Privacy Policy

Last updated: 12 November 2026

In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), we inform you as follows:

DATA CONTROLLER

Identity: CITY CLINIC GROUP SA, CIF A93097079 (hereinafter “the Controller”)
Address: Parque Comercial La Cañada Shopping, Carretera de Ojén s/n, First Floor, Local 131B, 29602 Marbella, Málaga, Spain
E-mail: admin@cityclinic.io

DATA PROTECTION OFFICER

The Controller has appointed a Data Protection Officer (DPO), communicated to the Spanish Data Protection Agency. You can contact the DPO about any matter related to the processing of your personal data at administradatos@lextools.com or by post at C/ María Tubau 9, 4ª planta, 28050 Madrid, España.

PURPOSE OF DATA PROCESSING

We process the data you provide for the following purposes:

To attend to and respond to contact requests, information requests and enquiries received through the contact channels available on the website (forms, chat assistant, WhatsApp, Instagram, telephone and e-mail).
To manage the appointment requests you send through the website and to contact you (by WhatsApp, telephone or e-mail) to arrange your visit.
To manage the enquiries you send through our advertising forms on social networks (Meta/Instagram, TikTok) and our landing pages.
To provide the CityScan AI preview tool, if you choose to use it (see the specific section below).
To send commercial information, offers and promotions about our services, only if you have given your consent for it.
To provide healthcare to patients and keep their clinical records, as required by law.

In compliance with the GDPR, a record of processing activities is maintained. Personal information will not be used for purposes other than those described. No automated decisions with legal or similarly significant effects are taken about you.

HEALTH DATA

When you tell us the reason for your enquiry or appointment (for example, the treatment you are interested in or a dental or skin concern), or upload photos to CityScan AI, you may be sharing health data, which is a special category of personal data. We only process it to answer your request and organise your care, on the basis of your explicit consent (article 9.2.a GDPR) and, once you are our patient, for the provision of healthcare (article 9.2.h GDPR). Please only share the information needed for your request.

GOOGLE REVIEWS SHOWN ON THIS WEBSITE

We display public reviews that patients have published on Google about City Clinic Marbella, including the reviewer’s public name and profile photo, using the Trustindex service. The legal basis is our legitimate interest in showing genuine patient feedback (Art. 6(1)(f) GDPR). These files are served from our own server, so your browser does not connect to Trustindex or Google to show them. If you wrote one of these reviews and would like it removed from our website, please write to admin@cityclinic.io.

LEGAL BASIS FOR DATA PROCESSING

Your consent, given through the corresponding checkbox or by contacting us. You can withdraw it at any time, without affecting the lawfulness of processing carried out before.
Pre-contractual and contractual measures: managing your request, appointment, payment and treatment.
Legal obligations of the Controller, such as keeping clinical records (Law 41/2002 on patient autonomy) and tax obligations.

PERSONAL DATA PROCESSED AND ORIGIN

We process identification and contact data (name, e-mail, telephone), the content of your enquiry, appointment and payment data, and, where you provide it, health data as described above. This data is provided by you through our forms, chat, messaging channels, e-mail, our advertising forms on social networks, or in person at the clinic.

Providing your data is voluntary, but the fields marked as required are necessary to handle your request. You guarantee that the data you provide is true, accurate and up to date. If you provide data of a third party, you guarantee that you have informed them and obtained their consent.

CityScan AI

CityScan AI (cityclinic.io/cityscan/, also reachable at scan.cityclinic.io) is an optional tool that gives you an informative preview of your smile, your skin, an aesthetic look or your dental X-ray. It is information, not a medical diagnosis, and does not replace a consultation. Only use this tool if you are 18 or older.

Photos and X-rays. They are analysed in real time by an artificial-intelligence provider acting on our behalf (Google Cloud, processed in the European Union) through our own server. We do not store them: they are processed in memory and discarded as soon as your preview is generated, and they are not used to identify you or to train AI models. If you describe in your own words the look you would like to see, that text is sent with your photo for the same purpose and is not stored either. Your result is shown only in your browser and we do not keep a copy. If you want to keep it, you can save it on your own device as a PDF or as a result card (which includes your preview image); if you choose to share it, you decide where and with whom.
X-rays. Before uploading an X-ray you confirm that it is yours (or that you are allowed to share it), that you are 18 or older, and that you understand the overview is educational information and not a diagnosis.
Your details. To use the tool you give us your name, email, phone and country and confirm that you are 18 or older. We keep these together with the tool you used, the dates, how you reached us (our website or a campaign link) and the record of your consents, to provide the tool, prevent misuse and produce usage statistics. Legal basis: your consent (Art. 6(1)(a) GDPR and, for health-related images, Art. 9(2)(a) GDPR).
Being contacted. We only contact you about treatments if you tick the optional box when you sign up, or press “Yes, contact me” after seeing your result (Art. 6(1)(a) GDPR and Art. 21 LSSI). Only then are your details passed to our patient coordinators (Google Sheets via Zapier, and email). You can withdraw this consent at any time by writing to admin@cityclinic.io or simply replying “stop”.
How long we keep your details. If you never agree to be contacted, your name, email and phone are removed 12 months after your last use of the tool; only anonymous statistics remain. If you agree to be contacted, we keep your details for up to 5 years from our last contact, unless you ask us to delete them earlier.
Booking a consultation. If you press “Book a consultation” after your result, the details you entered in CityScan AI are kept in your own browser for up to 30 minutes so that our booking form can be filled in for you, and are then deleted from your browser. Nothing is sent to us until you submit the booking form yourself.
Usage statistics. If you accept analytics cookies, we measure anonymous steps of the tool (for example, which tool was used, whether a scan finished, or whether a result was saved or shared). These events contain no name, contact details, photo or result. See our Cookie Policy.
Security. Network and device markers used to prevent misuse are stored only as one-way codes (hashes), never in readable form. Our server also keeps technical security logs, which include IP addresses, for 14 days to protect the website (our legitimate interest, Art. 6(1)(f) GDPR).

MINORS

The online forms, chat and tools on this website are intended for adults (18 years or older). If you want to request information or an appointment for a minor, the request must be made by their parent or legal guardian.

DATA RETENTION PERIOD

Enquiries and requests from people who do not become patients: up to 5 years from the last contact, after which they are deleted or anonymised.
Commercial communications: until you withdraw your consent or unsubscribe.
Patients’ clinical records: for at least 5 years from the last care episode, as required by Law 41/2002, or longer where health legislation so requires.
Accounting and tax data: for the periods required by law.

When the retention period ends, or if you request deletion, the data will be kept blocked, available only to judges, courts and public authorities, for the legal periods during which liability may arise, and then deleted.

RECIPIENTS AND SERVICE PROVIDERS

Your data is not sold or transferred to third parties, except where required by law. To provide our services we use the following providers, who process data on our behalf under a data processing agreement, or as independent controllers where indicated:

Website hosting and security: clouding.io (Spain), Cloudflare
E-mail and lead management: Google (Google Workspace / Gmail, Google Sheets), Zapier
Chat assistant: Chatbase
Messaging: WhatsApp and Instagram (Meta Platforms), ManyChat
Advertising forms on social networks: Meta Platforms and TikTok (who also act as independent controllers under their own policies)
Protection of our forms against spam: Cloudflare Turnstile (Cloudflare, Inc.)
Clinic management software and patient portal: Odontonet
CityScan AI: Google Cloud (Vertex AI), artificial-intelligence image analysis processed in the European Union
Cookie consent management: CookieYes. Cookies used for analytics and advertising are described in our Cookie Policy.

International transfers: some of these providers may process data outside the European Economic Area, for example in the United States. In that case the transfer is covered by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, for certified companies) or by the Standard Contractual Clauses approved by the European Commission.

CONFIDENTIALITY AND DATA SECURITY

The Controller adopts the technical and organisational measures appropriate to the level of risk of the data collected, to guarantee its security and prevent its accidental or unlawful destruction, loss, alteration, or unauthorised communication or access. Personal data is treated as confidential, and this confidentiality is guaranteed by legal or contractual obligation for employees, collaborators and anyone with access to it. Health professionals are also bound by professional secrecy.

LINKS AND SOCIAL NETWORKS

The website may include links to third-party sites, such as social networks where the Controller is present. These sites are not controlled by the Controller, which is not responsible for their content or for what users publish on them. Users should be aware that their posts are visible to other users.

YOUR RIGHTS

You have the right to:

know whether we process your personal data, and access it;
request the correction of inaccurate data or its deletion when, among other reasons, it is no longer necessary;
request the restriction of processing, or object to it for reasons related to your particular situation;
receive your data in a portable format, where applicable;
withdraw your consent at any time, including for commercial communications.

You can exercise these rights by writing to admin@cityclinic.io with the reference “GDPR Rights / Derechos RGPD“. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it. We will reply within one month.

If you consider that your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.