Privacy policy
Last updated: 31 October 2026
1. Controller
Viktoria Sargsyan Zaduryan, trading as Diagnostic Station.
NIF: 60737332J.
Address: Carrer d'Almogàvers 60, 08018 Barcelona, Spain.
Email: hello@diagnosticstation.com.
Phone: +34 684 782 711.
We process your data under Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
2. Who this covers
This policy applies to:
- Visitors to this website.
- People who use the contact form, and customers we email about their order or their request.
- People who sign up for news by email.
- People who request a custom quote.
- People who buy a test.
- People who write to us on WhatsApp.
- People who give their consent on our WhatsApp quote page.
Our services are for people aged 18 or over. If we find a child’s data, we delete it at once.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answer your contact enquiry | Art. 6.1.b (pre-contractual steps at your request) |
| Email you about your order or your request | Art. 6.1.b (performance of the contract or pre-contractual steps at your request) |
| Prepare a custom quote | Art. 6.1.b (pre-contractual steps) |
| Reply to you on WhatsApp | Art. 6.1.b GDPR |
| Prepare your quote from what you sent on WhatsApp and send it to you on WhatsApp | Art. 6.1.b + Art. 9.2.a GDPR |
| Keep the proof of your consent | Art. 7.1 GDPR |
| Store the markers you selected so we can price the quote. It is an enquiry. It does not mean you have a condition. | Art. 6.1.b (pre-contractual steps) and Art. 9.2.a (explicit consent for health data) |
| Carry out your purchase: order, code, payment and email support | Art. 6.1.b (performance of the contract) |
| Process the health data implied by the test you buy | Art. 9.2.a (explicit consent) |
| Issue an invoice, if you ask, and keep the accounting records | Art. 6.1.c (legal obligation) |
| Host the site and keep technical logs | Art. 6.1.f (legitimate interest) |
| Cookieless website analytics. Not used for advertising. This is an exempt audience measurement. | Art. 6.1.f (legitimate interest). Art. 22.2 LSSI and the AEPD guide of January 2024. You can object at hello@diagnosticstation.com. |
| Count blog visits in aggregate (a number on the article). That count keeps only the number. This is an exempt audience measurement. | Art. 6.1.f (legitimate interest). Art. 22.2 LSSI and the AEPD guide of January 2024. You can object at hello@diagnosticstation.com. |
| Count each test page visit in aggregate (a number per test). It does not create a visitor profile. It does not store the IP. This is an exempt audience measurement. | Art. 6.1.f (legitimate interest). Art. 22.2 LSSI and the AEPD guide of January 2024. You can object at hello@diagnosticstation.com. |
| Count each city home page visit in aggregate (a number per city). It keeps only the number. This is an exempt audience measurement. | Art. 6.1.f (legitimate interest). Art. 22.2 LSSI and the AEPD guide of January 2024. You can object at hello@diagnosticstation.com. |
| Send the emails for those requests | Art. 6.1.b (pre-contractual steps) |
| Send you news and offers by email, only if you subscribe, tick the consent box and confirm your sign-up from the link in the email we send you | Art. 6.1.a (consent). You can unsubscribe at any time with the link in each email. |
| If you have already bought from us, send you information about tests similar to the ones you bought | Art. 21.2 LSSI and legitimate interest (Art. 6.1.f). Each email includes an unsubscribe link, and you can object at any time. |
| Produce aggregated, anonymous statistics to improve the service | Art. 6.1.f (legitimate interest). They do not identify anyone. |
The markers you selected are the test list for a price. It is an enquiry. It is not a diagnosis and it does not mean you have a condition.
We never use your health data, or the tests you selected, for marketing. We only send you commercial emails if you subscribe or, if you have already bought from us, about similar tests. You can unsubscribe in each email.
4. Data we process
Contact: name, email, optional phone number, and message. The box “I have read the privacy policy” is proof that we informed you before you sent the form. It is not consent. The basis for answering you is your own request. If we write to you first, about your order or about something you asked us by phone or WhatsApp, we keep your email address, your name if we have it, and the messages. The basis is your order or your request.
News by email: your email address, the date and time you ticked the box, the exact text of the box, the page you signed up from, and the site language. We also store the sign-up status (pending, confirmed or withdrawn), the confirmation time, the version of this policy in force that day and a hashed fingerprint of the confirmation link. Together these are the proof of your consent. Nobody joins the sending list until they click the confirmation link we email them.
Custom quote: your first name, last name, email, the markers you chose, optional notes and your explicit consent, signed with your name in the form.
Purchase: your name, your email, the order, the tests you bought, the four boxes you tick before paying (terms and privacy, health data, start of the service, and that you are 18 or over) and, if you ask for an invoice, your tax ID.
Contact messages and custom-quote requests are stored in our operations database. The team receives only an email alert with the request id and a link to our internal panel. Your name, your email, your message, the markers you selected and the notes are not in that alert. They exist only in the database. News sign-ups: the proof of your consent is stored in the operations database, and your email joins the sending list of our email provider only when you confirm the sign-up.
We answer contact messages and quote requests from that internal panel. Our reply reaches you by email from hello@diagnosticstation.com, through our email provider. We store the text of the reply and its time on the same request, and they are deleted with it. If you answer that email, your answer arrives in our internal panel, on the same request, and is deleted with it. We do not keep files you attach.
Technical data from a visit: IP address, browser user agent, device type, and the cookies ds_locale, ds_location, ds_consent and, only on a team browser, ds_staff_visit.
Analytics: page URL, referrer, device type, browser, operating system, and a coarse location (country or region). The analytics provider identifies the visit with a hash of the request and discards that hash after 24 hours. This is not a marketing profile.
Blog: we add 1 to the article view count in the operations database. The IP is used only briefly to limit abuse in server memory, and is then discarded. The count does not include a visitor profile. This measurement does not need your consent.
Tests: we add 1 to the visit count for each test in the operations database. The IP is used only briefly to limit abuse in server memory. It is not stored. There is no visitor profile. This measurement does not need your consent.
City pages: we add 1 to the visit count for each city home page in the operations database. The IP is used only briefly to limit abuse in server memory. It is not stored. There is no visitor profile. This measurement does not need your consent.
Browser session storage (not a cookie): remembers if you closed the launch banner. This is necessary. It clears when you close the tab.
The same tab stores a mark so a blog article, a city home page, or a test page is not counted twice. It is session storage. The measurement runs on the first view.
5. Do you have to give us your data?
The fields marked as required on each form are needed to handle your request or your purchase. If you do not provide them, we cannot reply, prepare the quote, or process the order. The other fields are optional. Please give us true information and tell us if it changes.
6. Automated decisions
We do not make automated decisions and we do not build profiles from your data.
7. Recipients
To provide the service we use providers that process data on our behalf, under a data-processing agreement:
- Web hosting and cookieless analytics provider.
- Database and storage provider (Google Cloud, servers in the European Union). It hosts our operations database and its backups, in the same region.
- Email provider. It sends the team the alert with your request id, and sends you our replies to your enquiries and quotes, the newsletter confirmation email, the newsletter itself, and the confirmations and authorisations for your purchase.
- Email provider for the team. That mailbox only receives the alerts with the request id, without your data.
- Card payment provider (a payment institution authorised in the European Union). It processes your card data. We do not see it.
- Map provider. If you accept, the map loads on its own on every page. If you reject or make no choice, it loads when you press Show map, for that visit only. That press does not change your choice.
- Artificial intelligence providers (OpenAI and Anthropic), as data processors, for operating the website and our internal tools, for example preparing quotes or translating content. We only send them the text needed, without your name or contact details.
Authorised partner clinical laboratory (Spain), which processes your data as an independent controller. We send it your name, your email, your code and the tests, so it can run the test and send you the results.
WhatsApp (WhatsApp Ireland Limited, Meta), to communicate with you.
We do not sell your data. You can ask us for the specific list of providers by emailing hello@diagnosticstation.com.
8. International transfers
Some providers are based in the United States. We only use providers that take part in the EU-US Data Privacy Framework, which has an adequacy decision from the European Commission (Decision 2023/1795), and also Standard Contractual Clauses (Decision 2021/914). Our database is in the European Union.
WhatsApp (Meta), OpenAI and Anthropic may process data in the US. The transfer relies on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses, depending on the provider.
9. Retention
Contact: we keep your message, or the email we wrote to you, and the replies in the operations database for at most 90 days from the first message. We may delete it sooner. When that time is up, the database deletes it automatically. Backups are deleted automatically after 7 days, so complete deletion happens at most 97 days after the first message. The alert the team receives carries only the request id, with no personal data.
Custom quotes: we keep the request in the operations database for 90 days from the day we receive it. When that time is up, the database deletes it automatically. Backups are deleted automatically after 7 days, so complete deletion happens at most 97 days after we receive it. The alert the team receives carries only the request id, with no personal data. We keep the proof of your consent (name, email, date and document version) for 3 years.
Quotes sent as a link: when we prepare a quote for you (for example on WhatsApp), we store in the operations database the tests, the price, the language of the link, and whether the link was opened, accepted or paid. We do not store your name or your phone number on the quote. The link works for 7 days unless we extend it, and the database deletes the quote automatically after 30 days (or 23 days after the link expires, if that is later). To keep our prices consistent, we keep a one-year record of prices per test that holds no data about you and no link. If you send us your request in a message, we keep a copy of that message and our quote tool’s answer for 90 days, only to check that our quotes are correct. After that, the database deletes it automatically. If you pay, the data of your purchase follows the rules for purchases.
Our replies and yours: the text and time of each message are stored on the same request and deleted with it. We do not keep attachments.
Website analytics: the provider discards the visitor hash after 24 hours. Aggregated reports stay in its dashboard for the reporting window of the plan.
Blog counter: the aggregate number stays on the article document for as long as the article exists. We do not store an IP or a profile.
Test counter: the aggregate number stays on the test record for as long as the test exists. We do not store an IP or a profile.
City counter: the aggregate number stays on the city record for as long as that city is on the site. We keep only the number.
Orders and invoices: we keep them for 6 years (article 30 of the Spanish Commercial Code). Then we delete them.
News by email: if you do not confirm your sign-up, we delete the record after 30 days. Backups are deleted automatically after 7 days, so complete deletion happens at most 37 days after you signed up. If you confirm, your email stays in the sending list until you unsubscribe. The unsubscribe link is in every email. When you use it, our record keeps the withdrawal date as proof for 3 years, the longest limitation period in data protection. After that it deletes itself, and backups disappear at most 7 days later.
10. Security measures
The site is served over HTTPS.
The cookies ds_locale, ds_location, and ds_staff_visit are httpOnly and SameSite=Lax.
The ds_consent cookie stores your choice about third-party cookies for 12 months. If you accept, the map loads on its own on every page. If you reject or make no choice, one press on Show map loads the map for that visit and does not change this cookie. Audience measurement does not depend on this cookie.
Your contact message and the markers you selected on a quote are stored only in the operations database, with access restricted to the team. The team alert does not include them.
Database backups are kept for 7 days in Google Cloud, in the same European Union region as the database, and are then deleted automatically.
We apply technical and organisational measures suited to the risk: restricted access to accounts with two-step verification, encryption in transit (HTTPS), and providers bound by data-processing agreements.
11. Online purchase and payment
Diagnostic Station sells tests online. You buy the test on this site and pay by card. A card payment provider, a payment institution authorised in the European Union, handles the payment. It processes your card data. We do not see it.
Your purchase is the test you pay for on this site. You then visit the partner laboratory during collection hours. Barcelona and Madrid do not need an appointment. Valencia and Málaga do. You call the laboratory to book. The phone number is on the authorisation we send after you pay. It is not a medical appointment.
The laboratory takes the sample, analyses it and handles the results. Diagnostic Station does not receive, store, or send the result report.
We keep your order with your name, your email, the tests you bought and your code. We send the partner laboratory those same four items: your name, your email, the tests and your code. It needs them to complete the service you buy from us. When you arrive at the laboratory, you sign its own data protection form there.
We work with partner laboratories in several cities. We do not publish the list. Yours is on the authorisation we send after you pay.
12. Cookies
This site sets a language cookie and a city cookie for every visitor. The cookie that stores your choice about third-party cookies is set when you accept, reject or save. One more cookie is set only on a team browser, from a private link. It does not set marketing cookies.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| ds_locale | Stores your language (en, es or fr) on paths with no locale in the URL. | 12 months | Own, strictly necessary |
| ds_location | Stores the city you chose (Barcelona, Madrid, Málaga or Valencia) for the address and collection hours. | 12 months | Own, preference |
| ds_consent | Stores your choice about third-party cookies, such as the map. | 12 months | Own, necessary |
| ds_staff_visit | Marks a team browser so its test page views are not counted. Set only from a private admin link. Visitors do not receive it. | 12 months | Own, functional |
The language cookie and the city cookie do not ask for a separate consent. Audience measurement does not either. Your choice cookie covers third-party cookies, such as the map.
The launch notice uses browser session storage (sessionStorage) to remember if you closed it. This is necessary. It is not a cookie. It clears when you close the tab.
The cart is saved in your browser's local storage (localStorage). This is necessary to buy. It is not a cookie. It is shared between your tabs and clears when you pay or 24 hours after the last change.
The mark that avoids counting the same blog article, city home page, or test page twice is stored in the tab. It is session storage. The measurement runs on the first view.
Website analytics do not use cookies. The visit hash is discarded after 24 hours. This is an exempt audience measurement (Art. 22.2 LSSI and the AEPD guide of January 2024). Basis: Art. 6.1.f. You can object at hello@diagnosticstation.com.
If you accept, the map loads on its own on every page. If you reject or make no choice, you see the Show map button and a short line. One press loads the map for that visit, including a neighbourhood switch and the other pages. A new visit shows the button again. That press does not change your choice cookie.
13. Social networks (Instagram)
We have a profile on Instagram, a network of Meta Platforms Ireland Limited. When you follow us, comment, react, or send us a direct message, we process the data you publish or send us: your username, your profile photo, and the content of your messages and comments.
Purpose: to reply to your messages and comments, and to show our content. Legal basis: legitimate interest (Art. 6.1.f) to manage the profile, and pre-contractual steps (Art. 6.1.b) if you ask us about a test.
Health data is sent by email, to hello@diagnosticstation.com, and stays off Instagram. That includes symptoms, results, and the tests you are interested in. If we receive health data through Instagram, we do not use it, and we ask you to write to us by email.
Meta receives aggregated statistics about our profile (Insights). For that, Meta and we are joint controllers, under Meta’s agreement for pages and profiles. Meta also processes your data under its own privacy policy, and may transfer it outside the EU with the safeguards stated there.
Retention: comments and messages stay on Instagram until you or we delete them. We do not copy them to our systems, unless we need them to handle your request.
Rights: you can exercise them with us at hello@diagnosticstation.com. For the data Meta controls, also exercise them with Meta from your account settings.
14. WhatsApp
You can write to us on WhatsApp (WhatsApp Ireland Limited, part of the Meta group). If you ask us for a quote, before we use what you send, we send you a link to our website or ask you in the window that opens when you tap the WhatsApp button, where you read this information and give your explicit consent. Until then, we do not use the tests or documents you sent. If you do not accept, we delete them.
Data: your number, your WhatsApp name, your messages, and the tests or documents you send us, which may be health data.
Proof: we keep your name, your number, the date, and the version of the text you accepted.
Your consent covers your future quotes on WhatsApp for 3 years, or until you withdraw it.
WhatsApp processes your data under its own terms and may transfer it to the US under the EU-US Data Privacy Framework.
Retention: we delete chats after 90 days. We keep the record of your consent for 3 years.
Withdraw your consent: write STOP on WhatsApp or to hello@diagnosticstation.com.
15. Your rights
You may request access, rectification, erasure, restriction, portability, or object to processing.
You may withdraw consent at any time. That does not affect processing that was already lawful.
You may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.
To exercise your rights, email hello@diagnosticstation.com.
16. Changes
We may update this policy when our practices change. The current version is always on this page.