Privacy Policy

1. Data controller

Vendora Solutions S.L. (hereinafter, "Serenna") is the entity responsible for processing your personal data.

• Tax ID (CIF): B21816756
• Address: Carretera Barcelona 552, 2-3, 08204 Sabadell, Barcelona, Spain
• Contact email: info@serenna.es

2. Data we collect

We collect the following types of data depending on how you interact with our service:

2.1. Data you provide

2.2. Data generated by use of the service

• Activity records and access logs
• Usage and navigation data within the platform
• IP address and device technical data

2.3. Health data (special category)

Patient data (medical records, diagnoses, treatments) is entered by the clinics that use Serenna. Serenna acts as the data processor for this data, with the clinic being the data controller.

3. Purposes of processing

• Provision of the contracted service (clinic management)
• User account management and billing
• Sending service-related communications
• Product improvement through anonymous usage analytics
• Compliance with legal obligations

4. Legal basis for processing

5. Data recipients

Your data may be shared with the following third parties, always under appropriate safeguards:

• Stripe, Inc. — Payment processing (with standard contractual clauses)
• Google LLC — Web analytics (Google Analytics 4, Google Tag Manager), advertising conversion measurement (Google Ads) and calendar services. To attribute conversions to our Google Ads campaigns we may share with Google contact data you provide (such as your email), always hashed (the "Enhanced Conversions" feature). This data is only shared if you have accepted marketing cookies.
• Meta Platforms, Inc. — WhatsApp Business API integration and conversion tracking via Meta Pixel (ID: 1645822426520382). Meta Pixel collects browsing data (pages visited, actions taken, device data and IP address) to measure the effectiveness of advertising campaigns on Facebook and Instagram. The associated cookies are _fbp and _fbc, detailed in our Cookie Policy. More information in Meta's Privacy Policy.
• Google Cloud Platform (Firebase) — Data hosting and database on servers within the EU

We do not sell or transfer personal data to third parties for commercial purposes.

6. International transfers

Some of our providers (Stripe, Google, Meta) may process data outside the European Economic Area. In all cases, the Standard Contractual Clauses (SCC) approved by the European Commission apply and/or the provider is certified under the EU-US Data Privacy Framework (DPF).

7. Data retention

• Account data: while the account is active + 5 years after closure
• Billing data: 6 years (tax obligation)
• Patient data: as per applicable health regulations (minimum 5 years after the last treatment)
• Access logs: 12 months

8. Your rights

As the data subject, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate or incomplete data
• Erasure: request the deletion of your data
• Portability: receive your data in a structured format
• Objection: object to certain processing
• Restriction: request the restriction of processing
• Withdrawal of consent: you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7.3 GDPR)

To exercise these rights, send an email to info@serenna.es stating your name, the email associated with your account and the right you wish to exercise. We will respond within a maximum of 30 days.

8b. Automated decisions

Serenna does not make decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect the user (Art. 22 GDPR).

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

9. Security

We implement technical and organisational measures to protect your data:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Secure authentication and session management
• Daily encrypted backups
• Access restricted to authorised personnel
• Monitoring and periodic audits

10. Cookies

We use first- and third-party cookies (Google Analytics, Meta Pixel) to analyse the use of the site and measure the effectiveness of our campaigns. For more detail on the cookies we use, their purpose and duration, see our Cookie Policy.

11. WhatsApp communications (Meta's WhatsApp Business Platform)

When your clinic has enabled the WhatsApp channel and you have given your consent, we use the WhatsApp Business Platform, provided by Meta Platforms Ireland Ltd. ("Meta"), to send you communications related to your care.

Roles. Your clinic is the data controller. Vendora Solutions S.L. acts as a data processor (Art. 28 GDPR), operating the WhatsApp channel on the clinic's behalf. Meta acts as a sub-processor.

Data processed through this channel. Your phone number, your name, the content of the messages exchanged (appointment reminders and confirmations, change or cancellation notices, and replies to your inquiries), and technical delivery metadata (sent/read status, timestamps). To onboard and maintain the clinic's account we also process the WhatsApp Business Account ID, the clinic's phone number, and the message templates.

Purpose. To send you appointment reminders and confirmations, change or cancellation notices, and to reply to your service inquiries. We do not use this channel for advertising or marketing communications unless you have given specific additional consent. We do not sell your data and we do not share it with Meta for its own advertising purposes.

Legal basis. Your consent for the use of the WhatsApp channel (Art. 6.1.a GDPR) and, for messages about an appointment you have already booked, performance of the service relationship (Art. 6.1.b GDPR). Because an appointment reminder may reveal that you are a patient (a special category of data), processing also relies on your explicit consent (Art. 9.2.a GDPR).

Retention. We retain the content of conversations for a maximum of 12 months from sending, and the delivery metadata (sent/read status, timestamps, technical identifiers and the record evidencing the send) for a maximum of 24 months, for the provision, traceability and proof of lawfulness of the service, unless a longer legal retention obligation applies or you request earlier deletion. Clinically relevant content is recorded in your medical record, subject to its own legal retention period (Spanish Law 41/2002). After those periods, the data is deleted automatically.

International transfers. Meta may process this data outside the European Economic Area, applying appropriate safeguards through the European Commission's Standard Contractual Clauses.

Your rights and data deletion. You may exercise your rights of access, rectification, erasure, restriction, portability and objection —including the deletion of data processed through WhatsApp— by writing to info@serenna.es. We will respond within one month. You may withdraw your consent to this channel at any time, without affecting the provision of the service, by replying STOP to any message or by writing to that address. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

12. Deletion of your data

To request the deletion of the data we process about you, including WhatsApp messages, write to info@serenna.es stating your name and phone number. We will delete your data within a maximum of one month, unless a legal retention obligation applies.

13. Changes

We may update this policy to reflect changes in our practices or in the law. We will notify significant changes by email or through a notice on the platform.