This privacy policy describes how we collect, use and protect the personal information of users who visit the institutsarro.com website. As a centre dedicated to providing healthcare services (mental health, neurology and related specialties), we assume the utmost commitment to confidentiality and the protection of health data.

Last updated: August 31, 2026

1. Data Controller Information

• Legal name: Institut Sarró, S.L.
• Tax ID (NIF): B10650430
• Registered address: Muntaner 200, entresòl 3B, 08036 Barcelona, Spain
• Contact email: info@institutsarro.com
• Data Protection Officer (DPO): dpd@institutsarro.com
• Registration code in the Register of Health Centres, Services and Establishments of the Department of Health of the Generalitat de Catalunya: 9015-802991/2023 (provisional)

2. Principles and Types of Data Collected

We process personal data in accordance with the General Data Protection Regulation (GDPR) and Organic Law 3/2018 (LOPDGDD). Through the website, we may collect:

• Identification and contact data: Name, surname, email address, phone number and message sent through the contact or appointment request forms.
• Health data (special category): Only where the user voluntarily provides it in the reason for the enquiry. This data is handled under the strictest confidentiality and medical professional secrecy.
• Browsing data: IP address, device type and cookies (see our Cookie Policy).

3. Purpose and Legal Basis of Processing

• Managing enquiries and appointments: Handling requests for information or booking healthcare appointments. (Legal basis: Consent of the data subject and pre-contractual measures).
• Healthcare and clinical care: Providing the requested mental health and neurology services. (Legal basis: Performance of the healthcare services contract and processing of health data for diagnostic or treatment purposes).
• Website improvement and audience measurement: Analysing website use to improve its content and positioning (via Google Analytics, only with the user's prior consent). (Legal basis: Consent of the data subject).
• Compliance with legal obligations: Complying with applicable healthcare and clinical records regulations. (Legal basis: Legal obligation).

4. Data Retention

Personal data will be kept for the time strictly necessary to fulfil the purpose for which it was collected. In the case of information related to healthcare, it will be kept for the minimum periods established by clinical records legislation (a minimum of 5 years from the discharge of each care process, without prejudice to longer periods that may apply under current healthcare regulations).

5. Data Recipients and Data Processors

To provide our services and operate the website, we share certain data with the following providers, always under the corresponding data processing agreements or as independent controllers of their own service:

• Web hosting: our hosting provider, to keep the website operational.
• Google (Google Analytics, via Google Site Kit): statistical and audience analysis of the website, only if the user gives consent.
• Automattic (Jetpack): technical performance optimisation of the website.
• CookieYes: management of the cookie consent banner.
• Doctoralia: if the user uses the online appointment booking widget embedded in the website, the data entered into that widget is processed directly by Doctoralia (Docplanner) as an independent controller of its own service, subject to its own privacy policy.

6. International Data Transfers

Some of the providers listed above (Google and Automattic) are based in the United States. Where data is transferred outside the European Economic Area (EEA) to these providers, this is done under the safeguards provided by the GDPR, such as the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission. These transfers are limited to browsing data and, in the case of Google Analytics, only take place if the user has given prior consent via the cookie banner.

7. User Rights

As a user, you have the right to:

• Access your personal data.
• Request the rectification of inaccurate data.
• Request its erasure when no longer necessary.
• Request restriction of or object to the processing of your data.
• Request data portability.
• Withdraw consent given at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

To exercise any of these rights, you may send an email to dpd@institutsarro.com attaching a copy of your identity document. If you believe that we have not properly addressed your rights, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).