Patient Portal

LEGAL INFORMATION

By virtue of the provisions of article 10 of law 34/2002, of July 11, on information society services and electronic commerce, you are informed that the entity providing the services herein is IDCSALUD, S.L.U (herein, IDCSALUD), a Spanish company whose business address is C/ Fernández de la Hoz, 24, 28010, Madrid, and whose tax identification number B-83921534. The aforementioned entity is entered in the Companies Register of Madrid, Volume 29,294, sheet 162, Section 8, Page M-350156, entry 61, and is authorized to provide health services through the URL http://www.idcsalud.es.

PURPOSE

In order to better serve its patients, IDCSALUD offers patients the service known as the "Patient Portal." By using this Portal, patients may access their clinical records and manage communication with IDCSALUD health centers and medical staff.

INTENT

These Terms of Access and Use (herein, the "Terms") are intended to regulate access to and use of the Patient Portal, an online consultation service accessible through the website www.idcsalud.es. Via the aforementioned Patient Portal, patients may access their clinical records generated in health centers managed by the companies belonging to the IDCSALUD Group.
In addition, the General Conditions governing the use of the web portal used to access the Patient Portal will also apply.

FUNCTIONING

The Patient Portal online consultation service provided by IDCSALUD allows users to do the following:

• view, print, or save clinical reports
• modify the User's login information
• make online appointment requests
• fill out forms

USER STATUS

In order to consult the information available in the Patient Portal (herein, the "Service"), you must be a registered User of the Service.
"User" is anyone who, after registering, uses the "Patient Portal" service.
The username and password (herein, the "Login Information") required for registration must be requested in person in any of the associated hospitals or health centers. Once you have presented the proper identification, the system will generate the appropriate login information, which will be sent to your mobile telephone. This login information will grant you access to your clinical records and all other services offered through the Patient Portal.

REQUIREMENTS FOR ACCESSING THE SERVICE

Upon signing these Terms, any patient of IDCSALUD over the age of 16 having full capacity to enter into contracts will be allowed be register. By becoming a User, you declare that you have read and expressly accept without reservations all of the Terms herein pertaining to the Privacy Policy and Legal Notice of the website and also declare that you have been made aware of the policy concerning cookies.
Parents or legal guardians of individuals under the age of 16 who have provided proof of their status as such may request the login information for the Patient Portal of the minor in question. Similarly, for minors over the age of 16, parents or legal guardians may be granted access to the minor's login information provided the minor has authorized said access.

ACCESSING THE SERVICE

The User may access his or her Patient Portal through the following URL: https://www.idcsalud.es/portalpaciente. Each User's username and password will allow for the User to be personally identified, after which he or she will be granted access to the system of IDCSALUD.
Said usernames and passwords are strictly personal, confidential, and non-transferrable. It is the responsibility of the User to safeguard the confidentiality of his or her password, and the User must not reveal or transfer these to third parties. The User therefore expressly accepts that IDCSALUD will presume that all use of the services accessed through the login information is the doing of the individual registered as a User except in cases in which prior notification has been given that the login information has been lost or stolen. Any User who believes that his or her login information may have been accessed by another—either accidentally or fraudulently—must report this to portaldelpaciente@idcsalud.es. In such circumstances, we will cancel your existing Login Information and provide you with new information.
You must periodically change your password when requested to do so.
IDCSALUD may block access to and use of the website or Service when doing so is deemed necessary for reasons of security. The Service will be automatically blocked if successive login attempts are unsuccessful, that is, when an incorrect username or password is entered erroneously a number of times.

REQUIREMENTS OF USE

In order to gain access to the Service, you will need a device that meets the software and hardware requirements to use the web (these requirements may change over time) as well as Internet access. Users must be aware that these factors may influence the performance of the web and the possibility of accessing the Service.
IDCSALUD is not responsible for cases in which the web may be unavailable or functioning deficiently due to the use of inappropriate devices or due to Internet service interruptions caused by excess web traffic or by any other factor.

USE OF THE SERVICE

The User hereby commits to use the Service in a manner that is diligent, appropriate, legal, and in adherence of the law, the Legal Notice, these Terms, rules of use, and instructions made known to him or her, in addition to all generally accepted moral values and proper customs and behavior upholding public order.
For these purposes, you shall refrain from any activity that is illicit, prohibited, or that impinges on the rights and interest of others, and will refrain from activities that may in any way damage, disable, overload, impair, or impede normal use of the Services, computer devices, or documents, files, and any and all contents of IDCSALUD computer equipment as well as the computer equipment of other Users or any User of the Internet (hardware and software).

INCIDENT MANAGEMENT

The User shall report any and all incidents he or she may detect as soon as possible and in such a way that the report is properly logged. Incident reports should be sent to the following e-mail address: portaldelpaciente@idcsalud.es. Incidents are defined as any and all anomalies that affect or may affect data security as well as any detected breach of security regulations.

ACCESS CONTROL

Each User may only access the information resources for which he or she has been granted access. Should it be discovered that it is possible to access others' personal information that should remain inaccessible, this anomaly must be reported according to the procedure appearing in the paragraph "Incident Management."

TEMPORARY FILES

Information accessed by the User through the Patient Portal must be consulted using the IDCSALUD information systems. IDCSALUD is not liable for information exported to systems other than those pertaining to IDCSALUD.

TERMS OF USE

When using the Service, the User will be responsible for ensuring that no unauthorized persons can see the information being processed.
If the application remains inactive for thirty minutes, it will be automatically deactivated. The User expressly agrees not to store, use, transmit, or disseminate:

• programs intended to unlock restricted content, serial numbers for programs, or any other content that is in violation of other parties' intellectual-property rights
• Internet-disseminated viruses, worms, Trojan horses, or destructive activities of any sort, including mail bombing or denial-of-service attacks
• activities that interrupt or interfere with proper use of the resource network by other Users
• gathering and/or using the personal information of other Users without their express consent or otherwise in a way that violates data-protection regulations
• sharing of login information with other individuals or entities
• destroying, altering, or rendering useless via other means the information, programs, or electronic documents pertaining to IDCSALUD or third parties
• impeding other Users' access through mass and unjustified consumption of the digital resources through which IDCSALUD renders any of its services and performing actions that may damage, interrupt, or cause errors in these systems
• using the system in an attempt to access restricted areas of the server without the express consent of IDCSALUD

COMMUNICATION AND EXCHANGE OF INFORMATION

The User expressly accepts that all communication, notices, and information that IDCSALUD is to send or provide to the User shall, whenever the law so permits, be sent via e-mail to the address provided by the User at the time of sign-up or, alternatively, the e-mail address provided subsequently by the User.
All communication sent by the User to IDCSALUD shall be considered valid provided it is sent to the following e-mail address: portaldelpaciente@idcsalud.es.
Notices will be considered as being sent and received on the third business day following the day in which the notices are correctly sent to the addresses provided.

INTELLECTUAL AND INDUSTRIAL PROPERTY

The design, images, banners, distinctive features, trade name, brands, logos, products, services, and the like that appear in the Patient Portal are protected under the Law on Industrial Property. In no way does the use of or access to the Service grant the User rights of any nature to the aforementioned design, images, banners, distinctive features, trade name, brands, logos, products, or services.
The website, its source code, and any and all contents accessible through this website are the intellectual property of IDCSALUD and/or third parties. Under no circumstances shall it be understood that rights to the aforementioned are granted to the User.
IDCSALUD is the owner or licensee of all the rights to the contents of the Web Portal and the Patient Portal and to any and all services offered through the website. Accessing the website or the services provided therein does not grant Users rights or ownership whatsoever to the intellectual- or industrial-property rights or the Content housed within. The User acknowledges and agrees that it is prohibited to use, reproduce, communicate, and/or distribute, modify, alter, or disaggregate said elements, whether for personal, private, and non-profit use or for commercial and for-profit motives.
IDCSALUD reserves the right to take legal actions against any User who violates or infringes upon its intellectual or industrial-property rights.

USER LIABILITY

The User shall be responsible for the following:

• Safeguarding the confidentiality of the login information provided to the User.
• Providing accurate information to IDCSALUD; the User will be solely liable for any inaccurate information provided. Similarly, the User will be responsible for updating information provided to IDCSALUD in such a way that said information accurately reflects the situation of the User at all times.
• Any damages inflicted on IDCSALUD or third parties as a result of information that is not updated, false, or inaccurate and that may result from others' using the Login Information of the User.
• Should a User obtain a copy of his or her clinical information, said User will be solely liable for the use and custody of such information.

AVAILABILITY OF THE SERVICES

The information, content, and services offered through the website shall be those determined by IDCSALUD at all times and may vary from time to time. Therefore, IDCSALUD is under no obligation to continue offering these Services. Nonetheless, IDCSALUD will inform Users if and when it decides to discontinue a given Service and shall explain the conditions of the discontinuation of the Service.
In addition, IDCSALUD may partially or totally discontinue access to the Services for Users who fail to comply with these Terms.

GUARANTEE AND RESPONSIBILITIES

Although IDCSALUD utilizes systems that are compatible with most of the technology available on the market, it cannot guarantee the compatibility of the devices employed by Users.
IDCSALUD does not guarantee the availability or the continued functioning of the website or the Service. IDCSALUD shall be exempt from all liability arising from access to and use of the website and/or the Service (e.g., performance failure, interruption or delay in the functioning of the services, system or line failure), even in cases in which failure or incorrect functioning causes damage to the computer systems of third parties. Users shall access the website and the Service at their own risk.
The Service offered through the website is in compliance with the provisions of Spanish law.
IDCSALUD shall be held exempt from all liability arising from incorrect use of the website and/or Service by Users.
IDCSALUD shall not be liable for circumstances in which the Service is unavailable due to force majeure or temporary unavailability of the Service owing to technical reasons. Therefore, IDCSALUD will not be liable for any damages or losses that may result from events that are unforeseeable or inevitable either due to fortuitous occurrences or force majeure.
IDCSALUD is not responsible for failures, technical errors, accidents, malfunctions, manipulation, interruptions of service, or other incidents of any kind that may occur in products, equipment, or technical services belonging to others and that are necessary to access the services.
Although IDCSALUD has acted with diligence and has taken the necessary measures made available by technological advancements so as to avoid any possible security breaches in the Portal, IDCSALUD does not guarantee that the security means taken are beyond vulnerability.
IDCSALUD is not responsible for the legal compliance of other websites belonging to third parties which may be accessed through the Portal. IDCSALUD is not responsible for the legality of other websites that may link to this Portal.

MODIFICATIONS IN THE TERMS

IDCSALUD may include new functionalities in the website or the Service and/or change the Terms currently in force. In such cases, IDCSALUD will publish the updated version on the website so that the User may be aware of any and all changes. If the User does not agree with the new Terms, he or she will have fifteen days as of the time of the notification of the change to terminate the contract by providing valid notice of cancellation to IDCSALUD. Failure to provide notice of cancellation within the aforementioned period implies the User's full acceptance of the new Terms.

PRIVACY

In accordance with EU Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; Organic Law 3/2018, of December 5, on data protection and digital-rights guarantees; and Law 41/2002, of November 14, regulating patient autonomy and patient rights and obligations regarding clinical information and documentation, all patients, users of the services rendered on these premises, and the general public are hereby informed of the following:

Introduction

This document contains the privacy policy of the health centers of Grupo Hospitalario Quirónsalud regarding the personal data processing of patients receiving treatment from the aforementioned business entity and/or the individuals acting on behalf of these patients.

Patients may address any issues or questions regarding this matter to the Quirónsalud Hospital Group Data Protection Officer, who may be reached via post at Calle Zurbarán, 28, 28010 Madrid. The Data Protection Officer may also be reached via email at DPO@quironsalud.es.

Who is the data controller?

Data Controller is the company that holds ownership over the facility where the care is rendered:

What personal information do we process and what is the source of this information?

Based on the relationship you enter into with us, we may process the following personal data:

• Identification data and Contact details of patients or their representatives (including signature, image, health-service card, and social security number or mutual benefit association number);
• Health-related information appearing in patient medical records;
• Personal characteristics and demographic attributes; and
• Transactional data (payments of any nature, including transfers and debits).

The data may come from the Data Subject (the patient) or from your legal or volunteer representative and/or care professionals.

Why do we process your personal information?

Data Controller may process personal data for the following purposes:

1. Delivery of health care: your personal information is processed for the purposes of providing you the health care you need as well as to appropriately manage the health services and carry out administrative tasks required for the provision of care, as in the following examples:

- To send appointment reminders;

- To issue proof-of-hospital-visit documents for family members or others with ties to you and who may request such a document in adherence of applicable regulations;

- To communicate with another health center when instructed to do so by the patient;

- To process any and all incidents or claims filed by the individual using the service and/or you, the patient;

- To administer surveys intended to gather your opinion of the care delivered to you; such surveys shall be used exclusively to improve and develop our care services and management activities; and

- To provide the services offered via the Quirónsalud Patient Portal: personal information pertaining to patients who register as users of the Portal may be processed for the purposes of accessing and using the tool.

2. Scientific research: your data may be processed for scientific purposes in compliance with specific regulations governing such processing.

3. Procedures: for anonymization and pseudonym use: For scientific or statistical research purposes, your data may be subjected to certain procedures to make them unidentifiable or so that they can no longer be linked to any party in the absence of additional information appearing separately.

4. Processing of information requests, complaints, suggestions, grievances, and the exercise of data-protection rights, etc.: your data will be processed to fulfill the request by any means necessary, including telephone calls and/or electronic means.

5. Compliance with legal obligations: in order to comply with applicable legal obligations, it may be necessary to process personal information. Specifically, these obligations may be related to compliance with legislation on data protection, taxation, health, etc.

6. Drawing up executing the contract: personal information is processed to manage the contractual relationship with the patient.

7. Video surveillance: certain health facilities have a video surveillance system that takes real-time footage of individuals who use the facility’s services. These data are processed for the sole purpose of safety and to monitor individuals appearing on the premises.

8. Distribution of advertising materials using any means in case of additional consent: If you so consent, we may transfer your data to business entities that form part of the Hospitalario Quirónsalud Group in order to inform you—via any means and for promotional and advertising purposes—as to the health- and health-care-related facilities, services, products, or events of the companies belonging to the Quirónsalud Hospital Group (under no circumstances will your data be used to send you advertising content from third parties).

The information collected will be processed for the established purposes, and under no circumstances shall data be processed toward ends that conflict with those established here. Please note that the processing of data for purposes related to scientific research or statistical measurements is not considered to be incompatible with the initial purpose.

We process your data with the same degree of care and quality at all times, regardless of the channel you may choose to communicate with us (e.g. the web page of a facility, mobile apps, face-to-face, telephone, computer).

What are the legal basis for your personal data processing?

How long will we storage your personal information?

In general, your data will be kept only for the length of time strictly necessary for the purpose for which said data were collected.

The personal data provided, as well as data derived from the health care delivered, are kept only for the storage period appropriate to each case (in accordance with medical and legal criteria); these data will be maintained for a minimum of 10 years as of the date of each care episode, with the exception of cases in which regional and/or specific regulations stipulate that this period must be longer than that mentioned above.

After the aforementioned minimum period has elapsed, and once the care and contractual relationship has concluded, the person in charge of data processing will safeguard the data, duly blocked and pseudo-anonymised, for the legally stipulated period.

The personal data processed for purposes of scientific research shall be maintained, in adherence of retention criteria, for a period not to exceed five years as of the termination of the research. With regard to data processed for purposes of scientific research, the competent regional authorities may, upon request of the data controller and in accordance with established regulatory procedures, order prolonged retention of the entire set of certain data for purposes of historical, statistical, or scientific research in adherence of applicable legislation in each case.

Personal data provided for the purposes of processing information requests, complaints, suggestions, grievances, or the exercising of data-protection rights of any sort, etc., shall be retained for the period necessary to process the request. In all cases the minimum period shall be that which is legally mandated as well as that required to file grievances, exercise rights, or for the defense against such grievances or the exercise of individual rights.

Data processed to comply with legal obligations will be kept for the storage period set forth in applicable legislation.

Data gathered to sign and perform a contract shall be retained for the duration of the contractual relationship as well as the period necessary to file grievances, exercise rights, or for the defense against against such grievances or the exercise of individual rights. This period shall not be less than five years.

Images recorded using video surveillance systems will be retained for a maximum of 30 days, unless the data controller becomes aware of any facts that may be relevant to subsequent legal proceedings.

Personal data processed for the distribution of advertising materials will be retained until the concerned party withdraws his or her consent and/or exercises their right to oppose the retention of such data and/or requests that they be deleted.

Who will receive my personal information?

To properly provide services, certain service providers and/or entities belonging to the Quirónsalud Hospital Group must process data on behalf of the data controller and act as designees for the processing of personal data. By way of example, such designees may be providers of medical services, diagnostic services, clinical testing, audits, entities charged with oversight of physical safety, archiving, information storage or digitization, destruction of documents, legal advisory services, or IT services.

Your personal data will not be disclosed to third parties except where there is a legal obligation, vital interest, or prior consent of the party concerned; such disclosure will only take place in the following circumstances, the recipients being those listed below:

a) As a patient may have contracted an insurance policy in which a third party (e.g., insurance providers, mutual benefit associations, public-health authorities, or third parties in cases of civil liability insurance) may be liable for payment of the health services rendered by the facility, provided the patient makes this information known, we may disclose the patient’s personal data to the aforementioned parties so they may manage, authorize, verify, and monitor payment for the care services rendered. The foregoing is legitimized by the requisite management of health-care systems and services as well as the provisions set forth in Law 50/1980 on insurance contracts.

Where a patient has insurance coverage contracted with an entity located outside the European Economic Area[1], (hereinafter, E.E.A.) where legislation concerning data protection is less stringent than that of the European Union, it may be necessary to disclose personal data internationally, provided the patient grants their express prior consent after being informed of the risks involved. We hereby inform you that these disclosures are only made to meet the needs of the patient and facilitate payment for the care services rendered; in short, information is only disclosed to manage payment and verify information with the insurer in the shortest time possible regarding services rendered for patients who have insurance coverage provided by entities based outside of the E.E.A.

Patients who decline to consent to such disclosure of their information may lead to insurer refusal of payment for the services rendered, causing them to be liable for payment given that the entities normally responsible for payment would, under these circumstances, be unable to verify, validate, or monitor billing on the part of the health facility for all care delivered.

b) We also inform you that, due to legal obligations and/or in the vital interest of patients, your personal data may be disclosed to suppliers of medical equipment, prostheses, implants, and providers of ambulance services.

All information that you provide to us will be processed as confidential and in strict compliance with mandatory security measures necessary to prevent access by unauthorized third parties.

What are your right of your personal data?

You may exercise your rights to require access to information, rectification information that is inaccurate, or request the erasure of your data when, among other reasons, the data are no longer necessary for the purposes for which they were collected. In certain circumstances, you may also request the restriction of personal data proccesing, in which case we will only keep these data to file or defend against claims and grievances. Finally, and for reasons related to your particular situation, you can also exercise your right to object and to data portability. Additionally, you may revoke the consent given for your data processing at any time.

Exercise of your rights and withdrawal of consent to process your data are free of charge, except in the cases set forth in art. 12.5 of the Regulation (EU) 679/2016, which may be exercised by completing the questionnaire (download here), in person at the patient answer center of the health facility where their care is rendered, or by mailing a letter to the patient answer center of the individual’s care facility (see mailing address) stating that the letter is in reference to "data-protection rights" and attaching a photocopy of the individual’s identity card or equivalent document and indicating the right they wish to exercise.

We also inform you that you may file a grievance before the competent authority overseeing these matters, following the procedure set forth for each individual case.

TERMINATION

The User may voluntarily disable the Service at any time; doing so will prevent him or her from accessing the Service in the future.
The following conduct may cause an individual to lose his or her rights as a User:

• non-payment or outstanding balances owed to IDCSALUD
• impeding the performance of the Services
• transferral of the rights and obligations set forth in this contract
• involvement in legal or administrative proceedings that may jeopardize the image or commercial reputation of IDCSALUD
• non-compliance of any nature with the conditions related to the Services

Disabling an account will not affect any of the obligations of the User that apply at the time the account is disabled.

JURISDICTION AND APPLICABLE LAW

These terms and conditions of use will be governed by Spanish law. Except as required by law, the courts of law of Madrid, Spain will rule on any dispute between the Parties as to the interpretation of the contract and its performance.