Privacy Policy
Last updated: 24 August 2026
This policy explains what this website does with your data. It is written to be understood, not to cover ourselves: where data is health data, we say so; where an external provider sees it, we name them; and where we process nothing at all, we say that too.
1. Data controller
| Entity | PREMIUM ESPECIALISTAS SLP |
| Tax ID (NIF) | B72827785 |
| Registered address | Calle Pizarro 2, 38019 El Rosario, Santa Cruz de Tenerife, Spain |
| facturaspremiumespecialistas@gmail.com | |
| Phone | +34 699 62 91 62 |
| Website | doctoraveledo.com |
Dr Ricardo Aveledo practises through this company. The company is legally responsible for the processing of your data.
2. What this site processes, and what it doesn’t
Worth separating from the start, because not everything that looks like a form sends data to a server:
There are two points at which this site processes data, and both require you to tick a consent box:
- The contact forms (contact and international patients pages). See section 3.
- The shoulder test. See section 4.
Outside those two, browsing the site generates no processing at all: there is no analytics, no profiling and no tracking.
This site sets no cookies. See section 7.
3. The contact forms
When you submit one of the site’s forms we process your name, your email address, your country (on the international patients form only) and the message you write.
The message is treated as health data. Almost nobody writes to an orthopaedic surgeon about anything else: you will normally describe what hurts and since when. That field therefore receives the reinforced protection of Article 9 GDPR even though it is free text, and that is why the form asks for explicit consent.
What for: solely to reply to you and, where appropriate, arrange an appointment. You are not added to any mailing list.
Legal basis: your explicit consent, given by ticking the box on the form (Articles 6(1)(a) and 9(2)(a) GDPR). Without ticking it, the form does not submit.
What happens on submission: two emails go out. One to Dr Aveledo with your enquiry, and one to you confirming it arrived, with a copy of what you wrote. The server keeps no copy once they are sent.
This used to work differently. Until August 2026 these forms sent nothing: they opened your own email program with a draft and you sent it yourself. It was changed because on many phones, and for anyone using webmail, that simply did not work, and enquiries were lost without anyone knowing.
4. The shoulder test
At /en/shoulder-test/ there is a pre-consultation questionnaire. When you
complete it, we process:
- Identification and contact data: full name, age, city and country (optional), email address and phone number.
- Health data: your answers about your shoulder (mobility, pain, strength, how long it has been going on, limitations in daily life, warning signs) and anything you choose to write in the free-text field.
Health data is a special category of data under Article 9 GDPR and is handled with the reinforced protection the regulation requires.
What for
- So that Dr Aveledo can prepare your case before the first consultation. He receives a report with your answers organised.
- To send you a copy of that report by email, so you can keep it and bring it to the consultation.
- To contact you if your case needs attention without waiting.
We do not use this data for advertising, we do not add you to any mailing list, and we do not pass it to third parties for commercial purposes.
Legal basis
Your explicit consent, given by ticking the box on the last step of the test (Articles 6(1)(a) and 9(2)(a) GDPR). Without that box the form does not submit.
You can withdraw consent at any time by writing to the address in section 9. Withdrawal does not affect the lawfulness of processing carried out beforehand.
If you subsequently become a patient, the processing of your medical record is governed by the care relationship (Article 9(2)(h) GDPR and Spanish Law 41/2002), which is a different processing operation from the one described here.
How it works internally
This matters because it determines who sees your data:
- The report is calculated in your browser. The score and the patterns are computed on your device, not on a server.
- There is no database. This site does not store your answers. If you close the tab without sending, nothing remains anywhere.
- On submission, your answers travel to a server function that composes two emails — yours and the doctor’s — and delivers them. Once sent, no copy is kept on the server.
- The mobility dial on the homepage does not carry your answer into the test. You are asked again on purpose: passing it through the web address would put health data into your browser history and into server logs.
The result is not an automated decision
The test returns a score from 0 to 100 and up to two possible patterns. It is guidance, not a diagnosis, and it produces no legal effect and does not significantly affect you within the meaning of Article 22 GDPR: it does not determine whether we see you, the price, or the treatment. Any clinical decision is made by Dr Aveledo after examining you. You may request an explanation of how your result was calculated by writing to the address in section 9.
5. Who else sees your data
These providers process data on our behalf, under a data processing agreement in accordance with Article 28 GDPR:
| Processor | Purpose | Where it is processed |
|---|---|---|
| Vercel Inc. | Hosting the site and running the function that sends the emails | Servers in the European Union (Paris) |
| Resend, Inc. | Delivery of the test and contact form emails | Servers in the European Union (Ireland) |
| Google Ireland Ltd. | The doctor’s mailbox is on Gmail, so your message or your report rests there like any other email | European Union |
If automation tools or additional forms handling this data are activated in future, they will be added to this table before being put into service.
Your data may also be disclosed to healthcare facilities where your consultation or procedure takes place, where necessary to provide you with care, and to public authorities where a legal obligation requires it.
6. International transfers
Processing takes place on servers located in the European Union.
Vercel Inc. and Resend, Inc. are United States companies. Although data is processed and stored in the EU, their staff may access it from outside the European Economic Area for support and maintenance. Such access is covered by the Standard Contractual Clauses approved by the European Commission and, where applicable, by the EU-US Data Privacy Framework.
7. Cookies
This website sets no cookies. None of its own and none from third parties; no technical, analytics or advertising cookies. There are no analytics tools running, no pixels, and no social media buttons that track you.
The only thing stored in your browser is your cookie notice preference, kept in
your device’s localStorage so the notice is not shown to you again. That
preference is not sent anywhere, does not allow you to be identified, and
disappears if you clear your browsing data.
See the Cookie Policy for details.
8. How long we keep your data
- This website: nothing. There is no database and the server keeps no copy of your message or your answers once the emails have been sent.
- In the doctor’s mailbox: the report remains as correspondence for as long as it is useful for treating you, and is deleted when it no longer is, or when you ask us to.
- If you become a patient: your medical record is kept for the periods required by Spanish healthcare legislation (Law 41/2002 and Canary Islands regional rules), being at least five years from the discharge of each episode of care.
- Technical server logs (IP addresses, errors) are kept for the minimum time needed to diagnose problems and ensure security.
9. Your rights
You may exercise at any time your rights of:
- Access — to know what data of yours we process.
- Rectification — to correct anything inaccurate.
- Erasure — to ask us to delete it.
- Restriction — to ask us to keep it but not use it.
- Objection — to object to the processing.
- Portability — to receive your data in a reusable format.
- Withdrawal of consent — at any time and without giving reasons.
How: write to facturaspremiumespecialistas@gmail.com stating which right you wish to exercise and attaching a copy of a document proving your identity. We will respond within one month at the latest.
Complaints: if you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid. If you reside in another EU member state, you may also complain to your national supervisory authority.
10. Security
The whole site is served encrypted over HTTPS and test submissions travel encrypted. Access keys for the email providers are stored as server environment variables and are never included in the code your browser downloads. Access to the mailbox where the reports rest is limited to Dr Aveledo.
No system is infallible. Should a security breach affect your data, we will inform you and notify the Spanish Data Protection Agency within the time limits set by Article 33 GDPR.
11. Minors
This site is not aimed at children under 14. If you are under that age, do not complete the test without your parent or legal guardian doing it with you.
12. Changes to this policy
When the site’s operation or the applicable legislation changes, we will update this policy and the date in the heading. If a change substantially affects how we handle health data, we will flag it visibly within the test itself.