Privacy Policy

Miguel Monllau Monfort (NIF ES73383415Y), Calle Doctor Coca 1, planta 1, puerta 1, 08700 Igualada, Barcelona, Spain — trading as “Clynalia” — operates clynalia.com and the Clynalia app. Contact: privacy@clynalia.com.

This policy covers three situations. For visitors of clynalia.com and for the professionals who use the app, Clynalia is the data controller. For the patients whose records a clinic keeps in Clynalia, the clinic is the controller and Clynalia is its processor, under the Data Processing Agreement signed with each clinic.

• What you send through the contact form: your name, your email address and, if you write one, your comment about your practice.
• Along with the message, the language of the page you write from and, if you arrived through a link from one of our campaigns, the name of that campaign. It tells us which channel works without any analytics.
• The IP address and browser it is sent from, to stop bulk submissions and abuse of the form.

We run no analytics on this site. No cookies, no tracking pixels, no third-party scripts, and no profiling of you across other sites. The campaign is read from the link itself when you send the form; nothing is stored in your browser. If that ever changes, it will be stated here before it does.

If you signed up for the launch notice before 14 October 2026, we will write to announce the launch, as we told you, and for nothing else.

If your clinic gives you access to Clynalia, we process the data needed to run your account and keep it secure:

• Your name, email address and role in the clinic, and your professional registration number if the clinic records it.
• Your password, stored only as a hash. If you add a passkey, its public key. If you link your Apple account, the identifier Apple assigns to you for Clynalia.
• The date, time and IP address of each sign-in, and — on Apple devices that support it — a device attestation, so that the account can only be used from the app.
• A log of each patient record you open. Clinics are legally required to know who accessed a clinical record, so this log is kept for the clinic and cannot be switched off.

The app contains no analytics, advertising or tracking SDKs. Nothing you do in the app is shared with third parties for their own purposes.

When a clinic uses Clynalia, the clinic is the controller of its patients' data and Clynalia is the processor.

• We process patient data only on documented instructions from the clinic.
• Categories: identification and contact details; tax identification number and address when the clinic invoices the patient; health data (anamnesis, examination, treatment, progress, recommendations, allergies, history and medication); and documents or images the patient provides.
• Clinical content is stored encrypted with a key per clinic, each clinic's data is isolated at the database level, and every access to a record is logged.
• Optional AI features. If the clinic enables the relevant feature and an authorised person requests it, Clynalia uses Amazon Bedrock to: (a) literally transcribe the visible text of a document; (b) organise its written information; or (c) draft a visit or episode-of-care report from notes already written by the professional.
• For the first two features, the selected PDF or image is sent with technical instructions. For visit reports, the history, examination, treatment, progress and recommendations notes are sent. For episode reports, the notes from its visits, with dates and session numbers, and the reason for consultation are sent; the episode’s diagnosis field is not sent. Clynalia does not add other identifying fields from the patient record, but the file or notes themselves may contain identifiers and health data.
• The result may contain errors or omissions. The purpose is documentary: the system must not supply new clinical interpretations, diagnoses or recommendations. A professional must compare it with the sources, correct or discard it and expressly decide whether to add or issue it. The identity shown in the report is added afterwards, outside the model call. The professional gives the report to the patient; Clynalia does not automatically send it to third parties.
• AWS provides inference within the verified EU boundary. Use requires assessed contractual and retention conditions. Sources, the AI draft, the reviewed text and their audit trails are kept under the policy applicable to each category. The sub-processor list describes services and safeguards. Clynalia does not use clinical records to train models.
• We do not sell data.
• Patients exercise their rights with the clinic, not with Clynalia. We assist the clinic in responding.

Clynalia is an invoicing system that complies with the Spanish VERI*FACTU rules (Royal Decree 1007/2023). When a clinic issues an invoice, a billing record is created with the recipient's name, tax identification number and address, the date, number and concept of the invoice, and its amounts. The clinic submits that record to the Spanish Tax Agency (AEAT) from its own computer, with its own digital certificate. The legal basis is compliance with a legal obligation.

Billing records contain no health data: the concept is the clinic's tariff (for example, “physiotherapy session”), never the content of the visit.

• Contact form: your consent when you send it and, if you ask us to set up your clinic, the pre-contractual steps you request. The IP address and browser: our legitimate interest in protecting the form from abuse.
• Launch notification list: your consent.
• Your account as a professional: performance of the contract with your clinic, and our legitimate interest in keeping the service secure. The access log: a legal obligation of the clinic.
• Legal basis for patient data. The clinic, as controller, determines and documents the applicable basis under GDPR Articles 6 and 9 and meets its information duties. Clynalia processes the data as a processor, on documented instructions and under the data processing agreement. Enabling the feature is an instruction from the clinic, not patient consent.
• Billing records: compliance with a legal obligation (tax and invoicing law).

• Contact form messages, with their IP address and browser: if your clinic signs up, they become customer data. If not, we delete them when you ask or, at the latest, twelve months after your last message.
• Launch notification list: until you unsubscribe.
• Professional accounts and sign-in logs: while the clinic is a customer, and afterwards for as long as needed to answer for legal liabilities.
• Patient records: as instructed by the clinic, within the legal retention periods for clinical records — at least five years from discharge from each care process under Spanish Law 41/2002, and the longer periods set by regional law, such as the fifteen years that apply to the clinical course in Catalonia. When a clinic leaves, its data is exported to the clinic and deleted under the DPA.
• Invoices and billing records: the tax limitation period of four years and the six-year commercial period, whichever applies to the clinic.

The providers we rely on to run Clynalia:

• Amazon Web Services (Stockholm region, Sweden): hosting, database, encryption keys, backups and — for AI document reading — Amazon Bedrock, run in a European Union region.
• Resend (United States): transactional email, such as password reset links and the internal notice of each contact form message. We never send clinical content by email. Transfers are covered by Standard Contractual Clauses.
• Cloudflare: authoritative DNS and inbound email routing for clynalia.com, under its Data Processing Addendum.
• Google (United States): the Gmail mailbox where we read the email you send to clynalia.com addresses and the contact form notices. Transfers are covered by Standard Contractual Clauses.

Apple (Sign in with Apple, passkeys, device attestation and the App Store) acts as an independent controller under its own privacy policy. We give clinics notice before adding a new sub-processor.

Patient records and account data are stored in the European Union. Resend, Cloudflare and Google may process the data described above outside the European Economic Area, under Standard Contractual Clauses. Submitting billing records to the Spanish Tax Agency is not a transfer.

You may request access, rectification, erasure, portability, or object to processing, by writing to privacy@clynalia.com. If you are a patient, address your request to your clinic, which is the controller of your record. You also have the right to lodge a complaint with your data protection authority — in Spain, the AEPD.

Last updated: 17 October 2026.