Privacy policy

1. Data controller

The data controller for personal data collected through this website is Seiva Health, based in Madrid, Spain. For any privacy question, contact Seiva Health through the contact channels published on this website.

2. Two roles

• As data controller: Seiva processes the data of clinic representatives, clinicians and people who request information or a pilot place, or who browse the website.
• As data processor: when a clinic uses the Seiva platform for intake, consultations, lab organisation and care plans, the clinic is the data controller for patient health data. Seiva acts as data processor under a data processing agreement (Article 28 GDPR) and processes data only on the clinic's documented instructions.

3. Purposes and legal basis

• Pilot applications and clinic contact (name, email, phone, clinic, role, specialties and needs): pre-contractual steps, legitimate interest and consent (Art. 6.1.a, 6.1.b and 6.1.f GDPR).
• Platform access and service communications (login credentials, technical activity logs and support): performance of the service or pilot agreement (Art. 6.1.b GDPR).
• Enquiries and support (information shared in messages or forms): consent and legitimate interest in replying (Art. 6.1.a and 6.1.f GDPR).

4. Health data and clinical oversight

• Health data belongs to each clinic's clinical care. Seiva provides secure infrastructure with strict separation of each clinic's data.
• Seiva's AI tools only help organise information, prepare pre-consultation briefs and draft care plans. They do not diagnose or make automated decisions with legal or health effects (Art. 22 GDPR). Clinicians review and approve every assessment and plan before anything reaches the patient.

5. Data location and transfers

All personal and health data managed by Seiva Health is stored and processed in the European Union, with GDPR-compliant providers. Health data is not transferred outside the European Economic Area.

6. Retention

• Information and pilot requests: for as long as the contact or pilot is managed, then for the applicable legal periods.
• Patient clinical data: according to the responsible clinic's instructions and the periods set by Spanish healthcare law (Law 41/2002 on patient autonomy).

7. Recipients

Seiva does not sell or share personal data with third parties for commercial purposes. Only the following can access data:

• Technology providers strictly needed to deliver the service (EU hosting, authentication and database), bound as data processors.
• Public administrations and courts where a legal obligation applies.

8. Your rights

You can exercise your rights of access, rectification, erasure, restriction, portability and objection by contacting Seiva Health and verifying your identity.

Patients whose data is processed through a clinic should contact that clinic first, as data controller; Seiva will help handle the request.

You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).