email address, preferences, consents and mailing history to inform you about services, activities, content, updates and communications related to Eonlife Clinic.

The main legal basis for this treatment is your consent. Where legally permissible, we may also base certain communications relating to similar services on legitimate interest, always with the right to object. Under no circumstances will we use a commercial communication to unnecessarily reveal your status as a patient.

4. Initial visits, initial assessment and health triage

To arrange an initial visit, assess the suitability of our services and prepare the care process, we may process identification and contact details, medical history, medication, previous reports, diagnostic tests, preferences and data necessary to manage the appointment or payment.

This processing may be based on the provision of healthcare, on explicit consent where required for processing health data, on the performance of a contract or pre-contractual measures, and on applicable healthcare legal obligations.

Patient management, medical records and healthcare provision

When you are a patient, we process the data necessary to provide medical services and maintain your medical record: identification and contact details, medical history, diagnoses, tests, medical images, reports, prescriptions, clinical consents, follow-up, care communications, financial data, and information entered by healthcare professionals. Clinical transcriptions validated by the professional may also be integrated.

The legal basis derives from the provision of healthcare and the management of medical records, from statutory health obligations, from the healthcare contract and, where required, from explicit consent. Any use of clinical data for purposes not strictly related to healthcare will require a separate legal basis and specific information.

6. Regenerative medicine, personalised treatments and post-treatment follow-up

To plan, apply and monitor regenerative medicine treatments, we can handle diagnoses, tests, images, functional scales, pain data or limitations, information on the treatment applied, the patient's own biological material, clinical consents, incidents and progress.

These treatments are based, depending on the case, on the provision of healthcare, explicit and informed consent, statutory healthcare obligations and the performance of the healthcare contract.

7. Preventive and predictive medicine, diagnostic tests, blood tests and health plans

To carry out or coordinate preventative or predictive medicine procedures and draw up health plans, we may process health data, habits, family medical history, test results, biomarkers, diagnostic tests, reports and recommendations. If the service requires it, genetic data may also be processed.

The legal basis is, as appropriate, the provision of healthcare, explicit consent, legal health obligations and the performance of the healthcare contract. Genetic data or predictive profiling, if used, shall be subject to enhanced safeguards.

8. Personalised performance, wellbeing and quality of life programmes

In personalised performance optimisation, recovery, well-being or quality of life programmes, we may process identification and contact details, health, habits, physical activity, goals, functional tests, pain or performance scales, progress and programme adherence.

The processing is based on the provision of the contracted service and, where health data are involved, on the provision of healthcare or the corresponding explicit consent.

9. Management of biological samples, stem cells and cell banking

When the service includes the obtaining, preparation, preservation or coordination of biological samples or stem cells, we may process identifying data, health data, biological material, associated clinical information, sample identifiers and traceability, consents, results, preservation data and chain of custody.

The legal basis may include the provision of healthcare, explicit and informed consent, statutory health obligations and the service contract. Depending on the specific organisation involved with laboratories, cell banks or collaborating centres, specific information will be provided regarding the data protection roles of each entity.

10. Tracking, rehabilitation and functional monitoring platform

We can use a tracking platform to monitor functional progress, injuries, pain, recovery, exercises or rehabilitation protocols. In this context, we may process identifying data, health data, questionnaire results, functional scales, adherence data, communications and, where applicable, videos or images.

The legal basis is the provision of healthcare, explicit consent where necessary, the performance of the service and, insofar as it is applicable, the legitimate interest in ensuring continuity of care.

11. Payments, invoicing, accounting and administrative obligations

We process the data necessary to manage quotes, collections, payments, invoices, accounting, taxes and eventual refunds. This may include identification and contact data, economic, tax and billing data, and bank details or partial payment data.

The legal basis is the performance of the contract, compliance with accounting and tax legal obligations, and legitimate interest in administrative management. We will endeavour to ensure that invoices and supporting documents contain only the strictly necessary care-related information.

12. Testimonials, images, videos, results and corporate communication

With your authorisation, we can manage testimonials, photographs, videos, success stories, opinions or results for corporate communication, the website or social media. This content may reveal health information if the testimonial or case is identifiable.

The legal basis is consent, which shall be explicit and specific when health data is disclosed. Corporate content that does not allow the identification of any person may be processed on the basis of legitimate interest.

13. Suppliers, collaborating professionals and contractual relationships

We process data of contact persons of suppliers, medical professionals, laboratories, platforms, collaborating centres, advisors and other third parties with whom we maintain a contractual relationship. We may process identification and contact details, professional details, qualifications, contractual, economic and insurance data, credentials and activity records.

The legal basis is the performance of the contractual or pre-contractual relationship, compliance with legal obligations and our legitimate interest in properly managing professional relationships.

14. Recruitment, human resources and employment management

We process the data necessary to select and manage our own personnel and contracted professionals, including contact details, CVs, training, professional or healthcare qualifications, employment details, payroll, bank details, time and attendance records, incidents and, where applicable, occupational health information.

The legal basis is the application of pre-contractual measures, the performance of the employment or professional contract, compliance with legal obligations, and consent only when necessary for optional processing.

15. Exercise of rights, complaints, security breaches and regulatory compliance

We process personal data when you submit a request to exercise your rights, a complaint, or a data protection enquiry, and also when we manage incidents or security breaches. We may process identification and contact details, the data subject to the request, evidence, incident logs, and documentation regarding the response or identity verification.

The legal basis is compliance with our legal obligations and, where applicable, our legitimate interest in managing and defending claims or liabilities.

16. Cookies, consent, analytics, preferences and digital marketing

Our website may use cookies and similar technologies to ensure its operation, manage preferences, obtain statistics and, if you authorise it, develop analytics or digital marketing. This processing may include IP addresses, online identifiers, device and browser data, preferences, consents and browsing data.

Strictly necessary cookies are based on technical necessity or the legitimate interest in ensuring the operation of the website. Analytical, marketing cookies or other non-necessary technologies will only be activated on the basis of your consent. Please see our Cookie Policy for detailed information on each technology and its duration.

Physical security, access control and video surveillance

If the clinic has video surveillance or access control systems, we may process your image, date and time, location, visitor identification data and incident logs to protect people, facilities, equipment, samples, medicines, clinical information and other property.

The legal basis is our legitimate interest in security and, where applicable, the public interest or a legal obligation. CCTV-monitored areas will be duly signed.

18. Artificial intelligence system for clinical transcription and diagnostic support

We can use an artificial intelligence tool to transcribe conversations between healthcare professionals and patients, generate preliminary clinical notes or summaries, and support care documentation or diagnosis. The system can process voice, identifying data, health data, medical history, symptoms, tests, diagnoses, treatments, relevant family or social information, transcripts, summaries, AI-generated suggestions and audit logs.

The tool is used as support and does not replace the judgement of the healthcare professional: notes, summaries or suggestions must be reviewed and validated by a person before being incorporated into the medical record or used in a care decision. The legal basis is framed within healthcare, applicable healthcare obligations and, where required, explicit consent or enhanced information. We will not permit the use of patient data to train provider models without a specific legal basis, adequate information and enhanced safeguards.

Recipients and international transfers

We do not share your personal data with third parties indiscriminately. We will disclose them or grant access to them only when necessary to provide you with the services, when you request or authorise it, when there is a legal obligation or when another legal basis permits it. Depending on the processing, the recipients or categories of recipients may be:

• Healthcare professionals and authorised administrative staff who need to access the information in order to provide or manage care.

• Laboratories, diagnostic centres, medical centres, cell banks and other healthcare professionals or entities involved in tests, treatments, samples, monitoring or continuity of care.

• The Andorra healthcare system, public administrations and health authorities when regulations require communication or when it is necessary within the scope of care.

• Insurance companies, when requested by you, authorised by you or where there is a sufficient legal basis for the communication.

• Technology providers acting on our behalf, such as web hosting services, forms, CRM, email, messaging, tracking platforms, medical records, signature, backup, analytics or artificial intelligence tools.

Payment providers, banking institutions, accounting, tax or labour advisory services, and auditors, to the extent necessary to manage payments, invoicing, accounting, payroll or legal obligations.

• Marketing, social media or video platform providers when you have consented to the corresponding processing or when we publish authorised content.

• Security companies, insurance companies, law enforcement authorities, courts or other competent authorities when necessary to manage an incident, protect rights or comply with a legal obligation.

• The Andorrana Data Protection Agency, legal advisers and other competent authorities when necessary to manage rights, claims, security breaches or responsibilities.

• Suppliers, collaborating professionals and sub-processors who need to access data to provide us with a service, always subject to their corresponding contractual and confidentiality obligations.

Some technological services, laboratories, social media or platforms may involve processing or access from outside Andorra or the European Economic Area. When an international transfer occurs, we will apply the safeguards required by the LQPD and will inform you when necessary. In the case of particularly sensitive processing, such as biological samples or clinical AI tools, we will specifically validate the location, sub-processors, remote access and transfer safeguards before using the service.

Conservation by type of treatment

Enquiries and web forms

Pending the processing of the request; if the consultation results in a care relationship, the relevant information may be incorporated into the clinical record.

Informative communications and newsletters

Until you withdraw your consent or object, we will keep the necessary evidence of the withdrawal or consent for the period of liability.

Medical history, initial consultations and treatments

Within the timeframes required by health regulations, continuity of care and professional liability, the Clinic shall apply a specific clinical retention policy.

Biological samples and cell bank

In accordance with health regulations, the applicable consents, preservation contract and chain of custody.

Tracking platforms

During follow-up and, when information is integrated into the medical record, in accordance with the clinical retention policy.

Invoicing and accounting

For the duration of the applicable accounting, tax and liability legal periods.

Testimonials, images and videos

Until the withdrawal of consent where legally possible, or during the period of the corresponding campaign or authorisation; proof of consent shall be kept for the limitation period for liability.

Suppliers and professional relationships

During the relationship and the legal, accounting and tax liability periods.

Applications and human resources

Applications will be kept for a limited period; employment data for the duration of the employment relationship and the applicable employment, tax and liability periods.

Rights, claims and gaps

During the processing and limitation periods for liabilities.

Cookies and web consents

Depending on the duration of each cookie and the period required to keep the evidence of consent.

CCTV

Where they exist, images will be kept for a limited period, usually a maximum of 30 days, unless it is necessary to block or retain a copy due to an incident or request.

Clinical AI

The original audio files, if any, only for the strictly necessary time to generate and validate the transcription, unless there is a justified clinical or legal necessity. The validated notes will follow the medical records policy and activity logs for the necessary period for security, traceability and liabilities.

Rights and how to exercise them

You have the right to obtain confirmation as to whether or not we are processing your personal data and, where applicable, you can exercise the following rights:

• Access to your personal data.

• Rectification of inaccurate or incomplete data.

• Deletion of data when legal requirements are met.

• Restriction of processing.

• Objection to processing, especially when based on legitimate interest.

• Data portability where applicable.

• Withdrawal of consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

• Right not to be subject to a decision based solely on automated processing where regulations recognise this right.

Any artificial intelligence tools we may use in the clinical setting have a supporting function: their transcripts, summaries or suggestions must be reviewed and validated by a healthcare professional before being used in a care decision.

Where and how you can exercise your rights

You can exercise your rights by sending a written request to EON LIFE LONGEVITY, SLU, C. Prat de la Creu, 6, AD500 Andorra la Vella, or preferably by email to DPDextern@win2win.ad, indicating in the subject line «Exercise of personal data protection rights».

If we cannot reasonably verify your identity, we may request additional information strictly necessary to ensure that we are responding to the data subject or their legitimate representative. If you are acting through a representative, proof of representation will be required.

If you consider that we have not adequately addressed your rights, you can lodge a complaint with the Andorran Data Protection Agency (APDA).

Responsibilities when providing personal data

When you provide us with personal data, you must ensure that they are accurate, complete and up to date. If you provide us with data belonging to another person, you should only do so when justified by the relationship or the service and when you have the necessary legal basis to communicate them to us.

In the healthcare sector it is especially important that the clinical information you provide is accurate and up to date, as it may be relevant for assessment, diagnosis, treatment or monitoring. If you spot an error, please let us know as soon as possible.

When acting on behalf of a minor or a represented person, you must provide proof of the corresponding representation or authorisation in accordance with the applicable regulations.

Security and confidentiality

We are committed to the confidentiality, integrity and availability of personal data. We apply technical and organisational measures adapted to the risk, particularly reinforced when we process clinical information, health data, genetic data or biological samples.

• Role-based access control and principle of least privilege.

• Access to the medical history is limited to the healthcare and administrative staff who need it.

• Traceability and recording of access when possible and appropriate.

• Encryption of communications and, where possible, of stored information.

• Backup copies and procedures for continuity and restoration.

• Health confidentiality protocols and staff training.

• Incident management and security gaps.

• Contracts and controls regarding managers and subordinates.

• Minimization of data and separation of clinical information from administrative information whenever possible.

• For clinical AI tools: impact assessment where appropriate, human oversight, access control, activity logging, error review, and limiting the use of data for provider training.

Modifications to this policy

We may update this Privacy Policy to adapt it to legal, regulatory, technical, or service changes. When changes are relevant, we will take reasonable measures to inform you and, where necessary, request your consent again. We recommend that you periodically review the current version published on our official channels.

Contact

NIF: L-722179-B
Email: info@eonlifeclinic.lucusprueba.es
Address: C. Prat de la Creu, 6, AD500 Andorra la Vella, Principality of Andorra
Responsible for the processing: EON LIFE LONGEVITY, SLU (Eonlife Clinic)