Privacy policy

1. Controller and privacy contact

Cell4Care Spain, S.L.

Carrer de Fray Luis de León, 5, 07011 Palma, Illes Balears, Spain

Email: centro.medico@iune-4dlongevity.com

Telephone: +34 871 621 622

Privacy contact: Gabriele Albrecht. For information, to exercise your rights or for questions about processing, please use the email address above.

2. Scope and current status

This notice covers the new IUNE Medical Center website, its contact form and voluntary patient survey. It does not cover separate medical records or a standalone IUNE Score application. Software screens are illustrations; this website does not connect wearables or retrieve health readings.

The website at iune-4dlongevity.es is publicly accessible. The contact form and patient survey use Resend for email delivery and Cloudflare Turnstile for spam protection. The survey area is password-protected.

3. Page access and technical delivery

The website is hosted through OpenAI Sites using Cloudflare infrastructure. Access involves processing technical data such as IP address, requested URL, time and browser information to deliver content and detect faults or abuse.

Technical delivery and security processing is based on our legitimate interest in a functional, secure website under Article 6(1)(f) GDPR. Provider information: https://openai.com/policies/privacy-policy/ and https://www.cloudflare.com/privacypolicy/

Fonts, images and icons are served with the website, without external font or image services. No analytics, advertising or social-media tracking services are configured.

4. Contact and appointment requests

The contact form requests name, email, subject and message. Phone and preferred appointment date are optional, except a phone number is required for callbacks. It also records your chosen contact method and acknowledgement of the privacy notice.

Clicking “Send enquiry” transmits your details to our server and, after a successful security check, through Resend to centro.medico@iune-4dlongevity.com. Your email address is used as the reply-to address. The website does not create its own contact database.

We use the details to handle your enquiry and respond as requested. Contract-related enquiries rely on Article 6(1)(b) GDPR. Other enquiries rely on Article 6(1)(f), our legitimate interest in responding. Acknowledging the privacy notice is not marketing consent.

We cannot process the form without the required contact details. You can also call or email us. An enquiry is not a confirmed booking. Please do not enter findings, diagnoses or other confidential health information.

5. Voluntary patient survey

The survey helps us understand prospective patients’ needs, interests and expectations. Depending on your choices, it processes age group, residence context, interests, preferred services, organisational preferences, budget and optional free-text answers. Questions may be skipped. Names and contact details are not requested.

While you complete the survey, answers remain in the page’s memory. Only after your explicit consent and clicking “Submit survey” are they transmitted and, following a successful security check, emailed through Resend to centro.medico@iune-4dlongevity.com. There is no separate survey database; answers are not stored in localStorage or cookies.

We evaluate responses to develop our services on the basis of your voluntary consent under Article 6(1)(a) GDPR. Where responses reveal health information, we also obtain your explicit consent under Article 9(2)(a) GDPR. Please do not include diagnoses, names or information about other people in free-text fields.

Not asking for names does not guarantee complete anonymity: free text and technical connection data can identify someone. The application does not add an IP address to the results email. This website does not automatically transfer answers to an embassy or referral partners.

Requests for the 10% benefit use a separate email link. Survey answers are not automatically included. Voluntarily supplied contact details are used to handle that request under Article 6(1)(b) GDPR.

6. Spam protection with Cloudflare Turnstile

We use Cloudflare Turnstile by Cloudflare, Inc. in Managed mode. The security check loads in the contact form and at the final survey step, before submission. The additional pre-clearance feature is disabled.

Security checks provide Cloudflare with browser, device and connection information, including the connecting IP address. Our server verifies the token with Cloudflare. Our application does not pass completed form answers to Turnstile.

The check prevents automated or abusive submissions under Article 6(1)(f) GDPR. Our legitimate interest is protecting our forms and email inbox. IUNE does not use it for advertising or audience measurement.

Cloudflare Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/

7. Email delivery with Resend

Resend (Plus Five Five, Inc.) delivers form messages from the server. It receives form content, sender and recipient details and technical delivery information. For contact enquiries, your email is passed as the reply-to address. Ireland (eu-west-1) is configured as the sending region; this does not mean that all data is processed exclusively in Europe.

Delivery serves the purposes and legal bases described for contact and survey processing. No separate database copy is kept by the website; the provider and recipient mailbox may still store messages. Confirmation indicates provider acceptance, not necessarily inbox delivery.

Provider information: https://resend.com/legal/privacy-policy

8. Recipients and processing outside the EEA

Recipients are authorised IUNE Medical Center staff and service providers for hosting, security, email delivery and the receiving mailbox. The website uses OpenAI Sites, Cloudflare and Resend for these purposes. Disclosures required by law remain possible.

These services may process data outside the European Economic Area, particularly in the United States. Selecting Ireland as the sending region does not exclude such transfers.

The providers publish information on data processing and international transfers, including standard contractual clauses: https://resend.com/legal/dpa and https://www.cloudflare.com/cloudflare-customer-dpa/ Please contact our privacy contact for information on the contractual safeguards applicable to your data.

9. Cookies and browser storage

We use our own cookie notice. No analytics or marketing cookies are configured. You can reopen the information at any time using “Cookie settings” in the footer.

After the delivery provider accepts a survey, the application sets the necessary “iune_survey_receipt” cookie. It contains a signed timestamp and random identifier, not answers. It enables the confirmation view at /umfrage/danke and expires after 24 hours. Without valid confirmation, only a preview is shown.

The receipt cookie applies across the website (Path=/) so the thank-you page works in every language. It is HttpOnly, Secure and SameSite=Lax. It confirms your requested submission under Article 6(1)(f) GDPR and can be deleted in your browser settings.

The contact form sets no receipt cookie of its own. Form answers are not persistently stored in the browser. Section 6 describes the Turnstile security check.

The survey is password-protected. Successful login sets “iune_survey_access” for eight hours. It contains a signed access confirmation, no answers or password, with HttpOnly and SameSite=Strict, plus Secure on HTTPS. Access control relies on our legitimate interest under Article 6(1)(f) GDPR. Delete the cookie to end access. Failed attempts are temporarily counted to prevent automated attacks; public operation may process IP addresses for this purpose.

When you select a language manually, we store your choice in the “iune_language” cookie for up to one year. It contains only a language code, no health data. Without a saved choice, we use the language preference sent by your browser. You can change the language in the header or delete the cookie at any time. Storage serves your requested language setting.

Your acknowledgement of the cookie notice is stored in the functional iune_cookie_notice cookie for six months. You can reopen the information at any time through Cookie settings in the footer. The notice does not activate analytics or marketing cookies.

10. Retention and deletion

Unsubmitted answers are held only in the open page’s memory and are generally lost when leaving or reloading it. After a delivery error they remain available for retry within the same session.

Contact enquiries should be deleted once handled, unless legal duties or legitimate grounds such as legal claims require retention. Identifiable survey answers should be retained only as needed for the stated analysis or another lawful basis.

Resend states that email and log data is retained for 30 days on the Free plan used here: https://resend.com/security/gdpr The receiving mailbox has separate deletion procedures; the website does not automatically delete delivered emails there. Browser cookie lifetimes are described in section 9.

This website does not maintain medical records. Retention rules for later treatment are assessed separately and do not automatically apply to a voluntary survey.

11. Your rights and withdrawal

Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR.

Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your situation under Article 21 GDPR.

You can withdraw consent at any time for the future through our privacy contact. Prior lawful processing remains unaffected. The survey is voluntary; without consent answers are not sent.

As the survey requests no name, later identification may be impossible. We do not collect extra identifiers solely for this. To exercise rights about a submission, first provide the approximate sending time so we can assess whether it can be identified reliably.

You may complain to a data protection authority, particularly the Agencia Española de Protección de Datos (AEPD): https://www.aepd.es/

12. External links and digital communication

Instagram and directions are external links, not embedded feeds or maps. Opening a link leaves this website and connects to that provider, whose privacy notice then applies.

An email link opens your email application. Sending occurs through your provider only when you send the message yourself. Ordinary email is not necessarily end-to-end encrypted.

The public website and server connections to Resend and Cloudflare use HTTPS. Form data is validated on the server. Email delivery is not end-to-end encryption between you and the centre.

Please agree a suitable transfer method with the center before sending confidential medical records. The form and survey do not replace medical advice. This website does not make automated medical decisions or assess your health automatically.