Privacy policy

In accordance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights, you are informed that the personal data you provide through the website https://adeu.now (hereinafter, the website) will be processed on the following terms:

Data controller

Personal data collected through this website is processed by Clínica Quirúrgica Sarrià (B62285846), with an address for exercising your rights at C/ Gironella 6-8, consulta 1.7, 08017 Barcelona.
Email: dpo@admiravision.es

Processing of personal data

The processing described in this policy relates exclusively to processing carried out through this website. Clínica Quirúrgica Sarrià is not responsible for personal data processing that may take place on third-party websites.

The personal data processing on this website is as follows:

Personal data provided in the assessment and appointment request form

When you provide your personal data through that form, the data is processed in order to assess your situation and give you information about the most suitable treatment based on your answers, and ultimately to request an appointment with us.

Besides your contact details and your date of birth, the clinic may ask you a few short questions, before or after you book: for example, which vision correction you use (glasses or contact lenses), how you heard about us, why you want treatment now or what made you decide to book. Some answers, such as your vision correction, are health data. Questions asked after the booking are optional. The answers are processed for the same purpose and on the same legal basis as the rest of the form.

The booking also records the type of device (phone, tablet or computer) and its operating system. No other browser data is kept.

If you have accepted statistics cookies, the booking also carries the pseudonymous identifier with which PostHog, our analytics tool, recognises your browser and your visit, and PostHog receives the booking's reference. This lets us measure which visits and which campaigns lead to an appointment, whether the appointment takes place and whether it leads to treatment. PostHog never receives your name, your phone number or your email address. If you have not accepted statistics, the booking carries no PostHog identifier.

Legal basis. Processing is based on the explicit consent given by the data subject by ticking the corresponding box (art. 6.1.a and 9.2.a GDPR). Consent may be withdrawn at any time. For more information, see the rights section of this privacy policy.

Recipients. No disclosure of data to third parties is envisaged, except where legally required, and Google Ireland Ltd., Meta Platforms Ireland Ltd. and Stape (only with your consent, for campaign measurement).

Retention. Personal data will be kept as long as the data subject does not request its erasure or withdraw consent, and for as long as it remains necessary for the purpose for which it was collected.

Video consultations

If you book your appointment as a video consultation, the call takes place on Google Meet, a Google service that acts as a processor for the clinic. Our appointment system creates the call's room in the clinic's Google Workspace account without giving Google your name or any information about your health: the room carries no name at all. We send you the link by email.

During the call, Google processes the data it needs to provide the service: the name you enter when you join, your IP address, technical data about your device and your connection, and the audio and video of the call. The link takes you straight into the call. Video consultations are not recorded. This website does not load Google Meet: the connection to Google starts when you open the link.

Legal basis. Processing is based on the explicit consent you give when you request the appointment (Art. 6(1)(a) and 9(2)(a) GDPR) and on steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Recipients. Google, as a processor, under the clinic's Google Workspace contract. Until the end of October 2026, video consultations took place on Zoom, a service of Zoom Communications, Inc. (United States). No other disclosure of data to third parties is planned, except where required by law. See also "International data transfers".

Retention. Appointment data is kept on the terms given for the appointment request form. Google keeps the call's technical data for the period set in its processing agreement with the clinic.

Handling contacts through WhatsApp

Personal data is processed in order to respond to enquiries and to establish a direct channel of communication with the data subject.

Legal basis. The legal basis for processing is the taking of pre-contractual steps and the legitimate interest of the controller.

Recipients. No disclosure of data to third parties is envisaged, except where legally required, or where disclosure is necessary to deal with a request from the data subject.

Retention period. Data will be kept for as long as needed to fulfil the purpose for which it was collected, and for as long as legal liability may arise from the processing, within the periods laid down for bringing, exercising or defending claims.

Web traffic

In order to obtain information about use of the website, we analyse the number of pages visited, the number of visits, and visitors' activity and frequency of use. For that purpose we use the statistical information produced by our internet service providers. You can find all the information about this processing in our Cookie policy.

Advertising campaign measurement (only with your consent). If you allow it in the cookie banner, we use Google Tag Manager, Google Ads and Google Analytics (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) and the Meta Conversions API (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland) to measure how well our campaigns work and how many appointment requests they generate. These tools load through our own subdomain (t.adeu.now), operated by the server-side tagging provider Stape and hosted in the European Union, which acts as a processor. The legal basis is your consent (art. 6.1.a GDPR), which you can withdraw at any time under "Cookie settings" in the footer.

These tools receive the pages you visit and some of your interactions with them (for example, opening a frequently asked question or tapping the map), plus three campaign signals: that the appointment form was opened, that a request was sent, and that a WhatsApp chat was started. Page addresses and page titles are rewritten before they are sent, so they do not reveal which treatment you looked at. They are never told your form answers, your age, whether you wear glasses or contact lenses, or any other health data.

International data transfers

The use of WhatsApp entails international transfers of data to the United States of America. These transfers are made with appropriate safeguards in place, such as the standard contractual clauses approved by the European Commission, in accordance with applicable law.

Google LLC and Meta Platforms, Inc. may process data in the United States. Both are certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply in addition.

Cloudflare, Inc. (Turnstile, see "Security measures") is based in the United States and runs a worldwide network, so Turnstile's signals may be processed outside the European Economic Area. For transfers to the United States, Cloudflare is certified under the EU-US Data Privacy Framework; for other transfers, it applies the European Commission's standard contractual clauses.

Google (video consultations on Google Meet) may process call data outside the European Economic Area, including in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and its processing agreement also incorporates the European Commission's standard contractual clauses. Earlier video consultations, with Zoom Communications, Inc., relied on the same safeguards.

Security measures

The controller has adopted the technical and organisational measures necessary to guarantee the security and integrity of personal data — especially data of a sensitive category such as health data — and to prevent its alteration, loss, unauthorised processing or unauthorised access.

These measures have been implemented taking into account the state of the art, the nature of the data processed and the risks to which it is exposed, in accordance with the General Data Protection Regulation.

To protect the booking form against abuse, our server keeps the IP address of each request, and a pseudonymised version of the phone number and email entered, in memory for at most 24 hours. They are used only to limit the number of requests and bookings. When these checks refuse a request, the server's technical log also records its IP address and user agent (the type of browser and device), to detect and investigate attacks; that log is deleted with every update of the website. None of this data is shared with third parties. The legal basis is the controller's legitimate interest in the security of the service.

Booking pages of the appointment system. The clinic's booking pages on our appointment system link to this policy. Those served from the sanoptis.cloud domain use Cloudflare Turnstile, a security check by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, United States) that confirms, usually without you noticing, that the person booking is a human and not an automated program. To do so, Turnstile processes technical signals from your browser and your connection, such as the IP address, the TLS fingerprint and the user agent. For this check, Cloudflare acts as a processor, and the legal basis is the controller's legitimate interest in the security of the service. Cloudflare also processes these signals as a controller, on the basis of its own legitimate interest, to improve its bot detection. You can find more information in Cloudflare's Turnstile Privacy Addendum. This website does not use Turnstile.

Users should nonetheless be aware that security measures on the internet are not impenetrable.

Your rights

To exercise your rights of access, rectification, erasure and portability of your data, as well as the rights to restriction of and objection to processing, or to withdraw the consent you have given, you may do so by written request accompanied by an official document proving your identity, addressed to Clínica Quirúrgica Sarrià, at C/ Gironella, 6-8 (Cons. 1.7), 08017 Barcelona.

You can also contact us at the following email address: info@admiravision.es

If you are unhappy with the processing, you also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).