Home · Privacy policy
Privacy policy
Your health data is among the most sensitive data there is. Here you can find out what data I process, for what purpose and what rights you have. This is based on the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (Ley Orgánica 3/2018, LOPDGDD).
1. Controller
Cemile Ballnus, FemBalear
Calle Reis Catolics 17, 07007 Palma, Illes Balears, Spain
NIE: Y5984415-N
Phone: +34 676 168 071 · Email: mail@fembalear.com
As a doctor working on my own, I am not required to appoint a data protection officer (Art. 34 LOPDGDD). If you have any questions about data protection, please contact me directly.
2. Visiting the website
When you visit this website, the server automatically stores technical data: IP address, date and time, page visited, browser and operating system. This is necessary to deliver the website securely and reliably (Art. 6(1)(f) GDPR). In the website's access logs, IP addresses are only stored in shortened form. For security reasons, the hosting provider stores full IP addresses for a maximum of seven days, and longer only if an attack needs to be investigated.
Hosting: ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany. A data processing agreement (Art. 28 GDPR) is in place with All-Inkl. More information at all-inkl.com/datenschutzinformationen.
Fonts and the video are stored directly on this website. No data is sent to Google or other services when you visit it.
3. Cookies and browser storage
This website itself does not set any cookies and does not use any analytics or advertising services. Only if you select "Always open the calendar directly from now on" is this choice saved in your browser's storage (Art. 22(2) LSSI-CE). You can delete it at any time by clearing the site data in your browser.
4. Online booking and video consultations with DriCloud
For appointments, video consultations and patient records, I use the medical software DriCloud. The provider is Massive Bionics LLC, 6555 Sanger Rd, 101, Orlando, FL 32827, USA. According to DriCloud, all data is stored and processed on Microsoft Azure servers within Europe and remains there. No data is transferred to the USA. A data processing agreement (Art. 28 GDPR) is in place with DriCloud.
The calendar is only loaded when you click "Open calendar". Your IP address and technical data are then sent to DriCloud. DriCloud sets cookies: technically necessary cookies for security and server load balancing, as well as cookies from Microsoft Azure Application Insights for usage and error statistics. To protect against automated requests, DriCloud uses the Cloudflare Turnstile service. By clicking, you consent to the calendar being loaded (Art. 6(1)(a) GDPR, Art. 22(2) LSSI-CE). You can also arrange an appointment by phone or email instead.
When you book an appointment, I process your details in order to arrange the appointment and carry out the consultation (Art. 6(1)(b) GDPR). I process any health data you give me for your medical care (Art. 9(2)(h) GDPR).
5. Treatment and patient records
I keep a patient record (historia clínica) for your treatment. It contains your details, results, diagnoses, treatments and prescriptions. This is based on your treatment contract and the Spanish law on patient autonomy (Art. 6(1)(b) and (c), Art. 9(2)(h) GDPR, Ley 41/2002). I keep the record for at least five years after the end of each course of treatment (Art. 17 Ley 41/2002), or longer if required by law. Everything you tell me is subject to medical confidentiality.
Consultation for girls: from the age of 15, you can attend the consultation on your own. For younger girls, a parent joins the conversation. Where consent is required, young people aged 14 and over can give it themselves (Art. 7 LOPDGDD).
6. Contact by phone and email
If you call or write to me, I process your details in order to respond to your enquiry (Art. 6(1)(b) GDPR, and for health questions Art. 9(2)(h) GDPR). Please do not send sensitive results by unencrypted email; bring them to the consultation instead. Enquiries that do not lead to treatment are deleted once they have been dealt with.
The mailbox is also hosted by All-Inkl (see section 2) on servers in Germany.
7. Payment with Stripe
You pay online via Stripe. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your payment data in order to process the payment and prevent fraud (Art. 6(1)(b) and (c) GDPR). Stripe is the controller for this processing. More information at stripe.com/privacy. I keep invoices for as long as required by tax and commercial law (up to six years).
8. Who receives your data
Your data is only shared with the service providers named above, to the extent necessary for their tasks, and with Gestoría Brunet in Palma for accounting and tax purposes. I only pass on medical documents to others, such as a laboratory or another doctor, with your consent or where required by law. Your data is not sold and not used for advertising. There is no automated decision-making.
9. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw your consent at any time with effect for the future. Simply write to me at mail@fembalear.com. I may not delete data from your patient record before the statutory retention period has expired.
You also have the right to lodge a complaint with the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
10. Security
This website is transmitted in encrypted form (HTTPS). I protect your data against loss and unauthorised access with technical and organisational measures.
Last updated: October 2026