Privacy Policy
1. Data controller
Dr. Nico Sierra is the controller of the personal data collected through this website. Medical licence no. COMB 45307. Address: Carrer del Lluçanès 6, Planta Baixa, 08022 Barcelona, Spain. Contact: admin@drnicosierra.com — We reply within 24 hours.
2. Data we collect
Through the contact form we collect, on a voluntary basis: your name, email address, telephone number (optional), country of residence and a description of the clinical case. Sensitive health data (a special category under Art. 9 GDPR) is collected only with your explicit consent and is necessary to assess the clinical viability of your case. The form is protected by HTTPS and managed by Netlify Forms.
Each request is recorded, in addition to the email, in an internal contact-tracking log (a spreadsheet hosted on Google) that we use so that no enquiry is missed, to reply to each case and to keep internal control of activity. This log includes the data you provided in the form together with technical data about your visit (date and time, the page you wrote from, device type and approximate country obtained from your IP address). Your IP address is not stored.
3. Purpose of processing
Your data is used exclusively to: (a) manage your initial enquiry, (b) reply to you with personalised clinical information, (c) establish a care relationship with Dr. Sierra if you wish, (d) record and follow up your contact in order to ensure a reply and for the internal management and control of the practice's activity, and (e) meet legal obligations arising from healthcare.
We do not use your data for advertising or direct marketing, we do not sell it, and we do not pass it to third parties for their own purposes. Access is limited to the data processors listed in section 6, who act only on our instructions and under a duty of confidentiality, and to any legal obligations that may apply.
4. Legal basis
Initial enquiries: Consent given when you submit the form (Art. 6.1.a GDPR). Care relationship: Legitimate interest in managing the medical enquiries received (Art. 6.1.f GDPR) and public interest in healthcare (Art. 6.1.e GDPR). Health data: Explicit consent (Art. 9.2.a GDPR). Contact recording and follow-up: The controller's legitimate interest in organising the enquiries received, not missing any, and keeping internal control of its activity (Art. 6.1.f GDPR). All of this is in accordance with Organic Law 3/2018 (LOPDGDD) and Law 41/2002 on Patient Autonomy and Rights and Obligations regarding Clinical Information and Documentation.
5. Data retention
Enquiries not taken further: Kept for 6 months from your last contact, then deleted. Patients under follow-up: Kept for the duration of the care relationship plus 5 years after treatment ends, in line with the requirements of Law 41/2002 and standard clinical practice. After that period, the data is destroyed with appropriate security measures (anonymisation or irreversible deletion).
Internal contact-tracking log: For enquiries that do not lead to a care relationship, identifying data (name, contact details, text of the case) is deleted from this log 12 months after the last contact; after that, only anonymised activity data (date, source, outcome) may be kept. If the enquiry leads to a care relationship, the periods in the previous paragraph apply.
6. Data processors
Your data may be accessed by: (a) Netlify (web hosting and receipt of the form, US, Data Processing Agreement in force), (b) Google Analytics 4 (anonymous traffic analysis, US, deferred loading via GTM), (c) Google Tag Manager (tag management, US), (d) Google (Google Sheets and Apps Script, hosting the internal contact-tracking log, US/EU, Google Data Processing Addendum in force), (e) an external collaborator who provides Dr. Sierra with website management and contact-tracking services as a data processor, bound by a processing contract and a duty of confidentiality, with no use of the data of their own, and (f) authorised medical staff of Dr. Sierra, only if you are in a care relationship and under the duty of medical confidentiality of Law 41/2002. Non-medical staff do not access clinical data beyond what is strictly necessary to manage your contact. All processors have a data processing agreement (DPA) in force and comply with the GDPR. You can request the specific identity of the external collaborator by writing to admin@drnicosierra.com.
7. Your rights
You have the right to:
- Access: Request a copy of your data.
- Rectification: Correct inaccurate data.
- Erasure (right to be forgotten): Have your data deleted (subject to legal medical exceptions).
- Restriction: Restrict processing while you verify your data.
- Portability: Receive your data in a structured format and transfer it to another controller.
- Objection: Object to processing based on legitimate interest.
- Withdrawal of consent: Withdraw your consent at any time, without retroactive effect.
To exercise these rights, write to admin@drnicosierra.com and attach a copy of your national ID (DNI). We will reply within the legal period of 30 days.
8. Right to complain to the AEPD
If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) without first having to contact Dr. Sierra. AEPD contact: www.aepd.es — Telephone: +34 901 100 099. The right to complain does not affect other administrative or judicial routes.
9. Cookies, web analytics and storage in your browser
Google Analytics 4 (GA4): We measure visits with Google Analytics 4, which is loaded through Google Tag Manager when you open any page of the website (deferred, so as not to slow it down). For this, Google may install the cookies _ga and _ga_… in your browser, which are used to distinguish visits and to count page views and clicks on the contact buttons. The website currently does not include a cookie selector. You can prevent measurement through your browser's privacy settings or with the Google Analytics opt-out extension.
Local storage on this website: The website does not install its own cookies, but it saves in your browser's local storage the origin of your first visit (where you came from: search engine, link or campaign, the landing page and the date) and a random visit identifier. These are used to know how a contact request arrived. They reach us only if you start the contact (form, WhatsApp or telephone) and they form part of the internal log described in the previous sections. When you click on WhatsApp or the telephone number, the source, medium and landing page of your visit are also included in the Google Analytics measurement event; the random identifier is not sent to Google. This data stays in your browser until you clear its browsing data.
We do not use advertising or retargeting cookies.
10. Security and data protection
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or accidental damage: (a) HTTPS encryption on all communications (TLS 1.2+), (b) Secure storage on Netlify with automatic backups, (c) Role-based access controls, (d) Regular security reviews, (e) Restricted, authenticated access to the contact-tracking log, limited to the people who manage replies to enquiries. Your sensitive data is kept separate from identifying data in accordance with Law 41/2002.
11. Data breach notification
In the event of a security breach affecting your personal data, we will notify you within the legal period of 72 hours from its discovery, and we will also notify the AEPD. The notification will include: the nature of the breach, the resulting risks, the measures taken and a contact point for further information.
12. Informed consent for medical care
If you establish a care relationship with Dr. Sierra, you will sign a separate Informed Consent Document in accordance with Law 41/2002, setting out the procedure, risks, benefits and alternatives. This document does not replace a medical consultation. The information on this website is educational and does not replace a professional clinical assessment.
Last updated: 11 October 2026 (section 9 describes web analytics and local storage in detail). Previously, 10 September 2026: the internal contact-tracking log and its data processors were added. This policy may be revised from time to time. Significant changes will be communicated. If you have any questions, write to us at admin@drnicosierra.com.