TREATMENT personal data

Who is the controller of your personal data?

The data controller is CLÍNICA UNIVERSIDAD DE NAVARRA, holder of Corporate Tax No. R3168001J, with corporate domicile at Avenida Pio XII, 36, 31008, Pamplona, (hereinafter, “CUN”).

CUN has formally appointed a Data Protection Officer and has also enabled the following communication channel:

How do we obtain your personal data?

To answer this question, it is necessary to distinguish between the sources your personal data comes from and the type of personal data processed by CUN:

Sources of your personal data.

  • Provided by the patient in legal, contractual, medical or other relationships of any kind established with CUN.
  • Management, maintenance and development of the relationship established between CUN and the patient.
  • Insurance companies.
  • Public Bodies and Administrations.

Types of personal data.

  • Identifying details, including image.
  • Data about personal characteristics and social situation.
  • Clinical and health data contained in your clinical history, obtained during development of the relationship established between CUN and the patient.
  • Economic, financial and insurance data required for invoicing your healthcare.

Why do we process your personal data?

At CUN we process your personal data for the purposes described below:

• Management, maintenance and development of the legal, contractual and/or medical relationship entered into by CUN and the patient, which may include:

  • Healthcare provided to the patient.
  • Medical tests conducted on the patient.
  • Clinical diagnoses.
  • Any other specific issue during medical treatment.

• Management of payment and invoicing of medical care and interventions.

• Use of medical data for the purposes of research conducted at CUN, if consent is given.

Medical data for research purposes shall always be processed in accordance with legislation currently in force.

You are also informed that the data shall be processed with codified and/or pseudonymised data, in strict compliance with the security measures applicable to the storage and custody of data and, in all cases after the Ethical Committee of the CLÍNICA UNIVERSIDAD DE NAVARRA has delivered an opinion.

• Sending information by post, telephone or electronic means about CUN to the University of Navarra or CIMA (Applied Medical Research Centre). Said information shall refer to research projects, activities or studies carried out by said bodies, to advances and new developments in products, services and techniques taking place in the field of medicine, at both practical and research levels, and also to products and services provided by CUN, University of Navarre and CIMA. Likewise, information about organisations that belong to the hospitality and commercial sectors and that collaborate with CUN in those cases where consent has been given.

You may at any time object to your data being processed for advertising or promotional purposes by using the channels provided by CUN in the section: "What are your rights with regard to how we process your data?".

• Use of data to inform the patient about financial support projects for clinical research conducted by CLÍNICA UNIVERSIDAD DE NAVARRA, either individually or in collaboration with other scientific research bodies, and requests for your participation in same, solely when consent has been given.

What legal standing does CUN have to process your data?

The legal bases for processing your personal data can be found in:

  1. Execution, development, performance and maintenance of the medical, legal and/or contractual relationship entered into by the patient and CLÍNICA UNIVERSIDAD DE NAVARRA.
  2. Fulfilment of legal obligations applicable to CLÍNICA UNIVERSIDAD DE NAVARRA.
  3. Legitimate interest of CLÍNICA UNIVERSIDAD DE NAVARRA.
  4. Consent granted by the patient for the purposes we requested it for.

Who shall receive your personal data?

The personal data processed by CUN for the purposes defined above may be transmitted to the following recipients according to the legal standing used for transmission.

By virtue of the foregoing, the processes used in the following data transmissions set out to ensure that the contractual relationship is correctly fulfilled, and that the legal obligations requiring said transmissions to take place are fully complied with:

  • Public Bodies and Administrations, to comply with the legal obligations that CUN is subject to.
  • Financial institutions for managing invoicing and payments.
  • Suppliers of health products and material and pharmaceutical companies.
  • Students for educational purposes, if consent is given.
  • Insurance companies for the purposes of maintaining the medical and financial relationship.

How long do we keep your data for?

Your personal data shall be kept for the duration of the medical, legal and/or contractual relationship, and subsequently, if you have not exercised your right to deletion, it shall be kept for the period established by the legal provisions for each particular case, bearing in mind the type of data and the purpose for which the data is processed.

The data and documentation used to justify the medical and/or legal relationship that the patient has entered into with CLÍNICA UNIVERSIDAD DE NAVARRA shall be kept up to the time limits established by the relevant legislation, and for the limitation periods provided for in civil, criminal, administrative and other proceedings that might arise from the relationship entered into.

If you would like more information about the time limits for keeping personal data at CLÍNICA UNIVERSIDAD DE NAVARRA, please write to

What are your rights with regard to how we process your data?

CUN informs you that you are entitled to access your personal data and obtain information about how said data is being processed. You are also entitled to ask for any imprecise data to be rectified or, when applicable, have it deleted when the data is no longer necessary for the purposes given by CUN.

In certain situations, you can ask for limitations on the processing of your data, in which case CUN shall only keep it to exercise its rights or for defence against any possible claims.

Likewise, in certain situations, you may object to the processing of your personal data for the purposes given by CUN. In such a case, CUN shall stop processing the personal data, unless there are legitimate reasons for doing so, or to exercise its rights or for defence against any possible claims.

Finally, you are entitled to the right of portability and obtain for yourself or another service provider certain information arising from the contractual relationship entered into with the Organisation.

We would also like to remind you that you may at any time object to the use of your persona data for advertising or promotional purposes.

You may exercise said rights in writing to “CLÍNICA UNIVERSIDAD DE NAVARRA”, by sending a letter to either of the addresses below:

  • If you are a patient in Pamplona, to the postal address: Avenida Pio XII, 36, 31008, Pamplona. Servicio de Atención al Paciente.
    Or the e-mail address
  • If you are a patient in Madrid, to the postal address: Calle Marquesado de Santa Marta, 1, 28027 Madrid. Unidad de Seguridad y Protección de Datos.
    Or the e-mail address

In both cases, you should certify the identity of the person exercising their rights by sending a copy of both sides of their National Identity Card, Foreign Residency Permit, Passport or similar document.

CUN informs you that you can find document templates that you can use to exercise your data protection rights at the website of the Spanish Data Protection Agency (

CUN shall provide the information you request within one month after receiving the application. Said period may be extended by another two months if necessary, according the complexity and number of requests.

You may withdraw your consent at any time if you have given your consent for some particular purpose, without this affecting the legitimacy of the processing based on the consent given prior to the withdrawal of same.

You may present a claim to the Supervisory Authority that manages data protection issues. However, you may in the first instance present a claim to the Data Protection Office at the e-mail address, who shall resolve the claim within two months.