Privacy Policy

Grabowski Medical — Dr. Gabriel Grabowski.

Address: Vogue Clinic, Av. España N° 2, 29680 Estepona, Málaga, Spain.

Email: info@grabowski-medical.com — Phone: +34 633 31 83 14.

For any question about how your personal data is processed, or to exercise your rights, contact: Dr. Gabriel Grabowski — info@grabowski-medical.com.

Contact data you provide via the contact form or email (name, email, phone, message).

Health data necessary to provide medical care, collected during your consultation.

Technical data automatically transmitted by your browser (IP address, browser type, date and time of access). This data is used only to operate the site securely and is not used to identify you personally.

Responding to enquiries — Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (legitimate interest in answering you).

Provision of medical treatment and keeping medical records — Art. 6(1)(b) and Art. 9(2)(h) GDPR.

Compliance with legal obligations (e.g. accounting, healthcare law) — Art. 6(1)(c) GDPR.

Operating and securing the website — Art. 6(1)(f) GDPR.

Contact requests are retained as long as necessary to answer your enquiry and any follow-up.

Medical records are retained for the periods required by Spanish law (typically at least 5 years after the last episode of care; longer where applicable).

Server log data is deleted or anonymised after a short period.

Your data is only disclosed to third parties where necessary for treatment (e.g. laboratories, referred specialists), where required by law, or to service providers that process data on our behalf under a data processing agreement.

We primarily process data within the European Economic Area. Where a service provider processes data outside the EEA, we ensure an adequate level of protection through Standard Contractual Clauses or another lawful transfer mechanism.

This website uses only technically necessary cookies required to operate the site. We do not use advertising or third-party tracking cookies. Should this change, a cookie banner with consent options will be displayed.

You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent at any time without affecting prior processing.

To exercise these rights, contact info@grabowski-medical.com (or the data protection contact above).

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es).

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.

This website presents medical practices in two countries. For the Estepona (Vogue Clinic) and La Cala de Mijas practices, Spanish data protection law applies (GDPR together with LOPDGDD 3/2018 and Ley 41/2002 on patient documentation). For the Nürnberg practice, German data protection law applies (GDPR together with the Federal Data Protection Act BDSG, the Bavarian Medical Association's professional code and § 203 of the German Criminal Code on medical confidentiality).

Controller: Praxis Dr. med. Gabriel Grabowski, Äußere Sulzbacher Straße 124 (im CNO), 90491 Nürnberg, Germany. Phone: 0911 - 59 30 26. Email: drgabrielgrabowski@googlemail.com.

Legal bases: Art. 6(1)(b), Art. 6(1)(c), Art. 6(1)(f) and Art. 9(2)(h) GDPR in conjunction with § 22(1) no. 1(b) BDSG for the processing of health data for the purpose of medical treatment.

Medical confidentiality: all staff are bound by medical secrecy under § 203 StGB and the professional code of the Bavarian Medical Association (Bayerische Landesärztekammer).

Retention: patient records are kept for at least 10 years after the end of treatment under § 630f(3) BGB; longer statutory periods (e.g. 30 years for X-ray records under the Radiation Protection Act) apply where relevant. Accounting documents are kept for 6 or 10 years under §§ 147 AO, 257 HGB.

Recipients: statutory and private health insurers, medical billing services (Privatärztliche Verrechnungsstelle), laboratories, referred physicians and hospitals, and processors under an Art. 28 GDPR data processing agreement.

Online appointment booking via Doctolib: if you book through Doctolib, Doctolib GmbH processes your data as an independent controller/processor under its own privacy policy (doctolib.de/privacy).

Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)) GDPR.

Supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany — www.lda.bayern.de. You may lodge a complaint there at any time.