Official version
The Spanish version of this policy is the only legally effective version. Translations into other languages are provided solely for convenience and information.
If there is any contradiction between a translation and the Spanish version, the Spanish version will prevail.
Data controller
The controller must complete its legal details before publishing this page as a definitive notice.
- Controller: Telemedical Solutions.
- Contact email: info@telemedicalsolutions.com.
- Website: https://telemedicalsolutions.com.
- Registered address: pending completion by the owner.
- Tax ID and registry details: pending completion by the owner, where applicable.
Data Protection Officer and automated decisions
- Data Protection Officer: to be confirmed by the owner before publishing this policy as final.
- No automated decisions are made and no profiles are created with data received through the website.
Scope of this policy
This policy covers the Telemedical Solutions website, contact forms or emails, commercial communications requested by the user, technical services required for T-One licences and updates, error telemetry, support diagnostics voluntarily sent by the user, and T-One functions that allow information to be stored, exported or sent.
T-One is a desktop application used by professionals, centres or organizations to support video consultations, device captures, patient management, observations and multimedia files. Use of T-One does not turn the website into a channel for receiving clinical data.
When a healthcare organization, professional or client uses T-One to enter, capture, store, export or send patient data, that organization or professional must have the corresponding legal basis, authorizations, patient information, contracts, security measures and internal procedures.
Data processed on the website
On the website, only data necessary to answer the enquiry or manage the relationship requested by the user should be requested.
- Identification and contact data: name, email, organization or phone if provided by the user.
- Content of the enquiry: message, sector of interest, technical or commercial context communicated by the user.
- Minimum technical data: browsing information necessary for security, technical logs or site operation.
- Web-font requests: the reviewed version of the site requests fonts from Google Fonts, so Google may receive the IP address, technical headers, date and requested resource. This dependency must be confirmed for each deployment or replaced with locally hosted fonts.
- Consent or acceptance of communications when the user ticks a box, sends a form or requests information.
- Cookie or similar technology preferences, in accordance with the Cookie Policy.
Data processed in T-One
T-One is designed to work mainly on the user's computer. Images, videos, audio, documents, forms, observations, patient data and captures generated or imported during normal product use are stored locally on the device, in the application's local database or in locations chosen by the user.
Telemedical Solutions does not receive or store on its servers the images, videos, audio, documents, forms or clinical data stored in T-One during normal product use.
- Patient or case data entered by the user: name, internal identifying data, observations, measurements, forms or clinical notes when the user records them.
- Multimedia files or documents: images, video, audio, PDF, device captures and other files that the user captures, imports, selects or generates.
- Local technical data: language settings, sending preferences, video call provider, device status, operation logs, local errors and technical metadata required for the application to work.
- Licence and maintenance data: client identifier, activation key or identifier, application version, platform and technical machine fingerprint in code or hash form.
- Update data: installed version, platform, activation identifiers and technical data needed to check whether an applicable update exists.
Local storage and user control
Data created or imported in T-One remains under the control of the user, professional or organization using the product. Telemedical Solutions cannot access that data from its servers during normal application use.
The application may use an encrypted local database and encrypted local storage for original files. It may also generate previews, temporary files or exports required to display, send, save or process the selected files.
The user or organization is responsible for protecting the computer, managing operating-system users and passwords, controlling backups, safeguarding exports, deleting data where appropriate and complying with its own legal and professional obligations.
Authentication data and permissions
When the user connects Google or Microsoft, T-One receives the basic profile required to identify the account and stores access or refresh tokens locally using the operating system's secure storage.
Google requests access to the account email, files created by T-One in Drive and sending messages through Gmail. Microsoft requests identity, offline access, email sending and read-and-write access to files.
Signing out of T-One removes the locally stored session, but may not by itself revoke the authorization granted to the provider. The user should review and, where appropriate, revoke access from their Google or Microsoft account.
Shared links, metadata and encryption
T-One includes functions that allow the user to send, export, share or save data. These actions are not automatic: they depend on the user's selection, configuration and decision.
If the user decides to send files by email, upload them to Google Drive, OneDrive or another service, save them in a local or shared folder, or share links generated by third parties, the subsequent processing will depend on the account, permissions, configuration and terms of the provider used.
Google Drive may create a link visible to anyone who has it. OneDrive attempts to create an anonymous link and may use a link limited to the organization when the configuration prevents anonymous access.
The folder name may contain the patient's identifying code. That metadata remains visible to the cloud provider and in the link information even when the files are inside an encrypted ZIP.
If only the patient form is sent and there are no multimedia files, the reviewed flow may skip the encryption prompt and upload the form as readable text. For other sends, the user may also choose an unencrypted upload.
Telemedical Solutions does not decide the content sent, recipients, external folder permissions, retention periods in third-party services or the clinical or care legitimacy of each sending action.
- Email: attached data is sent through the account and provider chosen by the user, such as Gmail or Outlook, when that function is configured.
- Cloud storage: files are uploaded to the Google Drive or OneDrive account authorized by the user, when that function is enabled.
- Local or network saving: files may be copied to a local or shared location chosen or configured for the client.
- Encrypted sending: when the application offers an encrypted ZIP option, the user must safeguard the password and decide how to communicate it to the recipient through an appropriate channel.
- Revocation: the user or organization must restrict and withdraw links when they are no longer needed; the reviewed version does not include a unified function that deletes all copies or revokes all external links.
Licences, activation and updates
T-One may communicate with Telemedical Solutions services to activate or verify licences, check maintenance or consult available updates.
These communications are limited to technical and licence data necessary to provide the contracted service, such as activation key, client identifier, licence or activation identifier, application version, platform and technical machine fingerprint in code or hash form.
The licence or update server does not need to read images, videos, audio, documents, forms or clinical data stored in T-One.
Error telemetry and support diagnostics
Telemedical Solutions may use Sentry or equivalent tools to receive application error telemetry, detect failures, improve stability and maintain product security.
Error telemetry is intended to include technical information, such as application version, operating system, error type, stack trace, affected module and technical context. It is not intended to collect user images, videos, audio or clinical data.
The reviewed configuration disables default sending of personal data, filters common patterns and may send performance traces and logs as context. Trace sampling is configured at one hundred per cent when Sentry is enabled. Filters cannot identify every name, patient code, path, identifier or free-text entry.
When the user voluntarily sends a diagnostic report, the written message, technical metadata, complete licence information for verification, paths, T-One and auxiliary-component logs, recent installation logs and a ZIP package of up to 40 MB may be transmitted.
The reviewed service may store the ZIP and its metadata in Cloudflare R2 and send a limited notification to a configured webhook. The reviewed implementation does not yet define an object-deletion lifecycle or automatically delete the local ZIP after upload.
The application includes reduction and filtering measures, but the user must avoid entering or sending clinical data, credentials or sensitive information that is not needed to resolve the incident.
Optional or third-party functions
Some functions may depend on client configuration, the user's own credentials or external providers. If a function is not enabled, it is not used for that client.
The reviewed active repository does not contain an artificial-intelligence assistant or a solely automated decision that produces legal or equivalent effects. Any future addition will require an assessment and a prior update to this policy.
Video call platforms, email providers, cloud storage, operating systems and other external services apply their own terms, privacy policies and security measures.
Applied principles
Processing should comply with GDPR, LOPDGDD and applicable Spanish and European regulations.
- Lawfulness, fairness and transparency: inform users before processing their data and use a valid legal basis.
- Minimization: request only data that is adequate, relevant and necessary for each purpose.
- Storage limitation: keep data only for the time needed for the corresponding purpose or to comply with applicable obligations.
- Integrity and confidentiality: apply reasonable measures to protect data against unauthorized access, loss or misuse.
- Accountability: review processing, providers and measures when functions, services or data collection channels change.
Purposes and legal basis
The purposes and legal bases depend on the channel and on the specific relationship with the user or client.
- Responding to enquiries received through forms, email or other enabled contact channels, based on pre-contractual measures requested by the user or the legitimate interest in handling received communications.
- Sending commercial information about T-One only when the user requests it or authorizes it separately. Each commercial communication must allow free objection or unsubscribe.
- Maintaining security, availability and technical operation of the site, based on the owner's legitimate interest.
- Activating licences, verifying maintenance and checking updates, based on performance of the contractual or pre-contractual relationship and the legitimate interest in protecting the product from unauthorized use.
- Receiving error telemetry and technical diagnostics, based on the legitimate interest in maintaining, protecting and improving the application, or on user consent or request when the sending is voluntary.
- Managing requested commercial or information communications, based on consent, the user's request or the existing contractual relationship.
- Complying with applicable legal obligations where a regulatory obligation exists.
Health data and professional user responsibility
T-One may be used to create, store or send information that, because of its context, may include health data or patient data. This data has reinforced protection and must not be processed without a valid legal basis and appropriate measures.
During normal use of T-One, Telemedical Solutions does not access the clinical content stored locally by the user. The professional, centre or organization that enters, captures, keeps, exports or sends that data decides the purposes, means, recipients and retention of that processing.
The professional user or organization must inform patients where appropriate, obtain consents or rely on another valid legal basis, limit internal access, control sending actions and comply with applicable healthcare, confidentiality and data-protection rules.
Clinical data, diagnoses, medical documentation or sensitive patient information must not be sent through the website form, commercial email or support channels unless there is a specific need, sufficient legal basis and appropriate channel.
Technical providers and transfers
Technical providers may intervene under contractual safeguards when needed to provide, protect or maintain the website, contact form or T-One. The effective entity, region, contract, retention period and transfer mechanism must be confirmed for each deployment before this notice can be considered final.
- Site hosting, CDN and security: the code supports Cloudflare Pages, while other deployment packages may use another provider; the provider serving the published version must be identified.
- Form delivery: the code supports an endpoint using Resend and hosting packages may use a different processor; the effective provider must be identified.
- Google: web fonts requested by the site and, at the user's choice, authentication, Gmail and Google Drive in T-One.
- Microsoft: at the user's choice, authentication, Outlook and OneDrive in T-One.
- Sentry: T-One error and performance telemetry when configured.
- Cloudflare Workers and R2: receipt and storage of voluntarily submitted diagnostics, when the configured service is used.
- Licence, update and support-notification services: these must be identified in the final register of processors and recipients.
- These providers may process data outside the European Economic Area where applicable, applying valid safeguards for international transfers.
Retention, deletion and uninstallation
- Contact or demo enquiries will be kept for up to 12 months after the last interaction, unless a commercial relationship is created or a legal obligation requires another period.
- Technical website security data will be kept for the period necessary for security, diagnostics and abuse prevention, depending on the technical provider configuration.
- Local T-One data is retained on the computer, account or location chosen by the user until a verified deletion procedure is applied, subject to applicable healthcare and restriction-of-processing obligations.
- Deleting a patient in the reviewed version removes the patient's database rows, but deletion of all associated external originals, previews and other file copies has not been verified.
- The reviewed uninstaller does not expressly delete T-One's media folder located in LocalAppData. Uninstalling the application must not be regarded as evidence of complete deletion.
- Licence, activation, maintenance and update data may be retained during the contractual relationship and for the periods needed for security, support, audit and liabilities; the reviewed reference service does not yet provide a deletion interface.
- Diagnostic reports submitted voluntarily may remain in R2 until the operator deletes them or configures a lifecycle. The local ZIP is not automatically deleted after upload either.
- Local logs currently rotate by size and number of copies, not by a time period. The client must define and apply retention appropriate to its environment.
- Personal data is not sold.
- Technical hosting, email, security, error telemetry, maintenance, licence, update or support providers may access data under the corresponding contractual safeguards.
- External providers chosen by the user, such as email, video call or cloud storage platforms, will process the data according to their own terms and the configuration of the account used.
- If providers outside the European Economic Area are used, valid safeguards for international transfers must apply.
- Deletion in one location does not delete emails, cloud copies, backups, shared folders, links or copies received by third parties.
User rights
Users may request access, rectification, deletion, objection, restriction of processing and portability by writing to info@telemedicalsolutions.com.
These rights are personal. The owner may request additional information to verify the applicant's identity when necessary.
When data is stored only on the user's computer, in the user's external account or under the responsibility of a client organization, Telemedical Solutions may not have technical access to search, rectify or delete it. In that case, the request should also be addressed to the professional, centre, organization or provider controlling that data.
They may also lodge a complaint with the Spanish Data Protection Agency if they consider that processing does not comply with applicable regulations.
Data security
Telemedical Solutions should apply reasonable technical and organizational measures to preserve the confidentiality, integrity and availability of the personal data it processes.
T-One may use local encryption for the database and original files stored by the application, as well as sensitive-data filtering in technical logs and error telemetry.
These measures do not replace the security obligations of the user or organization over its computers, accounts, networks, permissions, backups, exports and communications with third parties.
No Internet-connected system, local computer, external provider or encryption mechanism is completely infallible. Security measures should therefore be reviewed when services, providers, functions or data collection channels change.
Third-party content and services
The site may link to third-party pages or services. Each provider is responsible for its own privacy, cookie and security policies.
T-One may integrate with external providers selected or authorized by the user for email, storage, video calls, authentication or other functions. The user should review each provider's settings, permissions and terms.
If embedded content, measurement tools, maps, video or other external services are added to the website, this policy and the cookie policy should be reviewed before publication.
Data accuracy
Users should ensure that the data they provide is correct, complete and up to date.
When users provide third-party data, they must have sufficient grounds to do so.
When users record patient data or data about other persons in T-One, they are responsible for ensuring that this information is adequate, necessary, accurate and processed in accordance with applicable regulations.
Minors and health data
This site offers commercial information about T-One. It should not be used to send clinical data, diagnoses, medical documentation or sensitive patient information.
T-One may be used in care contexts by responsible professionals or organizations. Processing data relating to minors, patients or health data must take place only if the professional user or organization has a sufficient legal basis, prior information, reinforced measures and appropriate controls.
Telemedical Solutions does not use images, videos, audio, documents or clinical data stored locally in T-One for advertising, data sale or training its own models.
Changes to this policy
The owner may update this policy to adapt it to regulatory, technical or organizational changes.
The applicable version will be the one published on this page at any given time.