Spain — ANX-ES: Spain Annex
Document ID: ANX-ES · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]]
Language: Spanish controls (es/annex-es.md). This English text is a convenience translation.
Applies to: Clinics established in Spain, together with the MDPA and the EEA Transfer Module (TM-EEA). Terms defined in the MDPA have the same meaning here.
1. Legal framework
This Annex supplements the MDPA, which is the contract required by Article 28 of the GDPR, with the provisions of:
- Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"); and
- Law 41/2002 on Patient Autonomy ("Law 41/2002").
2. Use for own purposes (LOPDGDD, Art. 33.2)
If VstreamX were to use the Clinic Data for its own purposes, or in its own name, it would be considered controller of that processing. It would be liable as such, without prejudice to MDPA clause 17.2(c).
3. End of the service: return, blocking and destruction (LOPDGDD, Art. 33.3)
3.1 Return, then destruction. At the end of the service, VstreamX returns the Clinic Data to the Clinic through the complete export (MDPA clause 14), and then destroys it.
3.2 Retention the law requires. Where a legal provision requires the data to be kept, VstreamX does not destroy it before returning it to the Clinic. The Clinic is then responsible for keeping it.
3.3 Blocked data. VstreamX may keep, duly blocked, the data needed to answer for liabilities that could arise from its relationship with the Clinic, for as long as those liabilities may be claimed. Blocked data is:
- not processed for any other purpose; and
- made available only to the courts, the Public Prosecutor's Office or the competent public administrations, in particular the data protection authorities.
The audit trail kept under MDPA clause 14.5(c) is kept on these terms.
4. Blocking (LOPDGDD, Art. 32)
4.1 The Clinic's duty. When the Clinic rectifies or erases a patient's data, it must block it where Article 32 of the LOPDGDD requires.
4.2 DentalX's "blocked" state. DentalX provides a "blocked" state for a patient's record, which the Clinic may use instead of erasure. A blocked record:
- is hidden from all Users;
- cannot be modified; and
- is made available only to answer a request from a judge, the Public Prosecutor or a competent administration, at the Clinic owner's express action.
[[TO CONFIRM: release date of the "blocked" record state for Spanish Clinics]]
5. Clinical records (Law 41/2002)
5.1 Retention. The Clinic keeps the clinical record of each care process for at least 5 years from the date of discharge (Law 41/2002, Art. 17), or longer where the law of its Autonomous Community requires.
5.2 Retention settings. DentalX lets the Clinic select its Autonomous Community, and sets the retention default for it. It does not auto-delete clinical records.
5.3 Patients' access. The Clinic guarantees the patient's access to the clinical record under Article 18 of Law 41/2002. VstreamX assists it as MDPA clause 8 provides.
6. Data Protection Officer
6.1 When the Clinic needs one. Under Article 34.1(l) of the LOPDGDD, health centres that are legally obliged to keep their patients' clinical records must appoint a Data Protection Officer. Health professionals who practise individually are excepted.
6.2 DentalX's prompt. Where the Clinic declares at signup that more than one professional practises in it, DentalX reminds it:
- to appoint a DPO;
- to notify the appointment to the Spanish Data Protection Agency within 10 days (Art. 34.3); and
- to record the DPO in the Service.
7. Prescriptions
7.1 Paper and PDF only. DentalX produces prescriptions as printed or PDF documents. It does not connect to the electronic prescription systems of the National Health System or of the Autonomous Communities.
7.2 The Clinic's responsibility. The Clinic is responsible for ensuring that each prescription it issues meets Royal Decree 1718/2010 on medical prescriptions and dispensing orders. [[TO CONFIRM: that DentalX's prescription format meets RD 1718/2010 for private prescriptions before it is promoted to Spanish Clinics]]
8. Security breaches
VstreamX's notice within 24 hours (MDPA clause 9) allows the Clinic to notify the Spanish Data Protection Agency within 72 hours (GDPR, Art. 33).
9. Language
The Spanish version of this Annex is the authentic text. The MDPA in Spanish is also the authentic text for Spanish Clinics (MDPA clause 22).
Items to confirm before publication (Spain)
- Publication date.
- Release date of the "blocked" record state (§4.2).
- That the prescription format meets RD 1718/2010 for private prescriptions (§7.2).