Privacy
Privacy notice
Heart Clinic processes personal data only for contact, appointment handling, form security and necessary administration.
Below you can read which data we process, why we do so and what rights you have.
Data controller
The data controller for this website and the contact form is:
- Dr M.H.H. de Vaan, trading under the name Heart Clinic
- Legal form: autónomo
- Email: info@heartclinic.es
- Telephone: +34 625 552 656
Which data may we receive?
Through the contact form or direct contact, the following data may be processed:
- Name
- Email address
- Telephone number
- Date of birth, where necessary for appointment handling
- Your message or question
- Health-related information that you voluntarily include in the message field
- Technical data such as IP address, browser data and spam-check information
Why do we process this data?
The data is used to contact you, assess your request, prepare an appointment, reduce misuse of the form and meet necessary administrative or legal obligations.
If you voluntarily include health-related information in the free message field, we process it only to assess your contact or appointment request. For that health-related information we rely on your explicit consent; for the other data we rely on our legitimate interest in handling your request.
Hosting, email and security
This website and its contact form run on Cloudflare Workers.
Form submissions are sent through SMTP2GO’s European API endpoint and delivered to Heart Clinic’s Microsoft 365 environment.
The website uses Cloudflare Turnstile to protect against spam and misuse.
Cookies and analytics
The website uses necessary technical cookies for the operation and security of the contact form.
The website uses Cloudflare Web Analytics for aggregated visit statistics. This analytics works without cookies and does not track individual visitors.
Contact form and storage
Messages sent through the contact form are not permanently stored on the web server. The content of the form is forwarded to Heart Clinic by email.
Technical logs at hosting, email and security services may be processed temporarily for security, troubleshooting and misuse prevention.
Transfers outside the EEA
Heart Clinic uses services from Cloudflare, SMTP2GO and Microsoft. To the extent that personal data is processed outside the European Economic Area, this is done according to the safeguards and terms of the relevant service providers.
Retention period
Heart Clinic does not keep personal data longer than necessary for the purpose for which it was received, unless a legal retention obligation applies.
- Contact requests and email correspondence: for as long as needed to handle and follow up on your question and for our administration
- Backups: system backups are kept for up to seven years and then overwritten
- Technical logs: according to the retention periods of hosting, email and security services
Your rights and complaints
You may request access, correction, deletion, restriction of processing or transfer of your personal data. You may also object to certain processing. Send your request to info@heartclinic.es.
Where processing is based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.
You also have the right to lodge a complaint with the competent data protection authority. For a Spanish establishment this is generally the Agencia Española de Protección de Datos (AEPD), unless legally determined otherwise.
Not for emergencies
Do not use the contact form for urgent medical symptoms. In an emergency, contact local emergency care or the emergency number in the country where you are staying.
Last updated
26 July 2026