Privacy policy
Version 4 · 31 October 2026
BeMedi (bemedi.app) is a platform that lets patients find health professionals and book appointments with them, and lets professionals and clinics manage their profile, schedule and appointments. This policy explains which personal data we process, why, on what legal basis, for how long and what rights you have, in line with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). If you use BeMedi from another country, the mandatory data protection rules of your country also apply.
1. Controller
The controller is José García Ontiveros, tax ID 30246229X, with address at Apartado de Correos 41710 (full details in the legal notice). Contact for any privacy matter and to exercise your rights: info@bemedi.app. We are not required to appoint a data protection officer (art. 37 GDPR and art. 34 LOPDGDD); the owner handles these matters personally.
Professionals and clinics. When you book an appointment, the professional or clinic you book with receives your data and becomes, from that moment, an independent controller of the processing they carry out to provide your care (art. 9(2)(h) GDPR and healthcare law), with their own information duties and professional secrecy. For the appointments professionals enter manually in their schedule and for the patient data they keep in BeMedi, BeMedi acts as a processor on behalf of the professional (art. 28 GDPR), under the data processing agreement included in the terms of use.
2. What data we process
- Patients and users: name and surname, email, phone (only if the professional requires it for the appointment), language, time zone, the appointments you book (professional, service, location, date and time, status), the short reason you write when booking (optional), the name of the person attending if you book for a minor in your care, your reviews and replies, waiting-list requests, saved professionals, your consents and preferences, and the messages you send us through the contact form.
- Professionals and clinics: name, title, photo, license or registration number and issuing body, qualifications and experience, specialties, areas treated, languages, locations (address, phone, coordinates), services, prices, schedules, account and clinic data, and the appointments and patients in their schedule.
- Sign-in with Google or Apple: if you choose this option, we receive from Google or Apple your name, your email address (with Apple it may be an anonymous relay address) and an identifier for your account, which we use only to identify you. We never receive your password or your contacts. Google and Apple process this data as independent controllers under their own privacy policies.
- Professionals who request information: if you leave your details in the “Get information” form on our pages for professionals, we process your name, email, phone number (if you give it), specialty, city and any message you write, together with the date, IP address and the text of the box you ticked, as proof of your consent.
- Technical data: IP address and browser, used for security (attempt limits, logging of sensitive actions) and to keep proof of your consents. We do not use third-party analytics or tracking cookies (see the cookie policy).
Health data (special category, art. 9 GDPR)
The fact of booking an appointment with a professional of a healthcare specialty (for example, a psychologist), the service chosen and, if you write it, the short reason for the visit are data concerning your health. We process them only to manage that appointment and pass it on to the professional, on the basis of your explicit consent (art. 9(2)(a) GDPR), which you give by ticking the box when booking. You can withdraw it at any time by cancelling the appointment, deleting your account or writing to us; withdrawal does not affect processing carried out before. BeMedi does not store medical records or reports. The “reason for the visit” field is optional and meant for one short sentence: please do not include detailed medical information. The professional processes your health information under their own responsibility and professional secrecy.
3. Why we use the data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Managing the booking, confirmation, change, cancellation, reminders and follow-up of your appointments, and passing your details to the professional or clinic you book with | Performance of a contract or pre-contractual steps (art. 6(1)(b)); for health data, your explicit consent (art. 9(2)(a)) |
| Creating and maintaining your account, verifying your email, recovering your password, showing your appointments and saved professionals, notifying you of waiting-list openings | Performance of a contract (art. 6(1)(b)) |
| Publishing and moderating patient reviews of completed appointments, and letting the professional reply | Your consent when publishing (art. 6(1)(a)) and legitimate interest in the reliability of the platform (art. 6(1)(f)) |
| Publishing professionals’ and clinics’ profiles and verifying their identity and entitlement (license or registration number) | Performance of the contract with the professional (art. 6(1)(b)) and legitimate interest in patient safety (art. 6(1)(f)) |
| Sending service emails (confirmations, reminders, changes, security notices, weekly report to the professional) | Performance of a contract (art. 6(1)(b)) |
| Sending you BeMedi news by email (only if you opted in) | Your consent (art. 6(1)(a)), which you can withdraw from “My account”; each mailing will also include an unsubscribe link |
| Sending you information about BeMedi for professionals by email and, if you gave us your phone number, calling you, when you ask for it in the “Get information” form | Your consent (Art. 6(1)(a) GDPR; Art. 21 of Spanish Law 34/2002 on information society services), which you can withdraw at any time using the unsubscribe link in each email or by writing to us |
| Security, abuse and fraud prevention, logging of sensitive actions, request limits | Legitimate interest (art. 6(1)(f)) and security obligation (art. 32) |
| Handling your enquiries, complaints and the exercise of your rights | Legal obligation (art. 6(1)(c)) and legitimate interest (art. 6(1)(f)) |
| Keeping proof of your consents and of the terms you accepted | Legal obligation (arts. 5(2) and 7(1) GDPR; art. 27 Spanish LSSI) |
We make no automated decisions with legal or similarly significant effects on you and we do not profile you. The order of search results depends on the specialty, the city or distance, availability and reviews, not on your personal data.
4. Who we share data with
- The professional or clinic you book with: receives your name, email, phone (if required), the short reason and the appointment details.
- Providers that process data on our behalf (processors, under a contract compliant with art. 28 GDPR): Cloudflare, Inc. (hosting of the application and database; data is stored in the European Union and Cloudflare’s network handles traffic at the point closest to the user) and Resend, Inc. (delivery of transactional emails). When we enable payments for professional plans we will use a payment provider and update this policy.
- Third-party content loaded by your browser: maps (OpenStreetMap tiles, only if you enable the map in search results) and blog cover images (Unsplash). These services receive your IP address to serve the content; we send them no other data about you.
- Authorities where the law requires it, and courts in case of a claim.
We do not sell your data or share it for advertising purposes.
5. International transfers
Cloudflare and Resend are United States companies. Transfers rely on the EU-US Data Privacy Framework (Decision (EU) 2023/1795) where the provider is certified and, in any case, on the European Commission’s standard contractual clauses (art. 46(2)(c) GDPR) signed with each provider, with additional measures such as encryption in transit and database storage in the European Union. You can request a copy of the safeguards at info@bemedi.app.
6. How long we keep data
| Data | Period |
|---|---|
| User account | While it is active. When you delete it, your data is anonymised immediately (name, email, phone and reason of appointments) and your future appointments are cancelled. |
| Appointments (with or without an account) | The personal data of each appointment is anonymised automatically 5 years after the appointment date (limitation period for civil claims, art. 1964 Spanish Civil Code); the professional may keep their own record under their responsibility. |
| Reviews | While the professional’s profile is published; if you delete your account, they remain without your name. |
| Consents and accepted terms | While the account exists and 5 more years, as proof. |
| Waiting list | Until we notify you or, at most, 12 months. |
| Information requests from professionals | Until you withdraw your consent or, at most, 12 months after your request if you do not sign up. If you unsubscribe, we keep only your email address and the date, so that we never write to you again. |
| Contact messages | 24 months. |
| Log of emails sent | 12 months. |
| Log of sensitive actions (with IP) | 12 months. |
| Request limits (IP) | 24 hours. |
| Sessions | 30 days or until you log out. |
| Professional profile | While the account is active; when you leave it is no longer published. Data that must be kept for tax obligations (once paid plans exist) is blocked for the legal periods (art. 32 LOPDGDD). |
7. Your rights
You have the right to access your data, rectify it, erase it, restrict or object to its processing, request its portability and withdraw your consent at any time (arts. 15 to 22 GDPR). You can do it yourself from My account › Privacy (download your data, change your preferences, delete the account) or by writing to info@bemedi.app. We reply within one month at most (extendable by two further months in complex cases; we would let you know) and we may ask you to prove your identity. If you believe we have not respected your rights, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.
8. Security
Encryption in transit (HTTPS), passwords stored as hashes (PBKDF2), protected session cookies, role-based access control (a professional only sees the data of patients who have an appointment with them; a clinic only that of the professionals who accepted to join), logging of sensitive actions, abuse limits and minimal data collection. If a security breach with risk to your rights occurred, we would inform you and notify the supervisory authority (arts. 33 and 34 GDPR).
9. Minors
BeMedi is intended for people aged 18 or over. Appointments for minors must be booked by their parents or guardians with their own contact details, giving the minor’s name as the person attending. If we detect an account of a child under 14 without authorisation, we will delete it.
10. Professionals and clinics
We publish on your profile the professional data you choose to show (name, photo, qualifications, registration number, specialties, locations, services, prices, schedules) so that patients can find you and book. We check your license or registration number before publishing the profile, consulting public registers where they exist. We send you service emails (new appointments, changes, cancellations, weekly report); you can turn the report off from your panel. Regarding your patients’ data in your schedule, you are the controller and BeMedi is your processor: see the data processing agreement in the terms of use.
11. Changes to this policy
We will publish the current version here with its date. If a change affects your rights or the legal bases, we will inform you by email in advance. History: v1 (October 2026, launch) · v2 (28 October 2026: health data, retention, providers, data processing agreement and contact info@bemedi.app).
If you have any questions about this text, write to info@bemedi.app. In case of discrepancy between languages, the Spanish version prevails.