In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, ASSISTÈNCIA AVANÇADA BCN S.L.U informs you of its Privacy Policy.

1. Responsible for the processing of personal data

ASSISTÈNCIA AVANÇADA BCN S.L.U, WITH CIF B62081716 AND REGISTERED OFFICE AT Passeig de la Zona Franca, 105-107, AXA-Torre Ponent, 08038 Barcelona

2. Purposes and legal bases of the processing

Your personal data will be processed for the following purposes:

2.1. If you are a user of the website, the data will be processed for the following purposes:

• Website maintenance.

The basis of legitimacy is the legitimate interest to allow communication between the computer and the network, to provide the service requested on the website such as the user's log-in and subsequent identification and customization of the user interface.

This purpose corresponds to the need to display content on your website and improve usability by accessing users.

• Analysis of browsing behaviour and profiling of your browsing preferences and interests.

The basis of legitimacy is the consent granted by you, allowing the Data Controller to proceed with the creation of your profile based on information on your browsing, according to your consumption habits.

This purpose responds to the need to show you products or services for advertising purposes on the different browsing websites adjusted to your real needs, to maintain the preferences chosen on the website and to measure the traffic on the website. The information relating to your profile will be treated securely and confidentially, being processed only in systems that analyse the information obtained in an automated way. On the other hand, you may, at any time, express your desire not to be subject to this processing, exercising your right to oppose it.

• In the event that you provide your personal data by telephone or contact email made available to you on the website:

Your data will be processed for the purpose of managing your requests for information, resolving your doubts, answering your queries or processing your complaints, including those related to health and surgical care services, as well as the maintenance and development of the legal relationship that may be established between the parties, before contracting our services.

The basis of legitimacy is the consent given expressly when calling or writing to us, as well as the application of pre-contractual measures, at your request (article 6.1.b GDPR) and compliance with legal obligations, in accordance with article 6.1.c GDPR and article 8.1 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights.

• Recording of calls made to the contact telephone number of the website and the medical centres, in order to control the quality of the service, as well as to improve it:

The legitimate basis on which this processing is based is the legitimate interest of the Data Controller in ensuring the correct execution of the service and its continuous improvement.

• Management of the whistleblowing channel: If you report an irregularity or inappropriate conduct to us through the whistleblowing channel, your data will be processed for the processing, investigation, and resolution of the complaint received through said channel.

The legitimate basis is the consent of the complainant to the processing of their personal data when they communicate the complaint, as well as compliance with the legal obligations established in Law 2/2023, of 20 February, regulating the protection of people who report regulatory breaches and the fight against corruption.

2.2. If you are a patient and you contract health care or surgical services through any enabled channel, your data will be processed for the following purposes:

• Management of the appointment request service:

You can request an appointment with the medical centre of your choice through the means made available to you. Your data will be processed exclusively to process this appointment in the medical centre's systems.

The legal basis on which this processing is based is the contractual performance established between you and the medical centre, on which the health or surgical care you have requested is based.

• Provision, monitoring, management, control and billing of healthcare and/or surgical services requested directly or through a third party, including prevention, diagnosis and medical treatment:

The basis of legitimacy is the management and formalisation of the contract for the provision of healthcare services and of which you are an integral party (articles 6.1.b and 9.2.h GDPR), as well as compliance with legal obligations, in accordance with article 6.1.c. of the GDPR and article 8.1 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights.

In addition, in the event that you undergo a healthcare process that requires the processing of genetic data, the data controller will obtain your express consent.

Based on Law 14/2007, of 3 July, on Biomedical Research, personal genetic data will be kept for a minimum period of five years from the date on which they were obtained, after which the interested party may request their cancellation. If there is no request from the interested party, the data will be kept for the period necessary to preserve the health of the person from whom they come or of third parties related to them. Outside these cases, the data may only be kept, for research purposes, in an anonymised form, without it being possible to identify the source subject.

• Generation and maintenance of the medical record and similar documentation:

The basis of legitimacy is compliance with the provisions of the applicable regulations, including the regional ones: Law 14/1986, of 25 April, General Health, Law 4/2002, of 14 November, regulating patient autonomy, and obligations and rights in terms of clinical information and documentation and Law 21/2000, of 29 December, on the rights of information concerning the health and autonomy of the patient, and the clinical documentation of Catalonia), in addition to tax and accounting regulations. Only in certain cases of extreme urgency, the basis of legitimacy of the patient's vital interest will be applicable.

If you do not provide us with the data we request, we will not be able to provide you with the corresponding assistance service, as these are necessary contractual and legal requirements, and the Data Controller reserves the right of admission.

• Biometric Signature

When we use written electronic signature systems, for greater security, convenience, savings on paper and better management, biometric elements are captured in the creation of the signature, for example, the speed and acceleration of each line or the pressure exerted at each point. This data is essential to ensure that you are the one signing the documents and that no one is impersonating you. If you refuse to provide us with the biometric data in the form of a written electronic signature, you can sign the document in a handwritten signature on paper.

The legal basis is consent, which you give when you sign the form provided to you at the medical centre.

Sending commercial and informative communications about products and services of the data controller: If you give your consent, your identification, contact and demographic data may be used to send information or advertising, offers and promotions, gifts and loyalty campaigns, or any other commercial actions, through post, email, telephone, SMS or other equivalent electronic means, about our products and services.

The basis of legitimacy is the consent granted by you to send commercial communications through post, email, telephone, SMS or other equivalent electronic means. In this sense, the Information Services Society Law itself (hereinafter, the "LSSI") allows the provider to send commercial communications referring to products or services of its own company that are similar to those that were initially contracted with the client.

At any time you may oppose or revoke your consent to the processing of your data for this purpose, free of charge, and in each electronic communication made, you may unsubscribe from receiving this type of communication. Likewise, the "Rights" section of this Policy describes how to request the unsubscribe of this type of communication.

• Satisfaction and service quality surveys and studies

Your data may be processed for the purpose of carrying out surveys and satisfaction studies with the aim of improving the quality of the service by contacting you, by any means or channel that you have authorised us, to request your assessment of the services provided and to analyse this information in order to improve them.

This processing responds to the need to adapt the services to your preferences and expectations with the commitment to increase the quality of the service provided, for which it is necessary to know your opinion

The basis of legitimacy is the legitimate interest in improving the quality of the healthcare service, in accordance with the provisions of Article 6.1.f) GDPR

At any time, you may refuse to give your assessment, as well as communicate your opposition to being contacted for this purpose.

2.3. If you go to a medical centre in person, whether or not you are a patient, the Data Controller will process your data for the following purposes:

• Video surveillance. If you access a medical center that has a video surveillance system, you are informed that your image will be processed in order to safeguard the safety of the goods and people in the facilities.

The legitimate basis is the legitimate interest to ensure the safety and protection of the persons and facilities of the data controller.

2.4. Patient Portal

In case you decide to make use of our patient web portal, we will provide you with access to various services, such as managing medical appointments, uploading and downloading clinical documentation, reviewing prescriptions and conducting video consultations, among others.

Below we inform you about how your personal data will be processed in this context.

• The personal data collected on the portal will be processed for the following purposes:

o Manage and manage medical appointments.

o Allow the upload and download of clinical documentation.

o Facilitate the review of medical prescriptions.

o Offer video consultation and telemedicine services.

o Improve the quality and safety of health care.

o Comply with applicable legal and regulatory obligations.

o Creating and managing your user profile

• The processing of your personal data is carried out with the following legal bases, as appropriate:

o Performance of a contract: for the provision of medical and health services through the portal.

o Compliance with legal obligations: in compliance with health and data protection regulations.

o Legitimate interests: in the continuous improvement of our services and in the security of the portal.

o Consent: for those services that require it, as well as access to your clinical information by third parties.

• Video-Consultation: USE OF ARTIFICIAL INTELLIGENCE (AI) SYSTEMS AS A SUPPORT TOOL

The patient is informed that, during the video consultation, the health centre may use technological tools based on artificial intelligence systems for natural language processing (NLP), aimed at transcription and analysis of clinical language, with the exclusive purpose of assisting in the preparation of clinical documentation, such as medical reports, discharge reports or other documents derived from the consultation.

These systems can analyse in real time the content of the conversation held between the healthcare professional and the patient, with the sole aim of facilitating the generation of draft clinical documentation. The system will proceed to record the consultation carried out for a short time in order to prepare the administrative documentation. This recording will not be stored after its transcription.

AI does not participate in clinical decision-making, nor does it diagnose, nor does it establish treatment.

It does not replace the health professional criterion in any case. All the documentation generated through this system will be in draft form and will be reviewed, validated, and, where appropriate, modified by the responsible health professional before being incorporated into the medical record or delivered to the patient.

The use of these tools is intended to improve the quality, clarity and efficiency of clinical documentation, without this implying a guarantee of automatic accuracy. The patient may object to the use of these tools, without affecting their right to receive health care by other means, although it may imply that the preparation of clinical documentation is carried out exclusively manually.

The processing of personal data is carried out in accordance with the regulations on the protection of personal data, Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights.

3. Category of personal data

The Data Controller will process the following categories of data to achieve the purposes set out in this Privacy Policy.

• Website maintenance: data on behavior and interaction between parties:

o Browsing data on the website or mobile applications through cookies or other data storage and retrieval devices: information collected from the navigation you make on them, in the event that you have accepted the use of cookies and similar technologies on your devices.

• Customer Service

o Identification data: name and surname.

o Contact details: email address.

o Other data (if applicable): subject and message.

• Health and surgical care service

o Identification data: name, surname, date of birth and ID card.

o Contact details: telephone, address, email.

o Health data: medical history, diagnostic tests, medical history data.

o Biometric data: written electronic signature, image and voice.

o Financial data: bank account number, insurance policy data.

o Identification and contact details of relatives, relatives or contact persons.

o Genetic data

o Lifestyle: sedentary, active, sports or activities performed regularly

o Details about the job or professional category that may be relevant

o Sexual orientation and sex life, when strictly necessary and relevant.

• Patient Portal:

o Identification data: name, surname, DNI/NIF, date of birth.

o Contact details: address, telephone, email.

o Clinical data: medical history, medical documentation, test results, prescriptions.

o Portal usage data: access logs, preferences, queries made.

o Data for video consultations: image and voice during them.

o Personal characteristics: nationality, language, gender

o Data relating to your policy or mutual insurance company: policy number, health card

o Browsing data on the web or mobile applications or devices from where you connect to the portal.

• Video surveillance

o Image

• Call Recording

o Voice

o Personal data arising from the telephone call.

• Whistleblowing channel

o Data derived from the complaint filed through the complaints channel:

o Identification data of the complainant and, where appropriate, of the accused.

o Personal data or images presented with the complaint.

• Commercial and informative communications

o Identification data: name and surname.

o Contact details: phone, email

o Demographics: address, age, gender, language.

• Managing requests and other requests

o Identification data: name and surname.

o Contact details: email address.

o Other data (if applicable): subject and message

• Satisfaction and service quality surveys and studies

o Identification data: name and surname.

o Contact details: telephone, email.

o Opinion: Quality Survey Responses

• Biometric electronic signature:

o Written electronic signature: speed and acceleration of each line or the pressure exerted at each point

4. Main recipients

Personal data will not be transmitted to third parties, except in the following cases:

• External healthcare service providers (e.g. your private doctor involved in the treatment you receive at the medical centre) and providers of healthcare services or materials (laboratories for carrying out analyses or tests, providers of prosthetic services and surgical material, when they need to access personal data), all for the purpose of providing adequate healthcare, based on the fulfilment of the contract for the provision of healthcare services.

• Banks and financial institutions, to manage the collection of services provided, when applicable.

• Corresponding insurance companies: In the event that you are a beneficiary of an insurance policy, the health centre may communicate to you the data strictly necessary for the billing of the service provided to the patient, constituting a necessary treatment for the management of the health care service provided, on the legal basis of Law 50/1980 on Insurance Contracts and Law 20/2015 on the regulation, supervision and solvency of insurance and reinsurance companies.

• Public Authorities and Administrations (including the Tax Agency, Social Security, Catalan Health Service or Ministry of Health), courts and tribunals and other natural and legal persons, public or private, when applicable according to the regulations applicable to the Data Controller. Likewise, you are informed that your data may be communicated to the health authorities of Catalonia in order to comply with the legal obligation established in Royal Decree 2210/1195, by which Notifiable Diseases must be notified for epidemiological purposes.

• Relatives and close friends, with respect to the patient's condition, when expressly authorised by the patient or when appropriate in accordance with the applicable regulations.

• Video surveillance: In the case of images captured by video surveillance systems, they may be communicated to State Security Forces and Corps, as well as to Courts and Tribunals, when required by the applicable regulations.

5. International transfers of personal data

We inform you that the Data Controller will not carry out international data transfers.

However, in the event that they occur in the future, the Data Controller guarantees that the data processing and the intervening providers will be covered by the guarantee mechanisms established in the applicable regulations.

Similarly, where personal data is transferred to a third country or to an international organisation, you have the right to be informed about how appropriate safeguards relating to the transfer can be accessed or obtained.

6. Rights

As the owner of the personal data subject to processing, you have the right to contact the Data Controller through the following channels:

Contact for the exercise of rights:

- By post by sending your request to:

- By Post: ADVANCED ASSISTANCE BCN S.L.U at C/ Aribau, nº 168, CP 08036 Barcelona

- Through the email address intended to manage your rights and complaints regarding data protection: dpo.centrosmedicosaxa@axa.es

- By requesting the forms made available to you at the patient care points in our centers.

Below is information on each of the data protection rights under current legislation:

• Right of Access

You have the right to be informed by the Data Controller as to whether or not it is processing your personal data and, if so, to be able to access such data and receive information on the purposes for which they are processed, the categories of data affected by the processing, the recipients to whom your personal data were communicated and the expected period of data retention, among other information.

• Right of Rectification

You have the right to request the rectification of inaccurate data concerning you when.

• Right of Erasure

You have the right to request the erasure of personal data provided that the applicable legal requirements are met, among other reasons, when these are no longer necessary for the purposes for which they were collected.

• Right to restriction of processing

In certain circumstances (for example, in the event that the applicant contests the accuracy of your data, while the accuracy of your data is being verified), you may request that the processing of your personal data be restricted, which will only be processed for the exercise or defence of legal claims.

• Right to revoke consent

You also have the right to revoke the consent given at any time. The withdrawal of consent will not affect the lawfulness of the processing based on the consent prior to its withdrawal. For example, you may request the revocation of the consent given for the following purposes:

o Biometric signature

o Transfer of data to other medical centres or doctors

o Sending commercial and informative communications about products and services of our entity, which may be of interest to you.

• Right to object in whole or in part to the processing.

You have the right to object to the processing at any time, on grounds relating to your particular situation, if the processing is based on our legitimate interest or on the legitimate interest of a third party (including processing for the purpose of direct marketing and the preparation of related profiling). In this case, the Data Controller will cease the processing, unless there are proven legitimate reasons.

• Right to data portability

You have the right to receive the personal data you have provided to the Data Controller, in a structured, common and machine-readable format, and to be able to transmit them to another Data Controller without being prevented from doing so by the Data Controller to whom you provided them, in the cases legally provided for this purpose.

• Automated individual decisions

In addition, in addition to the rights mentioned in the context of processing involving automated decision-making, including profiling, you have the right to obtain human intervention from the Data Controller, and to express your views and to challenge the decision.

• Data Protection Officer

Regardless of who your Data Controller is, depending on the entity that provides the service, we inform you that these entities have a Data Protection Officer who can be contacted at the email address dpoaxa@axa.es

You may contact him or her for any additional questions or questions regarding the exercise of your rights or, in general, about the processing of your personal data.

• Spanish Data Protection Agency

You have the right to lodge a complaint with a national supervisory authority, the Spanish Data Protection Agency (www.aepd.es) or your respective regional authority.

7. Origin

In addition to the information you provide to us directly (e.g. through forms, requests for information, etc.), we will obtain information about your browsing habits in the event that you consent.

In the event that the data provided refers to third parties other than the patient, they expressly state that they have informed and obtained their prior consent for the processing of their data in accordance with the purposes set out in this Privacy Policy.

8. Minors and legal incapacities

We are committed to protecting the privacy and confidentiality of the personal data of minors and incapacitated persons, as well as to ensuring that their processing is carried out in accordance with current data protection regulations.

The personal data of the representatives of minors or disabled persons will be processed for the purpose of managing and exercising legal representation in relation to health, administrative and management services and procedures associated with medical care and the use of the patient's web portal.

To ensure the correct identification and accreditation of the legal representation, we may request documentation that proves the status of legal representative, such as:

• Copy of the DNI/NIF of the legal representative.

• Official documents that prove guardianship, guardianship or power of attorney, such as judgments, deeds, or notarial documents.

• Any other additional documentation that allows verifying their capacity to represent.

Purposes of the Processing

The processing of personal data by representatives of the minor or incapacitated person is for the purpose of:

• To manage the health and administrative care of the minor or incapacitated person.

• To facilitate access to the services of the web portal on behalf of the minor or incapacitated person.

• To guarantee the protection and compliance with current regulations on data protection and the rights of minors or incapacitated persons.

Legitimate Bases of the Treatment

The processing of the data is based on:

• The contractual and legal relationship that binds us based on the service provided

• Compliance with a legal obligation, in particular, data protection regulations and health legislation.

• The consent of the legal representative, who expressly authorises the processing on behalf of the minor or incapacitated person.

9. Retention period

Your personal data will be kept as follows:

Call Recording 3 months

Data related to enquiries or request management 2 years

Data related to quality and satisfaction surveys 2 years.

Patient's documentation or medical history

Based on Law 21/2000, of 29 December, on the rights to information concerning the health and autonomy of the patient, and clinical documentation:

The information and documentation that is part of the Medical Record will be kept for at least twenty years after the death of the patient.

However, documents that are not relevant to care can be selected and destroyed, ten years after the last patient care.

Documentation that, in the opinion of the doctor, is relevant for preventive, healthcare or epidemiological purposes, may be kept for as long as necessary.

In the case of genetic data processing, and based on Law 14/2007, of 3 July, on Biomedical Research, personal genetic data will be kept for a minimum period of five years from the date on which they were obtained.

Whistleblowing channel

In relation to the personal identification data of the complainant communicated through the whistleblowing channel, they will be kept in the whistleblowing system for a period of 1 month from the communication.

Video surveillance 1 month

All this without prejudice to the fact that this period may be extended when you expressly authorise it or there are particular processing derived from the contractual relationship that remains in force after said period. Likewise, your personal data will be kept during the limitation period of the responsibilities arising from the processing, without prejudice to the duty to block. Once the storage periods have ended, the information will be deleted.

LAST UPDATE: OCTOBER 2026