Privacy and data protection policy

Last updated: 26/10/2026

This policy applies to the personal data processed through www.sanitasinfo.com, its forms and the office's customer service channels (telephone, email and WhatsApp). It complies with Reglamento (UE) 2016/679 (RGPD) (Regulation (EU) 2016/679, GDPR), Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) (Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights), Ley 34/2002 de Servicios de la Sociedad de la Información (LSSI) (Law 34/2002 on Information Society Services) and Real Decreto-ley 3/2020 (Royal Decree-law 3/2020) on insurance distribution.

Who is the controller of your data

Data from the quote and sign-up forms: Sanitas

The controller of the personal data you provide in the forms on this website (quote, sign-up or call-back request) is SANITAS S.A. DE SEGUROS ("Sanitas"):

• Registered office: C/ Ribera del Loira, 52, 28042 Madrid
• NIF (tax ID): A-28037042
• Email: lopd@sanitas.es
• Sanitas Data Protection Officer (DPO): dpo@sanitas.es

Ovanie Agency, S.L.: Sanitas agent and data processor

The owner of this website is Ovanie Agency, S.L.:

• NIF (tax ID): B-64503477
• Address: Carrer de Sant Jordi, 24, local, 08172 Sant Cugat del Vallès (Barcelona)
• Registration: Sanitas Agency no. 19069 · DGSFP code C0320B64503477
• Contact: info@sanitasinfo.com

In accordance with Real Decreto-ley 3/2020 (Royal Decree-law 3/2020) on insurance distribution and the GDPR, the insurance agent acts as data processor for the insurer with which it has signed the agency contract. Therefore Ovanie Agency, as Sanitas insurance agent, processes the form data on behalf of and for the account of Sanitas, following its instructions and the provisions of this policy.

What belongs to the website itself: Ovanie Agency

Ovanie Agency is the controller only of the processing activities that belong to the website and the agency itself:

• cookies and similar technologies (see the cookie policy);
• the website's own analytics, without cookies and in aggregate form;
• the agency's communications (for example, office notices or information you expressly request from us).

For all of this you can write to us at info@sanitasinfo.com or at the postal address above.

How we obtain your data and what data we process

The data is obtained directly from you. In connection with the forms, the following is processed:

• First name and surnames, telephone number and email address.
• The data the form asks for to prepare your quote: your situation (visa or residence, studies, switching insurance, family, company), province of residence, number of people to be insured, their dates of birth and when you want the insurance to start.
• The day and time you would like us to contact you.
• Any other information you give us during the call, by email or by WhatsApp.

On the website we do not ask you for health data. If you give us data about other people (for example, your family for a quote), you must have informed them and have their permission.

For its part, Ovanie Agency processes browsing data (pages visited, device and source of the visit) according to what you accept in the cookie panel.

For what purpose and on what legal basis

Form data (controller: Sanitas)

Purpose: to carry out the insurance distribution activity performed by Ovanie Agency, consisting of advice, proposals or carrying out the work prior to the conclusion of the insurance contract, or assistance in the management and performance of those contracts, at the request of users who ask for these services.

Legal basis: the consent you give when you complete the form and submit it voluntarily (art. 6.1.a GDPR). You can withdraw it at any time.

If you take out a policy, the processing of your policy data is also governed by the privacy information Sanitas gives you in the insurance application and at www.sanitas.es/RGPD.

The website's own processing (controller: Ovanie Agency)

• Measurement and advertising cookies: to understand how the website is used and measure our campaigns. Legal basis: your consent (art. 22.2 LSSI and art. 6.1.a GDPR).
• Own analytics without cookies: to know, in aggregate form, which pages and buttons are useful and to protect the website against abuse. Legal basis: legitimate interest (art. 6.1.f GDPR).
• Agency communications: to send you the information you request or office notices. Legal basis: your consent (art. 6.1.a GDPR and art. 21 LSSI). You can unsubscribe whenever you like.

No decisions are taken based solely on automated processing that produce legal effects concerning you or significantly affect you.

Use of artificial intelligence

The website and the office CRM use artificial intelligence tools only to help the human team, never to replace it:

• Text assistants: they help draft replies, summarise conversations and translate messages so we can help you in your language. A person from the office always reviews what is sent to you.
• Request classification: they sort incoming requests (for example, by type of insurance, language or priority) so that the right person can deal with them as soon as possible.

What these tools do not do:

• They do not take automated decisions with legal or similar effects on you (Article 22 GDPR). The offer, the price and the acceptance of the insurance do not depend on them.
• They are not used to assess risks or set prices for life or health insurance, or to build creditworthiness profiles.

Transparency (European AI Regulation). In compliance with Reglamento (UE) 2024/1689 de Inteligencia Artificial (Regulation (EU) 2024/1689 on Artificial Intelligence), if on any channel you are talking to an automated assistant and not a person, we will tell you clearly at the start of the conversation, and you can always ask to be helped by a person. Texts generated with the help of AI that we publish or send you are reviewed by our team, which is responsible for their content.

When these tools are used with the data from your requests, Ovanie Agency does so as data processor on behalf of Sanitas and only to deal with your request, with data minimisation and human oversight. AI providers act as sub-processors under the contract required by Article 28 GDPR. If you prefer your request to be handled without these tools, write to us at info@sanitasinfo.com.

How long your data is kept

Form data is kept for the time necessary for the purpose for which it was collected and for the period necessary for the establishment, exercise or defence of possible claims.

Once those periods have ended, the data is no longer processed and is blocked in accordance with current regulations. Once the legal limitation periods have elapsed, it is destroyed or anonymised (except for scientific, medical or statistical research or for reasons of public health).

Cookies are kept for the period indicated for each one in the cookie policy, and agency communications until you withdraw your consent.

Who your data is disclosed to

Your data is not disclosed to third parties, except where required by law or where necessary to provide the service:

• Ovanie Agency, as Sanitas insurance agent and data processor, accesses the data you provide in the forms and contacts you in accordance with this policy.
• Other service providers of Sanitas or the agency access the data as processors or sub-processors, with high standards of security and confidentiality: web and CRM hosting, email, telephony, messaging (WhatsApp Business, by Meta) when you write to us or ask us to contact you through that channel, and artificial intelligence tools.
• Public authorities that require it under current legislation, Fuerzas y Cuerpos de Seguridad del Estado (State Security Forces), courts and, in the event of vital interest, healthcare centres.
• Sanitas may disclose your data to other Grupo Sanitas entities (Sanitas Group), identified at www.sanitas.es/RGPD ("Empresas del Grupo" section), for internal administrative purposes.

For the website's own processing, and only if you accept it in the cookie panel, Google, Microsoft and Meta are involved (see the cookie policy). We do not sell your data.

International transfers

Some providers (for example, Google, Microsoft, Meta or AI tool providers) may process data outside the European Economic Area, particularly in the United States. This is only done with appropriate safeguards:

• the European Commission's adequacy decision on the EU-US Data Privacy Framework, for certified companies, or
• the standard contractual clauses approved by the European Commission, with additional measures where necessary.

What your rights are and how to exercise them

You may exercise at any time, free of charge, your rights of access, rectification, objection, erasure, portability and restriction of processing, and withdraw the consent you have given, without affecting the lawfulness of processing carried out before its withdrawal.

You can exercise them through any of the following channels:

• With Ovanie Agency: by email to info@sanitasinfo.com or by written and signed request to Ovanie Agency, S.L., Carrer de Sant Jordi, 24, local, 08172 Sant Cugat del Vallès (Barcelona), accompanied, if necessary, by a copy of your DNI (national ID card) or equivalent document proving your identity. If your request concerns data for which Sanitas is the controller, we will forward it to them.
• With Sanitas: at www.sanitas.es/RGPD ("Derechos ARCO" section).

You have the right to receive a response within one month, which may be extended by two further months for complex requests.

Complaint: if you consider that your rights have not been respected, you may lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

Security

Technical and organisational measures appropriate to the risk are applied: encrypted connection (HTTPS), CRM access only for authorised staff, backups and a duty of confidentiality for the whole team and for providers.

Minors

Children under 14 may not provide us with data without the consent of their parents or guardians (Article 7 LOPDGDD). Insurance that includes minors is always requested and taken out by a responsible adult.

Changes to this policy

We may update this policy to adapt it to changes in the law or in our services. The date of the last update appears at the top. For the website's other terms, see the legal notice.