Privacy policy

Controller

Juan Manuel Morales Tamajón.

What for

Replying to your messages, arranging appointments, doing the sessions and taking payment.

Health data

Only what I need for the session, and with your explicit consent.

Legal basis

Your request and the service you ask me for. Your consent, for health data and Google Analytics. My tax obligations. My legitimate interest in a website that works and is secure.

Who else receives it

I do not sell your data. The technical services I use receive it, some under their own terms. So do the banks if you pay by transfer or Bizum, the translator if you ask for one, and the authorities where a law requires it.

Your rights

Access, rectification, erasure, objection, restriction and portability; withdrawing your consent; and a complaint to the Spanish Data Protection Agency.

The controller is me, Juan Manuel Morales Tamajón. For any question about your data you can write to me or call me:

Clinic

C/ Ilusión 17, Fuente Nueva, San Pedro de Alcántara (Marbella)

Phone and WhatsApp

+34 672 29 91 22

Email

contact@juanmorales.es

I have not appointed a data protection officer: it is not required for a professional who works on their own.

You can message me on WhatsApp or by email, call me or use the form on this website. I receive your name, your phone number or email address and what you write. For a home visit, I also receive the address of the session.

I use this data to reply to you and arrange the appointment. The legal basis is your own request and, when you book, the service you ask me for (Article 6(1)(b) GDPR).

On the form, your name and phone number are required: without them I cannot reply. The message is optional.

Before the appointment I do not need details about your health: it is enough to know what kind of visit you need and where. In an emergency I may ask, by phone and if you agree, only what I need to know whether I can help.

Please do not send me medical reports, diagnoses or test results by WhatsApp, email or the form. If they are needed, we look at them in the session.

If you still tell me something about your health in a message, I do not forward it or use it: I delete that part as soon as I read it and keep only what is needed for the appointment. We talk about it in the session, after I ask for your written consent.

In the session I take your case history, a first conversation about your health. This is health data, a special category of personal data (Article 9 GDPR). If you tell me about your health in personal training or kickboxing, for example an injury, I treat it the same way.

I process it only with your explicit consent (Article 9(2)(a) GDPR) and only for your sessions. I ask for this consent in writing at the start of the first session. You can withdraw it at any time; this does not affect processing carried out before. If you do not give me this data, I may not be able to do the session.

I do not work with minors unless a parent is present. If the minor is under 14, their data and the consent for health data are given by their mother, father or legal guardian (Article 7 of Spanish Organic Law 3/2018). From the age of 14, young people can consent to the use of their data themselves.

If a relative arranges visits for someone else, for example their mother or father, they give me that person’s name, address and the details needed for the appointment. I ask them to have that person’s permission. At the first visit, I explain to that person what this page says.

If that person cannot give consent for their health data, I ask their legal representative. I discuss their health with a relative only if they, or their legal representative, authorise it.

You can pay by bank transfer, Bizum or in cash. I keep the details of each payment (name, amount, date and payment method) to meet my tax and accounting obligations (Article 6(1)(c) GDPR).

Cloudflare hosts and serves the pages of this website. To do so, and to protect it from abuse, it processes your IP address and other technical connection data. It also counts visits, without cookies and only as overall figures.

The basis is my legitimate interest: a website that works and is secure, and knowing how many visits it gets (Article 6(1)(f) GDPR). You can object by writing to me.

I use Google Analytics only if you accept analytics cookies (Article 6(1)(a) GDPR). All of this is explained in the cookie policy, where you can also change your choice.

I do not use your data to send you advertising, I do not build profiles and I make no automated decisions about you.

I do not sell your data. I use these services for my work:

• Cloudflare, Inc.: hosts the website, sends the form messages, forwards email to contact@juanmorales.es, protects the form (Turnstile) and counts visits. Cloudflare also uses the technical data from Turnstile, as a controller in its own right, to improve its bot detection.
• Google: the Gmail inbox where I receive form messages and email, which Google Ireland Limited provides under its own terms; and Google Analytics, only if you accept it.
• SMTP2GO: the service I use to send email from contact@juanmorales.es.
• WhatsApp Ireland Limited: if you message me on WhatsApp. WhatsApp processes data under its own privacy policy.
• The banks involved if you pay by bank transfer or Bizum.
• The translator, if you ask for one in advance for a session in Russian or Ukrainian: she is present at the session.
• A technician who maintains the website and email on my behalf: he can see technical data about messages, such as email addresses. He cannot see my inbox.
• The authorities, for example the Spanish Tax Agency or a court, only where a law requires it.

Cloudflare, Google and WhatsApp may process data in the United States. On the date of this page, their US companies are on the EU-U.S. Data Privacy Framework List: Cloudflare, Inc., Google LLC and WhatsApp LLC.

The European Commission recognises this framework as adequate protection (Implementing Decision (EU) 2023/1795). If they stop being listed, the European Commission’s standard contractual clauses would apply.

SMTP2GO (Sand Dune Mail Ltd) is a New Zealand company. The European Commission recognises New Zealand as providing adequate protection (Decision 2013/65/EU). SMTP2GO keeps technical data about each email, such as sender, recipient and date, for about 35 days.

You can ask me for more information about these safeguards at contact@juanmorales.es.

• Messages that do not lead to an appointment: up to one year after the last message. Health data that arrives in a message is deleted as soon as I read it.
• Client details and session notes: while you keep coming to sessions and, after that, five years from the last one. This is the general period in which liability claims can be made (Article 1964(2) of the Spanish Civil Code).
• Payment records: as long as tax and accounting rules require, generally four to six years.
• Google Analytics: 2 months. Your cookie choice is kept for 12 months in your browser.

After that I delete the data, or block it for as long as a law requires it to be kept (Article 32 of Spanish Organic Law 3/2018).

You can ask me for access to your data, or to rectify or erase it. You can also ask me to restrict its use or to give it to you in a portable format, and you can object to its processing. You can also withdraw your consent at any time, without affecting what was done before.

In particular, you can object at any time to processing based on my legitimate interest, that is, website security and visit counts.

Write to me at contact@juanmorales.es or ask me at the clinic. I reply within one month at most. For a complex request I may need two more months; if so, I will tell you within the first month.

If you think I have not handled your data properly, you can complain to the Spanish Data Protection Agency, also online. You do not need to write to me first.

The website uses an encrypted connection (HTTPS) and the form is protected against automated submissions.

If I change the way I process your data, I will update this page and its date.