Privacy Policy

Last updated: September 2026

This is an English translation of the Política de Privacidad, provided for your convenience. If there is any discrepancy between the two versions, the Spanish version prevails.

Data controller

  • Owner: Katy Caballero
  • Tax ID (NIF): 55527709M
  • Activity: Osteopathy and therapeutic massage
  • Address: Calle Río Guadarrama 2, Alpedrete, Madrid
  • Email: katycaballero.osteopata@gmail.com
  • Phone: 643 961 065

What data do we collect?

We only collect the data you voluntarily provide to us through:

  • Booking form: name, phone number, email (optional), the service, date and time you choose, the language you prefer us to write to you in and, if you add them, your notes.
  • Contact form: name, email and message, to answer your enquiry.
  • WhatsApp: the data you share when you contact us through this channel.
  • At the practice: the health data needed for your treatment and the informed consent you sign.

What do we use your data for?

  • To manage and confirm your appointments.
  • To remind you of your appointment the day before, by WhatsApp or, if you gave us your email, by email.
  • To answer your enquiries.
  • To provide the osteopathy or massage service you requested.
  • To occasionally send you follow-up messages as a patient by WhatsApp: asking how you are if it has been a while since your last session, asking for your opinion on Google or wishing you a happy birthday. You can ask us to stop at any time.
  • To comply with legal, tax and healthcare obligations.
  • If you accept it in the cookie notice, to measure statistically how the website is used.

Legal basis for processing

The processing of your data is based on:

  • Performance of a contract: to manage your appointment, remind you of it and provide the service you requested.
  • Consent: when you send us a contact or booking form, and for measurement cookies.
  • Legitimate interest: for follow-up messages to patients, which you can object to at any time.
  • Legal obligation: to comply with tax and healthcare obligations. Health data is processed to provide healthcare, under professional secrecy.

How long do we keep your data?

We keep your data for as long as it is necessary for the purpose for which it was collected. Patient data is kept for the period required by the applicable healthcare regulations.

Do we share your data?

We do not sell or pass on your data to third parties, except where required by law. To run the website we rely on these providers, which only process data on our behalf:

  • Hosting: the website and the appointment book are on a server run by Hetzner Online GmbH in Germany (European Union).
  • Email delivery: confirmations and reminders by email are sent through Resend, a service based in the United States.
  • Notifications to the osteopath: when you book, Katy receives a notification on her phone through Telegram with your name and the time of the appointment.
  • Measurement: Google Analytics (Google Ireland Limited), only if you accept measurement cookies. More information in the Cookie Policy.
  • WhatsApp: if we write to each other on WhatsApp, that service's own terms also apply.

Some of these providers may process data outside the European Economic Area. In those cases, the transfer relies on the safeguards provided for in the GDPR, such as the European Commission's standard contractual clauses.

Your rights

You can exercise the following rights by sending an email to katycaballero.osteopata@gmail.com:

  • Access: to know what data we hold about you.
  • Rectification: to correct inaccurate data.
  • Erasure: to request that your data be deleted.
  • Restriction: to restrict the processing of your data.
  • Portability: to receive your data in electronic format.
  • Objection: to object to the processing of your data.

You can also file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).

Security

We apply technical and organisational measures to protect your personal data against unauthorised access, loss or destruction.

Changes to this policy

We may update this privacy policy from time to time. The date of the last update appears at the top of this page.