TREATMENT personal data

Who is the controller of your personal data?

The data controller is CLÍNICA UNIVERSIDAD DE NAVARRA, holder of Corporate Tax No. R3168001J, with corporate domicile at Avenida Pio XII, 36, 31008, Pamplona, (hereinafter, “CUN”).

CUN has formally appointed a Data Protection Officer and has also enabled the following communication channel:

How do we obtain your personal data?

To answer this question, it is necessary to distinguish between the sources your personal data comes from and the type of personal data processed by CUN:

Sources of your personal data.

  • Provided by the patient in legal, contractual, medical or other relationships of any kind established with CUN.
  • Management, maintenance and development of the relationship established between CUN and the patient.
  • Insurance companies.
  • Public Bodies and Administrations.

Types of personal data.

  • Identifying details, including image.
  • Data about personal characteristics and social situation.
  • Clinical and health data contained in your clinical history, obtained during development of the relationship established between CUN and the patient.
  • Economic, financial and insurance data required for invoicing your healthcare.

Why do we process your personal data?

At CUN we process your personal data for the purposes described below:

• Management, maintenance and development of the legal, contractual and/or medical relationship entered into by CUN and the patient, which may include:

  • Healthcare provided to the patient.
  • Medical tests conducted on the patient.
  • Clinical diagnoses.
  • Any other specific issue during medical treatment.

• Management of payment and invoicing of medical care and interventions.

• Use of medical data for research carried out at CUN, if the patient consents to this.

Medical data for research purposes shall always be processed in accordance with legislation currently in force.

You are also informed that such information shall be processed with codified and/or pseudonymised data, in strict compliance with the relevant security measures on data storage and custody, and shall always be subject to expert opinion from the Ethics Committee of the CLÍNICA UNIVERSIDAD DE NAVARRA.

• Sending information by post, telephone or electronic means about the CUN, the Universidad de Navarra or CIMA (Applied Medical Research Centre). This information refers to projects, activities or research studies undertaken by these bodies, to advances and new developments in products, services and techniques that take place in the medical sector (both the healthcare and research areas), and to products and services provided by CUN, Universidad de Navarra and CIMA. It also refers to sending information about organisations that collaborate with CUN and that belong to the hospitality and business sectors. This information may only be sent with your consent.

You are entitled to block the use of your data for marketing or promotional purposes by using the channels provided by CUN, as described in the section: What are your rights regarding the data that we process?

• Use of data to inform the patient about clinical research projects undertaken by CLÍNICA UNIVERSIDAD DE NAVARRA, either individually or in collaboration with other scientific research bodies, and requests for participation in such projects solely if you have given your consent.

What legal standing does CUN have to process your data?

The legal basis for processing your personal data is as follows:

  1. Signing, developing, carrying out and maintaining the healthcare, legal and/or contractual relationship established between the patient and CLÍNICA UNIVERSIDAD DE NAVARRA.
  2. Compliance with legal obligations applicable to CLÍNICA UNIVERSIDAD DE NAVARRA.
  3. The legitimate interests of CLÍNICA UNIVERSIDAD DE NAVARRA.
  4. Consent given by a patient for the purposes we requested.

Who do we send your personal data to?

The personal data processed by CUN for the purposes described above may be communicated to the following recipients depending on the legal basis for transmitting it.

This means that the following communications of data set out to ensure that the contractual relationship is correctly maintained, and to comply with the legal obligations that require such communications:

  • Public Administrations and Bodies, in order to comply with the legal obligations that CUN is subject to.
  • Financial institutions for management of charges and payments.
  • Suppliers of healthcare products and materials, and pharmaceutical companies.
  • Students for teaching purposes when consent is given.
  • Insurance companies for maintaining healthcare and financial relationships.

How long do we keep your data for?

Your personal data shall be kept for the duration or the healthcare, legal and/or contractual relationship and subsequently, as long as you have not exercised your right of erasure, they shall be kept in accordance with the relevant periods legally established for each particular case, bearing in mind the type of data and the purpose of processing it.

The data and documentation that justifies the healthcare and/or legal relationship established by the patient with CLÍNICA UNIVERSIDAD DE NAVARRA shall be kept for the periods of custody imposed by the relevant legislation, and for the prescription periods for civil, criminal. administrative or other proceedings that might arise from the relationship.

Please ask for more information about the periods personal data is retained for by CLÍNICA UNIVERSIDAD DE NAVARRA at

What are your rights regarding the data that we process?

CUN informs you that you are entitled to have access to your personal data and to obtain confirmation about how it is being processed. You are also entitled to ask for rectification of any inaccurate data or, where applicable, ask for it to be erased when the data is no longer required for the purposes it was collected for by CUN.

In some cases, you can ask for limitations on the processing of your data, in which case CUN may only keep it for exercising the right to make claims or defending itself against them.

You may also oppose the processing of your personal data for the purposes stated by CUN. In such a case, CUN shall stop processing the personal data unless there are legitimate reasons to do otherwise or to exercise the right to make claims or defend itself against them.

You also have the right to portability and to obtain data from the contractual relationship entered into with the organisation and so obtain such information for yourself or for use by another service provider.

You are also informed that you may at any time oppose the processing of your data for marketing or promotional purposes.

You may exercise these rights by writing to “CLÍNICA UNIVERSIDAD DE NAVARRA”, at the addresses below:

  • If you are a patient in Pamplona, the postal address is: Avenida Pio XII, 36, 31008, Pamplona.

Patient Assistance Service

Or the electronic mail address

  • If you are a patient in Madrid, the postal address is: Calle Marquesado de Santa Marta, 1, 28027 Madrid.

Data Security and Protection Unit

Or the electronic mail address

Please send a copy (both sides) of your national identity card, foreign residency permit, passport or equivalent document to certify your identity.

CUN informs you that you can find templates of documents that you can use to exercise your data protection rights at the website of the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (

CUN will provide you with the requested information within one month dating from when the application was received. This period may be extended by a further two months if necessary depending on the complexity and number of applications.

You may withdraw your consent at any time if you have previously given it for any specific purpose, without this affecting the legitimate nature of the processing based on the consent given prior to its withdrawal.

You may submit a claim to the competent data protection Control Authority. However, that does not prevent you from firstly lodging a claim with the Data Protection Officer at the electronic mail address:, who shall resolve the claim within two months.