List of active policies

Full policy

Privacy and data protection policy

1. Data controller

Data controller: Asociación HEALTH4OL
Contact person: Pablo Ryan
Tax identification number (CIF): G44589927
National Register of Associations: 626310
Address: Calle del Conde de Xiquena, 9, 2.º izquierda, 28004 Madrid, España
Privacy and support: info@health4ol.es
Data Protection Officer: none has been appointed; privacy enquiries are handled at the email address above.

2. Scope

This platform provides online training primarily for healthcare and social care professionals. Creating an account and enrolling in courses are voluntary. The service is not designed to collect clinical data or patients' personal information; users must not enter such information.

3. Data processed

We process the data provided on registration —first name and surname, email address and institution or organisation—, the data needed to authenticate the account, and the data generated when using the platform: enrolment, access records, technical logs, IP address, progress, attempts, answers, grades and completion.

4. Purposes

The data are used to create, confirm and protect the account; enrol the user and provide access to training; record progress and completion; manage pre-tests, content, post-tests and repeat attempts; send essential communications about the account or course; respond to enquiries, incidents and rights requests; prevent fraud and abuse; comply with legal obligations; and produce aggregate statistics.

The institution stated by the participant will be used for the programme's internal management and evaluation and will not be visible to other learners. Individual information about a participant's progress or results will not be disclosed to their institution unless there is a legal basis and the participant is informed in advance.

5. Legal basis

The provision of the requested training is based on the performance of the training relationship and on measures requested by the user (Art. 6.1.b of the GDPR). Platform security and the prevention of abuse are based on the controller's legitimate interests (Art. 6.1.f). Processing required by regulatory obligations is based on compliance with a legal obligation (Art. 6.1.c). Promotional communications or optional purposes will require a specific legal basis and, where applicable, separate consent (Art. 6.1.a).

6. Automated training rules

The platform applies automatic navigation and completion rules —pre-tests, audiovisual content, final assessments and access to resources— solely for training purposes and without legal effects for the participant. Learners may repeat activities where permitted. To request a review of an incident or result, you can write to info@health4ol.es.

7. Recipients and service providers

Authorised administrative and teaching staff and the service providers required for hosting, maintenance and transactional email may access the data, subject to the appropriate safeguards. The platform integrates Google reCAPTCHA to prevent automated registrations and may display YouTube videos in privacy-enhanced mode. These services may generate technical communications with Google and apply their own policies and safeguards for international transfers. We do not sell personal data.

8. Retention

Unconfirmed accounts are deleted after 7 days. Data relating to confirmed accounts will be retained while the account remains active. Training records, completion records and grades may be retained for 5 years from the last activity or completion to provide evidence of training and address liabilities. Technical activity logs will be retained for a maximum of 365 days. Backups will be retained for their technical rotation cycle and overwritten periodically. After that, the data will be deleted or anonymised unless a legal obligation requires their retention.

9. Rights

You may request access, rectification, erasure, restriction of processing and portability, object to processing where applicable, and withdraw consent without affecting prior processing, by writing to info@health4ol.es. You may also lodge a complaint with the Spanish Data Protection Agency.

10. Mandatory data

Your first name, surname, email address and institution or organisation are necessary to manage your account and training. If you do not belong to an institution, you can enter “Independent”. Registration cannot be completed if mandatory fields are missing.

11. Minors

The training is intended for adult healthcare and social care professionals. Minors must not register without the involvement and authorisation required by law.

12. Security and updates

We apply technical and organisational measures to protect data. This policy may be updated when processing activities or service providers change. Significant changes will be communicated and, where appropriate, renewed acceptance will be requested.