Data protection information notice for patients

The data protection information notice for patients is the text with which the clinic tells each patient who processes their data, for what purpose and on what basis, to whom it is disclosed, how long it is kept and what rights they have. It is given when the data is collected, and the LOPDGDD (Spain's Organic Law on Data Protection and Digital Rights) allows it to be delivered in layers.

What information must be given

The information to be given is set by article 13 of the General Data Protection Regulation (GDPR) for cases where the data is obtained from the patient themselves. It is one of the basic building blocks of data protection in a clinic, and this is what it requires, with what it means in a practice:

What the GDPR requires	In a clinic
The identity and contact details of the controller	Who the clinic is (its name or company name) and how to contact it.
The contact details of the data protection officer, where applicable	If the clinic has one. When one is needed is covered in the data protection officer in a clinic.
The purposes of the processing and its legal basis	What you use the data for, such as care or invoicing, and what each use relies on.
The recipients of the data, where applicable	To whom it is disclosed, if it is disclosed to anyone.
The intention to transfer the data to a third country, where applicable	Only if it is planned to leave for a third country or international organisation.
The retention period, or the criteria used to determine it	How long you keep each thing. For the medical record, Ley 41/2002 (Spain's patient autonomy law) sets a minimum, which we explain in how long to keep a medical record.
The rights of access, rectification, erasure, restriction, objection and portability	That they exist and how to exercise them.
The right to withdraw consent, where the processing is based on it	Only for what relies on their consent, such as sending advertising.
The right to lodge a complaint with a supervisory authority	According to the AEPD guide, with the Spanish Data Protection Agency (AEPD), or with the Catalan, Basque or Andalusian authority if the centre is part of the public health service of that region.
Whether providing the data is a legal or contractual requirement, and the consequences of not providing it	Which data is essential to book an appointment or invoice them.
Automated decision-making and profiling, if any	Only if there is any.

When it must be given

The information is given when the data is collected: the GDPR says the controller shall provide it “at the time when personal data are obtained”. In a clinic, that moment is usually patient registration, before the first visit. There are three nuances:

• If they already have it, there is no need to repeat it. Article 13 does not apply where and insofar as the patient already has the information, so it does not have to be given at every visit.
• If you are going to use the data for another purpose, for example to send them news from the clinic, you must tell them about that purpose before you start. And that purpose may also require their consent.
• If the data does not come from the patient themselves, article 14 of the GDPR applies, with its own exceptions: as a rule, you must inform them within a reasonable period and at the latest within one month, or sooner if you are going to contact them or disclose their data to another recipient. In that case, the LOPDGDD adds to the basic information the categories of data and the sources they come from.

Layered information

Layered information is a way of informing without handing over a whole leaflet at the counter. The LOPDGDD allows the duty to inform to be met by giving the patient basic information and pointing them to an electronic address or other means that lets them access the rest of the information simply and immediately. Its preamble calls it “información por capas” (layered information), and the AEPD explains it in its guide for patients as giving the essentials and referring to the website or a leaflet for the rest.

The basic information must contain, at least:

• the identity of the controller and of their representative, where applicable;
• the purpose of the processing;
• the possibility of exercising the rights set out in articles 15 to 22 of the GDPR.

If the data is going to be used for profiling, the basic information must also say so. The rest of the table above can go in the second layer, provided the patient can reach it simply and immediately.

Layer	What it contains	Where it can go
First	Who processes the data, for what purpose, what rights the patient has and where to read the rest.	In the document the patient reads at registration.
Second	All the information in the table above.	On the clinic's website, with a copy to hand at reception.

How to write it so it is understood

A notice is understood when it answers simple questions in short sentences. The form is also in the rules: the GDPR requires the information to be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and says it is given in writing or by other means, including, where appropriate, by electronic means.

1. Informing is not asking for permission. The AEPD guide for patients puts it this way: when someone goes to a healthcare centre to receive care, their consent to process their data generally does not need to be requested, but they must be informed. We explain this in informed consent and data protection.
2. What does need consent, separately. If on the same sheet you ask for something that does need it, such as receiving advertising, the GDPR requires that request to be clearly distinguishable from the other matters.
3. Organised by questions: who processes the data, for what, to whom it is disclosed, how long it is kept and what the patient can do.
4. Nothing copied from another clinic. The purposes, recipients and retention periods have to be yours.

How to hand it over at reception without paperwork

At reception, the practical approach is to hand over the first layer at registration and leave the second one a link away. One way to organise it:

1. At registration, the first layer goes in a document the patient reads on the tablet and signs. A signature is not the only way to inform, but it helps you prove it: the GDPR makes the controller responsible for compliance and requires them to be “able to demonstrate” it.
2. The second layer, in your website's privacy policy, with the address written in the document itself, and a printed copy at reception for anyone who asks.
3. If something changes, such as a new purpose or a new provider, update the second layer and, if it is a new purpose, inform before you start.
4. With a record: keep the signed document in the patient's file and note which version of the text was in force.

How Mi Clínica does it

In Mi Clínica, when a patient is registered, the “Protección de datos (RGPD)” (Data protection (GDPR)) box comes ticked: on saving, that patient's data protection document is generated for them to sign. The patient signs it on the tablet, and the signature is stored as evidence that cannot be modified.

The text this document comes with as standard is short: it says what the data is processed for (care management, administration and communication with the patient) and how to exercise their rights. It does not replace your full information: check with your adviser that your first layer includes everything the law requires, including where to find the rest.

What the software does not do: it does not draft your notice, publish your privacy policy or decide your clinic's purposes or retention periods. The summary of how documents work is in documents and signing (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.
• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Guía para pacientes y usuarios de la Sanidad. AEPD.
• Ley 41/2002, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica (texto consolidado). BOE.