Privacy policy
How we handle your personal data at tuplansalud.es
1. Data controller
- Website name: Tu Plan Salud
- Domain: tuplansalud.es
- Data protection contact: info@tuplansalud.es, or through our contact page
2. The personal data we collect
Depending on which services you use on our website, we may collect the following personal data:
Data you give us directly
- Comparison form: Age, postcode, employment situation, household situation, health needs, budget.
- Contact form: Name, email address, phone (optional), message.
- Advice request: Name, contact details, insured profile, insurance preferences.
Data collected automatically
- IP address (anonymised where possible).
- Browser type and operating system.
- Pages visited and time spent.
- Where your visit came from (search engine, direct link, and so on).
- Cookies (in line with our cookie policy).
3. Why we process your data
We use your personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Providing you with health insurance comparison results | Your consent |
| Answering your questions and requests | Legitimate interest / pre-contractual steps |
| Providing personalised advisory services | Your consent |
| Sending you marketing communications (only if you've agreed) | Express consent |
| Improving our services and the user experience | Legitimate interest |
| Meeting our legal obligations | Legal obligation |
4. How long we keep your data
We keep your personal data for as long as needed for the purpose it was collected for:
- Comparison data: Kept for the session and deleted after 30 days of inactivity.
- Contact and advisory data: Kept for the duration of the commercial relationship and for the statutory limitation periods afterwards.
- Marketing data: Until you withdraw your consent.
- Browsing data: For the periods set out in our cookie policy.
5. Who receives your data
Your personal data may be shared with:
- Insurers: Only when you expressly request a quote or ask to take out a policy, and always with your prior consent.
- Service providers: Companies providing us with technology services (web hosting, statistical analysis), always under data processing agreements that safeguard your data.
- Public authorities: Where there is a legal obligation to do so.
We will never sell your personal data to third parties.
6. International transfers
Some of our technology providers may be located outside the European Economic Area. Where that's the case, we make sure data transfers are carried out with appropriate safeguards under the GDPR (standard contractual clauses, adequacy decisions or equivalent mechanisms).
7. Your rights
Under the GDPR and Spain's LOPDGDD, you have the following rights:
Right of access
You can ask us to confirm whether we're processing your personal data and, if so, to obtain a copy of it.
Right to rectification
You can ask us to correct inaccurate data or complete incomplete data.
Right to erasure ("right to be forgotten")
You can ask us to delete your personal data where, among other reasons, it's no longer needed for the purpose it was collected for.
Right to object
You can object to the processing of your personal data in certain circumstances, including processing for direct marketing.
Right to restriction of processing
You can ask us to restrict the processing of your data in the circumstances set out in the legislation.
Right to data portability
You can ask to receive your personal data in a structured, commonly used, machine-readable format, and to transfer it to another controller.
Right to withdraw consent
Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
How to exercise your rights
To exercise any of these rights, email us at info@tuplansalud.es or use our contact page, stating which right you wish to exercise and enclosing a copy of your identity document.
Right to complain to the supervisory authority
If you believe your data isn't being handled properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), at C/ Jorge Juan 6, 28001 Madrid, or through its website: www.aepd.es.
8. Data security
We have put in place appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or destruction. These include:
- Encryption of data in transit using HTTPS/TLS.
- Restricted access control to personal data.
- Regular backups.
- Staff training on data protection.
- Periodic security reviews.
9. Changes to this policy
We reserve the right to amend this privacy policy to reflect changes in legislation or in our services. We'll notify you of any significant change through our website.
Last updated: March 2026.