Legal

Privacy Policy

In accordance with GDPR and Spanish data protection law

Last updated: 09 July 2026

1. Data Controller

2. General Information on Data Processing

Doc-Mallorca processes personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Spanish data protection laws. If you have questions about the processing of your data, exercising your rights, or this privacy policy, please contact Doc-Mallorca at info@doc-mallorca.com.

Legal Bases

The processing of personal data is based on the following legal bases under GDPR Article 6:

• Art. 6(1)(a) GDPR: Your explicit consent to data processing
• Art. 6(1)(b) GDPR: Processing for the performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR: Compliance with a legal obligation to which Doc-Mallorca is subject
• Art. 6(1)(f) GDPR: Legitimate interests of Doc-Mallorca or a third party

3. Hosting

This website is hosted by:

The processing of hosting-related data (e.g. server log files with IP addresses) is based on Article 6(1)(f) GDPR (legitimate interests) and Article 28 GDPR (data processing agreement). A data processing agreement with All-Inkl.com is in place.

With each page request the server automatically records technical access data (server log files): the page requested, date and time, volume of data transferred, browser and operating system, referrer URL and the IP address. These server log files are stored only as long as necessary for operational security, stability and defence against attacks, and are then deleted automatically; the specific retention period follows the requirements of the processor (All-Inkl.com). This data is not combined with any other data sources.

4. Fonts

This website uses exclusively locally hosted fonts. No external font services (e.g. Google Fonts) are used. Therefore, no data is transferred to third parties in connection with fonts.

4a. Web Analytics — Google Analytics 4 (consent-based)

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). Google Analytics is loaded only after your explicit consent via the cookie banner. Without consent, no analytics cookies are set and no data is transmitted to Google (the Google script is not even loaded in that case).

• Purpose: Anonymous reach and usage statistics to improve the website (e.g. page views, approximate region, device type, referral source).
• Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG.
• Consent Mode v2: Prior to consent, analytics and marketing storage (incl. analytics_storage) is disabled by default.
• IP anonymisation: In Google Analytics 4, IP addresses are not permanently stored or logged; collection is IP-anonymous.
• Data processed: Pseudonymous identifiers (cookie ID), truncated location data, device and browser information, interactions with the website.
• Transfer to third countries: A transfer to the USA (Google LLC) is possible, based on the EU-US Data Privacy Framework and Standard Contractual Clauses pursuant to Art. 46 GDPR.
• Storage period: Analytics cookies up to 24 months.
• Withdrawal: You can withdraw your consent at any time with effect for the future — reopen cookie settings and choose "Decline", or delete the cookies in your browser.

A data processing agreement pursuant to Art. 28 GDPR is in place with Google. For more information, see the Google Privacy Policy.

4b. Marketing — Google Ads conversion tracking (consent-based)

This website uses Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; "Google") to measure the effectiveness of our ads (conversion tracking) — in particular when you click a WhatsApp contact button. The Google Ads tag is loaded only after your explicit consent to the "Marketing" category via the cookie banner. Without marketing consent, no marketing cookies are set and no conversion data is transmitted to Google.

• Purpose: Measuring the effectiveness of Google Ads campaigns (conversion tracking, e.g. WhatsApp contact).
• Legal basis: Your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG.
• Consent Mode v2: Before consent, marketing storage and advertising identifiers (ad_storage, ad_user_data, ad_personalization) are disabled by default.
• Data processed: Pseudonymous cookie/click identifiers, the conversion event (click on a WhatsApp CTA), device and browser information.
• Transfer to third countries: Transfer to the USA (Google LLC) is possible, based on the EU-US Data Privacy Framework and standard contractual clauses under Art. 46 GDPR.
• Withdrawal: You can withdraw your marketing consent at any time with future effect — reopen cookie settings and deselect the "Marketing" category (or choose "Decline").

For more information, see Google\x27s Privacy Policy.

5. Online Booking Form

You can request a doctor's house call via the online booking form (/en/book/). The data you enter is transmitted encrypted to our server and processed there — not via WhatsApp or any third-party messenger.

• Purpose: Processing your booking request and contacting you by phone to arrange the visit.
• Data processed: Name, phone number, email address, place of stay/hotel, date of birth and your voluntary details on symptoms/notes.
• Legal basis: Your consent under Art. 6(1)(a) GDPR (checkbox in the form). For the voluntarily provided health data, additionally Art. 9(2)(a) GDPR (explicit consent) in conjunction with Art. 9(2)(h) GDPR (healthcare provision).
• Storage and deletion: Booking requests are stored encrypted (AES-256) on our web server (for hosting see section 3) and are automatically deleted after 30 days. If a request becomes a treatment case, the retention periods in the section "Management System (Admin Dashboard)" apply additionally.
• Confirmation email: After submitting, you receive an automatic confirmation email to the address provided (sender info@doc-mallorca.com). It contains no health data.
• Disclosure: Your data is not passed on to third parties.
• Withdrawal: You can withdraw your consent at any time with effect for the future (contact see section 1).

5a. Communication via WhatsApp

Booking requests can be submitted via the website's contact form. The data provided (name, phone number, address/hotel name, date of birth, complaints) is processed for handling the request and scheduling appointments.

Communication and the transmission of booking requests takes place via WhatsApp (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). Your data may be processed on Meta servers, which may be located outside the EU. Please refer to WhatsApp's Privacy Policy.

Note on medical data (Art. 9 GDPR): When making a booking, you voluntarily submit health data (complaints, symptoms). This data is processed exclusively for providing the medical house call and is not shared with third parties. The legal basis is Art. 9(2)(h) GDPR (healthcare) and your explicit consent under Art. 9(2)(a) GDPR, which you provide by actively sending the message.

5b. Invoicing and Storage

Purpose: Sending invoices (as download links) and treatment information via email, as well as a one-time review request after the medical visit (via email or QR code on the invoice).

Legal basis: Your consent under Art. 6(1)(a) GDPR, provided by checking the consent box in the booking form. You may withdraw this consent at any time.

Invoice storage: Invoices are stored as PDF files on our web server and are accessible via an individual, non-publicly listed link. Storage is based on statutory retention obligations (Art. 6(1)(c) GDPR, § 14b German VAT Act: 10 years).

5c. Push Notifications (Web Push)

Doc-Mallorca offers the option to receive push notifications via your web browser to inform you when the doctor is available again.

• Legal basis: Your explicit consent under Art. 6(1)(a) GDPR, provided by actively enabling notifications
• Data processed: Only technical, anonymous push endpoint data is stored (endpoint URL, encryption keys). No personal data such as name, phone number or email address is collected
• Purpose: One-time notification when the doctor becomes available (maximum once per day)
• Storage period: The push subscription is stored until you unsubscribe or the subscription expires through the browser
• Withdrawal: You can unsubscribe at any time — directly in the app via the "Unsubscribe" link or through your browser's notification settings

5d. Management System (Admin Dashboard)

Doc-Mallorca operates an internal, access-restricted management system for coordinating medical house calls.

• Legal basis: Art. 6(1)(b) GDPR (contract fulfilment — provision of medical house calls) and Art. 6(1)(c) GDPR (statutory retention obligations for invoices)
• Data processed: Patient master data (name, phone number, date of birth, address/hotel), deployment data (complaints, time preference, status), invoice data (services, amount, payment method)
• Storage: Server-side on the Doc-Mallorca web server, protected by access restrictions (authenticated physicians only)
• Retention periods: Invoices: 10 years (§ 14b German VAT Act). Deployment data: 2 years after completion. Patient master data: until deletion request or 2 years after last deployment
• No disclosure: Patient data is not shared with third parties
• Your rights: You may request information about your stored data, its correction or deletion at any time (provided no statutory retention obligation applies)

Case map view (internal): In the management system, cases can be displayed on a map. Location is determined exclusively via a fixed list of service-area coordinates stored in the system — no location data is transmitted to third parties for this. Map tiles are served by OpenStreetMap. An optional "Navigation" button opens a route in Google Maps; the destination address is transmitted to Google only upon your active click. Legal basis: Art. 6(1)(b) GDPR (performance of the contract — coordination of the house call).

6. Your Data Protection Rights

Under the GDPR, you have the following rights with respect to Doc-Mallorca (provided the legal requirements are met):

• Right of access (Art. 15 GDPR): You may request confirmation of whether and which personal data Doc-Mallorca processes about you
• Right to rectification (Art. 16 GDPR): You may have inaccurate data corrected
• Right to erasure (Art. 17 GDPR): You may request deletion of your data, provided no legal retention obligations exist
• Right to restriction of processing (Art. 18 GDPR): You may request that processing be restricted
• Right to data portability (Art. 20 GDPR): You may receive your data in a structured, commonly used format
• Right to object (Art. 21 GDPR): You may object to the processing of your data, particularly in the case of legitimate interests
• Withdrawal of consent: You may withdraw your consent to data processing at any time with future effect

To exercise these rights, please contact Doc-Mallorca at info@doc-mallorca.com.

7. Complaint to the Supervisory Authority

Doc-Mallorca is subject to the supervision of the AEPD (Agencia Española de Protección de Datos), the Spanish data protection authority. You have the right to lodge a complaint with the AEPD if you believe that Doc-Mallorca has violated your data protection rights.

8. Data Security

Doc-Mallorca implements technical and organisational measures to protect your personal data from unauthorised access, loss, misuse and alteration. These include:

• Encrypted transmission (TLS/HTTPS) of all data
• Secure data storage
• Access control and authentication
• Regular review of security measures

Despite these measures, absolute security cannot be guaranteed.

9. Changes to This Privacy Policy

Doc-Mallorca may update or amend this privacy policy at any time without prior notice to reflect changes in laws, regulations or other operational reasons. It is recommended to review this privacy policy regularly to stay informed about any changes.

10. Contact and Questions

If you have questions about this privacy policy, the processing of your personal data or the exercise of your rights, please contact Doc-Mallorca at: