Privacy Policy

This page explains what personal data is processed on the website ronquidoyapneas.com, what for, under which legal basis, how long it is kept, who else sees it and what you can ask for at any time. It is written in compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPD-GDD).

The website has been designed under the principle of "privacy by design": whenever technically possible, sensitive data is calculated on your own device and never leaves it.

The controller who decides why and how your data is processed on this website is:

Browsing and reading this website does not require you to give us any data. Data only appears when you do something specific:

• Writing us an email: your email address, your name if you sign it and whatever you tell us in the message (which may be health information). Purpose: to read and answer you. The route that email follows is explained in section 8.
• Booking a video consultation: your email, your phone number if you leave it, the date and time and the payment details. Purpose: to schedule the appointment, remind you of it, charge for it and email you the invoice, which is mandatory.
• Entering the video consultation waiting room: your first name, your surnames, your ID/NIE number and your date of birth. Purpose: to open or complete your medical record, which the law requires, and to write your prescription if you need one (a prescription requires that data). The video consultation application does not keep them: they go directly to the doctor's medical record, stored encrypted on his server in Paris, together with the email, the phone number (if you left it when booking) and the booking language, so that the report and prescriptions can be sent to you. If you already had a record and the data do not match, the doctor checks your identity before opening it. If the patient is a minor, their mother, father or guardian books and is present in the room; the data are the minor's and are provided by their representative. The patient needs their own ID card or NIE, also if they are a minor; if they do not have one, they must ask for an in-person appointment. To enter the room you use the personal link you receive by email (it can be reused during the time window of your appointment, for example if your connection drops, and it is stored encrypted until the appointment data is deleted) or, if you do not have it, you type your email and receive a 6-digit code by email, valid for 10 minutes; knowing the email is not enough. If you book in English, the emails, the entry page and the waiting room are in English.
• Booking a private consultation by calling Elena: Elena is an artificial intelligence virtual assistant and tells you so when the call starts. She does not record the call or keep what is said in it, and she does not ask you anything about your health. To give you an appointment she stores your first name, your surnames, the phone number you call from and the appointment (clinic, day and time); if you leave a message for the doctor, your name and your phone number. Purpose: to give you the appointment, call you the day before to remind you of it and, if the doctor cannot see patients that day, offer you another slot. The doctor is the controller of this appointment data. The in-person consultation is provided and invoiced at the HM Hospitales centre you choose: there HM asks for your details and keeps your medical record as controller of that processing. Elena does not send your data to HM; the doctor only lets the centre's reception know if needed to organise your appointment (for example, if you cancel it on the same day).
• Being seen in consultation: the clinical data of the care provided. Purpose: to treat you and to document it in your medical record, as the law requires.
• Completing the questionnaires and the self-examination: your answers. Purpose: to calculate your result on your own device (see section 5).
• Requesting the extended AI report: a reduced version of that data (see section 5). Purpose: to write an orienting, educational text.
• Writing in the virtual assistant, the Orientation Guide or the website's search boxes and pressing their button: the text you write. While you type in the search boxes nothing is sent; the text only leaves your device when you press the button. Purpose: to generate the answer or to point you to the relevant information on the website (see sections 6 and 9).
• Accepting analytics cookies: aggregated usage data. Purpose: to know which pages are read and improve the website. Only if you accept them (see section 10).
• Using the AI tools: a daily usage counter linked to an irreversible code derived from your IP address (the IP itself is not stored). Purpose: to prevent abuse and protect the service.

None of this is used for advertising or sold. Who else is involved in the processing, and on what terms, is explained in section 8.

Health data is special category data (Article 9 GDPR) and needs a reinforced legal basis. There is not just one here: there are two different situations, and each one has its own.

This means that:

• Risk score calculation runs locally in your browser.
• The extended AI report is optional. It is only generated if you tick the consent box (which is unticked by default) and press the "Generate extended AI report" button. If you do not request it, the rest of the assessment works the same.
• In that case, a reduced version of your data is sent encrypted (TLS): the questionnaire scores, your sex and, as ranges rather than exact figures, your age, BMI and neck circumference; in the global results and in the self-examination, also the self-examination findings. The comments or questions you have written are not sent, nor your name, email, phone number or any other data that could identify you.
• That data is processed on servers in the European Union for the sole purpose of writing the report and is not stored: neither your data nor the report is kept in our systems. It is not used for advertising purposes or to train artificial intelligence models.
• The PDF report is generated entirely in your browser memory.
• When you close the tab, the questionnaire data is automatically deleted from your device.

To provide the interactive chat service ("Virtual Assistant"), the platform uses Artificial Intelligence technology.

After those periods, data is erased, unless it must be kept blocked in order to deal with possible legal liabilities.

Your data is not sold or used for advertising purposes. For the website to work, the technology providers in this table are involved, each one only for what is stated:

• Hostinger, Supabase, the artificial intelligence provider and Google (for Google Analytics) process the data on behalf of the controller, under the data processing agreement (Article 28 GDPR) that is part of their terms of service. The specific identity of the artificial intelligence provider is given to anyone who requests it by exercising their right of access.
• OVH, a French storage provider, keeps the nightly backups of the server as a data processor, in the European Union. The backups are encrypted on the doctor's server before leaving it, so OVH only stores files it cannot read.
• Cal.com handled the scheduling of video consultations booked until October 9, 2026 and states in its privacy policy that it processes that data as a data processor. Since that date, bookings are made in the doctor's own video consultation application (see the table).
• Stripe, the platform that takes the card payment for a paid video consultation on its own secure payment page, states in its privacy policy that it processes the payment data as a data processor and, for its own purposes such as security and fraud prevention, as a controller.
• Elena's telephone carrier and voice services (recognition of what you say and Elena's voice) process the call data on behalf of the controller, as data processors, only while the call lasts.
• Google (Gmail) receives the contact email on the terms explained below the table.

In addition, your data may be disclosed to public authorities, courts and law enforcement when required by law.

• The extended AI report and the assistant answers are produced in the European Union: the model that writes them is called through the provider's European endpoint, with no alternative route outside the EU, and the search in the website's knowledge base also takes place in the EU. The extended report data only goes to that European endpoint.
• The initial classification of what you write does leave the European Union: the text you write in the virtual assistant, the Orientation Guide and the website's search boxes first goes, already stripped of any personal data detected, through an automatic service that classifies it (for example, to detect a possible emergency or to know what topic it is about). That service operates outside the EU and receives only the text, not your IP address. The transfer relies on the European Commission's standard contractual clauses that the access provider includes in its data processing agreement. That is why we recommend that you do not write your name or other data that could identify you. The snore analyzer second opinion goes through the same service, only if you tick its box: it receives the numerical measurements of tone and rhythm, never the audio.
• Bibliographic searches also leave, but without you in them: to look for scientific studies, PubMed, the search engine of the US National Library of Medicine, is queried. For the reports, fixed topic texts written in advance are sent — for example, "daytime sleepiness and sleep apnea"; for the assistant, a few English medical keywords taken from your question. Your full text, your scores, your age or BMI ranges, your sex or any data that could identify you are never sent.
• Contact email: it is forwarded to Gmail (see section 8). Google may process those messages on servers located outside the European Union; for those transfers it states in its privacy policy that it relies on the safeguards provided for in the GDPR (the EU-U.S. Data Privacy Framework and standard contractual clauses).
• Calls to Elena: the telephone carrier may process outside the European Union the number you call from and the technical data of the call, with the safeguards of Chapter V GDPR that it states in its terms. What you say is turned into text, answered and voiced in the European Union.
• Payment and analytics: Stripe may process the payment data in the United States and Google may process Google Analytics data outside the European Economic Area; Cal.com processed in the United States the data of bookings made until October 9, 2026 (current bookings are stored in the European Union). These transfers rely on the safeguards of Chapter V GDPR (an adequacy decision, such as the EU-U.S. Data Privacy Framework, or standard contractual clauses) that each provider states in its own terms.

This website does not use advertising or invasive tracking cookies.

You may exercise the following rights at any time, free of charge:

• Access: to know what data of yours is processed and obtain a copy.
• Rectification: to correct data that is inaccurate or incomplete.
• Erasure: to ask for deletion when the data is no longer necessary, subject to what the law requires to be kept (for example, the medical record, which cannot be erased before five years from discharge).
• Objection: to object to processing based on legitimate interest.
• Restriction: to ask that data be kept but not used while a claim of yours is resolved.
• Portability: to receive, in a commonly used format, the data you have provided.
• Withdraw consent: where processing is based on it (AI report, snore analyzer second opinion, virtual assistant, Orientation Guide and search boxes, analytics cookies), you may withdraw it at any time and as easily as you gave it: by unticking the box or, in the Orientation Guide, the search boxes and the assistant, by no longer pressing the send button. Withdrawing it does not affect processing carried out beforehand: what was done up to that point remains lawful.

If you believe your data has not been handled properly, you may first write to the controller at the contact address in section 2. In any case, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid: www.aepd.es

If you live in another country of the European Economic Area, you may also complain to the data protection authority of your country.