Guide 10/12

Data protection

Health data is special-category data (GDPR art. 9). The API enforces the same protections as the clinic's own screens.

What an integration receives

• Only the modules in its scopes, inside its clinic. Fields protected by another permission are removed from responses — they are never sent «empty».
• Administrative and commercial data (identification, contacts, appointments, payments, indicators) through the corresponding scopes.
• Webhook payloads and indicators are free of clinical content by design.

Clinical scopes

ficha.clinica, ficha.fotografias and ficha.captura (history, diagnosis, photographs, 3D captures) require a written clinical justification approved by the clinic's clinical director, and every read is recorded in the immutable audit log with the integration as actor. Sales and front-desk integrations never receive clinical content.

Your obligations

• Sign a data processing agreement with the clinic and keep data in the EU unless agreed otherwise.
• Store only what you need, encrypted at rest; never put personal data in URLs or logs.
• Honour erasure and objection requests forwarded by the clinic; stop processing when the integration is revoked.
• Report security incidents to the clinic without delay (72 h legal deadline to the authority).