Privacy notice

1. Who is responsible for your data

• Controller: LUNGTEST, S.R.L., RNC (tax ID) 132708352, operating under the trade name LungTest Neumocentro.
• Registered address: Calle Restauración No. 57, corner of Calle Cuba, Plaza Clínica Corominas, 6th floor, office 603, Santiago de los Caballeros, Dominican Republic.
• Center: Plaza Clínica Corominas, 6th floor, suite 603, Calle Restauración No. 57, corner of Calle Cuba, Santiago de los Caballeros, Dominican Republic.
• Privacy contact: Dr. Joel Castillo Pichardo, executive manager, lungtestneumocentro@gmail.com, phone 809-580-1171, ext. 4603.

2. What data we collect and why

2.1 Referral form for doctors (“For doctors” page)

A doctor who refers a patient fills in the form with:

• Their details: full name, specialty, phone or WhatsApp, email and clinic or practice.
• The patient's details: full name, age or date of birth, phone and health insurance (ARS).
• The study: the studies ordered, the indication or diagnosis, and notes.
• Confirmation that the patient authorized sharing this data with LungTest Neumocentro to arrange their appointment, as described in this notice. Without this confirmation the form cannot be sent.

Specialty, clinic or practice, insurance, indication or diagnosis and notes are optional. The email we receive also shows the date and time it was sent and whether the English version of the site was used.

What we use it for: to arrange the patient's appointment, prepare the ordered study and contact the doctor about the referral. If the patient needs it, we use their insurance details to request the study's authorization from their ARS.

How it is sent: when you press “Send referral”, the data travels encrypted (HTTPS) to the site's server, which builds an email and sends it to our address (lungtestneumocentro@gmail.com). The site does not keep a copy: it has no referral database. The email stays in our Gmail account. Cloudflare, which sends it, may keep a record for up to 31 days with the sender, the recipient and the subject line, which includes the patient's name and the ordered study (or how many studies, if there are several).

The ordered studies and the indication or diagnosis are health data, which the law gives special protection (section 3).

2.2 WhatsApp, phone and email

The site's WhatsApp buttons (to book, ask for more information or ask about a product) and the floating button open WhatsApp with a ready-made message (for example, the name of the study you are interested in). You can change it or not send it. If you send it, we receive your number, your profile name and what you write, and we use them to reply and book your appointment. WhatsApp is a Meta service; its privacy policy also applies when you use it. The site does not send WhatsApp any other data about you. If you call us or email us, we use your data in the same way.

2.3 Visits to the site

Like any website, to show you the pages our hosting provider, Cloudflare, receives the technical data your browser sends: IP address, browser and device type, the page you request and the date and time, which it also processes under its own privacy policy. With it, Cloudflare:

• delivers the pages and protects the site against attacks and abuse;
• limits how many referrals or error reports can be sent in a row from the same connection, to stop fake mass submissions. For this it counts the submissions from each IP address for one minute;
• keeps technical logs of visits, which we check to find and fix faults. These logs may include your IP address, browser, approximate location (country and city), the page and the time, and they are deleted after 7 days at most. They do not store what you type in the form.

We measure visits with Cloudflare Web Analytics, which uses no cookies or identifiers: it counts page views and load times and shows us only aggregate figures (for example, how many visits a page had or from what type of device). It does not tell us who you are.

Fault alerts: if something fails on the site (if it stops responding, a referral could not be sent, there is an error on the server or in your browser, or a link leads to a page that does not exist), the technical team receives an automatic alert on Telegram. When the error happens in your browser, the page sends the site a technical report with the page where it happened, the error message and the browser and system name (for example, “Chrome 141 Android”). Alerts only say what failed, where and when: they do not include what you type on the site or any data about the doctor or the patient, and emails, IP addresses and phone numbers are blanked out before they are sent.

In addition, a monitoring service, UptimeRobot, checks from the outside every so often that the site responds and, if it does not, alerts the technical team by email. To do so it only requests pages of the site: it receives no data about the people who visit it.

2.4 Google map and links to other services

On the Home and Contact pages we show an interactive Google Maps map so you can find the center. The map loads from Google's servers when you reach that part of the page. When it loads, Google receives your IP address, browser data and our site's address, and it may use its own cookies inside the map, depending on your browser settings and whether you are signed in to Google. This is controlled by Google, under its privacy policy.

The Google Maps, Waze, Apple Maps and Instagram buttons open those services only if you press them, and from then on their own policies apply. The site does not tell them which page you came from.

2.5 What we do not do

• We do not sell or rent personal data.
• We do not use data for advertising or profiling.
• The site has no user accounts, does not store what you type in the form and does not use cookies or advertising tools (such as social media pixels).

3. Legal basis and consent

• Doctors' data: you provide it when you send the form, so we can arrange your patient's referral and contact you about it.
• Patients' health data: the law treats it as sensitive data. We process it as a health center, only to provide the service the doctor ordered, and the laboratory staff are bound by professional secrecy.
• The patient's authorization: by ticking the box on the form, the doctor confirms that the patient authorized them to share their data with LungTest Neumocentro to arrange their appointment, as described in this notice. The doctor is responsible for having obtained that authorization. When we contact the patient to book, we tell them we received their referral and where to read this notice, and at their appointment we ask for their written authorization to process their health data. If you are a patient and did not authorize the referral, write to us and we will delete it.
• Messages and inquiries: we use the data you send us by WhatsApp, phone or email with your consent, to reply to you.
• Visits to the site: technical data is used to keep the site working and secure.
• No one is required to give us health data through the site: you can also book by phone, on WhatsApp or in person.

4. Who we share data with and transfers outside the country

We do not sell your data. To run the site and our communications we use the services in this table, each with its own privacy policy. Otherwise, we only disclose your data to others when needed for your care (for example, to your ARS, in the last row) or when a law or a court requires it.

Transfers outside the country: Cloudflare, Google and WhatsApp process or store data on servers outside the Dominican Republic, for example in the United States. Cloudflare serves many visits from Santo Domingo, but it also processes and stores data in other countries. So visiting the site or using the form, email or WhatsApp may mean sending data abroad. We do this because it is necessary for the site to work and to arrange your appointment or your patient's (Law 172-13, Art. 80). Their privacy policies: cloudflare.com/privacypolicy, policies.google.com/privacy and whatsapp.com/legal/privacy-policy.

5. How long we keep data

• Doctors' referrals: we keep referral emails for 60 days and use them to contact the patient and schedule the study. If the patient takes the study, their data becomes part of their medical record, which is kept for as long as health regulations require.
• WhatsApp conversations: they have 24-hour disappearing messages turned on, so each message is deleted from the chat 24 hours after it is sent.
• Emails: the emails you send us are kept in our Gmail account.
• On the site: no referrals are stored. Technical logs of visits (with the IP address) are deleted after 7 days at most, and any record Cloudflare keeps of each email sent, after 31 days. The sending limit counts the submissions from each IP address for one minute only.
• If you ask us to delete your data, we will delete it as explained in section 7, except for what a law requires us to keep, such as the medical record.

6. Security

On the site:

• all pages use an encrypted connection (HTTPS);
• the form only accepts submissions from the site itself, with size and sending limits and filters against bots;
• the site does not store form data, so there is no database that could leak;
• any links typed into the form reach our email disabled.

At the laboratory: our accounts are protected with passkeys and two-step verification. Only authorized staff have access to the email and the data, and they are bound by professional secrecy.

No system is infallible. If a security incident affecting your data occurs, we will let you know.

7. Your rights and how to exercise them

You can ask us, free of charge, for:

• Access: to know what data we hold about you, how we use it and who it is shared with.
• Rectification: to correct or update inaccurate or incomplete data.
• Cancellation or erasure: to stop using your data and delete it.
• Objection: to stop using your data for a specific purpose.

These rights are independent: you do not need to exercise one in order to exercise another.

How: write to lungtestneumocentro@gmail.com or come to the center, and include your name, what you are asking for and something to verify your identity (for example, a copy of your ID card). If you are asking for someone else (for example, your underage child), state your relationship to them.

Time limits: we will give you access to your data within 5 business days at most, and correct it, or stop using it and delete it, within 10 business days at most. If a law requires us to keep it, we will explain why; data that only has to be kept because of possible legal liability will be blocked, available only to the authorities for the legal period.

In court: you can also go to court at any time, without having to contact us first, through the habeas data action guaranteed by Article 70 of the Constitution and Law 172-13.

8. Cookies

The site does not use cookies, so it does not show a cookie banner. Cloudflare's visit measurement does not use them either. The only possible exception is the Google map on the Home and Contact pages, which may use Google cookies (section 2.4); you can limit them in your browser or Google account settings.

The only thing the site stores in your browser is how far you had scrolled on each page, so it can take you back there if you go back. It is deleted when you close the tab and is not sent to anyone.

9. Minors

The site is intended for adults. Data about an underage patient should reach us directly from their mother, father or guardian, or from their doctor with the authorization of the mother, father or guardian. The mother, father or guardian can exercise the rights in section 7 on the minor's behalf.

10. Changes to this notice

If we change this notice, for example when we add a new service to the site, we will publish the new version here with its date. If the change significantly affects how your data is used, we will highlight it on the site.

11. Contact

• LungTest Neumocentro (LUNGTEST, S.R.L.)
• Privacy: Dr. Joel Castillo Pichardo, executive manager, lungtestneumocentro@gmail.com
• Phone: 809-580-1171, ext. 4603
• WhatsApp: 809-963-4356
• Email: lungtestneumocentro@gmail.com
• Address and hours: Plaza Clínica Corominas, 6th floor, suite 603, Santiago de los Caballeros (section 1); Monday to Friday, 8:00 a.m. to 4:00 p.m.