Last updated: 18 October 2026
At GoalMedGroup we take care of your data. This policy explains clearly what data we process when you use this website, why, for how long, who we share it with and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).
1. Data controller
- Controller: GOALMED, S.L. ("GOALMED").
- Tax ID (NIF): B44905883.
- Address: calle Anselm Clavé, 64, 08912 Badalona (Barcelona), Spain.
- Email for privacy matters: info@goalmedgroup.es (subject "Privacy").
- Phone: +34 623 555 054.
Given the type of data it processes on this website, GOALMED is not required to appoint a data protection officer. For any question about your data, write to the address above.
2. Scope of this policy
It applies to the data we process through goalmedgroup.es: its forms, the WhatsApp and email links, and its technical operation. It does not apply to:
- the GoalUp and GoalUp Gestión apps (goalup.es), which have their own privacy policy and terms;
- the Gruk Salud website (gruk.es) or healthcare provided at the centre, which have their own privacy information;
- third-party websites we link to (WhatsApp, LinkedIn and others).
3. What data we process, why and for how long
| When | What data | Purpose | Legal basis | How long |
|---|---|---|---|---|
| Contact forms for centres and companies (home, GoalMed, GoalUp, GoalUp Gestión, Consulting and service pages) | Name, email, phone, centre or company, what you need (specialty, service or procedure) and your message, if you write one | Replying to you and, if you ask, preparing a proposal | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) | Up to 1 year from the last communication if you do not hire us; if you do, for as long as the relationship lasts plus legal periods |
| Form for professionals | Name, email, phone, profession and what you are looking for (shifts, a job, a consulting room or advice) | Replying to you and informing you about our services for professionals | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) | Up to 1 year from the last communication |
| Patient form | Name, phone, email and the reason (appointment at Gruk Salud, a transfer or another enquiry) | Passing your request to the group service that will help you, and replying | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) | Up to 1 year from the last communication |
| GoalTaxi form | Who is requesting, name, phone, email, pick-up, destination, day and time, and return trip | Organising and confirming the transfer | Pre-contractual steps or performance of a contract (Art. 6(1)(b) GDPR) | As needed for the transfer and then the legal invoicing periods (generally 6 years) |
| Spaces form | Name, email, phone, the option you are interested in, and your specialty and schedule | Giving you availability and price | Steps taken at your request before a contract (Art. 6(1)(b) GDPR) | Up to 1 year from the last communication |
| WhatsApp and email | What you write to us and your contact details | Replying to you | Pre-contractual steps or your consent when writing to us (Art. 6(1)(a) and (b) GDPR) | Up to 1 year from the last communication |
| Marketing communications | Name and email | Sending you news about our services | Your express consent (Art. 6(1)(a) GDPR and Art. 21 LSSI) | Until you unsubscribe |
| Website security | IP address, browser data and an anti-spam verification signal | Protecting the website and forms from attacks and spam, and checking that the sender is human | Legitimate interest in website security (Art. 6(1)(f) GDPR) | The minimum technical time; the provider's security logs, according to its policy |
Fields marked with an asterisk (*) in the forms are required to deal with your request. If you do not provide them, we will not be able to reply. The website form does not store your data in any database: it reaches us by email in our inbox. We do not make automated decisions or create profiles with your data.
4. Health data
We do not ask for health data on this website. Please do not write it in the forms or messages. If we receive it without asking, we will only use it to deal with your request and will delete it when no longer needed. Healthcare at Gruk Salud has its own privacy information.
5. Other people's data
If you give us someone else's data (for example, the patient for a GoalTaxi transfer or a colleague at your centre), you confirm that you have their permission and have informed them of this policy. You are responsible for the data being accurate.
6. Minors
This website is not aimed at children under 14. If you are under 14, ask your parent or guardian to contact us. If we learn that a child under 14 has written to us without that permission, we will delete their data.
7. Who we share data with
Within the group. If you ask for something provided by another part of the GoalMedGroup group (for example, an appointment at Gruk Salud or a GoalTaxi transfer), we pass your request on so they can help you.
Providers that help us (processors). They process data only on our instructions and under a contract that requires them to protect it:
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| Cloudflare, Inc. | Hosting the website, protecting it from attacks, verifying forms (Turnstile) and counting visits without cookies (Web Analytics) | United States and global network | EU-US Data Privacy Framework and standard contractual clauses |
| Resend | Sending the email with the form data to our inbox | United States | Standard contractual clauses or other Chapter V GDPR safeguards |
| Microsoft (Microsoft 365) | Email inbox where we receive and reply | European Union | Data processing agreement |
Others. We will only give data to courts, public authorities or other bodies when required by law. We do not sell your data or share it for advertising.
WhatsApp and LinkedIn. If you write to us on WhatsApp or interact with our LinkedIn page, those platforms (WhatsApp Ireland Limited and LinkedIn Ireland Unlimited Company) process your data under their own policies, as independent controllers.
8. International transfers
Some providers are based in the United States, so certain data may be processed outside the European Economic Area. We only do so with the safeguards of Chapter V GDPR: the EU-US Data Privacy Framework adequacy decision where the provider is certified, or the standard contractual clauses approved by the European Commission. You can ask us for more information at info@goalmedgroup.es.
9. Marketing communications
We will only send you news about our services if you have given your express consent. Every communication includes a link to unsubscribe, or you can write to info@goalmedgroup.es. Replying to your request is not a marketing communication.
10. Your rights and how to exercise them
You can exercise these rights at any time, free of charge:
- Access: find out whether we process your data and receive a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete it when it is no longer needed or you withdraw your consent.
- Objection: object to our processing it, for example for marketing.
- Restriction: ask us only to store it, without using it, while a complaint is resolved.
- Portability: receive it in a common format or have us send it to another organisation.
- Withdraw any consent you have given, without affecting anything done before.
How: write to info@goalmedgroup.es (subject "Privacy") or by post to calle Anselm Clavé, 64, 08912 Badalona, Spain, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you to prove it. We will reply within one month at most; for complex requests we may extend this by two more months, letting you know beforehand.
Complaints: if you believe we have not respected your rights, you can complain to the Spanish Data Protection Agency (AEPD, calle Jorge Juan, 6, 28001 Madrid; sedeagpd.gob.es). We would appreciate it if you wrote to us first so we can try to resolve it.
11. Security
We apply technical and organisational measures appropriate to the risk to protect your data against loss, unauthorised access or misuse. For example:
- the website only works over an encrypted connection (HTTPS);
- the forms are protected against spam and bots;
- the website does not store messages in any database;
- access to our systems is limited to the people who need it and protected with strong passwords and, where possible, two-factor authentication.
12. Changes to this policy
We may update this policy when the website, our services or the law change. The date of the last update is shown at the top. If the change is significant, we will indicate it visibly on the website.
In the event of any discrepancy, the Spanish version prevails.