Privacy Policy - Fisionexa Skip to content

Privacy Policy

Last updated: 19/10/2026

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), and other applicable data protection regulations, APPYWEB S.L. informs users of its Privacy Policy.

1. Data controller

Personal data that may be collected directly from the data subject will be treated confidentially and will form part of a processing activity for which the controller is:

  • Controller: APPYWEB S.L.
  • Tax ID (CIF): B02720803
  • Registered office: Calle Mestre Laporta, N 2, 1 piso, puerta 2, 03801, Alcoy (Alicante), Spain
  • Contact email: info@appyweb.es
  • Phone: +34 960 79 30 04

APPYWEB S.L. acts as data controller with respect to the data of the users of this website and of the clinics that contract its services (contact, commercial and billing data). With respect to the data of patients that clinics manage through the platform, APPYWEB S.L. acts as data processor on behalf of each clinic, under the terms described in section 3.

2. Purpose of the processing

The purposes for which personal data are collected are:

  • To manage requests for information, enquiries or contracting of services made through the website's contact forms.
  • To send commercial communications about our products and services, provided the user has consented to this processing.
  • To analyse the use of the website in order to improve its quality and the user experience.
  • To manage the contracting and provision of the services offered through the website.
  • To attend to and manage any incidents that may arise from the use of our services.
  • To provide the CRM software service, including the artificial intelligence assistants described in section 3, on behalf of the clinics that use it.

3. Processing through artificial intelligence assistants

The Fisionexa software incorporates virtual assistants based on artificial intelligence — accessible through channels such as WhatsApp, phone voice calls, web chat and the management panel — that allow clinics to automate appointment management and assist in documenting sessions.

With regard to the data of patients processed through these assistants — which may include health-related data, considered a special category of data under Article 9 of the GDPR — APPYWEB S.L. acts as data processor on behalf of the clinic, which is the data controller. This processing is governed by the corresponding data processing agreement (Article 28 of the GDPR) and by the clinic's instructions.

The legal basis legitimising the processing of health data is the provision of healthcare (Article 9.2.h of the GDPR), within the framework of the relationship between the patient and their clinic, as well as the performance of the contract between them (Article 6.1.b of the GDPR).

The artificial intelligence assistants always operate under human oversight: they can transfer the conversation to clinic staff at any time, do not make clinical decisions and do not replace the professional judgement of healthcare staff. In accordance with applicable regulations, users are informed that they are interacting with an artificial intelligence system and are always offered the option of being assisted by a person.

4. Legal basis for the processing of data

The legal basis for the processing of personal data is, depending on the case:

  • The consent given by the user when providing their data through our forms for the purposes indicated.
  • The performance of a contract to which the data subject is party, or in order to take steps at the data subject's request prior to entering into a contract.
  • The legitimate interest of the controller in sending commercial communications about products or services similar to those previously contracted.
  • For patient data processed on behalf of clinics, the legal bases indicated in section 3 (Articles 6.1.b and 9.2.h of the GDPR).

5. Recipients of the data and data processors

The personal data collected will not be disclosed to third parties, except where there is a legal obligation to do so or where it is necessary for the performance of the contractual relationship.

To provide the service, APPYWEB S.L. relies on technology providers that may have access to personal data as processors or sub-processors, with whom it has signed the corresponding data processing agreements under Article 28 of the GDPR. These providers include, in particular:

  • OpenAI — natural language processing and audio transcription for the AI assistants (United States).
  • Retell AI — orchestration of the phone voice assistant (United States).
  • Meta Platforms — WhatsApp Business messaging channel (United States).
  • Google — appointment calendar synchronisation (United States / European Union).
  • Stripe — processing of software subscription payments.
  • Hosting and email-sending providers necessary for the operation of the service.

In all cases, APPYWEB S.L. guarantees that such providers comply with data protection regulations and have assumed the confidentiality and security obligations required.

6. International data transfers

Some of the providers indicated in section 5 are located outside the European Economic Area, mainly in the United States. Consequently, the provision of the service may involve international data transfers.

In such cases, APPYWEB S.L. guarantees that these transfers are carried out with the appropriate safeguards provided for in Chapter V of the GDPR, in particular through:

  • The provider's adherence to the EU-U.S. Data Privacy Framework, where applicable; and/or
  • The signing of Standard Contractual Clauses (SCC) approved by the European Commission, supplemented, where appropriate, with the relevant additional measures.

Users may request further information about these safeguards and obtain a copy of them by writing to info@appyweb.es.

7. Data retention period

The personal data of website users and client clinics will be kept for as long as the business relationship is maintained or for the years necessary to comply with legal obligations. Once this period has elapsed, the data will be deleted in accordance with data protection regulations, which entails blocking them, making them available only at the request of Judges and Courts, the Public Prosecutor's Office or the competent Public Administrations during the statute-of-limitations period for any actions that may arise, after which they will be completely erased.

With respect to patient data processed on behalf of clinics, the retention periods are governed by the instructions of the controlling clinic and by applicable healthcare regulations, in particular Spanish Law 41/2002 of 14 November, on patient autonomy, which establishes a minimum retention period of five years for medical records.

8. Rights of data subjects

Users may exercise the following rights in relation to their personal data:

  • Right of access: to find out what personal data we process and for what purposes.
  • Right of rectification: to request the correction of inaccurate or incomplete data.
  • Right of erasure: to request the deletion of data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
  • Right to object: to object to the processing of their personal data.
  • Right to restriction of processing: to request the restriction of the processing of their personal data in certain circumstances.
  • Right to data portability: to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
  • Right to withdraw consent: to withdraw, at any time, the consent given for the processing of their data.

These rights may be exercised by writing to APPYWEB S.L., Calle Mestre Laporta, N 2, 1 piso, puerta 2, 03801, Alcoy (Alicante), Spain, or by email to info@appyweb.es, enclosing a copy of your ID card or equivalent identification document. Where the data subject is a patient of a clinic that uses the software, they may address their request to the clinic itself, as data controller, or to APPYWEB S.L., which will forward it to the clinic.

We also inform you that you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) if you consider that the processing of your data does not comply with applicable regulations.

9. Security measures

APPYWEB S.L. has adopted all technical and organisational measures necessary to guarantee the security and integrity of the personal data it processes, as well as to prevent its loss, alteration and/or access by unauthorised third parties. These measures include encryption of communications in transit, role-based access control, and the signing of confidentiality and data processing agreements with the providers involved in the service.

10. Updates to the privacy policy

APPYWEB S.L. reserves the right to modify this privacy policy in order to adapt it to legislative or case-law developments, as well as to industry practices. In such cases, it will announce, on this page or through other means of communication, the changes introduced with reasonable notice before they take effect.

11. Contact

For any query relating to this Privacy Policy, you may contact us through:

  • Email: info@appyweb.es
  • Phone: +34 960 79 30 04
  • Postal address: Calle Mestre Laporta, N 2, 1 piso, puerta 2, 03801, Alcoy (Alicante), Spain