Privacy Policy

Last updated: 4 November 2026

This policy explains what this website does with your data. It is written to be understood, not to cover ourselves: where data is health data, we say so; where an external provider sees it, we name them; and where we process nothing at all, we say that too.

1. Data controller


Entity	PREMIUM ESPECIALISTAS SLP
Tax ID (NIF)	B72827785
Registered address	Calle Pizarro 2, 38019 El Rosario, Santa Cruz de Tenerife, Spain
Email	facturaspremiumespecialistas@gmail.com
Phone	+34 699 62 91 62
Website	doctoraveledo.com

Dr Ricardo Aveledo practises through this company. The company is legally responsible for the processing of your data.

2. What this site processes, and what it doesn’t

Worth separating from the start, because not everything that looks like a form sends data to a server:

There are two points at which this site processes data, and both require you to tick a consent box:

The contact forms (contact and international patients pages). See section 3.
The shoulder test. See section 4.

In addition, if you accept analytics cookies, use of the site is measured with Google Analytics. See section 7. If you do not accept them, browsing the site generates no processing at all. There is no profiling and no advertising.

3. The contact forms

When you submit one of the site’s forms we process your name, your email address, your country (on the international patients form only) and the message you write.

The message is treated as health data. Almost nobody writes to an orthopaedic surgeon about anything else: you will normally describe what hurts and since when. That field therefore receives the reinforced protection of Article 9 GDPR even though it is free text, and that is why the form asks for explicit consent.

What for: solely to reply to you and, where appropriate, arrange an appointment. You are not added to any mailing list.

Legal basis: your explicit consent, given by ticking the box on the form (Articles 6(1)(a) and 9(2)(a) GDPR). Without ticking it, the form does not submit.

What happens on submission: two emails go out. One to Dr Aveledo with your enquiry, and one to you confirming it arrived, with a copy of what you wrote. The server keeps no copy once they are sent.

This used to work differently. Until August 2026 these forms sent nothing: they opened your own email program with a draft and you sent it yourself. It was changed because on many phones, and for anyone using webmail, that simply did not work, and enquiries were lost without anyone knowing.

4. The shoulder test

At /en/shoulder-test/ there is a pre-consultation questionnaire. When you complete it, we process:

Identification and contact data: full name, age, city and country (optional), email address and phone number.
Health data: your answers about your shoulder (mobility, pain, strength, how long it has been going on, limitations in daily life, warning signs) and anything you choose to write in the free-text field.

Health data is a special category of data under Article 9 GDPR and is handled with the reinforced protection the regulation requires.

What for

So that Dr Aveledo can prepare your case before the first consultation. He receives a report with your answers organised.
To send you a copy of that report by email, so you can keep it and bring it to the consultation.
To contact you if your case needs attention without waiting.

We do not use this data for advertising, we do not add you to any mailing list, and we do not pass it to third parties for commercial purposes.

Legal basis

Your explicit consent, given by ticking the box on the last step of the test (Articles 6(1)(a) and 9(2)(a) GDPR). Without that box the form does not submit.

You can withdraw consent at any time by writing to the address in section 9. Withdrawal does not affect the lawfulness of processing carried out beforehand.

If you subsequently become a patient, the processing of your medical record is governed by the care relationship (Article 9(2)(h) GDPR and Spanish Law 41/2002), which is a different processing operation from the one described here.

How it works internally

This matters because it determines who sees your data:

The report is calculated in your browser. The score and the patterns are computed on your device, not on a server.
There is no database. This site does not store your answers. If you close the tab without sending, nothing remains anywhere.
On submission, your answers travel to a server function that composes two emails — yours and the doctor’s — and delivers them. Once sent, no copy is kept on the server.
The mobility dial on the homepage does not carry your answer into the test. You are asked again on purpose: passing it through the web address would put health data into your browser history and into server logs.

The result is not an automated decision

The test returns a score from 0 to 100 and up to two possible patterns. It is guidance, not a diagnosis, and it produces no legal effect and does not significantly affect you within the meaning of Article 22 GDPR: it does not determine whether we see you, the price, or the treatment. Any clinical decision is made by Dr Aveledo after examining you. You may request an explanation of how your result was calculated by writing to the address in section 9.

5. Who else sees your data

These providers process data on our behalf, under a data processing agreement in accordance with Article 28 GDPR:

Processor	Purpose	Where it is processed
Vercel Inc.	Hosting the site and running the function that sends the emails	Servers in the European Union (Paris)
Resend, Inc.	Delivery of the test and contact form emails	Servers in the European Union (Ireland)
Google Ireland Ltd.	The doctor’s mailbox is on Gmail, so your message or your report rests there like any other email	European Union
Google Ireland Ltd.	Measuring use of the site with Google Tag Manager and Google Analytics, only if you accept cookies. It receives no test answers or form data	European Union, with possible access from the United States

If automation tools or additional forms handling this data are activated in future, they will be added to this table before being put into service.

Your data may also be disclosed to healthcare facilities where your consultation or procedure takes place, where necessary to provide you with care, and to public authorities where a legal obligation requires it.

6. International transfers

Processing takes place on servers located in the European Union.

Vercel Inc. and Resend, Inc. are United States companies. Although data is processed and stored in the EU, their staff may access it from outside the European Economic Area for support and maintenance. Such access is covered by the Standard Contractual Clauses approved by the European Commission and, where applicable, by the EU-US Data Privacy Framework.

If you accept analytics cookies, measurement data may be transferred to Google LLC, in the United States, under the same safeguards.

7. Cookies

This site only sets cookies if you accept them. They are Google Analytics cookies, and the legal basis is your consent, which you can withdraw at any time from “Cookie preferences” at the foot of each page. If you do not accept, none is set and your browser makes no request to Google.

They measure pages visited, where you came from, device, approximate area, clicks on contact and appointment buttons, and progress through the test. Your test answers, your result and anything you type into a form are never sent to Google.

Your choice is kept in your device’s localStorage so the notice is not shown again. It is not sent anywhere and disappears if you clear your browsing data.

See the Cookie Policy for details.

8. How long we keep your data

This website: nothing. There is no database and the server keeps no copy of your message or your answers once the emails have been sent.
In the doctor’s mailbox: the report remains as correspondence for as long as it is useful for treating you, and is deleted when it no longer is, or when you ask us to.
If you become a patient: your medical record is kept for the periods required by Spanish healthcare legislation (Law 41/2002 and Canary Islands regional rules), being at least five years from the discharge of each episode of care.
Google Analytics measurement data: 14 months, and only if you accepted cookies.
Technical server logs (IP addresses, errors) are kept for the minimum time needed to diagnose problems and ensure security.

9. Your rights

You may exercise at any time your rights of:

Access — to know what data of yours we process.
Rectification — to correct anything inaccurate.
Erasure — to ask us to delete it.
Restriction — to ask us to keep it but not use it.
Objection — to object to the processing.
Portability — to receive your data in a reusable format.
Withdrawal of consent — at any time and without giving reasons.

How: write to facturaspremiumespecialistas@gmail.com stating which right you wish to exercise and attaching a copy of a document proving your identity. We will respond within one month at the latest.

Complaints: if you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid. If you reside in another EU member state, you may also complain to your national supervisory authority.

10. Security

The whole site is served encrypted over HTTPS and test submissions travel encrypted. Access keys for the email providers are stored as server environment variables and are never included in the code your browser downloads. Access to the mailbox where the reports rest is limited to Dr Aveledo.

No system is infallible. Should a security breach affect your data, we will inform you and notify the Spanish Data Protection Agency within the time limits set by Article 33 GDPR.

11. Minors

This site is not aimed at children under 14. If you are under that age, do not complete the test without your parent or legal guardian doing it with you.

12. Changes to this policy

When the site’s operation or the applicable legislation changes, we will update this policy and the date in the heading. If a change substantially affects how we handle health data, we will flag it visibly within the test itself.