隐私政策

最后更新: January 2026

1. Identification of the Data Controller

2. Scope of Application

This 隐私政策 applies to all personal data collected through:

• The website https://owalls.com
• The OWALLS SaaS platform (web and mobile application)
• Communications via email, phone, or chat
• 联系 and registration forms

3. 个人数据 We Collect

3.1 Data you provide to us directly

a) Registration and 账户 Data

When creating an OWALLS account, we collect:

• First name and last name
• 邮箱 address
• 电话 number (optional)
• 牙科 clinic or practice name
• Tax ID of the professional entity
• 专业 address
• 密码 (stored using hash 加密)

b) 计费 and 支付 Data

To process subscriptions and payments:

• 姓名 or company name for invoicing
• Full tax address
• Tax ID
• Bank details (IBAN) for SEPA direct debit
• Credit/debit card details (processed directly by our payment provider, not stored by OWALLS)

c) Platform Usage Data

作者 using our services, you upload:

• 牙科 images: Photographs of clinical treatments
• Patient data: Information you voluntarily add (names, dates, clinical notes)
• Metadata: Technical information from images (capture date, device, camera settings)

d) Communications

• 消息s sent through the 联系 form
• Technical 支持 tickets
• Live chat conversations
• 邮箱s exchanged with our team

3.2 Automatically collected data

a) Browsing and Connection Data

• IP address
• Browser type and version
• Operating system
• Device type (computer, tablet, smartphone)
• Screen resolution
• Date and time of access
• Pages visited and time spent
• Referrer URL (page from which you arrived at the site)

b) Cookie and Similar Technologies

We use Cookie and similar tracking technologies. For detailed information, please see our Cookie 政策.

c) System Logs

We automatically record:

• Platform access (登录/logout)
• Actions performed within the application
• System errors and events
• Response times and performance

Retention: Logs are kept for 30 days (extendable due to legal or 安全 requirements).

4. Purposes and 法律 Basis for 专业版cessing

Purpose	法律 Basis (GDPR)
管理 of your user account Create, maintain, and manage your access to the platform	Art. 6.1(b) GDPR - Contract execution
专业版vision of the SaaS service Store, process, and manage 牙科 images using AI	Art. 6.1(b) GDPR - Contract execution
支付 processing and billing 订阅 collection and invoice issuance	Art. 6.1(b) GDPR - Contract execution Art. 6.1(c) GDPR - 法律 obligation (tax invoicing)
Customer service and technical 支持 Respond to inquiries, resolve issues	Art. 6.1(b) GDPR - Contract execution Art. 6.1(f) GDPR - Legitimate interest (service quality)
安全 and fraud prevention Detect unauthorized access, prevent abuse	Art. 6.1(f) GDPR - Legitimate interest (安全) Art. 6.1(c) GDPR - 法律 obligation (breach notification)
Service analysis and improvement Usage statistics, feature optimization	Art. 6.1(f) GDPR - Legitimate interest (product improvement)
Commercial communications Newsletters, product updates, offers	Art. 6.1(a) GDPR - 同意 (can withdraw at any time)
合规 with legal obligations Invoice retention, response to authorities	Art. 6.1(c) GDPR - 法律 obligation

4.1 专业版cessing of Health Data (Special Category)

When you upload 牙科 images containing patient data, OWALLS processes health data under the special category of Article 9 of the GDPR.

法律 basis:

• Art. 9.2(h) GDPR - Preventive medicine, medical diagnosis, healthcare provision
• Art. 9.3 GDPR - Data necessary for preventive or occupational medicine purposes

Your responsibility: As a healthcare professional, you must ensure:

• Obtain informed consent from your 患者 for processing their images
• Inform your 患者 about the use of cloud services
• Comply with professional secrecy and applicable healthcare regulations

5. Recipients of 个人数据

5.1 Internal Access

Within OWALLS, only employees and collaborators who need access to provide the service have access to your personal data, under strict confidentiality obligations.

5.2 Data 专业版cessors (Sub-processors)

We share your data with the following third parties acting as data processors under contract:

专业版vider	Service	Location
CONTABO GmbH	Server infrastructure and cloud storage	Germany (EU)
STRIPE	Card payment processing and SEPA direct debits	Ireland (EU)

All these providers are subject to Data 专业版cessing Agreements (DPA) that guarantee GDPR 合规.

5.3 Transfers Due to 法律 Obligation

We may share your data when legally required:

• Tax authorities (Agencia Tributaria) - invoices and tax data
• Law enforcement - in case of court order or criminal investigation
• Data protection authorities (AEPD) - in case of inspection

5.4 We Do Not Sell Your Data

6. International Data Transfers

6.1 Primary Data Location

Your data is primarily stored on servers located in the European Union (CONTABO data centers in Germany), ensuring full GDPR 合规.

6.2 Transfers Outside the EU (if applicable)

In the event we use providers with servers outside the European Economic Area (EEA), we guarantee the protection of your data through:

• Standard Contractual Clauses (SCC) approved by the European Commission
• Adequacy Decisions for countries with equivalent protection levels
• Additional 安全 guarantees (加密, pseudonymization)

7. Data Retention Periods

Data Type	Retention Period
账户 and profile data	While the account is active + 60 days after cancellation
Images and clinical data - Essential Plan	专业版cessed: While the account is active Originals: 12 月s from upload
Images and clinical data - 专业 Plan	专业版cessed and Originals: While the subscription is active + 60 days
Backup copies	DB: 30 days Full images: 12 月s Incremental images: 3 月s
计费 data	10 年s (legal tax obligation under Spanish legislation)
System logs	30 days (extendable for 安全 investigations)
支持 communications	2 年s from the last interaction
分析 Cookie	Up to 2 年s (depending on cookie settings)

After these periods, data will be securely deleted or irreversibly anonymized for statistical purposes.

8. Your 权利 Regarding Your 个人数据

In accordance with the GDPR and LOPDGDD, you have the following rights:

8.1 Right of Access (Art. 15 GDPR)

You may request information about what personal data we process about you, for what purposes, for how long, and with whom we share it.

8.2 Right of Rectification (Art. 16 GDPR)

You may request the correction of inaccurate or incomplete personal data. You can also update much of your data directly from your profile on the platform.

8.3 Right of Erasure - "Right to be Forgotten" (Art. 17 GDPR)

You may request the deletion of your personal data when:

• It is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis
• You object to the processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Exceptions: We cannot delete data when there is a legal obligation to retain it (e.g., tax invoices for 10 年s).

8.4 Right to Restrict 专业版cessing (Art. 18 GDPR)

You may request that we limit the use of your data in certain cases (e.g., while verifying the accuracy of data after a rectification request).

8.5 Right to Data Portability (Art. 20 GDPR)

You may request to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON, CSV) to transmit it to another provider.

Export feature: From your 控制台 you can export all your images and data at any time.

8.6 Right to Object (Art. 21 GDPR)

You may object to the processing of your data based on legitimate interest or for direct marketing.

Marketing opt-out: You can unsubscribe from commercial communications by clicking "unsubscribe" in any email or from your profile.

8.7 Right Not to Be Subject to Automated Decisions (Art. 22 GDPR)

Although we use AI to process images, we do not make automated decisions with legal or significant effects on you without human intervention.

AI processing is for technical assistance (classification, image optimization) and you always maintain control and professional oversight.

8.8 Right to Withdraw 同意

When processing is based on your consent (e.g., analytics Cookie, newsletters), you may withdraw it at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

8.9 How to Exercise Your 权利

8.10 Right to Lodge a Complaint with the Supervisory Authority

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the competent data protection authority:

9. 安全 Measures

OWALLS implements advanced technical and organizational measures to protect your personal data:

9.1 Technical 安全

• 加密: TLS 1.3 for data in transit, AES-256 for data at rest
• Authentication: bcrypt-hashed passwords, optional two-factor authentication (2FA)
• Firewall and DDoS protection: Advanced firewall, anti-attack protection
• Encrypted backups: Automatic backups with AES-256 加密
• Data isolation: Each client has an isolated private environment
• 24/7 Monitoring: Intrusion detection and suspicious activity monitoring
• 安全 updates: Regular patches and updates

9.2 Organizational 安全

• Restricted access: Principle of least privilege, authorized personnel only
• 保密 agreements: All personnel sign NDAs
• 安全 training: Regular data protection training
• Clean desk policy: 专业版tocols for devices and documents
• Incident response plan: 专业版cedures for 安全 breaches
• Periodic audits: 安全 and regulatory 合规 reviews

9.3 安全 Breach Notification

In the event of a 安全 breach affecting your personal data, we will comply with the GDPR:

• Notification to the AEPD: Within a maximum of 72 hours from becoming aware of the breach
• Notification to affected parties: If the breach poses a high risk to your rights and freedoms
• 文档: Detailed record of the incident, causes, and corrective measures

10. 隐私 of Minors

OWALLS is a professional service intended exclusively for 牙科 professionals over 18 年s of age.

We do not intentionally collect personal data from children under 16. If you become aware that a minor has provided personal data, please 联系 us immediately at info@owalls.com to proceed with its deletion.

10.1 Data of Minor 患者

If, as a 牙科 professional, you upload images of minor 患者:

• It is your responsibility to obtain consent from parents or legal guardians
• You must comply with applicable healthcare regulations on data of minors
• OWALLS acts solely as a data processor under your instructions

11. Cookie and Tracking Technologies

We use Cookie and similar technologies to improve functionality and user experience.

11.1 Types of Cookie We Use

a) Strictly Necessary Cookie (Do not require consent)

• Authentication: Keep your session securely logged in (JWT)
• 安全: CSRF protection, attack prevention
• 支付s: Secure transaction processing (Stripe)

b) 分析 Cookie (Require consent)

• Usage statistics: Most visited pages, time spent, navigation flow
• Performance: Load times, technical errors
• Anonymized data: Do not personally identify individual users

11.2 Cookie 管理

When accessing our website, a cookie consent banner will be displayed. You can:

• Accept all: Essential + analytics Cookie
• Essential only: Reject analytics Cookie
• Customize: Choose specific categories

You can change your preferences at any time by clicking on "Cookie 设置" in the footer.

For more information, please see our full Cookie 政策.

12. 链接 to Third-Party Websites

Our website may contain links to third-party websites (e.g., social media, technical documentation, external blog articles).

OWALLS is not responsible for the 隐私 practices of third-party websites. We recommend reading the 隐私 policies of any external site you visit.

13. Modifications to this 隐私政策

OWALLS reserves the right to modify this 隐私政策 to:

• Adapt to regulatory changes (new laws, case law)
• Reflect changes in our data processing practices
• Incorporate new service 功能
• Improve clarity and transparency

13.1 Notification of 变更

In the event of substantial modifications:

• The updated version will be published on this page with a new "最后更新" date
• Notification will be sent by email to registered users
• A prominent notice will be displayed on the platform
• 用户 will have 30 days to review the changes before they take effect

We recommend reviewing this policy periodically to stay informed about how we protect your information.

14. Applicable Data 专业版tection Regulations

This 隐私政策 complies with:

• Regulation (EU) 2016/679 - General Data 专业版tection Regulation (GDPR)
• Organic Law 3/2018, of 5 December - 个人数据 专业版tection and Guarantee of Digital 权利 (LOPDGDD)
• Law 34/2002, of 11 July - Information Society Services and Electronic Commerce (LSSICE)
• Directive 2002/58/EC - 隐私 and electronic communications (e隐私 Directive)
• Regulation (EU) 2024/1689 - Artificial Intelligence (AI Act) - for transparency in AI use

15. 联系 Information - Data 专业版tection

16. OWALLS as Data 专业版cessor of Health Data

16.1 Contractual Relationship with the Controller (牙科 专业)

When you, as a healthcare professional, upload health data of your 患者 to OWALLS:

• You are the Data Controller: Determines purposes and means of processing your 患者' data
• OWALLS is the Data 专业版cessor: 专业版cesses health data only according to your instructions

16.2 义务 of OWALLS as Data 专业版cessor (Art. 28 GDPR)

We undertake to:

• 专业版cess data only according to your documented instructions
• Ensure that authorized personnel are subject to confidentiality
• Implement appropriate technical and organizational measures (see section 9)
• Not subcontract without your prior informed authorization
• Assist you in responding to data subjects' exercise of rights
• Assist you in 合规 with 安全 obligations and impact assessments
• Delete or return data upon termination of the service (except legal retention obligations)
• Make available information to demonstrate 合规
• Notify 安全 breaches affecting health data

16.3 Your 义务 as Data Controller

As a healthcare professional, you must:

• Obtain informed consent from your 患者 for the processing of their data
• Inform 患者 about the use of cloud services
• Comply with the duty of professional secrecy
• Implement 安全 measures on your side (strong passwords, 2FA, etc.)
• Not upload more health data than strictly necessary
• Review and accept the Data 专业版cessing Agreement (DPA)

16.4 Data 专业版cessing Agreement (DPA)

作者 accepting the 条款 of Service, you accept the Data 专业版cessing Agreement which forms part of the contractual agreement and complies with Article 28 of the GDPR.

---

OWALLS 隐私政策 - Version 1.0
最后更新: January 2026
For inquiries about this policy: info@owalls.com