Privacy Policy
Last updated: 25 September 2026
This page explains who processes your data, why, on what legal basis and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). In short:
- This website uses no advertising or tracking cookies. Anonymous visit statistics and the Google map are only enabled if you accept them in the cookie notice.
- The contact form does not store your data: it prepares a WhatsApp message that you decide whether to send.
- The virtual assistant is powered by artificial intelligence: please don't share health data with it.
1Data controller
| Controller | Yurena Melo Betancort |
| Tax ID (NIF) | 78541745B |
| Trading name | Clínica Dental Ymelbet |
| Registered (tax) address | Avda. Las Palmeras, 9, Urb. El Palmeral, Vda. 2018 · 35508 Costa Teguise, Las Palmas, Spain |
| Clinic address | C/ La Férmina 2B, Local 8 · 35500 Arrecife, Las Palmas (Lanzarote), Spain |
| ymelbet@gmail.com | |
| Phone | +34 928 816 290 · WhatsApp +34 648 846 813 |
As a healthcare professional practising individually, the controller is not required to appoint a data protection officer (Art. 34.1.l LOPDGDD). For any privacy question, please write to the email address above.
2What data we process
- Enquiries: your name, phone number, the service you are interested in and the content of your message when you contact us through the form, WhatsApp, phone or email. If you tell us anything about your health, we process that information too.
- Patients: identification and contact details, health data recorded in your clinical history, and billing data.
- Virtual assistant: the text of the messages you type in the chat.
- Browsing: technical connection data (such as your IP address or browser type) logged by our hosting provider for security, and, only if you accept them in the cookie notice, anonymous visit and loading-speed statistics: page viewed, referring website, country or region, device type, operating system and browser (see our Cookie Policy).
3How the contact form works
The form does not send or store anything on our server. When you click “Send via WhatsApp”, your WhatsApp app opens with the message already written, and you decide whether to send it. From then on, the conversation is also subject to WhatsApp's terms and privacy policy.
4Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your enquiries (form, WhatsApp, phone or email) | Your consent (Art. 6.1.a GDPR). If you include health data, your explicit consent (Art. 9.2.a GDPR). |
| Managing your appointments | Steps taken at your request before entering into a contract, or performance of the service contract (Art. 6.1.b GDPR). |
| Providing dental care and keeping your clinical history | Performance of the contract (Art. 6.1.b GDPR), legal obligation (Art. 6.1.c GDPR and Spanish Law 41/2002) and provision of healthcare (Art. 9.2.h GDPR). |
| Billing, tax and accounting obligations | Legal obligation (Art. 6.1.c GDPR). |
| Answering your questions in the virtual assistant | Your consent, given when you type and send your question (Art. 6.1.a GDPR). |
| Showing you the Google Maps map | Your consent, given when you accept “Maps” in the cookie notice or click “Load map” (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). |
| Understanding, in aggregate and anonymously, how many people visit the website, how they use it and how fast it loads | Your consent, given when you accept “Statistics” in the cookie notice (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). No cookies or profiles. |
| Remembering your cookie preferences and being able to show that we respect them | Compliance with a legal obligation (Arts. 6.1.c and 7.1 GDPR, and Art. 22.2 LSSI-CE). |
| Keeping the website secure and running, including limiting the number of messages sent to the assistant to prevent abuse | Legitimate interest in protecting the site and its users (Art. 6.1.f GDPR). |
Giving us your data is voluntary, but without it we cannot answer your enquiry or book an appointment. Clinical history and billing data are required by law in order to treat you.
We do not make automated decisions with legal effects on you, nor do we profile you. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before; for cookies, use the “Cookie settings” link at the bottom of every page.
5How long we keep your data
- Enquiries that do not lead to an appointment: for as long as needed to answer them and, at most, 3 years from the last contact, unless you ask us to delete them sooner.
- Clinical history: at least 5 years from the discharge of each care process (Art. 17 of Spanish Law 41/2002), or any longer period required by law.
- Billing: for the periods set by tax and accounting rules (generally between 4 and 6 years).
- Virtual assistant: we do not store conversations; they disappear when you close or reload the page.
- Visit statistics: stored only in aggregate; the technical identifier of each visit is discarded after 24 hours.
- Cookie preferences: 12 months in your own browser; after that we ask you again.
- Technical logs: for as long as our hosting provider keeps them for security purposes. The IP address we use to limit abuse of the assistant is only held in memory for one minute and is never stored.
6Who we share your data with
We do not sell or share your data. We only disclose it to public authorities, courts and health or tax authorities when required by law, and to the professionals and dental laboratories involved in your treatment when this is necessary to provide it.
To run the website we rely on the following providers, who process data on our behalf with the safeguards required by the GDPR:
| Provider | Service | Location and safeguards |
|---|---|---|
| Vercel Inc. | Hosting of the website and the virtual assistant and, if you accept them, anonymous visit and speed statistics (Web Analytics and Speed Insights) | USA · EU–US Data Privacy Framework |
| OpenRouter, Inc. | Forwards assistant messages to the AI model (Anthropic, PBC) and returns the reply | USA · European Commission Standard Contractual Clauses |
If you use the following third-party services, they process your data as independent controllers under their own policies:
- WhatsApp Ireland Limited, when you message us on WhatsApp (privacy policy).
- Google (Google Ireland Limited and Google LLC), only if you load the map (privacy policy).
7International transfers
Some of the providers above are based in the United States. These transfers rely on the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).
8The virtual assistant
The assistant is powered by artificial intelligence. When you type, your message and the rest of that conversation go through our server, which sends them to OpenRouter so that Anthropic's model can generate a reply. Your IP address is not shared with these providers.
We do not link conversations to your identity or store them. Even so, please do not include personal or health data in the chat: for that, message us on WhatsApp or call us. Replies are automatic and for guidance only, may contain mistakes and do not replace an assessment by a professional.
9Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given us.
To do so, email us at ymelbet@gmail.com or hand in a written request at the clinic, stating which right you wish to exercise and enclosing proof of identity. We will reply within one month, which may be extended by two further months for complex requests.
As a patient, you may also access your clinical history under Article 18 of Spanish Law 41/2002.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
10Minors
If you are under 14, we need the consent of your parent or guardian to process your data (Art. 7 LOPDGDD). The data of underage patients is managed with their legal representatives.
11Security
We apply technical and organisational measures appropriate to the risk: the website always runs over an encrypted connection (HTTPS), does not store personal data on its server, protects the form and the assistant against spam and abuse, and access to clinical information is restricted to authorised staff bound by professional secrecy.
12Changes to this policy
We may update this policy to reflect legal changes or changes to our services. The date of the last update is always shown at the top of the page.