Patient notice. When you complete a questionnaire through a link or QR code provided by your doctor, your answers are transmitted to that doctor's ENT Quest account. You are not asked for any personally identifying data (full name, national ID, phone, address, email). Only your questionnaire answers and the computed score are recorded.
1. Roles: Controller and Processor
ENT Quest plays a dual role with respect to the personal data processed through the Application:
- Data Controller for the healthcare professional's account data (email, hashed password, first and last name, date of birth, medical licence number, country, city, postal code, and technical access and security logs).
- Data Processor (Art. 28 GDPR), acting on behalf of the professional user, for the patient questionnaire responses, the computed score and any short labels the doctor may associate with those records. In that scope the Controller is the doctor treating the patient, who must obtain the appropriate consent in their own consultation and inform the patient in accordance with the GDPR and LOPDGDD.
The Controller (for account data and as service provider) is: Juan Pablo García Arteaga, ENT physician, Spanish medical licence nº 212105263, professional address in Huelva, España. Contact: jgarciaarteaga.md@gmail.com.
This policy complies with Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 on Data Protection (LOPDGDD). The conditions governing the processing performed on behalf of the doctor are set out in the Terms of Use, section "Data Processing Agreement (Art. 28 GDPR)".
2. Data we process
- Healthcare professional (doctor): email and hashed password (authentication); first and last name, date of birth, medical licence number and residence data (country, city, postal code); questionnaire records they create or receive; short labels the doctor enters internally to identify their own records; minimum technical data (date, IP, user-agent) required for service operation and security.
- Patient completing a questionnaire: only the questionnaire answers, the computed score and the timestamp. No identifying data, contact details, labels or free-text notes are requested from the patient. Labels attached to a record are entered exclusively by the doctor in their own workspace and must not contain direct patient identifiers (full name, national ID, phone, address, email); recommended use is initials, aliases or the doctor's internal codes. Even so, such labels combined with clinical answers qualify as pseudonymised special-category (health) data and remain fully subject to the GDPR.
3. Purpose
- To provide the clinical questionnaire management service to healthcare professionals.
- To transmit and store, on behalf of the doctor and under their instructions, the questionnaire answers completed by their patients.
- To keep the service secure, reliable and traceable.
- To handle requests and feedback users send through the contact channel.
ENT Quest will not use patient answers or their labels for its own purposes beyond providing the service to the doctor (for example, they are not used for advertising, commercial, profiling or AI-model training purposes).
4. Legal basis
- For the professional's data (where ENT Quest is Controller): performance of a contract or service relationship (Art. 6.1.b GDPR) and legitimate interest in system security (Art. 6.1.f GDPR).
- For patient answers and labels (where ENT Quest is Processor): the legal basis is to be determined by the doctor as Controller within their clinical relationship, typically the patient's explicit consent (Arts. 6.1.a and 9.2.a GDPR) or the provision of healthcare (Art. 9.2.h GDPR).
5. Special categories of data
Answers to clinical questionnaires can reveal health-related information. The Application applies technical and organisational measures appropriate to the risk, and restricts access to the answers to the account of the professional to whom they are addressed.
6. Retention
- Professional account data: retained while the account is active and up to 12 months after cancellation, unless a longer legal retention obligation applies.
- Questionnaire answers: retained as long as the recipient professional keeps them in their inbox. The professional may delete them at any time.
- Minimum technical security logs: retained for up to 12 months.
7. Recipients and processors
Data is not shared with third parties except when required by law. We use cloud infrastructure providers acting as data processors under contract pursuant to Art. 28 GDPR, with safeguards equivalent to those of the EEA when international transfers may occur (standard contractual clauses approved by the European Commission).
8. Data subject rights
You may exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent at any time without retroactive effect. To do so, write to jgarciaarteaga.md@gmail.com proving your identity. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Security
The Application applies appropriate technical and organisational measures (encryption in transit, access control, logging and environment separation) to protect data against unauthorised access, loss or alteration. However, no Internet transmission can be considered absolutely secure.
10. Minors
The Application is not intended for users under 14 years of age. Where a questionnaire must be completed by a minor, the healthcare professional is responsible for obtaining consent from the person exercising parental authority or guardianship in accordance with applicable law.
11. Cookies and analytics
Only strictly necessary cookies are used for service operation (for example, the user session). No advertising cookies or profiling tools are used. The language preference is stored locally on the user's device.
12. Changes
This policy may be updated to reflect legal or service changes. The current version will be published on this page with its last-updated date.