Privacy Notice

This Privacy Notice of Eyren Health S.L. (“we,” “us,” or “our”) explains how and why we may access, collect, store, use, and share (“process”) personal data when you use our services (the “Services”), including our website and its subdomains, Eyren’s web and mobile applications for professionals and patients, as well as any other product, feature, or digital service that we offer or that is connected to Eyren.

This Notice explains your rights and choices. If you do not agree with our policies and practices, do not use the Services.

Summary of Key Points

Data processed: data you provide, technical and usage data collected automatically and, where applicable, data from public databases, business partners, social networks, or other sources.
Sensitive data: we do not intentionally process sensitive data unless indicated here: not applicable. We do not intentionally collect or process special categories of personal data through the website.
Purposes: to provide, improve, protect, and administer the Services; communicate with you; prevent fraud; and comply with the law.
Disclosures: only in the circumstances and to the recipients described below.
Rights: depend on your location and applicable law.
Requests: use the contact details provided at the end.

Data We Collect
How We Process Data
When and with Whom We Share Data
Cookies and Tracking Technologies
Social Login
International Transfers
Retention
Children and Minors
Privacy Rights
Do-Not-Track Signals
Updates
Contact
Requests for Access, Rectification, and Deletion

1. Data We Collect

Data You Provide

We collect the data you voluntarily provide when you register, request information, use features, participate in activities, make purchases, or contact us.

This data may include:

first and last name;
email address;
phone number;
name of the clinic, practice, or professional organisation with which you are associated.

The data must be accurate and kept up to date.

Data Collected Automatically

When you use the Services, we may collect your IP address, browser and device, operating system, language, referring URLs, device name, country, approximate location, dates and times of activity, and diagnostic data. We use this information primarily for security, operation, analytics, and reporting, through cookies and similar technologies where applicable.

Data from Other Sources

We may also obtain personal data from legitimate sources other than information provided directly by you, including official professional registers, institutional directories, publicly accessible databases, and other public or third-party sources that may be relevant to the purposes described in this Privacy Notice.

This data may include identification, professional, and contact information, such as your first and last name, professional registration or accreditation number, specialty, clinic or professional practice, and professional contact details that are lawfully accessible.

Where applicable, we will process this data in accordance with applicable law and inform you about its source and the processing carried out in the manner required by data protection legislation.

2. How We Process Data

Depending on your interaction with the Services, we process data to:

provide, operate, personalise, and improve the Services;
create and manage accounts and transactions;
respond to enquiries and provide support;
send administrative communications or, with permission, marketing communications;
protect the Services, prevent fraud, and enforce our terms;
comply with legal obligations and protect rights; and
pursue other purposes with your consent or another valid legal basis.

We currently do not sell personal data or share it with third parties for their own marketing or commercial purposes.

We may disclose or provide access to personal data where necessary to operate, maintain, protect, or improve the website and our services, including to technology, hosting, communications, security, analytics, professional support, or other service providers acting on our behalf and subject to applicable contractual and legal safeguards.

We may also disclose personal data:

to companies within the same corporate group or affiliated entities, if any, where necessary for the purposes described in this Privacy Notice;
in connection with a merger, acquisition, financing, reorganisation, sale of assets, or similar corporate transaction;
where necessary to comply with a legal obligation, court order, or lawful request from a competent authority;
where necessary to protect our rights, the rights of third parties, the security or integrity of the Services, or to prevent fraud and misuse.

Where we use service providers that process personal data on our behalf, they may only process such data in accordance with our instructions and subject to applicable confidentiality, security, and data protection obligations.

Sale or disclosure of data for third parties’ own purposes: not currently applicable. We do not sell personal data or disclose it to third parties for their own commercial purposes unless we inform you beforehand and there is a valid legal basis for doing so.

4. Cookies and Tracking Technologies

We and authorised third parties may use cookies, pixels, beacons, and similar technologies to operate the Services, remember preferences, prevent errors, analyse their use and, where lawful, personalise advertising. See https://eyren.health/en/legal/cookies and manage your consent through the preferences interface.

If you access the Services using a social account, the provider may send us your name, email address, profile picture, and other public or authorised information. We will only use this information in accordance with this Notice. The provider’s processing is governed by its own policy.

6. International Transfers

Our servers and providers may be located in various European countries. Your data may be processed in countries with different rules. Where required, we will apply appropriate safeguards, such as adequacy decisions, approved contractual clauses, or another valid mechanism.

7. Retention

We retain data only for as long as necessary for these purposes, unless the law requires or permits a longer retention period. We then delete or anonymise the data; where this is not immediately possible — for example, in backups — we securely isolate it until it can be deleted.

8. Children and Minors

The website and the services offered through it are not directed at individuals under the age of 18, and we do not intend to intentionally collect their personal data.

If we become aware that we have collected personal data relating to a minor inappropriately or without any authorisation that may be legally required, we will take reasonable steps to delete the data or otherwise process it in accordance with applicable law.

If you believe that a minor has provided us with personal data through the website, you may contact us at contact@eyren.health.

9. Privacy Rights

Depending on applicable law, you may request access, rectification, deletion, restriction, portability, or objection; withdraw consent; opt out of certain sales, communications, profiling, or marketing; and lodge a complaint with an authority. Withdrawal does not affect prior lawful processing. Your account can be managed at https://eyren.health/professionals/register. We may retain minimum data where required by law, fraud prevention, claims, or contractual enforcement.

10. Do-Not-Track Signals

Because there is no uniform standard, we currently do not respond to DNT signals unless legally required.

11. Updates

We may update this Notice. The revised version will display a new date. In the event of material changes, we may publish a prominent notice or contact you directly.

12. Contact

Eyren Health S.L.
85 Carrer de Provença, 1st Floor, Door 1
08029 Barcelona, Spain
contact@eyren.health

13. Requests for Access, Rectification, and Deletion

Submit your request using the contact details above. We may verify your identity and limit the request where permitted by law.