Table of contents
- Introduction
- Data controller
- Data we collect
- Health data & sensitive categories
- Students under 18
- How we use your data
- Legal bases for processing
- Sharing & disclosure
- Sanitas as independent controller
- International data transfers
- Storage & retention
- Data security
- Cookies & tracking
- Your data-protection rights
- Third-party links
- Updates to this policy
- Contact information
1. Introduction
Student Visa Health Insurance Spain (“we”, “our”, “us”) is operated by Stephen Paul Gregory, an Exclusive Insurance Agent of Sanitas S.A. de Seguros, registered with the Dirección General de Seguros y Fondos de Pensiones (DGSFP) in the Administrative Register of Insurance and Reinsurance Distributors under number C0320Y2155969D.
This Privacy Policy explains how we collect, use, store and protect your personal data when you visit studentvisahealthinsurancespain.com, use the eligibility checker or quote calculator, submit an application, correspond with us, or otherwise interact with our services for international students coming to Spain.
This Policy complies with Regulation (EU) 2016/679 (GDPR); Spanish Organic Law 3/2018 (LOPDGDD); Law 34/2002 (LSSICE); and Law 20/2015 (LOSSEAR) together with Royal Decree-Law 3/2020 transposing the EU Insurance Distribution Directive.
2. Data controller
Data controller
Stephen Paul Gregory — Exclusive Insurance Agent of Sanitas S.A. de Seguros
NIE: Y2155969D
DGSFP register no.: C0320Y2155969D
C/ Alcalde Clemente García, 19, 5 — 30169 San Ginés, Murcia, Spain
Where a quote is issued or a policy is contracted, Sanitas S.A. de Seguros (Calle Ribera del Loira 52, 28042 Madrid) acts as an independent data controller in its capacity as insurer. Its privacy practices are described at sanitas.es/RGPD.
3. Data we collect
Depending on your interaction with us, we may collect:
- Contact information: full name, email address, phone number, country of origin.
- Identification data: date of birth, nationality, passport number and passport details (where required to issue a policy or visa certificate).
- Study data: course type, course start and end dates, proof of enrolment or letter of admission, intended province of residence in Spain.
- Policyholder data for students under 18: the identity, contact details, date of birth and relationship of the adult policyholder (parent, legal guardian or grandparent) — see section 5.
- Health data: medical history and current treatments — collected only where necessary to assess insurability or issue a policy. See section 4.
- Transaction data: policy number, premium amounts, payment method.
- Communication data: records of emails, phone calls, WhatsApp messages and form submissions.
- Website usage data: IP address, browser and device information, pages viewed, referral source and campaign parameters — via cookies and similar technologies.
- Marketing preferences: consent status for commercial communications.
You guarantee that the data you provide is true, accurate, complete and up-to-date. Where you provide data about third parties (for example a student you are insuring as policyholder), you confirm you are entitled to do so and have informed them of this Privacy Policy.
4. Health data & sensitive categories
Why we need health data. Spanish health insurance cannot be quoted, underwritten or issued without information about each applicant's medical circumstances where the insurer requires it. Providing it is a necessary condition for the service you have requested.
Health data is a “special category” under Article 9 GDPR. We process it under: your explicit consent (Art. 9(2)(a)), given when you submit an application or health declaration; pre-contractual measures and performance of a contract (Art. 6(1)(b)); provision of health care / management of health systems (Art. 9(2)(h)) with the safeguards of Spanish insurance and health regulation; and compliance with legal obligations (Art. 6(1)(c)).
Health data is transmitted to Sanitas S.A. de Seguros for underwriting. We apply strict access controls and encryption, and never use health data for marketing.
5. Students under 18
The Sanitas International Students plan covers students aged 14 to 35. Where the student is aged 14–17, the application is made and the policy is held by an adult policyholder — a parent, legal guardian or grandparent aged 18 or over.
- The adult policyholder provides the minor's data, gives the consents required for the application, and signs it. The student aged 14–17 is the insured person.
- We process the minor's data solely to quote, underwrite, issue and administer the policy and the related visa documentation — never for marketing. Marketing consent is only ever attributed to the adult policyholder.
- We do not direct our services or marketing at children, and we do not knowingly process data of children under 14 in connection with the student plan (younger children can only be covered under family policies arranged separately with the adult).
6. How we use your data
- To check eligibility, calculate quotes and compare available Sanitas plans for your profile.
- To respond to enquiries and support the application process.
- To submit applications to Sanitas S.A. de Seguros and manage communications between you and the insurer.
- To issue visa certificates and documentation required for student-visa applications.
- To manage renewals, amendments, cancellations and claim assistance.
- To send marketing communications — only where you have consented and never to minors.
- To improve our website, content and services.
- To comply with legal, regulatory and tax obligations.
7. Legal bases for processing
| Purpose | Legal basis |
|---|---|
| Eligibility check, quote calculation and policy issuance | Pre-contractual measures / contract (Art. 6(1)(b)); explicit consent for health data (Art. 9(2)(a)) |
| Enquiry handling and support | Legitimate interest in responding to your request (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Legal, tax and AML compliance | Legal obligation (Art. 6(1)(c)) |
| Website security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Analytics and advertising cookies | Consent (Art. 6(1)(a)) — see the Cookie Policy |
8. Sharing & disclosure of data
- Sanitas S.A. de Seguros — the insurer to whom all applications are submitted; an independent controller for data processed in connection with a quote, policy or claim.
- Trusted service providers (processors) — including HubSpot (CRM and email), website hosting, analytics and cloud-storage providers, under Art. 28 GDPR data-processing agreements.
- Advertising and measurement platforms — Google (Analytics, Ads), Meta (Facebook & Instagram), LinkedIn and Microsoft (Clarity) may receive pixel or tag data (such as page-visit and quote-completion events) solely to measure campaigns and show relevant ads — only with your explicit cookie consent, governed by Standard Contractual Clauses. Withdraw consent at any time via the cookie preferences panel.
- Spanish authorities and public bodies where required by law (AEAT, DGSFP, AML supervisors).
- Courts, regulators and law enforcement where legally compelled.
We do not sell your personal data.
9. Sanitas as independent controller
Once your application is submitted, Sanitas S.A. de Seguros becomes an independent data controller for the data processed in its systems, per its Privacy Policy at sanitas.es/RGPD. The Sanitas Data Protection Officer can be contacted at dpo@sanitas.es.
10. International data transfers
Your data is primarily stored and processed within the EEA. Where a provider is located outside the EEA (for example US-based analytics or email platforms), we rely on European Commission adequacy decisions (including the EU–US Data Privacy Framework where applicable), Standard Contractual Clauses, and supplementary technical measures where required.
11. Storage & retention
- Quote requests with no policy issued: up to 12 months from last interaction, unless you withdraw consent earlier.
- Active policies: the duration of the policy plus the statutory limitation period.
- Tax and accounting records: 6 years (Spanish Commercial Code & General Tax Law).
- AML/KYC records: 10 years (Law 10/2010).
- Marketing consent records: until you withdraw consent.
- Cookies: see the Cookie Policy.
12. Data security
We apply appropriate technical and organisational measures — TLS encryption in transit, encrypted storage, access controls and regular review of processors' security standards. No internet-based service is entirely risk-free; we will promptly notify you and the supervisory authority of any breach meeting the thresholds of Arts. 33–34 GDPR.
13. Cookies & tracking technologies
Our website uses cookies and similar technologies for essential functionality, measurement and — where you consent — advertising. Full details and preference management are in our Cookie Policy.
14. Your data-protection rights
Under GDPR and LOPDGDD you have the rights of access, rectification, erasure, restriction, portability and objection (including to direct marketing at any time), the right to withdraw consent without affecting prior processing, and the right to lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es). Where a policyholder exercises rights concerning a minor's data, we may verify their authority to act.
To exercise any right, email info@studentvisahealthinsurancespain.com with proof of identity. We respond within one month (Art. 12 GDPR).
15. Third-party links
Our website may link to third-party sites (including Sanitas.es and official visa-information sites). We are not responsible for their privacy practices or content.
16. Updates to this Privacy Policy
We may update this Policy to reflect changes in our practices or in applicable law; the “Last updated” date shows the most recent revision. Material changes will be notified by a prominent notice on the website.
17. Contact information
Questions or rights requests
Student Visa Health Insurance Spain — Stephen Paul Gregory (Exclusive Agent of Sanitas)
C/ Alcalde Clemente García, 19, 5 — 30169 San Ginés, Murcia, Spain
Email: info@studentvisahealthinsurancespain.com
DGSFP register no.: C0320Y2155969D
Sanitas Data Protection Officer: dpo@sanitas.es