Privacy policy

1. Data controller

Data controller: Juan Miguel Pérez Roca (trading name: Centroterapia), Tax ID (NIF) 38452449Z.

Address: Carrer de Provenca, 112, 08029 Barcelona, Spain. Contact email for privacy matters: info@centroterapia.com.

2. Purposes of processing

To manage contact and appointment requests sent through the web form, responding to the queries raised.

Where the relevant box is expressly checked, to send informational communications about the centre. Without that explicit consent, no commercial communication of any kind is sent.

When the user uses the external booking link (MN Program) or the direct WhatsApp link, their data is processed directly by those services in accordance with their own privacy policies; Centroterapia does not receive or store that data through the website in that flow.

If the user uses the website's automated chat assistant, the text they type is sent to the technical provider Groq (see section 4) solely to generate a reply; no record of these conversations is kept on Centroterapia's servers, and the conversation is lost when the page is closed or reloaded. The assistant is configured not to request or process detailed health data.

3. Legal basis

The legal basis for processing the data provided through the contact form is the consent of the data subject, given expressly by checking the relevant box and submitting the form.

4. Recipients and data processors

Data is not transferred to third parties except where legally required. Technical providers acting as data processors are used for the website to function: web hosting, Vercel Inc. (United States), and delivery of contact form messages, Resend Inc. (United States). Both companies are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as an adequate safeguard for these international transfers.

Chat assistant: text entered by the user into the automated assistant is sent to Groq, Inc. (an AI inference provider based in the United States) solely to generate the reply in that moment; Centroterapia does not store those conversations. This international transfer is covered by the Standard Contractual Clauses approved by the European Commission, included in Groq's data processing agreement. We recommend not entering health data or other personal data into the assistant.

Database: where applicable, the centre's data (website content, and, if activated, contact form requests) is hosted on Supabase, region eu-west-1 (Ireland, European Union), so this does not involve an international data transfer.

Web analytics: to measure visits and the use of the booking and WhatsApp buttons in aggregate, the site uses Plausible Analytics (Plausible Insights OÜ, Estonia, European Union). It does not use cookies, does not collect personal data or persistent identifiers, and the data is hosted on servers in the European Union (Germany), so it does not involve any international data transfer.

Protection of the form against automated submissions: the site uses Cloudflare Turnstile (Cloudflare, Inc., United States, certified under the Data Privacy Framework), which checks technical browser signals to tell people apart from automated programs. It is not used for advertising or to track users across websites.

5. Retention period

Contact form data is kept for as long as necessary to handle the request and, subsequently, for the period required by applicable law to address any potential liabilities.

6. Rights of data subjects

Anyone has the right to access, rectify and delete their data, as well as to request the restriction of or objection to its processing, data portability, and to withdraw consent given at any time, by contacting info@centroterapia.com.

They also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) if they believe the processing of their data does not comply with current regulations.

7. Security

Reasonable technical and organisational measures are applied to protect personal data against unauthorised access, loss or alteration, appropriate to the risk of the processing carried out.