Patient Portal Privacy Policy

How personal data is processed when you use the portal to view what your clinic shares with you.

Introduction

This policy describes personal data processing related to the supper patient portal. It complements, and does not replace, the general Privacy Policy and any data-processing consent your clinic may ask you to sign.

Who does what

Your clinic is typically the controller of your clinical and nutrition follow-up data. It decides what appears in the portal and manages your care relationship.

Supper (contact: support@thesupper.co) acts as a processor for those data when providing the platform, and as a controller for technical data needed to operate portal access (for example sending the access link and securing the session).

Supper complies with the GDPR and applicable Spanish data-protection law in its role.

Data and purposes

What we process in the portal context and why.

Data we process

  • Identification and contact data on your patient record (name, email, language, etc.).
  • Portal access data (link requests, session tokens, acceptance date of these terms).
  • Follow-up information your clinic makes available in the portal (appointments, consultations, or other enabled content).
  • Technical security data (IP address, user agent) when needed to prevent abuse.

Purposes and legal bases

  • Let you access the portal and authenticate securely (performance of the service / legitimate interest in security).
  • Display information your clinic shares with you (processor under the clinic’s instructions).
  • Record acceptance of portal terms and privacy (legitimate interest / need to evidence agreement).
  • Comply with applicable legal obligations.

Any health or follow-up data-processing consent you sign with your clinic is a separate process managed with that clinic.

Retention and rights

How long data is kept and how to exercise your rights.

Retention

We keep data as long as needed to provide the portal and meet legal duties. One-time access tokens expire quickly; portal sessions have a limited lifetime. If your clinic disables the portal or your record, access stops according to their configuration.

Recipients

We do not sell your data. Authorized supper staff and, where needed, subprocessors hosting and operating the service may access it (in the EEA or with adequate safeguards). Your clinic accesses your clinical data as controller.

Your rights

You may exercise access, rectification, erasure, restriction, objection, and portability where applicable. For portal or platform data: support@thesupper.co. For clinical data managed by your clinic, contact your clinic as well. You may lodge a complaint with the Spanish AEPD (www.aepd.es).