Policy Privacy

Identity and contact details of the Data Controller

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you that the personal data collected through the website www.mri-assist.com (hereinafter, the “Platform”) will be processed by:

Data Controller: Medical Response International S.L.U.
Tax identification number (NIF/CIF): B57609380
Registered office: Camí dels Reis, 308 – 1st Floor, 07010 Palma de Mallorca, Illes Balears, Spain
General contact email address: info@medicalresponse.es
Data Protection Officer (DPO): rgpd@medicalresponse.es

The Data Controller ensures that personal data is processed lawfully, fairly and transparently, and undertakes to implement appropriate technical and organisational measures to protect the information of users of the Platform.

Users may contact us through any of the channels indicated above to:

Resolve any queries relating to this Privacy Policy.
Request information about the processing of their data.
Exercise the rights recognised under applicable data protection legislation (access, rectification, erasure, objection, restriction of processing, portability, etc.).

Transparency note: MRI Assist is the trading name under which Medical Response International S.L.U. carries out its activities involving the coordination of international medical assistance, medical transportation, repatriation and cost containment, serving patients, insurers and assistance companies.

Purposes and legal bases for processing

The personal data collected through the Platform www.mri-assist.com will be processed solely for the purposes set out below, each linked to its corresponding legal basis under the GDPR and the LOPDGDD:

2.1. Handling enquiries and requests for information

Purpose: to respond to enquiries submitted through the contact form, by email or by telephone, providing information about international medical assistance, medical transportation, repatriation and cost containment services.
Legal basis: the data subject’s consent when submitting the request (Article 6(1)(a) GDPR).

2.2. Coordination with insurers and assistance companies

Purpose: to manage requests for medical assistance or healthcare logistics submitted by patients, insurers or partner companies, including the coordination of services in Spain, Portugal, the Balearic Islands, the Canary Islands, Andorra and Gibraltar.
Legal basis: performance of a contract or the taking of pre-contractual steps (Article 6(1)(b) GDPR).
Health data: where users provide medical information, its processing will be based on the data subject’s explicit consent (Article 9(2)(a) GDPR).

2.3. Corporate and marketing communications (opt-in)

Purpose: to send informational and marketing communications relating to MRI Assist’s services, solely to users who expressly request them.
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR).

2.4. Security and fraud prevention

Purpose: to ensure the security of the Platform, prevent unauthorised access or fraudulent use, and protect both the Controller and users against cyber threats.
Legal basis: the Controller’s legitimate interest in ensuring the integrity and security of its systems and services (Article 6(1)(f) GDPR).

Types and categories of personal data processed

Depending on how users use the Platform www.mri-assist.com and the information they voluntarily provide, the following categories of personal data may be processed:

3.1. Identification and contact data

Examples: first name, surname, email address, telephone number, company or insurer with which the user is affiliated, and country of origin.
Purpose: this data is necessary to handle enquiries, coordinate requests for assistance and communicate with users.

3.2. Data concerning health (optional)

Examples: medical information voluntarily included in the contact form or in communications with MRI Assist (e.g. diagnosis, health status, specific medical needs, medical transportation or repatriation).
Note: its processing requires the data subject’s explicit consent (Article 9(2)(a) GDPR) and is subject to enhanced security measures.

3.3. Communications data

Examples: the content of messages sent through the contact form, emails sent to corporate email addresses and, where applicable, documents attached by users.
Purpose: to manage requests, respond to enquiries and maintain documentary records of the actions taken.

3.4. Data for marketing communications and newsletters (opt-in)

Examples: email address, communication preferences and interactions with campaigns (e.g. opening emails or clicking links).
Purpose: to send corporate and marketing communications, solely where users have expressly authorised this.

3.5. Technical browsing data

Examples: IP address, session identifiers, browser type and version, device used, operating system, language, access logs, cookies and similar technologies.
Purpose: to ensure that the Platform functions correctly, improve the user experience and, where consent has been given, carry out statistical analysis using tools such as Google Analytics.

Retention of personal data

Personal data provided through the Platform www.mri-assist.com will be retained only for as long as necessary to fulfil the purposes for which it was collected, and for the applicable statutory limitation periods.

In accordance with the principle of storage limitation (Article 5(1)(e) GDPR) and the data blocking requirements (Article 32 LOPDGDD), the following criteria will apply:

4.1. General enquiries and communications

Retention period: while the enquiry is being handled and for up to 2 years as part of a contact history for traceability and service improvement purposes.

4.2. Data concerning health (provided voluntarily)

Retention period: only for the time strictly necessary to address the initial enquiry or request.
Subsequent handling: the data will be erased or blocked once the purpose has been fulfilled, unless its processing leads to the provision of a specific medical service (in which case the retention periods under healthcare legislation will apply).

4.3. Coordination with insurers and assistance companies

Retention period: for the duration of the contractual or pre-contractual relationship with the insurer or company.
Subsequent retention: up to 5 years, in view of the general limitation period for contractual claims (Article 1964 of the Civil Code).

4.4. Invoicing and accounting management (if services are contracted)

Retention period: for the duration of the contractual relationship and while payments or collections are being managed.
Subsequent retention:
- 6 years to comply with commercial obligations (Article 30 of the Commercial Code).
- 4 years to comply with tax obligations (Articles 66 et seq. of the General Tax Law).

4.5. Data for marketing communications and newsletters

Retention period: until users withdraw their consent.
Subsequent retention: once users request to unsubscribe, the data will remain blocked for 1 year, solely to provide evidence of the consent previously given.

4.6. Technical data and cookies

Retention period: the data will be retained in accordance with the type and lifespan defined in the Platform’s Cookie Policy, or until users withdraw their consent.

4.7. Blocking and erasure of data

Once the retention periods have expired, the data will be blocked, remaining available solely to judges, courts, the Public Prosecutor’s Office or the competent public authorities.

Once the limitation period has expired, the data will be permanently and securely erased.

Recipients and categories of recipients

Personal data collected through the Platform www.mri-assist.com may be disclosed to the following recipients, always applying the principle of data minimisation and solely to the extent necessary to fulfil the purposes described:

5.1. MRI Assist’s internal team

Recipients: authorised personnel of Medical Response International S.L.U. (MRI), including the operations, coordination, administration and accounting departments.
Purpose: to handle enquiries, requests for assistance, coordination with insurers and invoicing for services.

5.2. Insurers and assistance companies

Recipients: insurers and assistance companies with which the provision of medical services, medical transportation, repatriation or cost containment is coordinated.
Legal basis: performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR); for health data, the data subject’s explicit consent (Article 9(2)(a) GDPR).

5.3. Network of medical and healthcare providers

Recipients: hospitals, clinics, medical specialists, ambulance services and other providers necessary to deliver the services requested.
Responsibility: each healthcare professional or facility acts as an independent controller in respect of the medical records it creates, in accordance with Law 41/2002.

5.4. External data processors

Certain service providers act as data processors (Article 28 GDPR), accessing data solely to provide the contracted service and in accordance with the Controller’s instructions:

Website hosting and maintenance provider.
Corporate email services.
Email marketing/newsletter platforms (e.g. Mailchimp, Sendinblue).
External consultants and advisers, including the Data Protection Officer (DPO).

5.5. Public authorities and judicial bodies

Recipients: competent public authorities, law enforcement agencies, judges and courts.
Purpose: compliance with legal obligations or official requests, or the defence of claims.

5.6. Third-party tools and services integrated into the Platform

Where external tools are used, they may process data in accordance with their own privacy policies:

Google Analytics: statistical analysis of website traffic (subject to prior cookie consent).
Google Maps: locating medical services or partner facilities.
Cookie consent management tool: recording users’ privacy preferences.

Transparency clause: under no circumstances will data be disclosed to third parties for marketing purposes unrelated to MRI Assist’s services without users’ prior, informed and explicit consent.

International data transfers

As a general rule, personal data processed through the Platform www.mri-assist.com is stored on servers located in the European Union (EU/EEA).

However, international data transfers may take place in the following circumstances:

6.1. Foreign insurers and assistance companies

Context: when coordinating medical assistance, medical transportation or repatriation, it may be necessary to disclose personal data (including health data) to insurers or assistance companies located outside the EEA.
Legal basis: performance of a contract or the taking of pre-contractual steps (Article 6(1)(b) GDPR); for health data, the data subject’s explicit consent (Article 9(2)(a) GDPR).
Safeguards: wherever possible, efforts will be made to work with entities in countries covered by a European Commission adequacy decision (Article 45 GDPR), or to enter into Standard Contractual Clauses (SCCs) (Article 46 GDPR).

6.2. Medical providers outside the EEA

Context: in specific cases, delivery of the service may require the involvement of hospitals, clinics, ambulance services or other medical providers located outside the European Economic Area.
Responsibility: these healthcare professionals or facilities act as independent controllers of the medical records they create, in accordance with Law 41/2002.

6.3. Technology providers

Google (Analytics, Maps): possible transfers to the United States or other countries where Google has servers.
Mailchimp / Sendinblue or other marketing platforms: they may transfer data to the United States or third countries.
Hosting and email service providers: where services are subcontracted outside the EEA, equivalent contractual measures will apply.
Safeguards: all these providers apply European Commission-approved SCCs and additional security measures.

6.4. Derogations and explicit consent

Where there is no adequacy decision or appropriate safeguards (Articles 45 and 46 GDPR), the international transfer will be based on:

The data subject’s explicit consent (Article 49(1)(a) GDPR), after being informed of the possible risks.
Necessity for the performance of a contract between the data subject and the Controller (Article 49(1)(b) GDPR).
The vital interests of the data subject or another natural person (Article 49(1)(d) GDPR), in medical emergencies.

Third-party tools and services

The Platform www.mri-assist.com may integrate certain services and technological tools provided by third parties which, in some cases, may involve the processing of personal data. These third parties act as data processors or independent controllers, depending on the nature of the service they provide.

7.1. Website hosting and maintenance provider

Purpose: to host the website and manage its technical operation.
Role: data processor (Article 28 GDPR), under a specific data processing agreement.
Location: servers in the European Union, except where occasional subcontracting would require the application of standard contractual clauses (SCCs).

7.2. Corporate email

Purpose: to manage communications with users, patients, insurers and assistance companies.
Role: data processor, subject to a contract and specific security measures.

7.3. Email marketing / newsletter platforms (e.g. Mailchimp, Sendinblue)

Purpose: to manage voluntary subscriptions to marketing communications and send newsletters.
Role: data processors, under agreements pursuant to Article 28 GDPR.
International transfers: where servers are located in the United States or other countries, Standard Contractual Clauses (SCCs) and additional security measures apply.

7.4. Google Analytics

Purpose: statistical analysis of website use and browsing, in order to improve the user experience and the services offered.
Data processed: IP address (anonymised), device, browser, pages visited, session duration, etc.
Legal basis: users’ consent, obtained through the cookie banner (Article 6(1)(a) GDPR).
Role: Google acts as an independent controller in respect of data processed for its own purposes.
Transfers: possible transfers to the United States and other countries, under SCCs.

7.5. Google Maps

Purpose: to display the locations and references of medical facilities or partner providers.
Data processed: IP address and, where applicable, device location data if users permit this.
Legal basis: users’ explicit consent (Article 6(1)(a) GDPR).
Role: Google acts as an independent data controller.

7.6. Cookie consent management tool

Purpose: to record and manage users’ privacy preferences in relation to cookies (functional, analytics and marketing cookies).
Role: data processor, acting in accordance with the Controller’s instructions.

Transparency clause: the use of these tools is always subject to the Platform’s Cookie Policy, where users can find detailed information about the types of cookies used, their duration and purposes, and the mechanisms for managing or disabling them.

Rights of data subjects

Users may exercise the following rights:

Access, rectification, erasure, objection, restriction of processing, portability, withdrawal of consent, and the right not to be subject to automated decision-making.

Channels for exercising rights:

Email: info@medicalresponse.es
DPO: rgpd@medicalresponse.es
Postal address: MRI Assist – Privacy, Camí dels Reis, 308 – 1st Floor, 07010 Palma (Illes Balears), Spain

Response time: 1 month, extendable to 2 months in complex cases.
Complaints: to the Spanish Data Protection Agency (AEPD), www.aepd.es.

Data security and confidentiality

The Data Controller undertakes to ensure the confidentiality, integrity and availability of personal data processed through the Platform www.mri-assist.com, implementing appropriate technical and organisational measures in accordance with Articles 24, 25 and 32 GDPR and Article 32 LOPDGDD.

9.1. Security principles applied

Confidentiality: access is restricted solely to authorised MRI Assist personnel and data processors with an agreement in force.
Integrity: mechanisms are implemented to protect information against accidental or malicious alteration.
Availability: backup and recovery systems are used to ensure service continuity.
Data minimisation: only data strictly necessary for the stated purposes is collected and processed.
Data protection by design and by default: all technical and administrative processes are configured to limit the collection of and access to personal data.

9.2. Technical and organisational measures

The following security measures, among others, are applied:

Encryption of communications between users and the Platform using the TLS/SSL protocol.
Access controls based on roles and differentiated permissions.
Activity logs and access audits in critical systems.
Regular backups and contingency plans.
Intrusion detection and prevention systems, firewalls and up-to-date antivirus software.
Confidentiality protocols signed by employees and collaborators.
Regular staff training on data protection and security.

9.3. Enhanced protection of health data

Where users voluntarily include health data in their enquiries:

Enhanced security measures and restricted access are applied.
Only personnel whose access is strictly necessary will have access to this information.
The data will be retained only for the time strictly necessary to address the enquiry, and will be blocked or erased immediately once the purpose has been fulfilled.

9.4. Risk management and impact assessments

The Controller conducts periodic analyses of the risks associated with data processing.
Where processing is identified that may pose a high risk to the rights and freedoms of data subjects, a Data Protection Impact Assessment (DPIA) will be carried out in accordance with Article 35 GDPR.

9.5. Management of incidents and security breaches

MRI Assist has an internal protocol for the detection, notification and management of security incidents.
In the event of a personal data breach, the Spanish Data Protection Agency (AEPD) will be notified within a maximum of 72 hours of its detection and, where appropriate, the affected users will also be notified, in accordance with Articles 33 and 34 GDPR.

Amendments and updates to the Privacy Policy

This Privacy Policy may be amended at any time in order to:

Adapt to changes in legislation or case law concerning data protection and information society services.
Incorporate criteria, guidelines or recommendations issued by the Spanish Data Protection Agency (AEPD) or other competent supervisory authorities.
Adapt to changes in the services offered by MRI Assist or to internal organisational changes.
Introduce technical or organisational improvements that enhance the security and confidentiality of personal data.

Where amendments introduce substantial changes to the processing of personal data or require renewed consent, users will be informed clearly and prominently through the Platform www.mri-assist.com and, where appropriate, their consent will be obtained again.

Users are advised to review this Privacy Policy periodically to stay informed about how their personal data is processed and about their rights.

Minors

The Platform www.mri-assist.com is not intended for children under 14 years of age.

If a child under this age provides personal data through the contact form or by any other means, the prior consent of their parents, guardians or legal representatives will be required.

The Controller accepts no responsibility for data provided by minors without the required authorisation. If this situation is identified, the information will be deleted immediately.

Relationship with other websites in the corporate group

MRI Assist forms part of the Medical Response International S.L.U. (MRI) corporate group, which operates other digital platforms related to medical assistance and healthcare services:

www.drnear.me → locating and booking in-person medical services through geolocation.
www.drnear.online → provision of video consultations and telemedicine services.
www.doctor-abroad.eu → attracting international patients interested in receiving medical treatment in Spain.
www.tdoctors.es → a network of private medical centres in Palma de Mallorca.

When users access or are redirected from www.mri-assist.com to any of these domains, the specific Privacy Policy published on the relevant website will apply. The purposes of processing and the scope of responsibility may vary depending on the service contracted.