Legal information
Privacy policy
Last updated: 19 October 2026.
1. Data controller
Acude.io is a platform owned by Playmedic Marketing S.L. (hereinafter "Acude", "we" or "us"), with Spanish tax identification number B66287061 and address at calle Aragón 548, 3.º 1.ª, 08026 Barcelona (Spain), which is the controller of the data described in this policy.
For any privacy-related questions, please write to rgpd@acude.io.
2. Who this policy applies to
This policy explains how we process data belonging to clinics, practices and professionals who subscribe to Acude and their users ("Customers"), people interested in Acude through our website, forms or demos ("leads"), and visitors to acude.io.
If you are a patient of a clinic using Acude, see section 6: in that case, the clinic is your data controller.
3. Data we process
Professional identification and contact details: name, role, clinic or practice name, telephone number, email and address.
Billing data: company name, tax identification number, billing address and subscription payment history. We do not collect or store your full card details, which are handled directly by our payment provider.
Usage and technical data: logins, IP address, device, browser and activity on the platform.
Communications: enquiries and messages you send us through support, forms, email or WhatsApp.
The use of cookies on acude.io is explained in our Cookie Policy.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Manage your account and provide the contracted service | Performance of a contract (Article 6(1)(b) GDPR) | For the duration of the relationship, then restricted for the applicable limitation periods for legal claims |
| Billing and accounting and tax obligations | Legal obligation (Article 6(1)(c) GDPR) | 6 years (Spanish Commercial Code) |
| Send service notices: incidents, technical changes or changes to terms | Performance of a contract (Article 6(1)(b) GDPR) | For the duration of the relationship |
| Respond to information or demo requests | Pre-contractual steps at your request (Article 6(1)(b) GDPR) | Up to 12 months after the last contact if you do not subscribe |
| Send marketing communications to leads | Consent (Article 6(1)(a) GDPR and Article 21(1) LSSI) | Until you withdraw consent |
| Send Customers marketing communications about products or services similar to those subscribed to | Legitimate interests (Article 6(1)(f) GDPR and Article 21(2) LSSI) | Until you object |
| Protect platform security, prevent fraud and improve the service | Legitimate interests (Article 6(1)(f) GDPR) | Technical logs: 12 months |
| Respond to your enquiries by WhatsApp, email or support | Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR) | 12 months from the last message |
5. Marketing communications
We only send marketing communications by email or WhatsApp to people who have given prior, express consent, or to our Customers about Acude products and services similar to those they already use, as permitted by the LSSI. We keep a record of each consent, including the date, wording accepted and channel through which it was obtained, so we can demonstrate it.
These communications may concern Acude updates, features, training, events or content about practice management and patient acquisition.
You can unsubscribe at any time, easily and free of charge, through the link in each email, by replying "BAJA" to our WhatsApp messages, or by writing to rgpd@acude.io. Withdrawing consent does not affect the lawfulness of previous processing or communications necessary to provide the service.
6. If you are a patient of a clinic using Acude
When you book an appointment, pay a deposit or receive a message from a clinic through Acude, that clinic is your data controller. Acude acts as processor: it processes your data only on the clinic's behalf and under its instructions.
The clinic decides which data is collected, which messages are sent and how long they are retained. It must inform you and, where appropriate, obtain your consent. Contact the clinic to exercise your rights. If we receive your request, we will forward it without delay.
If you message a clinic using Acude on WhatsApp, your messages and attachments are stored on the platform on the clinic's behalf so its team can assist you. The clinic decides who can access them and how long they are kept. We recommend not sending medical reports or other clinical information through WhatsApp unless the clinic asks you to. Acude does not use your conversation content for its own purposes.
If you reached the clinic through a Facebook or Instagram ad and the clinic has enabled this feature, Acude may send Meta, on the clinic's behalf, a notification that you requested information, booked an appointment or attended it, so the clinic can measure campaign effectiveness. This notification includes the ad click identifier and, where applicable, your hashed email address or telephone number, but never the treatment you are interested in, the service requested or any information about your health. The clinic is responsible for this disclosure, and Meta processes the data under its own privacy policy. If you do not want this information shared, you can object by contacting the clinic.
Payments are processed directly within Stripe's systems, under Stripe's own privacy policy. Neither Acude nor the clinic receives your full card details. WhatsApp messages are sent through Meta's official WhatsApp Business Platform, subject to WhatsApp's terms and privacy policy.
7. Data recipients
We do not sell or disclose your data to third parties for their own purposes. The following may access it:
Service providers acting as processors under an agreement pursuant to Article 28 GDPR: data hosting, application infrastructure and deployment, email delivery, technical support and billing tools.
Our payment provider, to collect subscription payments, which processes payment data under its own privacy policy.
Meta, when we communicate with you through WhatsApp.
Public administrations, courts and authorities where disclosure is legally required.
We are not responsible for the privacy policies or practices of third parties that do not act on our behalf, which are governed by their own terms.
8. International transfers
Acude data is stored on servers located in the European Union. Some technology providers we use, particularly for application infrastructure, are based in the United States and may process or access data there. In these cases, transfers rely on a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses approved by the Commission. You can request more information at rgpd@acude.io.
9. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and data portability, and withdraw consent at any time, by writing to rgpd@acude.io or to our postal address. We will request the information needed to verify your identity and respond within a maximum of one month.
If you believe we have not properly handled your request, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
10. Security
We apply technical and organisational measures appropriate to the risk, including encrypted communications, per-user access controls, regular backups and provider reviews. The platform database is hosted on servers in the European Union, and card details are never stored in our systems.
11. Children
Acude is a service for professionals and is not intended for children. We do not knowingly collect data from children as Customers or leads.
12. Changes to this policy
We may update this policy to reflect legal or service changes. We will publish the current version at acude.io with its update date and notify you by email of significant changes.