Privacy Policy and Data Protection

In compliance with current legislation, www.sebastianpodlipnik.com (hereinafter, also the «Website») undertakes to adopt the necessary technical and organizational measures, according to the appropriate level of security for the risk of the data collected.

Data controller

  • Titleholder and Responsible Party: SKINNOVATION CONSULTING SLP
  • CIF B24964512
  • Address Ricard Zamora Passage, 1, Ground Floor, 08017 Barcelona
  • Registration data: Registered with the Barcelona Mercantile Registry
  • Contact/Privacy Email: contacto@sebastianpodlipnik.com

Healthcare professional responsible for patient care activities Dr. Sebastian Podlipnik, Medical Specialist in Surgical Dermatology and Venereology, registered with the Official College of Physicians of Barcelona (COMB) under number 0849579.

A Data Protection Officer (DPO) has not been appointed as the conditions for mandatory appointment under Article 37 GDPR are not met. For any data protection-related inquiries, please contact the indicated email address.

Laws incorporated into this privacy policy

This policy is adapted to current Spanish and European regulations on personal data protection. Specifically, it respects the following rules:

  • Regulation (EU) 2016/679 (GDPR).
  • Organic Law 3/2018, of December 5, on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).
  • Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE).

Record of processing activities

In compliance with the GDPR and the LOPDGDD, we inform you that the personal data collected through the Website forms will be processed in order to attend to the user's requests, inquiries, or appointments and to manage the relationship established. Likewise, unless the exception of Article 30.5 GDPR applies, a record of processing activities is maintained that specifies, according to its purposes, the activities carried out and the other circumstances established by the regulations.

Principles applicable to the processing of personal data

The processing of the User's personal data is subject to the principles of Article 5 of the GDPR:

  • Lawfulness, loyalty, and transparency: It is transparently informed of the purposes of the treatment.
  • Purpose Limitation The data are collected for specified, explicit, and legitimate purposes.
  • Minimization Only the strictly necessary data is collected.
  • Accuracy the data is kept accurate and up-to-date.
  • Retention Period Limit they are kept only as long as necessary for their purposes.
  • Integrity and confidentiality: Your security and confidentiality are guaranteed.
  • Proactive responsibility The person in charge ensures compliance with the above principles.

Categories of personal data

Based on the User's interaction with the Website, the following are processed:

  • Identification and contact details: Name, last name, phone number, and email address.
  • Health data (special category — Art. 9 GDPR): when the User voluntarily includes information about their health status (e.g., description of symptoms or injuries) in the form, or requests a medical evaluation.
  • Navigation data: cookies and similar technologies (see Cookie Policy).

The origin of the data is the data subject themselves.

Legal basis for the processing of personal data

  • Handling requests, inquiries, and appointments: the User's consent (Art. 6.1.a GDPR) and/or the application of pre-contractual measures at the request of the data subject (Art. 6.1.b).
  • Health data voluntarily provided to assess the consultation: the explicit consent from the User (Art. 9.2.a GDPR) and, where applicable, for healthcare purposes (Art. 9.2.h).
  • Sending commercial communications and newsletters: the specific consent from the User (Art. 6.1.a GDPR and Art. 21 LSSI-CE), collected through a separate box.
  • Web analytics and advertising campaign measurement consent provided through the cookie settings panel (Art. 6.1.a).

The User may withdraw their consent at any time; withdrawing consent will be as easy as giving it. As a general rule, withdrawal will not affect the use of the Website. When filling out a form field is mandatory, the User will be informed.

Purposes of the processing for which the personal data are used

Personal data is collected and managed for the purpose of responding to and managing the User's information requests, inquiries, or appointments and the relationship that arises from them; evaluating medical consultations when the User provides health data; and, with specific consent, sending commercial communications and performing analytics and measurement of the Website's activity to improve its quality and functionality. At the time of collection, the specific purpose(s) of the processing will be communicated.

Retention periods of personal data

Personal data will be retained for the time necessary for each purpose and in accordance with applicable legal deadlines.

  • Requests/inquiries not leading to a care relationship: up to 1 year from last contact.
  • Clinical Data (Medical History): during the periods established by applicable clinical documentation regulations (generally, a minimum of 5 years and, in certain cases, up to 15 years or more from discharge from the care process).
  • Business Communications: until the User withdraws their consent or unsubscribes.
  • Data with tax or accounting effects: during the legally enforceable periods (generally up to 6 years).

Recipients and data controllers

The following processors are involved in the provision of services, with whom contracts as provided for in Art. 28 GDPR have been signed:

  • Raiola Networks, S.L. (Spain) — Website and email platform (MailWizz) hosting. Data is stored on servers located in Spain/EU.
  • Google LLC (Google Analytics, Google Ads, and Google Tag Manager) - web analytics and advertising. It involves a International data transfer to the USA., protected under the EU–U.S. Data Privacy Framework.

No other data is transferred to third parties, unless legally required.

Personal data of minors

In accordance with Articles 8 of the GDPR and 7 of the LOPDGDD, only individuals over 14 years of age may give their consent for the processing of their personal data. In the case of minors under 14 years of age, the consent of their parents or guardians will be required, and it will only be considered lawful to the extent that they have authorized it.

Secrecy and security of personal data

The controller shall take the technical and organizational measures necessary, according to the level of security appropriate to the risk, to ensure the security and confidentiality of data and prevent its accidental or unlawful destruction, loss, or alteration, as well as unauthorized access to it. The Website has an SSL certificate that ensures the encrypted transmission of data.

Nevertheless, given that the impregnability of the internet cannot be guaranteed, the controller undertakes to inform the User, without undue delay, of personal data breaches that are likely to result in a high risk to their rights and freedoms, in accordance with art. 4 of the GDPR. The data will be treated confidentially by the controller and by those involved in its processing.

Rights deriving from the processing of personal data

The User may exercise the following rights recognized in the GDPR and the LOPDGDD against the controller:

  • Right of access obtain confirmation as to whether or not your personal data are being processed and, where applicable, access to them and information about their processing, their origin, and recipients.
  • Right to rectification that inaccurate or incomplete data be modified.
  • Right to erasure («right to be forgotten»): obtain the erasure of data when they are no longer necessary, consent is withdrawn without another legal basis, objection is made without an overriding legitimate ground, they have been unlawfully processed, or they must be erased due to a legal obligation.
  • Right to limit treatment in the cases provided for in the GDPR.
  • Right to data portability: Receive data in a structured, commonly used, and machine-readable format, and transmit it to another responsible party.
  • Right to object object to the processing of your personal data.
  • Right to not be subject to solely automated decision-making, including profiling, except for legally provided exceptions.
  • Right to withdraw consent Anytime.

The User may exercise their rights by communicating with the data controller, with the subject line «GDPR,» at the address contacto@sebastianpodlipnik.com, stating the right they are exercising and attaching a document that proves their identity (or that of their representative).

Links to third party websites

The Website may include links to third-party pages not operated by the responsible party. Said third parties have their own privacy policies and are responsible for their own data processing.

Affiliation links

The Website occasionally uses affiliate links for products and services from brands that have an affiliate program, which are included after having used said products or having assessed that they meet an adequate level of quality. In particular, it participates in the Amazon EU Associates Program, through which income is generated from qualifying purchases. Arbitrary affiliate links to products that do not meet these conditions are not included.

Complaints to the supervisory authority

If the User considers that there is an infringement of current regulations in the processing of their data, they have the right to effective judicial protection and to lodge a complaint with a supervisory authority. In Spain, the supervisory authority is the Spanish Data Protection Agency (www.aepd.es).

Cookies

The Website uses its own and third-party cookies. You can check their details (types, purpose, owner, and duration) and configure or withdraw your consent at any time at the Cookie Policy and in the cookie settings panel available on the Website.

Acceptance and changes to this Privacy Policy

The use of the Website implies that the User has read and accepts this Privacy Policy. The controller reserves the right to modify it to adapt it to legislative, jurisprudential, or doctrinal changes from the AEPD; the changes will be published on this page and, when appropriate, will be notified to the User.

Last updated: June 29, 2026.