Privacy Policy

The controller responsible for the personal data described in this policy is [Legal entity name - to be completed], operating the Soluna website and services.

• Registered company number or CIF: [Registration number / CIF - to be completed]
• Registered address: [Registered address - to be completed]
• Data protection contact: [Data protection email - to be completed]
• Data Protection Officer: [DPO name and contact - to be completed, if one has been appointed]

If a Data Protection Officer has not been appointed, remove that line and keep a clear point of contact for privacy enquiries.

This policy covers personal data we process in our role as a controller through the public Soluna website, the interactive live demo and the demo request (lead) form.

Where we provide services to a clinic and process data on that clinic's instructions, the clinic is the controller and we act as a processor under a separate data processing agreement. That relationship is governed by that agreement rather than by this website policy.

Website usage

When you browse the site we may process limited technical data such as approximate location derived from IP, device and browser type, and pages viewed. This is handled through essential cookies and privacy-conscious analytics, as described in our Cookie Policy.

Live demo

The live demo is a fictional scenario built around a demo clinic. It is intended for demonstration only. Please do not enter real patient information. We may process technical interaction data to operate and improve the demo.

Demo request form

When you request a demonstration we collect the business contact and clinic details you provide, for example your name, business email, clinic name, website, location, systems in use and any message you choose to send.

No patient medical data through this site

We do not collect patient medical records or special category health data through this website, its forms or the live demo. Please do not submit patient health information to us through these channels.

Under the EU General Data Protection Regulation and Spanish data protection law, we rely on the following lawful bases:

• Consent, for non-essential cookies and privacy-conscious analytics, which you can give or withdraw at any time.
• Legitimate interests, for responding to enquiries, operating and securing the website, and understanding how it is used, balanced against your rights.
• Steps taken at your request prior to entering a contract, when you ask us for a demonstration or a proposal.
• Legal obligation, where we must retain or disclose data to comply with applicable law.

• To respond to demo requests and enquiries and to prepare and deliver demonstrations.
• To operate, secure, maintain and improve the website and the live demo.
• To measure, in aggregate, how the website is used so we can improve it.
• To communicate with you about your request and, where permitted, about relevant updates.
• To comply with legal obligations and to establish, exercise or defend legal claims.

We use a limited set of trusted providers who process data on our behalf under appropriate contractual safeguards. Described generically, these may include:

• Hosting and infrastructure providers that run the website and supporting systems.
• A conversational voice AI provider that powers the interactive demo experience.
• An automation and workflow layer that moves enquiry data between our internal tools.
• Email and communication providers used to reply to you.
• A privacy-conscious analytics provider used to understand website usage.

A current list of named providers should be maintained and inserted here before publication: [List of named processors - to be completed].

We keep personal data only for as long as necessary for the purposes described in this policy, after which it is deleted or anonymised.

• Demo request and enquiry data: kept for the period needed to handle your request and our ongoing relationship, then for a defined retention window. [Retention period - to be completed].
• Website analytics: kept in aggregated or short-lived form according to the analytics configuration. [Analytics retention period - to be completed].

Where a provider processes data outside the European Economic Area, we put in place an appropriate transfer mechanism recognised under EU law, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where needed.

Details of the transfer mechanisms relied upon should be confirmed and inserted here: [Transfer mechanisms and locations - to be completed].

Subject to the conditions in the GDPR, you have the right to:

• Access the personal data we hold about you.
• Request rectification of inaccurate or incomplete data.
• Request erasure of your data in certain circumstances.
• Restrict or object to certain processing.
• Receive your data in a portable format where applicable.
• Withdraw consent at any time, without affecting processing already carried out.

To exercise any of these rights, contact us at [Data protection email - to be completed]. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Espanola de Proteccion de Datos, www.aepd.es) or your local supervisory authority.

We use a minimal set of cookies for essential functionality and privacy-conscious analytics. Full detail on the categories we use and how to manage them is set out in our Cookie Policy, and you can change your choice at any time from the cookie preferences page.

We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, provide additional notice.

For any question about this policy or your personal data, contact [Legal entity name - to be completed] at [Data protection email - to be completed].