PRIVACY POLICY
Introduction
This Privacy Policy is intended to inform users about how the Carlos Simon Foundation for Research in Women’s Health processes personal data in connection with GenHERate IQ.
GenHERate IQ is an educational initiative of the Foundation focused on advanced education in reproductive medicine and women’s health.
This Policy applies to the processing of personal data carried out through the website genherateiq.com, the associated educational platform, its forms, services, communications and any other functionalities that expressly refer to this Policy. Certain services or activities may provide additional data protection information where required by the specific characteristics of the processing concerned.
Personal data will be processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and any other applicable legislation.
Data Controller
The data controller responsible for the processing of personal data is the Carlos Simon Foundation for Research in Women’s Health, Tax Identification Number (NIF) G98890437, with registered address at Ronda Narcís Monturiol Estarriol, 11 C, 46980 Paterna, Valencia, Spain.
For any questions relating to the processing of personal data, you may contact the Foundation at gdpr@carlossimonfoundation.com.
GenHERate IQ is an initiative of the Foundation and does not constitute a separate legal entity.
Personal Data We Process
Depending on the user’s relationship with GenHERate IQ and the services used, we may process identification and contact data, such as first and last name, email address, postal or billing address where required, telephone number, and country or location.
Where necessary for the management of educational activities, programmes or services, we may also process information relating to the user’s professional or academic profile, such as profession, speciality or professional field, academic or research profile, organisation, institution or centre to which the user belongs, and educational or professional interests.
Where the user has an account, we may process the data required to create and manage it, including account identifiers, username or associated email address, information required for authentication, and data relating to the services purchased. Where necessary to provide an educational service, certain data may also be used to create or update the user’s account on the associated educational platform and to provide access to the relevant courses or content.
We may also process information relating to communications with the user, including communication preferences, newsletter subscription status, records of consent provided, and information relating to certain interactions with electronic communications, where such processing is lawful.
Where a user contacts us, requests information, downloads educational material, requests information about a course or completes any other form, we will process the data provided and any data required to manage the request.
Finally, depending on the configuration of the website and the user’s cookie preferences, certain technical data relating to the use of our services may be processed. Specific information on cookies and similar technologies is available in our Cookie Policy.
Special Categories of Personal Data
Although GenHERate IQ provides educational activities relating to reproductive medicine and women’s health, the public website is not intended to collect patient health data, medical records, genetic data or other special categories of personal data through general contact, subscription or information-request forms.
Users are therefore requested not to include identifiable patient data, clinical information, diagnoses, genetic information or other particularly sensitive data in forms that are not expressly intended for this purpose.
Where, exceptionally, it is necessary to process special categories of personal data for a specific activity, the data subject will be provided with the relevant specific information and the processing will be carried out on an appropriate legal basis and subject to the safeguards required by applicable law.
Purposes of Processing
The Foundation will process personal data in order to manage user accounts, course registrations and enrolments, and to provide access to educational services purchased or requested. Personal data may also be processed to manage participation in courses and activities, provide user assistance and support, and respond to enquiries and requests submitted by users.
Where a user requests information about a course, programme, activity, educational resource or other service, their data will be used to respond to and manage that request. Merely requesting information or downloading an educational resource does not, in itself, constitute authorisation to receive subsequent marketing communications, unless there is an appropriate legal basis or the user has provided the relevant consent.
Where an appropriate legal basis exists, personal data may be used to send information relating to educational courses and programmes, GenHERate IQ activities, training in reproductive medicine and women’s health, scientific updates, educational resources, webinars, events and other GenHERate IQ initiatives.
Certain data may also be processed to protect user accounts, maintain the security of our systems, detect unauthorised access, prevent fraudulent or abusive use, investigate security incidents, prevent and detect unlawful activities, and establish, exercise or defend legal claims.
Legal Bases for Processing
Personal data will be processed on one or more of the legal bases set out in Article 6 of the GDPR, depending on the specific purpose of the processing.
Where necessary to create and manage an account, provide an educational service, manage an enrolment or perform a contract, processing may be based on the performance of a contract or steps taken at the request of the data subject prior to entering into a contract.
Where processing is necessary to comply with tax, accounting, commercial or other legal obligations, the legal basis will be compliance with a legal obligation.
Where applicable law requires the data subject’s consent, such consent will be obtained in a specific, informed and unambiguous manner. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.
In certain cases, processing may be based on the legitimate interests of the Foundation or a third party, provided that such interests are not overridden by the rights and freedoms of the data subjects. Where appropriate, the Foundation will carry out the relevant legitimate interest assessment.
In particular, processing based on legitimate interests may include activities related to systems security, fraud prevention, the management of certain enquiries, the defence of legal claims, or the protection of the Foundation’s rights and assets.
Marketing Communications
GenHERate IQ will send electronic marketing communications only where there is an appropriate legal basis for doing so and in accordance with applicable law.
Where a user subscribes to a newsletter or provides the relevant consent, their contact details and preferences may be added to the tools used to manage communications.
Users may unsubscribe at any time using the link provided for this purpose in the relevant communications or by contacting the Foundation.
Withdrawal of consent will not affect the lawfulness of any processing carried out prior to its withdrawal.
Communications that are strictly necessary to provide a requested service, such as those relating to an account, access to a service or the management of a request, may be sent where necessary for that purpose and will not be considered marketing communications.
Technology Providers and Services
To provide GenHERate IQ services, we may use specialist technology providers for hosting, infrastructure, educational platforms, communications, maintenance, security, user management and other services required for the operation of the project.
These providers include Brevo, which is used to manage certain subscriptions, mailing lists, automated emails and educational or marketing communications.
Where a provider processes personal data on behalf of the Foundation and in accordance with its instructions, the relationship will be governed by an appropriate data processing agreement in accordance with Article 28 of the GDPR.
The legal role of each provider will be determined according to the services actually contracted, the functions performed and the manner in which the purposes and means of the processing are determined. Where a provider acts as a processor, it may not use personal data for its own purposes where those purposes are incompatible with the Foundation’s instructions.
Educational Platform
GenHERate IQ uses an e-learning platform to provide certain educational services.
In this context, the data required to create and manage user accounts, manage course enrolments, provide access to content, record participation in courses, manage learning progress and administer certain educational activities may be processed. Where applicable, data relating to assessments, results or certifications may also be processed.
Specific processing activities carried out within the platform may be subject to additional information where required by the characteristics of the relevant service.
Purchases and Payments
Where a user purchases a course or service, the Foundation will process the personal data required to manage the contractual relationship, including user identification data, information required for administrative management, and any data required for invoicing and compliance with legal obligations.
Information relating to prices, contractual terms, payment methods, cancellations, refunds, the right of withdrawal and other commercial terms is governed by the applicable Terms and Conditions of Purchase or Contract, and is therefore not reproduced in this Privacy Policy.
Where external payment providers are involved, they may carry out their own processing of personal data in connection with the provision of their services and in accordance with their respective privacy policies and legal obligations.
Recipients of Personal Data
Personal data may be disclosed to or accessed by service providers and third parties where necessary to provide services, manage GenHERate IQ activities, comply with legal obligations or pursue the legitimate interests of the Foundation.
Such recipients may include hosting and infrastructure providers, educational platforms, technology service providers, electronic communications providers, payment service providers, maintenance and security providers, as well as legal, tax, accounting or other professional advisers where necessary.
Personal data may also be disclosed to public authorities, courts or other competent bodies where required by law or where necessary for the establishment, exercise or defence of legal claims.
Where such third parties act as processors, the relationship will be governed by the appropriate data processing agreement.
GenHERate IQ does not sell personal data.
International Transfers of Personal Data
Some of the technology providers used by GenHERate IQ may operate internationally or carry out certain processing activities outside the European Economic Area.
Where an international transfer of personal data takes place, the Foundation will apply the mechanisms and safeguards required by applicable data protection law.
Depending on the provider and destination country, these may include European Commission adequacy decisions, Standard Contractual Clauses approved by the European Commission, the EU-U.S. Data Privacy Framework where applicable, or other safeguards provided for under the GDPR.
The existence of an international transfer and the mechanism applicable to it will be determined according to the providers actually used and the current configuration of the relevant services.
Data Retention
Personal data will be retained for as long as necessary to fulfil the purposes for which it was collected.
Once the relationship with the user has ended, data may be retained for the periods required to comply with legal obligations, address liabilities arising from the processing, or establish, exercise or defend potential legal claims.
Data relating to accounts and educational services will be retained while the account or relationship with GenHERate IQ remains active and, thereafter, for the period necessary to comply with applicable legal obligations or address potential liabilities.
Data used for marketing communications will be retained while the user remains subscribed or until consent is withdrawn or another ground for erasure applies. Where the user unsubscribes, the minimum data necessary to demonstrate and respect their request not to receive further communications may be retained.
Data relating to enquiries and requests will be retained for the time necessary to manage them and, thereafter, for the period required to address any potential liabilities.
Data that must be retained in order to comply with a legal obligation will be kept for the periods established by applicable law.
Once the applicable retention periods have expired, personal data will be erased, anonymised or, where appropriate, subject to the blocking or restriction measures required by law.
Data Subject Rights
Where the applicable legal requirements are met, users may exercise their rights of access, rectification, erasure, restriction of processing, objection and data portability. Where processing is based on consent, users may also withdraw their consent at any time.
The right to object may be exercised in particular in relation to processing based on legitimate interests and the processing of personal data for direct marketing purposes.
The exercise of these rights will generally be free of charge.
To exercise any of these rights, the data subject may send a request to gdpr@carlossimonfoundation.com, preferably using the subject line “Data Protection – GenHERate IQ”.
The request must specify the right the data subject wishes to exercise and contain the information necessary to identify the applicant. Where necessary to ensure the security of personal data, we may request additional information to verify the applicant’s identity.
The Foundation will respond to requests within the time limits established by applicable law.
Right to Lodge a Complaint
If a data subject considers that the processing of their personal data infringes applicable law or that their rights have not been properly addressed, they may lodge a complaint with the competent supervisory authority.
In Spain, the competent supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD).
The right to lodge a complaint with a supervisory authority is without prejudice to any other administrative or judicial remedy that may be available.
Profiling and Automated Decision-Making
GenHERate IQ may carry out certain segmentation activities relating to users’ professional or educational interests, for example, in order to manage communications or content that may be relevant to them.
These activities do not, in themselves, involve automated decision-making that produces legal effects concerning users or similarly significantly affects them.
If processing involving decisions based solely on automated processing within the meaning of Article 22 of the GDPR is introduced in the future, the relevant information will be provided and the safeguards required by applicable law will be implemented.
Data Security
The Foundation implements technical and organisational measures appropriate to the level of risk in order to protect personal data against accidental or unlawful destruction, loss or alteration and against unauthorised disclosure or access.
Such measures may include access controls, permission management, authentication mechanisms, protection of systems and applications, backups, and internal information management and protection procedures.
The specific measures implemented will be determined on the basis of the relevant risk assessment and may be modified as risks, technologies or processing activities evolve.
Personal Data Breaches
In the event of a personal data breach, the Foundation will apply the relevant internal procedures to assess the incident and determine the measures to be taken.
Where legally required, the Foundation will notify the breach to the competent supervisory authority and, where appropriate, to the affected individuals, in accordance with Articles 33 and 34 of the GDPR.
Minors
GenHERate IQ is primarily aimed at professionals, researchers, clinical staff, students and other individuals interested in specialised education relating to women’s health.
The services are not specifically directed at minors. Where the processing of a minor’s personal data is based on consent, the rules set out in the GDPR and Spanish legislation regarding the age and conditions for validly providing consent will apply.
Where legally required, consent or authorisation will be obtained from the person exercising parental responsibility or legal guardianship over the minor.
Third-Party Links and Services
The website may contain links to or integrate services provided by third parties. The use of such services may involve the processing of personal data directly by the relevant third party.
In such cases, the processing carried out by the third party will be subject to its own privacy policy and, where applicable, its own consent mechanisms.
GenHERate IQ is not responsible for the privacy practices of third-party websites that are not managed by the Foundation.
Confidentiality
Persons involved in the processing of personal data will be subject to the applicable confidentiality obligations in accordance with applicable law and, where relevant, their professional or contractual obligations.
The Foundation seeks to apply the principles of data protection by design and by default to the processing activities under its responsibility, taking into account the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of individuals.
In this context, where appropriate, measures will be adopted to limit the personal data processed to what is strictly necessary, restrict access, apply appropriate security measures, establish retention periods and assess the risks associated with the processing activities.
Updates to this Privacy Policy
This Policy may be updated where necessary to reflect changes in applicable law, modifications to the services offered, changes in the technologies used, the addition or replacement of service providers, changes in processing purposes or legal bases, or changes in our data protection practices.
The current version will be made available on the GenHERate IQ website.
Where a change requires specific notification to users or renewed consent, the appropriate measures will be taken.
Contact
For any questions regarding this Privacy Policy or the processing of personal data, please contact:
Carlos Simon Foundation for Research in Women’s Health
Tax Identification Number (NIF): G98890437
Ronda Narcís Monturiol Estarriol, 11 C
46980 Paterna, Valencia, Spain
Email: gdpr@carlossimonfoundation.com
Additional Information
Where applicable, this Privacy Policy is supplemented by the Cookie Policy, in relation to the use of cookies and similar technologies, and by the applicable Terms and Conditions of Purchase or Contract, in relation to the purchase of courses and services.
Certain forms, services or activities may also include specific data protection information where their particular characteristics require additional information to be provided to the data subject.
Where a specific processing activity requires additional information under applicable data protection law, such information will be provided to the data subject at the appropriate time.
Last updated: 9 September 2026
