Privacy Policy
At MEDFLOW, S.L.U. (hereinafter OncoViva), our heart focuses on privacy. For us, the protection of your personal data is more than a legal obligation; it is a commitment of trust. This Policy describes, clearly and transparently, how we collect and process your information in compliance with the General Data Protection Regulation (GDPR) and the Organic Law 3/2018 (LOPDGDD).
I. Basic Information on Processing (Summary)
Below, the essential information about the processing of personal data is summarized, so that you have a quick and clear view of our commitment:
| Data Controller | MEDFLOW, S.L.U. (CIF: B22850085, Address: Calle de los sueños 82, S/C de Tenerife 38006). |
|---|---|
| Main Purpose | To manage requests for information and queries received through forms and, with their explicit consent, send commercial communications exclusively to professional users. |
| Legal Basis | Consent of the data subject (Art. 6.1.a GDPR) when submitting the form. |
| Recipients | Data will not be transferred to third parties, except legal obligation, judicial requirement, or necessary communication to data processors for the provision of services. |
| Rights (ARSLOP) | Access, Rectification, Erasure, Objection, Restriction of processing and Portability. |
| Complaint | Spanish Data Protection Agency (AEPD). |
In the context of technology application, OncoViva is committed to following the principles established in the European Union's Artificial Intelligence Act (AI Act), which you can consult here: AI Regulation.
II. Types of Personal Data Processed
The data that OncoViva collects and processes within the framework of our services or through contact forms are those strictly necessary to offer you the best care and are included in the following categories:
- Identifying data: Name and Surname, Email address.
- Contact data: Phone number.
- Sociodemographic data: Location (e.g., City or Country), other sociodemographic data that you voluntarily provide in your query.
- Navigation and usage data: Technical information about your interaction with our website, collected through cookies (see Cookies Policy).
III. Data Protection Officer (DPO) Details
We have a Data Protection Officer (DPO) to oversee compliance with data protection regulations. They are your contact point to ensure transparency and rigor in all our processes.
| Identity | OncoViva Data Protection Officer |
|---|---|
| Contact for DPO Queries | For any query related to data protection that is not the direct exercise of your rights, you can contact:dpd@enslegal.com |
IV. Purpose, Conservation, and Collection Methods
4.1. Detailed Processing Purposes and Legal Basis
Personal information is processed for the sole purpose of responding to your interest in us, always with the appropriate legal basis:
- Query Management: Responding to questions and information requested by the user through forms. Legal basis: Consent of the interested party (Art. 6.1.a GDPR).
- Commercial Communications to professional users: Sending professional users information about OncoViva products or services, only if the professional user has given us their explicit consent. Legal basis: Explicit consent of the professional user (Art. 6.1.a GDPR). Commercial communications will not be sent to patient users.
4.2. Collection Methods and Conservation
Data is collected through the third-party service Google Forms (Google Ireland Limited, with the necessary processing guarantees). We keep your registered consents for legal traceability. Your data will be kept for the time strictly necessary to fulfill the purpose for which they were collected (e.g. until your query is resolved). Subsequently, they will be kept blocked during the legally established periods to attend to possible liabilities.
V. Exercise of ARSLOP Rights
We want you to know that your data belongs to you. Therefore, you have the full right to exercise your ARSLOP rights (Access, Rectification, Deletion, Opposition, Limitation, and Portability) over your personal data. If you want to confirm whether we at OncoViva are processing your data, you can request it:
| Right | Application Example |
|---|---|
| Access | Request a copy of the personal information that OncoViva has about you, such as your name and contact email. |
| Rectification | Inform that your email address has changed and request the correction of your data in our records. |
| Erasure (Right to be Forgotten) | Request the deletion of your personal data if they are no longer necessary for the purpose for which they were collected. |
| Objection | Professional users may object to receiving further commercial communications (marketing) by email. |
| Restriction | Request that your data remain stored but not used for future processing, for example, while its accuracy is being verified. |
| Portability | Request that your data be delivered to you in a structured and readable format (e.g., a CSV file) to be able to transfer them to another service provider. |
To exercise these rights, you must direct a communication, attaching an identifying document, to:
- By Email: dpd@enslegal.com
- By Postal Mail: Calle de los sueños 82, S/C de Tenerife 38006.
VI. Interconnection with other Documents and Platforms
In the digital world, we interconnect with other external documents and platforms that also have their own rules. We recommend you consult them:
- Legal Notice: Aviso Legal to know the complete identification of the website owner and the terms of use.
- Cookies Policy: Information about cookies used on our website, their purpose, and how to manage them can be found in the Política de Cookies.
- Social Networks: You can check the privacy policies of each network here:
VII. International Data Transfers
OncoViva focuses on keeping your data within the European Economic Area (EEA). Therefore, we do not directly transfer your personal data to external countries. However, we inform you that for the provision of certain essential services (such as the use of Google Forms mentioned in point 4.2), third-party data processors (technology providers) may carry out international transfers. In these cases, these third parties guarantee that the transfers comply with their respective legislation and that data adequacy is ensured through the application of the guarantees required by the GDPR.terceros encargados del tratamiento (proveedores tecnológicos) puedan realizar transferencias internacionales. En estos casos, estos terceros garantizan que las transferencias cumplen con su respectiva legislación y que la adecuación de los datos está asegurada mediante la aplicación de las garantías requeridas por el RGPD.
VIII. Security Measures
Protecting your data is a technical and human priority at OncoViva. We are committed to applying the most robust security measures to guarantee the confidentiality, integrity, and availability of your personal information. Among the measures adopted, we highlight our commitment to:
- SSL Encryption: Our website uses an SSL (Secure Sockets Layer) certificate to encrypt communications, thus protecting all information transmitted between your browser and our servers.
- Anonymization and Pseudonymization: When possible and appropriate for processing purposes, we apply anonymization or pseudonymization techniques to minimize risk and protect the identity of the data subject.
- Backups: We perform rigorous and periodic backups of the information hosted on the website to ensure data recovery in case of an incident or disaster.
Reviewed as of 11/08/2026
Finally, if you feel that we have not complied with the protection you deserve, you can file a complaint with the Spanish Data Protection Agency (AEPD).