who is responsible for the processing of your data?
The data controller is the Universidad Francisco de Vitoria (UFV),
Contact details: Universidad Francisco de Vitoria. General Secretariat. Ctra. M-515 Pozuelo-Majadahonda Km. 1.800; 28223, Pozuelo de Alarcón (Madrid).
Contact details of the Data Protection Delegate: dpd@ufv.es

For what purposes will we process your personal data?
At the UNIVERSIDAD FRANCISCO DE VITORIA, we will treat your personal data for the following purposes:

• The provision of professional health services and maintenance of the clinical history of the interested party.
• When applicable, oversee your involvement in research or teaching initiatives pertaining to the medical, health, or research domains within the field of physiotherapy.
• You will be contacted via any available means, including electronic communications (SMS, email, and other instant messaging systems) in relation to the aforementioned purposes.

What is the legitimacy for the processing of your data?
The legal bases that legitimize the processing are:

• Execution of the healthcare contract.
• The processing of personal data for the purpose of providing professional healthcare services and maintaining the clinical history is carried out in accordance with the legal obligations set out in Law 41/2002, of November 14th,  which regulates patient autonomy and rights and obligations regarding clinical information and documentation..
• Consent of the interested party by checking the corresponding boxes included in the basic information.

For how long will we keep the personal data?
In regard to the provision of care services and maintenance of clinical records, your data will be retained for the duration of the services provided, for the appropriate time frame for each case, and for a minimum of five years from the date of discharge from each care process. This is in accordance with the provisions of Article 17 of Law 41/2002, of November 14,  which regulates patient autonomy and rights and obligations regarding clinical information and documentation. . Clinical documentation will also be retained for legal purposes in accordance with current legislation.
In the event that research or teaching projects are conducted within the medical, health, or research specialty of physiotherapy, the data will be retained for as long as is necessary to fulfill the objectives of the scientific research pursued by the research or teaching project. Once the research or teaching project is complete, the data may be anonymized due to the scientific interest of the study.

To which recipients will your data be communicated?
Your data will be communicated to the following entities and organizations:

• To the corresponding banking entities, for the payment of the benefit.
• To the Tax Administration.
• To other health professionals who provide services both in the Physiotherapy Clinic and in other health centers with which it is necessary to coordinate.

The Universidad Francisco de Vitoria has a number of providers of applications and computer support who may access personal data when executing this contract. The Universidad Francisco de Vitoria will always have a data access contract signed with the relevant providers in accordance with the requirements of Article 28 of the General Data Protection Regulation. This will provide sufficient guarantees in relation to the processing carried out by these providers. Some of the providers are based outside the European Union. In light of this, the Universidad Francisco de Vitoria requests additional guarantees in line with the international transfer provisions set out in the General Data Protection Regulation.

What are your rights in relation to data processing?
Any individual has the right to request information regarding the processing of their data, access their personal data, request the rectification of inaccurate data, or, when applicable, request the deletion of data that is no longer necessary for the purposes for which it was collected or when consent is withdrawn.
In certain cases, the interested party may request the limitation of the processing of their data. In such instances, we will only retain the data in accordance with the applicable regulations.
In certain cases, you may exercise your right to data portability. This will be provided in a structured, commonly used, or machine-readable format to you or the new data controller you designate.
You have the right to withdraw your consent for any of the processing activities for which you have provided consent.
To exercise your rights, you must submit the appropriate written documentation, either electronically signed or accompanied by a photocopy of your ID card.
If you are acting through a representative, the letter must be accompanied by a copy of the power of attorney, as well as a copy of your ID card or an electronically signed document.
Submit all written materials in person at the University Registry or via mail to the address listed in the “Responsible” section.
As a data subject, you have the right to contact our data protection officer regarding any matter related to the processing of your personal data and the exercise of your rights under this Regulation. Additionally, you have the right to lodge a complaint with the relevant supervisory authority in the event that you believe your rights have not been adequately addressed.
The maximum allowable resolution period is one month from the date of the request. In the event that the request is deemed to be particularly complex or if a high volume of requests is received, the resolution period may be extended by an additional two months.
Should any changes be made to your data, we kindly request that you inform us in writing so that we can ensure your information is kept up to date.