Processing of patients’ personal data

The SJD Barcelona Children's Hospital, with the aim of being fair, lawful and transparent with regard to our users’ privacy, hereby informs you of how your personal data are used by the Hospital.

This centre, adhering to the CODE OF CONDUCT of the CATALAN UNION OF HOSPITALS, with registration number CT 107, guarantees the security of all personal data.

Details of the party responsible for data protection

• Identity: SJD Barcelona Children's Hospital
• Address: Passeig de Sant Joan de Déu, number 2, 08950, Esplugues de Llobregat, Barcelona, Spain.
• Contact details: hospitalbarcelona.dpd@sjd.es

Data we process and sources

The SJD Barcelona Children’s Hospital can process the following types of data:

• Identifying data, contact details of patients or their representatives (including signatures, images, national healthcare cards, social security number or insurance number).
• Transaction data (payments, transfers, current account number, bank card number).
• Biometric data.
• Genetic data.
• Patient clinical healthcare record data.
• Personal and social characteristics.
• Location data (geolocalisation in the surgical wing).

Data can be provided by the interested party (the patient), their legal representative, or by healthcare services.

Purpose

The aforementioned data will be processed with the following purposes:

• Healthcare: To guarantee the correct record-keeping and monitoring of medical healthcare treatment provided at the Hospital; to ensure a continued healthcare continuum of several social and sanitary devices and agents; to provide the necessary information for correct billing for services used; to complement your Medical History Record at the centre and observational studies to improve our care provision; and to provide proof of appointment/consultation notes. To send healthcare-related information and promotional activities.
• SMS or messaging service appointment reminders and confirmations: To send SJD Barcelona Children’s Hospital users reminders of their appointments with Hospital Services.
• Teaching: The SJD Barcelona Children’s Hospital has an inherent educational role in the healthcare sector. The Hospital respects all data protection legislation at all times, and always adapts to the best data security and privacy practices available. This means that, prior to the provision of any healthcare services, the physician will inform the patient or their representative of the presence of students, requesting their consent for these students to be present at any clinical events, procedures or appointments that concern them. If they choose not to provide their consent, students cannot be present at any clinical events, procedures or appointments.
• Satisfaction and/or service quality surveys: With the aim of improving healthcare provision, at the end of any healthcare activity we will send a survey about your experience at the SJD Barcelona Children's Hospital. This survey is voluntary and the results gathered from it will allow us to offer you better service when you next return to the Hospital. Should you desire not to receive these surveys, you can send an email to hospitalbarcelona.dpd@sjd.es, providing your details and informing us of your wishes. Furthermore, we will ask you if you want to be part of the Patient Experience panel to take part in periodic improvement plans and evaluations involving patients and families, with the aim of improving healthcare provision at the Hospital.
• Scientific research: Your data may be used for scientific research purposes, following all relevant norms and legislation in the respective field. The SJD Barcelona Children's Hospital may contact you to ask if you would like to take part in clinical research trials. Your data may be subjected to certain anonimisation processes or processed so that you cannot be identified without additional information (i.e., using a pseudonym), with the purpose of statistical or scientific research.
• Handling of information requests, complaints, suggestions, claims, exercising data protection rights, etc.: Data will be processed in order to carry out these processes and requests.

Legitimate interests basis

• Healthcare provision: Data needed for medical purposes, such as medical diagnosis, service provision, social/sanitary treatment, or management of sanitary and social healthcare systems and services.
• SMS or messaging service appointment reminders or confirmations: Legitimate interest of the responsible party.
• Teaching: Prior consent as per relevant legislation (which will be obtained when necessary).
• Scientific research: Legitimate interests of the responsible party or consent from the interested party.
• Satisfaction and/or service quality surveys: Legitimate interest (sending the survey) and consent (responding to the survey is voluntary).
• Handling of requests: Consent of the interested party.

Recipients

This information will be used by administrative services and those services directly associated with the provision of healthcare within our centre within their scope of service. It may be transmitted either partially or in its entirety to official public/private staff who, for legal or material reasons, must access these data to provide the medical-sanitary healthcare they have committed to providing within the scope of treatment. 

Furthermore, the centre would like to make you aware that it takes part in the Shared Medical Record of Catalonia (HC3) directive. This means that the data of patients treated at this centre will be recorded in the HC3 in accordance with all legal requirements, following legislation brought in by the Generalitat de Catalunya, the party responsible for this document. 

International transfers

We inform you that your personal data will not be sent or processed outside the European Economic Area. In the case of one of our providers working outside of the EU, an international data transfer can be carried out, whereby the SJD Barcelona Children's Hospital will ensure that the recipient meets the minimum requirements established by the European Commission for data protection, or it will take the necessary steps to guarantee compliance with Article 46 of General Data Protection Regulations (GDPR).

Storage limitations

Processed data will be stored in accordance with healthcare legislation and in line with existing data protection legislation at all times, as well as during any period in which the SJD Barcelona Children's Hospital has any type of judicial responsibility thereof.

Interested party rights

You have the right to obtain information on how the SJD Barcelona Children's Hospital processes the data it holds on you. In particular:

• You have the right to access your personal data, to find out which of your personal data are being processed by us, as well as the right to request correction of inaccurate data, or if necessary, to request the erasure of your data when, among other reasons, said data is no longer needed for the purpose for which they were originally collected. To exercise these rights, visit the Request change of details page on our website.
• In some cases, you can request a restriction of processing of your data, in which case we will retain them only for the purposes of defending against claims.
• In certain circumstances, and for reasons relating to your personal situation, you can oppose the processing of your data, The SJD Barcelona Children's Hospital will stop processing your data, except in the case of legitimate overriding circumstances, or to effect or counter potential claims.
• You have the right to portability, meaning any data you have provided to us can be directly transferred to another party in an accessible, readable and understandable format, whenever technically possible.

We may ask you to provide a photocopy of your National Identity Document (DNI) or equivalent ID document. If in-person, we may ask you to show this ID to confirm your identity. For digital identity verification, we will only store a copy of your ID until your identity has been verified, at which point it will be deleted from our servers.

If you are unsatisfied with the result of exercising your rights, you may submit a claim to the Catalan Data Protection Authority, or to the overseeing authority of your place of residence.

In any case, before submitting a claim, we request that you contact us by email at hospitalbarcelona.dpd@sjd.es so we may try to solve the issue amicably.

You may exercise the aforementioned rights by emailing hospitalbarcelona.dpd@sjd.es.

We aim to respond to queries as soon as possible and within one month. Should this not be the case, we apologise, and ask that you contact us again so we may attend to your query and rectify any potential technical error that may have impeded our timely response.

You may withdraw your consent to the processing of your data for the aforementioned purposes at any time, the legitimate basis of which being your consent, whenever you have given it. You cannot withdraw consent for data which we did not require consent to process.