Scope
This policy concerns browsing arritmiashrc.es. The site has no user accounts, newsletters, payment forms or patient-data forms. It does not request diagnoses, health records or medical documents. Healthcare, university enrolment and services reached through external links have their own data-protection information.
Technical access and security
Delivering the website requires a connection between your device and the hosting service, involving an IP address and technical request information such as time, requested resource and browser. Technical records are used to deliver the service and investigate security incidents, not to create advertising profiles. Necessary security measures are covered by the controller’s data-security obligations under Articles 6(1)(c) and 32 GDPR.
Routine security records are limited to 30 days. Records needed for an actual incident or a legal requirement may be retained while the investigation or obligation remains in force, with restricted access. Hosting and technical-maintenance providers may process data on the controller’s behalf.
Optional audience measurement
Google Analytics 4 is used only when you consent. It measures visits, pages viewed, approximate location and browser/device information using pseudonymous identifiers. These data are not described as anonymous. The site does not send medical forms, user IDs or URL query strings to Analytics. Google Signals and advertising personalisation are disabled in the website integration.
The legal basis is your consent under Article 6(1)(a) GDPR. Analytics cookies have a maximum configured life of 180 days without automatic renewal on every page view. Individual user/event data are retained for a maximum of 2 months. Aggregated statistics are distinct from individual event records. You can withdraw consent without affecting the lawfulness of earlier processing.
YouTube videos
Video previews are hosted locally. A YouTube player connects to Google only after you authorise that category. The privacy-enhanced youtube-nocookie.com player is used, but this does not mean that no personal data or storage technologies are involved. Google receives connection/device information and can process playback activity under its policies. Authorising videos does not authorise Analytics. Videos hosted directly on this website do not require YouTube.
Providers and international transfers
Google services in the EEA are provided by Google Ireland Limited; Google group companies and service infrastructure may also operate outside the EEA, including in the United States. Google describes its reliance on applicable adequacy frameworks and standard contractual clauses in its published safeguards. See the Google privacy policy and Google’s international transfer safeguards. External websites such as maps and social networks are not embedded merely by opening this website.
Your choices and rights
You can accept, reject or change optional services at any time using “Cookie preferences” in the footer or the controls in the Cookie policy. Your selection is remembered for 180 days. Access to the site does not depend on accepting Analytics or YouTube.
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, portability and objection. Where processing relies on consent, you may withdraw it. Requests should normally receive a response within one month; complex or numerous requests can justify an extension, which must be explained within that first month. Additional identity information is requested only when reasonably necessary.
You may lodge a complaint with the Spanish Data Protection Agency (AEPD). There are no automated decisions producing legal or similarly significant effects in this website’s own processing.