Privacy Statement

Privacy & Data Sovereignty Statement

Last Updated: April 2026

1. Overview

We take your privacy with clinical seriousness. This statement explains how OHNS Service SL and its affiliated entities (“the Practice”) collect, use, and protect personal data within an international clinical framework.

The Practice operates across multiple jurisdictions. Depending on the context of care and interaction, different entities may act as independent Data Controllers or, where required, Joint Controllers.

These may include:

  • OHNS Service SL (Andorra) – clinical governance, coordination, and digital infrastructure
  • Independent affiliated healthcare providers and institutions (Spain) – responsible for the delivery of medical treatment
  • ANDSURGEONS LIMITED (Isle of Man) – patient acquisition, marketing, and supervisory functions

Each entity processes personal data strictly within its own legal, regulatory, and professional obligations.

2. Applicable Data Protection Framework

We process personal data in accordance with applicable data protection laws, including:

  • Andorran Qualified Personal Data Protection Law (LQPD 29/2021)
  • EU General Data Protection Regulation (GDPR), where applicable
  • UK GDPR, where applicable

Where multiple jurisdictions apply, we ensure an equivalent level of protection across all processing activities.

3. Categories of Personal Data

We may process the following categories of personal data:

  • Identification data (name, contact details)
  • Health and medical information (including images and reports)
  • Communication data (messages, correspondence)
  • Administrative and logistical data (appointments, preferences)
  • Technical data (IP address, device/browser information where applicable)

Health data is treated as special category data and handled with enhanced protection.

4. Communication Architecture & Data Security

We prioritise confidentiality through a structured, security-first communication model using privacy-focused technologies.

Secure Clinical Communication

  • Threema Work
    Used for clinical messaging, including images and follow-up discussions.
    Swiss-based, end-to-end encrypted, and does not require a phone number.
  • Proton Mail
    Used for formal medical communication, reports, and documentation.
    Hosted in Switzerland with zero-access encryption.

Administrative Communication

  • WhatsApp
    Used exclusively for administrative purposes such as scheduling or logistics.
    Patients are advised not to share clinical data via this platform. Use implies acceptance of WhatsApp’s metadata processing.

Third-Party Platforms

We may receive, transmit, or facilitate personal data through third-party patient acquisition, referral, and communication platforms that connect patients with healthcare providers.

These platforms operate as independent data controllers in respect of the data they collect and process directly. The Practice does not control the operation of such platforms and is not responsible for their independent data handling practices.

Where personal data is shared with the Practice via such platforms, it is processed in accordance with this Privacy Statement and applicable data protection laws.

Patients are encouraged to review the privacy policies of any third-party platform through which they initiate contact.

5. International Data Transfers

Due to the Practice’s international structure, personal data may be processed and transferred between:

  • Andorra
  • Spain (European Economic Area)
  • United Kingdom / Isle of Man
  • Switzerland

Where transfers occur outside the EEA or jurisdictions with equivalent protection, appropriate safeguards are implemented, including:

  • adequacy decisions
  • standard contractual clauses
  • or equivalent legal mechanisms

6. Legal Basis for Processing

We process personal data on the following legal grounds:

  • provision of medical care and treatment
  • patient consent (including use of secure communication channels)
  • compliance with legal and regulatory obligations
  • legitimate interests in managing clinical services and operations

Where required, explicit consent is obtained for processing health data.

7. Data Handling & Retention

We follow a minimal exposure and controlled-access principle:

  • Clinical data is received through secure, encrypted channels
  • Data is transferred to internal patient management systems
  • Temporary storage points (such as messaging devices) are cleared where appropriate

Personal data is retained only for as long as necessary to fulfil medical, legal, and regulatory obligations.

8. International Patients (Including United States)

While our infrastructure meets or exceeds technical standards comparable to HIPAA, the Practice:

  • operates primarily under European and Andorran legal frameworks
  • is not a “Covered Entity” as defined under US HIPAA legislation

In certain cases, particularly where required by specific service providers or platforms, the Practice may enter into Business Associate Agreements (BAAs) or similar contractual arrangements to ensure appropriate data protection standards.

These arrangements do not alter the primary legal framework governing the Practice but serve to enhance data protection when interacting with US-based systems or partners.

By communicating with us, international patients acknowledge and consent to the use of secure cross-border communication systems under these frameworks.

9. Data Subject Rights

Subject to applicable law, you may have the right to:

  • access your personal data
  • request rectification or deletion
  • restrict or object to processing
  • request data portability
  • lodge a complaint with a competent supervisory authority

Requests may be submitted via our secure communication channels.

10. Cookies & External Links

We use cookies to enhance website functionality and user experience.
Our website may contain links to external services or affiliated providers; we are not responsible for their privacy practices.

11. Contact

For privacy-related inquiries or to exercise your rights, please contact us via:

  • Proton Mail: info@andsurgeons.com
  • Threema secure communication channel: https://threema.id/4C99BEE4