Privacy Policy

Last updated: April 2026

1. Who we are

Bavel Health is a sovereign clinical data infrastructure company based in Spain operating across Europe, Latin America, Africa, and the United States. For the purposes of this policy, Bavel Health is the data controller for personal data collected through this website.

Contact: privacy@bavel.health.

2. What data we collect

Through this website we may collect the following personal data:

Contact form submissions: first name, last name, email address, phone number, organisation name, and message content.
Technical data: IP address, browser type, device type, pages visited, and time spent on pages, collected automatically through standard web technologies.
Cookie data: see our Cookie Policy for details.

We do not collect sensitive personal data such as health records, genetic data, or financial information through this website.

3. Why we collect it

To respond to enquiries submitted through the contact form, under the lawful basis of legitimate interests.
To improve the performance and usability of this website, under the lawful basis of legitimate interests.
To comply with legal obligations where applicable.

We do not use personal data collected through this website for marketing purposes without explicit consent.

4. How long we keep it

Contact form submissions are retained for up to 24 months from the date of submission, after which they are deleted unless an ongoing business relationship requires otherwise.
Technical and analytics data is retained for up to 12 months.

5. Who we share it with

We do not sell personal data. We may share data with:

Trusted technology service providers who support the operation of this website, under data processing agreements that require them to protect your data.
Regulatory or law enforcement authorities where required by law.

6. Your rights under GDPR

If you are located in the European Union or European Economic Area, you have the following rights:

Right of access: request a copy of the personal data we hold about you.
Right to rectification: request correction of inaccurate data.
Right to erasure: request deletion of your personal data.
Right to restriction: request that we limit how we use your data.
Right to portability: request your data in a structured, machine-readable format.
Right to object: object to processing based on legitimate interests.
Right to withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact privacy@bavel.health. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

7. International transfers

Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

8. Changes to this policy

We may update this policy from time to time. The date at the top of this page indicates the most recent revision. We encourage you to review it periodically.

Bavel Health is a sovereign clinical data infrastructure company operating across Europe, Latin America, Africa, and the United States.