Privacy Policy

Effective date: 14 September 2026
Last updated: 14 September 2026

1. Who we are

IberSalud is a brand and healthcare coordination service operated by ZANIOL VENTURES INC., a corporation registered in Olongapo City, Philippines.

For the purposes of the Philippine Data Privacy Act of 2012, ZANIOL VENTURES INC. is the Personal Information Controller responsible for the personal data described in this Privacy Policy.

Privacy contact:
privacy@ibersalud.es

2. What IberSalud does

IberSalud helps patients and families in the Philippines explore private medical treatment in Spain. We connect patients with selected hospitals, specialist units and international patient teams and assist with communication, hospital assessment and practical coordination.

IberSalud is not a hospital or medical provider. We do not diagnose medical conditions, prescribe treatment, replace the patient’s own doctor or guarantee that a hospital will accept a case or achieve a particular clinical outcome.

3. Scope of this Privacy Policy

This Privacy Policy applies when you interact with IberSalud through:

  • ibersalud.es and its contact forms;

  • email;

  • Facebook, Instagram and Meta messaging services;

  • WhatsApp Business;

  • Viber;

  • telephone or video calls;

  • hospital coordination;

  • travel, admission or other practical support requested from us.

The companies operating these platforms may also process information under their own privacy policies.

4. Personal data we may collect

Depending on how you interact with us, we may collect:

Contact and identification information

This may include your name, email address, telephone number, country of residence and preferred communication channel.

If necessary for an active case, we may later request additional information such as age or date of birth. Government identification documents will only be requested when genuinely necessary and through an appropriate channel.

Enquiry and communication information

This may include messages, questions, call notes, communication history, treatment interests and general information you choose to provide when asking about our services.

Representative information

If you contact us for another person, we may collect your relationship to that person and information needed to confirm that you are authorized to act for them.

Health and medical information

If you decide to proceed, we may receive diagnoses, medical reports, test results, medical images, previous treatments, medication information and other health-related documents needed for a hospital or specialist to review the case.

Health information is sensitive personal information. We will not intentionally request medical records through an advertising chat, public social-media conversation or the general website contact form.

Before asking you to provide medical documentation, we will give you a separate clinical privacy notice, explain the intended recipients and request the appropriate explicit consent.

Administrative and service information

If you engage IberSalud for coordination or logistical services, we may process appointment details, travel or accommodation requirements, invoices, payment status and related administrative correspondence.

We do not operate an online payment gateway and do not intend to store complete payment-card details on our website.

Website and technical information

Squarespace and other website services may automatically process technical information such as IP address, device and browser information, approximate location, pages visited, referring pages and cookie identifiers.

Consent and disclosure records

We may keep records showing the notices provided to you, consent you have given or withdrawn and information shared with hospitals or other authorized recipients.

5. Where personal data comes from

We may receive personal data:

  • directly from you;

  • from a family member, guardian or authorized representative;

  • from a hospital, doctor or other healthcare provider when you have authorized the communication;

  • through Squarespace, Meta, WhatsApp, Viber or another service you use to contact us;

  • from service providers supporting our website, communications or case coordination.

If someone provides us with information about another person, they must have authority to do so and should ensure that the person concerned receives this Privacy Policy.

6. Why we process personal data

We may process personal data to:

  • respond to enquiries;

  • understand whether IberSalud may be able to assist;

  • explain available coordination services;

  • communicate with patients and their representatives;

  • identify potentially suitable hospitals or specialist teams;

  • arrange hospital review, consultations and appointments;

  • send authorized medical information to selected hospitals or specialists;

  • coordinate admission, travel or other practical arrangements requested by the patient;

  • maintain case, consent and communication records;

  • prepare and manage invoices;

  • protect our systems, investigate misuse and maintain security;

  • comply with legal, regulatory, accounting or reporting obligations;

  • establish, exercise or defend legal claims;

  • send promotional communications only when the recipient has made a separate voluntary choice to receive them.

Information provided during an initial enquiry is used for coordination purposes. IberSalud’s initial review is not a medical diagnosis or clinical assessment.

7. Grounds for processing

Depending on the circumstances, we process personal data:

  • with your consent;

  • when necessary to respond to your request or take steps in connection with services you may request;

  • when necessary to perform an agreement with you;

  • to comply with a legal obligation;

  • for legitimate business or security interests permitted by law, provided these do not override your rights;

  • to establish, exercise or defend legal claims.

Sensitive health information will normally be processed on the basis of specific consent for the stated purpose, unless another legal basis expressly permitted by applicable law applies.

You may withdraw consent by contacting us. Withdrawal does not make previous lawful processing invalid, but it may prevent us from continuing a hospital referral or another service that requires the information.

8. Medical documentation

Do not send medical records, diagnostic images, prescriptions, passport copies or other identification documents through Meta advertising chats, public social-media conversations, WhatsApp, Viber or the general website contact form unless IberSalud has specifically instructed you to do so through an approved process.

If medical documents are required, we will:

  • explain what documents are needed and why;

  • identify the hospital, specialist or category of recipient;

  • provide a separate privacy notice and consent mechanism;

  • give instructions for an appropriate document-transfer method;

  • limit the information requested to what is reasonably necessary.

Where available, this may involve a secure business-document link or a hospital’s own patient portal.

9. Family members, representatives and minors

We accept enquiries from family members and authorized representatives.

Before processing or sharing another person’s medical information, we may need to confirm that the representative has the patient’s permission or other lawful authority.

Medical information concerning a minor should be provided by, or with the authorization of, a parent or legal guardian. We do not knowingly request medical documentation directly from children through advertising or general enquiry channels.

10. Automated chats and routing

We may use automated questions in Meta or other messaging platforms to understand the general nature of an enquiry and direct the person to an appropriate next step.

These questions should not be used to collect medical records or detailed health information. IberSalud does not use an automated chat as the sole basis for making a medical decision, determining hospital acceptance or recommending treatment.

11. Who may receive personal data

Personal data may be disclosed, when necessary, to:

  • authorized persons working for or on behalf of ZANIOL VENTURES INC.;

  • hospitals, specialist units, doctors and international patient teams selected for a particular case;

  • website, email, document-storage and communication providers;

  • travel, accommodation or logistical providers when you request those services;

  • accountants, legal advisers, insurers or other professional advisers where necessary;

  • regulators, courts, public authorities or law-enforcement bodies when legally required;

  • another organization involved in a legitimate corporate transaction, subject to appropriate confidentiality and legal requirements.

Hospitals and medical professionals may process the information they receive under their own professional responsibilities and privacy notices.

We do not sell or rent patient information.

12. Service providers and communication platforms

Services currently or potentially used in our ordinary operations include:

  • Squarespace for the website and website forms;

  • Microsoft 365 and Outlook for business email and document management;

  • Meta Business Suite, Facebook and Instagram;

  • WhatsApp Business;

  • Viber.

These providers may process information in different countries and under their own privacy terms. Information sent through a third-party platform is also subject to that platform’s security, retention and privacy practices.

13. International processing and transfers

IberSalud coordinates healthcare between the Philippines and Spain. Personal data may therefore be accessed, processed or transferred outside the Philippines, including in Spain, when this is necessary to obtain a hospital assessment or provide the requested coordination.

Technology and communication providers may also process data in countries where they or their subcontractors operate.

ZANIOL VENTURES INC. remains accountable for personal data under its control and will take reasonable steps to ensure that transfers and disclosures are limited to legitimate purposes and subject to appropriate protections.

We do not claim that all personal data is stored or processed exclusively in the Philippines or in the European Union.

14. How long we keep personal data

We retain information only for as long as reasonably necessary for the relevant purpose.

Our intended retention periods are:

  • general enquiries that do not become active cases: up to 12 months after the last meaningful contact;

  • medical documents used for an active case: during the coordination and ordinarily for up to 12 months after the case is closed or active coordination ends;

  • essential case-administration, consent and disclosure records: ordinarily up to 5 years after the case is closed;

  • invoices and accounting records: for the period required by applicable tax and accounting laws;

  • promotional contact details: until consent is withdrawn or after 24 months without meaningful engagement;

  • website and technical records: according to our settings and the applicable service provider’s retention periods.

We may retain information for longer where required by law, necessary for an ongoing dispute or reasonably required to establish, exercise or defend legal claims.

When information is no longer required, we will take reasonable steps to delete, anonymize or securely dispose of it.

15. Security

We use reasonable organizational and technical measures appropriate to the nature of the information and the risks involved.

These measures include limiting access to persons who need the information for an authorized purpose, using business accounts and service-provider security controls and avoiding unnecessary collection or disclosure of medical information.

No internet transmission, messaging platform or electronic storage system can be guaranteed to be completely secure. Please follow the document-transfer instructions provided by IberSalud and do not send sensitive documents through unapproved channels.

16. Your privacy rights

Subject to applicable law and relevant exceptions, you may have the right to:

  • be informed about the processing of your personal data;

  • request access to your personal data;

  • object to certain processing;

  • request correction of inaccurate or incomplete information;

  • request erasure or blocking of information;

  • withdraw consent;

  • request data portability where applicable;

  • seek compensation for damage caused by a violation of your rights;

  • lodge a complaint with the Philippine National Privacy Commission.

To exercise a right, contact privacy@ibersalud.es. We may need to verify your identity or authority before disclosing, correcting or deleting personal data. Any verification documents should be provided only through the method we specify.

You may also contact the Philippine National Privacy Commission through privacy.gov.ph.

17. Marketing communications

We will not use medical records or health information to send or target promotional communications.

If IberSalud introduces newsletters or other direct marketing, participation will be voluntary and based on a separate choice. You may unsubscribe or withdraw that choice at any time.

Withdrawing from marketing will not affect service-related communications concerning an active enquiry or case.

18. Cookies and website analytics

Our website uses cookies and similar technologies needed for the site to function. Squarespace and embedded third-party services may also use cookies for security, performance, analytics or media functionality.

Where a cookie-management tool is available, visitors can use it to accept, decline or manage non-essential cookies. Browser settings may also allow visitors to restrict or delete cookies, although doing so may affect some website functions.

We will update this section if we introduce additional advertising, analytics or tracking technologies.

19. Social media and messaging

Messages sent through Facebook, Instagram, WhatsApp or Viber are also processed by the company operating the relevant platform.

These channels are suitable for general enquiries but should not be treated as confidential clinical-document repositories. If a conversation needs to progress to medical-document review, IberSalud will provide separate instructions.

Information posted publicly on social media may be visible to other users. Please do not publish personal medical information in comments or other public areas.

20. Testimonials and photographs

We will only publish an identifiable testimonial, photograph, video or personal health story with a separate authorization from the person concerned or their legally authorized representative.

Such authorization is independent from this Privacy Policy and may be withdrawn subject to the terms and practical limitations explained when the authorization is obtained.

21. Changes to this Privacy Policy

We may update this Privacy Policy when our services, providers or legal obligations change.

The current version will be published at https://www.ibersalud.es/privacy-policy, with the date of the latest update shown at the beginning.

If a change materially affects how we use information already collected, we will provide additional notice where reasonably required.

22. Contact

Questions, requests or complaints concerning this Privacy Policy or IberSalud’s use of personal data may be sent to:

Privacy Contact
ZANIOL VENTURES INC.
Olongapo City, Zambales

Email: privacy@ibersalud.es