Privacy policy

Last updated: 1 November 2026

Service provider

• Trade name: DuDoctor
• Company name: Excelvion, SLU
• Registered office: Carretera Engolasters 53, Escaldes
• Registration details: Registered in the Companies Register under registration number 26506, book S-510, folios 51-60, with tax registration number L-721597Y
• Contact email: hello@dudoctor.com
• Data protection contact: hello@dudoctor.com
• Website: https://dudoctor.com

1. Who processes your data

The data controller is the Provider identified at the top of this page. This policy explains, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), what data we process, why, on what legal basis, for how long and with whom we share it. For any data protection matter or to exercise your rights, write to us at hello@dudoctor.com.

2. What data we process

• Identification and contact: first name and surname, email, telephone, date of birth, sex, address and identity document number.
• Health data: answers to the clinical questionnaires, medical history, medication, photographs and documents you attach, messages with the medical team, assessments, treatment plans and prescriptions.
• Purchase and billing data: service purchased, amounts, invoices and subscription status. We do not process your full card details, which are handled directly by Stripe.
• Technical and security data: IP address, access logs, session identifier, language, device and, if you enable them, your push notification subscription.
• Optional browsing data: only if you accept analytics and advertising measurement cookies (see the Cookie policy): pages visited, interactions and steps of the purchase process, cookie identifiers, and browser and device data.
• Questionnaire draft in your browser: while you fill in a questionnaire, your answers (never photographs) are stored temporarily in your own browser’s local storage so you can pick up where you left off. They are deleted when you submit the consultation, when you log out or after a period without changes (2 hours by default and never more than 48 hours).

Health data is a special category of data and receives enhanced protection. We do not process data of persons under 18.

3. Purposes and legal bases

• Creating and managing your account and patient area — Legal basis: Performance of the contract (Art. 6(1)(b) GDPR)
• Providing medical care: assessing your case, replying, following up and, where applicable, issuing prescriptions — Legal basis: Performance of the contract (Art. 6(1)(b)) and, for health data, the provision of healthcare by professionals bound by professional secrecy (Art. 9(2)(h) and 9(3) GDPR)
• Keeping and safeguarding your medical record — Legal basis: Legal obligation (Art. 6(1)(c) GDPR; Spanish Law 41/2002) and Art. 9(2)(h) GDPR
• Charging for services, issuing invoices and managing subscriptions — Legal basis: Performance of the contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c))
• Sending you service notices by email or push (new reply, renewal, security), which never include health information — Legal basis: Performance of the contract (Art. 6(1)(b)); push notifications also require you to enable them in your browser
• Handling your requests, complaints and the exercise of your rights — Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
• Protecting the platform: fraud prevention, access control and security logs — Legal basis: Legitimate interest in ensuring the security of the service (Art. 6(1)(f)) and the security obligation (Art. 32 GDPR)
• Website usage analytics, conversion measurement, personalised advertising and remarketing with Meta and Google (see section 7) — Legal basis: Consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE) given in the cookie notice, which can be withdrawn at any time
• Sending you marketing communications — Legal basis: Consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE). Never based on your health data

4. Automated rules in the questionnaire

The questionnaire applies predefined clinical rules to detect contraindications or warning signs and, for example, to tell you to go to an emergency department or that your case cannot be handled online. These rules are an aid: no decision about your treatment is taken without review by a doctor. If the questionnaire stops you from continuing and you disagree, you can ask for a doctor to review your case, express your point of view and contest the outcome by writing to hello@dudoctor.com (Art. 22 GDPR).

5. Retention periods

• Medical record (questionnaires, images, messages, assessments and prescriptions) — Period: At least 5 years from the discharge date of each care episode (Art. 17 Spanish Law 41/2002), or any longer period required by applicable regional legislation
• Account data — Period: While the account is active; afterwards, blocked for the applicable limitation periods
• Invoices and accounting records — Period: 6 years (Art. 30 Spanish Commercial Code) and 4 years for tax purposes (Spanish General Tax Act)
• Security and access logs — Period: 12 months
• Rights requests and complaints — Period: While they are handled and, afterwards, for the applicable limitation periods
• Analytics, advertising measurement and marketing communications — Period: Until you withdraw your consent; cookies, for the duration stated in the Cookie policy

When the period expires, the data are securely deleted or anonymised. During the blocking period they are available only to courts and competent authorities.

6. Who can access your data

Within DuDoctor, only the medical team handling your consultation can access your health data, and support staff can only access the administrative data needed to help you. All are bound by confidentiality and doctors by professional secrecy.

The platform, its databases and the sending of service emails run on a private internal server under the Provider’s control, without external hosting or email providers. The following third parties are also involved:

• Stripe Payments Europe, Ltd. — Service and role: Payment and subscription processing. Processor (Art. 28 GDPR) and independent controller for its fraud-prevention and anti-money-laundering obligations — Location / safeguards: European Union; possible transfers to Stripe, Inc. (USA) under the EU-U.S. Data Privacy Framework and standard contractual clauses
• Push notification service of the browser you use (for example, Google, Apple or Mozilla) — Service and role: Delivery of push notifications, without health content — Location / safeguards: Depending on the browser provider
• Google Ireland Limited (only with your consent) — Service and role: Google Tag Manager, Google Analytics 4 and, where applicable, Google Ads: analytics, conversion measurement and remarketing. Processor (Analytics) and independent controller (advertising features). See section 7 — Location / safeguards: Ireland (EU); possible transfers to Google LLC (USA) under the EU-U.S. Data Privacy Framework
• Meta Platforms Ireland Limited (only with your consent) — Service and role: Meta pixel and, where applicable, the Conversions API: conversion measurement, personalised advertising and remarketing on Facebook and Instagram. Joint controller with DuDoctor for the collection and transmission of the data (Art. 26 GDPR) and independent controller of further processing. See section 7 — Location / safeguards: Ireland (EU); possible transfers to Meta Platforms, Inc. (USA) under the EU-U.S. Data Privacy Framework

We may also disclose data to pharmacies when you present your prescription, to the tax authorities, to courts and to health authorities where required by law. We do not sell your data. You can object to analytics and advertising measurement at any time by rejecting or withdrawing your cookie consent.

7. Analytics, measurement and advertising with Meta and Google

DuDoctor works with Meta (Facebook and Instagram) and Google to analyse how the website is used, measure the effectiveness of its campaigns and show DuDoctor advertising. This processing is only activated if you click “Accept” in the cookie notice; if you reject, none of these tools is loaded.

• Meta Platforms Ireland Ltd. (Facebook, Instagram) — Tools: Meta pixel and, where applicable, the Conversions API (sending the same events from our server) — Role: Joint controller with DuDoctor for the collection and transmission of the data (Art. 26 GDPR; CJEU judgment of 29 July 2019, Fashion ID, C-40/17), under Meta’s Controller Addendum. Meta is the sole controller of any further processing it carries out
• Google Ireland Ltd. — Tools: Google Tag Manager, Google Analytics 4 and, where applicable, Google Ads — Role: Processor for Google Analytics; independent controller for the advertising features of Google Ads (conversion measurement and remarketing)

Purposes

• Analytics: knowing how many people visit the website, which pages they view and how they use it, in order to improve it
• Conversion measurement: knowing whether a visit, sign-up or purchase comes from one of our ads and how much each campaign costs
• Personalised advertising and remarketing: showing you DuDoctor ads on Facebook, Instagram and the Google network if you have visited our website, and reaching people with similar interests. We do not build audiences from health data

Data involved

• Identifiers: cookie identifiers (_fbp, _fbc, _ga…), ad click identifiers, IP address, and browser and device data.
• Browsing events: pages viewed and general interactions with the website.
• Purchase events: that a purchase has been started or completed, with its amount and currency.
• Where applicable, to attribute a conversion, your email or phone number irreversibly encrypted (hashed), never in clear text.

We do not send Meta or Google any health data, questionnaire answers, diagnoses or prescriptions.

Legal basis

Your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE), which you give by clicking “Accept” in the cookie notice. It is voluntary: if you do not give it, you can still use DuDoctor and purchase any consultation.

International transfers

Meta Platforms, Inc. and Google LLC, in the United States, may access this data. Both are certified under the EU-US Data Privacy Framework, covered by the European Commission’s adequacy decision of 10 July 2023; standard contractual clauses apply in addition.

Retention

Cookies last for the periods stated in the Cookie policy. Data received by Meta and Google is kept in accordance with their own policies and the settings of our accounts.

How to withdraw your consent

You can withdraw it at any time, as easily as you gave it, via the Cookie preferences link in the footer. From then on these tools are no longer loaded; withdrawal does not affect the lawfulness of earlier processing. You can also delete cookies in your browser.

More information and ad settings

• Meta: Privacy policy · Ad preferences · Controller Addendum
• Google: Privacy policy · How Google uses information from sites that use its services · My Ad Center · Google Analytics opt-out browser add-on

8. International transfers

The platform is hosted on a private internal server. Stripe, Google and Meta may process some data in the United States; they do so with appropriate safeguards: the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework or, failing that, standard contractual clauses. You can request information about these safeguards at hello@dudoctor.com.

9. Security

Your answers, messages and history are stored encrypted and the connection to the website is encrypted too. Photos and documents are not accessible through a public link: they are only shown after logging in and checking permissions. Emails and notifications only tell you there is something new in your private area, without mentioning the reason for your consultation.

10. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given without affecting the lawfulness of prior processing. In your patient area you can view and correct your data and download a full copy. For anything else, write to hello@dudoctor.com stating the right you are exercising. We will reply within one month, extendable by two further months in complex cases, in which case we will inform you within the first month.

Please note that erasure does not extend to the medical record while the statutory retention period is running, nor to data we must keep for tax obligations.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority where you live.

11. Changes to this policy

If we make material changes to this policy, we will inform you by email or in your patient area before the change applies.