Translation for information only. In case of discrepancy, the Spanish version prevails.
Privacy policy
This policy explains how we process the personal data of people who contact La Fábrica de tu Sonrisa through this website, WhatsApp, telephone or email, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
Sonrisa en Ruta, S.L. · CIF B05758974 · Calle Rosselló, nº 68, PB, 08029 Barcelona · taller@lafabricadetusonrisa.com · Tel. 667 96 26 01
Data Protection Officer (DPO): Isabel Castillo de la Fuente. You can contact her at taller@lafabricadetusonrisa.com, marking your message “For the attention of the DPO”.
2. What data we process
This website has no forms and does not create user accounts. We only process the data you give us when you contact us (name, telephone, email and the reason for your enquiry) and, if you become a patient, the data needed for your healthcare, including health data.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Answering your enquiries and managing your appointments | Pre-contractual measures taken at your request (Art. 6.1.b GDPR) and your consent when contacting us |
| Providing healthcare and managing your medical record | Provision of healthcare (Art. 9.2.h GDPR) and compliance with legal obligations (Art. 6.1.c GDPR; Spanish Law 41/2002 and Catalan Law 21/2000) |
| Check-up reminders | Legitimate interest in following up your oral health; you may object at any time |
| Invoicing, accounting and tax obligations | Compliance with legal obligations (Art. 6.1.c GDPR) |
4. Minors
Data of children under 14 are only processed with the consent of their parents or legal guardians, who will request the appointment and receive information about the treatment. From the age of 14, minors may consent to the processing of their contact details; for healthcare, patient autonomy legislation applies (Law 41/2002 and Law 21/2000).
5. Communications
We do not send advertising or commercial communications that you have not expressly requested or authorised (Art. 21 LSSI-CE). You can stop messages about your appointments or check-ups at any time by replying “STOP” or writing to taller@lafabricadetusonrisa.com. We do not make decisions based solely on automated processing or create profiles.
6. Retention period
Contact details are kept for as long as the relationship lasts and, afterwards, for the legal limitation periods. Clinical records are kept for the periods required by healthcare regulations (in Catalonia, generally at least fifteen years from the discharge date of each episode of care).
7. Recipients
We do not share your data with third parties except where required by law (for example, health or tax authorities) or where necessary for your treatment (for example, a dental laboratory or, with your authorisation, your insurer). We use providers acting as data processors with the safeguards of Art. 28 GDPR, including our web host (Netlify, Inc.), which may involve transfers to the USA covered by the EU-US Data Privacy Framework or standard contractual clauses. If you choose to contact us via WhatsApp, that service is provided by WhatsApp Ireland Ltd. under its own privacy policy.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to taller@lafabricadetusonrisa.com or to our postal address, with the subject “Data protection” and stating the right you are exercising. We may ask you to prove your identity to avoid disclosing data to third parties. You may also withdraw any consent you have given at any time, without affecting the lawfulness of prior processing. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
9. Security and professional secrecy
We apply technical and organisational measures appropriate to the nature of the data, especially health data, to prevent loss, alteration or unauthorised access. Our whole team is bound by confidentiality and medical professional secrecy, including after their relationship with the clinic ends.
10. Social media
If you follow or interact with our social media profiles, we will process your data within the limits each network allows and only to manage that relationship. Please do not use social media or public comments to send us information about your health: write to us privately instead.
11. CVs
If you send us your CV, we will process it only for the clinic's recruitment processes, on the basis of your consent, and keep it for a maximum of one year. We will then delete it securely.
12. Changes to this policy
We may update this policy to reflect legal changes or changes to our services. The current version will always be published on this page. In case of any discrepancy with this translation, the Spanish version prevails.
Last updated: octubre de 2026.