This page complements and expands the information provided in the different data collection forms of the Health and Neurorehabilitation Services.
WHO IS RESPONSIBLE FOR THE TREATMENT OF YOUR DATA?
Aspace Catalunya Foundation – CIF: G08393936 – c. Tres Pins 31, 08038, Barcelona
932002534 - aspace@aspace.cat
Data protection delegate contact: protecciodedades@aspace.cat
FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?
At ASPACE's health and neurorehabilitation services, we process the information provided by interested parties in order to guarantee the registration and monitoring of the medical treatment provided at the center, ensure the care continuum between the different health and social devices, provide the information necessary for the correct billing of the cost of the services provided, notify and send reminders of visits to patients through the channels they select, complete their clinical history at the center and implement the mechanisms for coordinating clinical histories that are developed.
Additionally, the data may be used (with the express consent of the person concerned) for other purposes, such as:
- Clinical research
- Dissemination of the entity: information regarding the processing of data with it purpose
- Institute
- Management of internship student data
Users of ASPACE's health service can be given a “criticality or complexity profile” based on the information provided. In no case are automated decisions made based on this profile.
HOW LONG WILL WE KEEP YOUR PERSONAL DATA?
The health data provided by the interested persons will be kept throughout the care process and once it has ended, in accordance with law 21/2000, they will be kept for a minimum of 15 years in relation to the relevant documentation, being able to extend the deadline in case of relevant data for healthcare purposes, advance wishes, epidemiological and research data. For the rest of the documentation, the data will be kept for 5 years.
WHAT IS THE LEGITIMATION FOR THE TREATMENT OF YOUR DATA?
The legal basis for the processing of your data is:
- The execution of healthcare as an entity providing public health services, in accordance with article 9.2 letter h) and article 6.1.c) of the General Data Protection Regulation.
- Internship students: The execution of the internship agreement or contract in application of article 6.1. letter b) GDPR.
- Other purposes: The express consents of the interested party, without in any case the withdrawal of any of these consents conditioning the execution of health care.
TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?
ASPACE transmits data from patients treated there to:
- Generalitat de Catalunya (departments of health and work, social and family affairs): basic invoicing data for services as a provider entity.
- Department of Health: Health data of users of health and rehabilitation services for the Department's different databases and records, as well as the Computerized Clinical History of Catalonia.
- Public and private entities that have a direct relationship with the patient: as part of the care process, we coordinate with schools, CAPs, EAPs, residences, entities that manage extracurricular activities, external physiotherapists, etc.
- Adapted transport companies, (name, address and contact details) in the event that the patient needs this service.
Apart from the above, ASPACE contracts different products or services in order to carry out health and rehabilitation services:
- iSalus: Offers connection services to CatSalut applications. There is a data processor contract that regulates the privacy of the data used.
- ecosystem: Aspace uses Office 365 as a corporate mail server, under the EU-US Privacy Shield agreement. Information available at: https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK
- Iron mountain: Company that takes care of clinical records on paper for patients who stop visiting. There is a data processor contract that regulates the privacy of the data used.
- Wibbi (former Physiotec): through this platform, neurorehabilitation professionals prepare physiotherapy treatment for some patients. The provider's own platform is used, with servers located in Europe: https://wibbi.com/privacy-policy
WHAT ARE THE RIGHTS WHEN THE DATA IS PROVIDED TO US?
- Anyone has the right to get information about whether at the Aspace Catalunya Foundation we are processing personal data that affect them, or not.
- Interested persons have the right to access to your personal data, as well as to request the rectification of inaccurate data or, where appropriate, request yours deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
- Interested persons have the right to request the portability of your data. The Aspace Catalunya Foundation will facilitate this portability as long as it is technically feasible.
- In certain circumstances, those interested may request the limitation of treatment of your data, in which case we will only keep them for the exercise or defense of claims.
- In certain circumstances and for reasons related to their particular situation, those interested may object to treatment of your data. The Aspace Catalunya Foundation will stop processing the data, except for compelling legitimate reasons, or the exercise or defense of possible claims.
- The interested person has the right to withdraw any consent previously granted This will not affect the legality of treatments already carried out based on withdrawn consent.
- For exercise any of these rights, the interested person will have to address Carrer Tres Pins 31-35 in Barcelona or the electronic address protecciodedades@aspace.cat, providing an identification document and setting out the right that you want to exercise, and if applicable the reasons or particular situation that makes it necessary. A right request form can be found at the web address: www.aspace.cat/protecciondedades.
- In any case, the interested person can present one claim before the Catalan Data Protection Agency if you believe that the Aspace Catalunya Foundation has not satisfied your rights correctly.
HOW DID WE OBTAIN YOUR DATA?
In general, the data we process are always provided by the interested person or their family. In cases of users of health services, data can be additionally obtained from the following CatSalut records:
- Central Register of insured persons: Administrative and contact details.
- Shared Clinical History of Catalonia: Health data from other health centers.
- Electronic Recipe: Prescription data.
- Other entities and professionals in the network related to the patient.
