Privacy Policy

Last updated: [date]

This document is a courtesy translation. The Spanish version is the only legally binding version. For any legal matter, please refer to the Spanish text or contact us at hola@athyrahealth.com.

1. Data controller

The controller responsible for processing your personal data is [Company legal name], with Tax ID [NIF/CIF] and registered address at [registered address]. You can contact us regarding the privacy of your data at hola@athyrahealth.com.

2. Data we collect

If you write to us through the contact form or the information request form, we collect the data you voluntarily provide: name, email address, and the content of your message or query.

If you register and book a test through the platform, we also collect: full name, email address, phone number, collection address (street, postal code, and access instructions if applicable), region, and, where the type of test requires it, sex. We also record the specific lab test you book and your order status (confirmed, sample collected, in transit, in analysis).

The lab test you book is, by its very nature, health-related data and constitutes a special category of data under Article 9 of the GDPR. We process this data only with your explicit consent, given when you complete the booking, and solely to coordinate the delivery of the service (assigning the nursing professional, sending the sample to the corresponding accredited laboratory). If you voluntarily include health information in the contact form, we apply this same explicit consent basis.

Payments are processed directly through Stripe, our payment gateway provider. We do not store your card details on our servers; we retain only the transaction identifier to manage your order.

3. Purpose and legal basis

We process your data for the following purposes and on the following legal bases: (i) responding to your inquiry or information request, based on your consent; (ii) managing your user account and the booking, coordination, and tracking of the lab test requested, based on the performance of a contract between you and Athyra Health; (iii) processing the data relating to the type of test booked, as a special category of data, based on your explicit consent; and (iv) complying with our legal obligations, in particular invoicing and accounting. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal, although withdrawing consent for the health-related data may prevent us from providing the requested service.

4. Data retention

Data provided through the contact form is retained for as long as necessary to handle your request, and for a maximum of 12 months from the last contact. Data associated with your user account and orders is retained while the account remains active and, after it is closed, for the period legally required to meet our tax and accounting obligations (up to 6 years, under Article 30 of the Spanish Commercial Code), after which it will be deleted or anonymized.

5. Recipients and data transfers

We do not share your data with third parties except where legally required, with the following exceptions necessary to provide the service: the nursing professional assigned to your test and the accredited laboratory that processes it receive the data strictly necessary for sample collection and analysis (name, address, and type of test), acting as independent controllers for the clinical processing. If your test is managed through a partner organization (a clinic or professional), that organization's authorized staff will also have access to your order data.

We use the following processors to operate the platform: Supabase (database and authentication, hosted in the European Union), Amazon Web Services (web hosting), Stripe (payment processing), and Resend (transactional email). When any of these providers involves a transfer of data outside the European Economic Area, we ensure it has adequate safeguards under Chapter V of the GDPR (such as standard contractual clauses).

6. Your rights

You have the right to access, rectify, and delete your data, as well as to request the restriction of or objection to its processing and its portability. To exercise any of these rights, write to us at hola@athyrahealth.com stating which right you wish to exercise; we will verify your identity and respond within one month at most, extendable to three months in particularly complex cases, under Article 12 of the GDPR. Even if you request deletion of your data, we may retain data we are legally required to keep (for example, invoicing records) for the legally required period. You also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing of your data does not comply with current regulations.

7. Minors

This website is not directed at minors. We do not knowingly collect data from persons under 18 years of age without the consent of their legal guardians.

8. Security

We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss, or alteration, appropriate to the risk of the processing.

We may update this policy to reflect regulatory changes or changes to our services. The date of the last update is shown at the beginning of this document.