Data Protection

Data controller

Company name: SHOMMA Healthspan Center
Registered address: C/ General Aranaz 49, Madrid
Email: mujer@shomma.com

Data Protection Officer

If you wish to contact our Data Protection Officer, you may do so at mujer@shomma.com.

Purposes of processing

Management of the contractual relationship with our patients and clients.
Provision of medical and wellbeing services.
Sending commercial communications (only with your express consent).
Compliance with legal and tax obligations.

Legal basis for processing

Express consent: For the processing of health data and the sending of commercial communications.
Performance of a contract: For the provision of our services.
Legitimate interest: For the improvement of our services and anonymised statistical analysis.
Legal obligation: For compliance with applicable health and tax regulations.

Categories of data processed

Identifying data: first name, surname, national ID, address, telephone, email.
Health data: clinical history, biomarkers, diagnostic test results, genetic data.
Financial data: billing information and payment methods.

Data recipients

Data will not be disclosed to third parties unless required by law. The following may have access to your data:

Healthcare professionals involved in the provision of the service.
Public authorities in compliance with legal obligations.
Data processors providing ancillary services (hosting, analytics, etc.).

International transfers

SHOMMA does not carry out international transfers of data outside the European Economic Area. Should this become necessary, appropriate safeguards in accordance with the GDPR would be implemented.

Retention period

Health data will be retained for a minimum of five years following the last interaction, in accordance with Spanish Law 41/2002 on Patient Autonomy. Tax data will be retained for the legally established period. All other data will be retained until you request its erasure.

Your rights

In accordance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD), you have the right to:

Access: Know which personal data we process about you.
Rectification: Request the correction of inaccurate data.
Erasure: Request the deletion of your data when it is no longer necessary.
Restriction: Request the restriction of processing under certain circumstances.
Portability: Receive your data in a structured, commonly used format.
Objection: Object to the processing of your data under certain circumstances.

You may exercise these rights by sending an email to mujer@shomma.com, attaching a copy of your identification document.

Right to lodge a complaint

If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security measures

SHOMMA has adopted the technical and organisational measures necessary to ensure the security of your personal data and prevent its alteration, loss, unauthorised processing or access, in accordance with the state of technology and the nature of the data stored.

Last updated: January 2025