Data protection notice for Doctor Cigna

The purpose of this Data Protection Notice is to provide you with information about the processing of your personal data in connection with your access to and use of the Doctor Cigna service.

The controller of your personal data is Cigna Life Insurance Company of Europe, S.A./N.V., Spanish Branch ("Cigna"), with registered address at Parque Empresarial La Finca, Paseo del Club Deportivo 1, Building 14, Floor 1, 28223 Pozuelo de Alarcón (Madrid), Spain.

This Data Protection Notice applies to users who access or use Doctor Cigna, in particular to individual beneficiaries of the Service. In accordance with the Terms and Conditions, the Service is intended exclusively for employees of Cigna client companies that have subscribed to Doctor Cigna and is not available to minors.

COLLECTION AND PROCESSING OF PERSONAL DATA

We collect personal data from, or relating to, the following individuals, to the extent necessary to provide access to and deliver the Doctor Cigna service:

Users or patient beneficiaries of the Doctor Cigna service.
Employees of Cigna client companies that have subscribed to the Service, provided they meet the applicable access requirements.
Healthcare and non-healthcare professionals involved in the provision of the Service, where necessary to document or manage the healthcare, guidance, or support interaction.
Third-party collaborators or specialized entities providing certain services associated with Doctor Cigna, as described in the Terms and Conditions.

We collect and process various categories of personal data, including, where applicable, special categories of personal data. Personal data that may be processed in connection with Doctor Cigna includes:

Service registration and access information, including, where applicable, login credentials, passwords, and information required to register on Cigna's Portal or private area.
User/patient identification and contact information necessary to enable access to the service and manage consultations.
Information arising from video consultations, teleconsultations, or chat interactions, including information communicated by the user and the opinion, advice, or guidance provided by the relevant professional.
Information relating to medical conditions, symptoms, medical history, allergies, previous or ongoing treatments, information required for the prescription, dispensing, or administration of medication, and any other health information provided by the user or generated during the provision of the Service.
The patient's Medical Record, in which the patient's health conditions, medical acts, and other procedures carried out by the attending physician are recorded chronologically.
Medical reports generated, where considered appropriate by the professional, following a medical consultation conducted through Doctor Cigna.
Medical prescriptions and documentation associated with the prescribing of medication, where applicable.
Referrals or prescriptions for diagnostic tests, including simple X-rays, standard laboratory tests, ultrasounds, and other examinations deemed relevant by the professional based on the patient's condition.
Information relating to voluntary participation in clinical follow-up programs, health coaching, psychological counselling, or virtual physiotherapy services, where such services form part of the contracted coverage and the user participates in them.
Technical or usage data relating to the Portal/App that is strictly necessary for access, authentication, operation, and security of the service.
Health data and other special categories of personal data processed in the context of healthcare, psychological, physiotherapy, clinical follow-up, or health guidance services.

Personal data may be obtained directly from you, from information you provide during registration, through your use of the Portal/App, video consultations, chats, or communications with Doctor Cigna, as well as from professionals or collaborating entities involved in the provision of the Service, where necessary and in accordance with applicable law.

In certain circumstances, if you do not provide the requested information, or if the information provided is incomplete, we may be unable to provide certain services, offer appropriate clinical guidance, issue prescriptions, prescribe diagnostic tests, maintain your Medical Record, or manage your consultation safely and effectively.

PURPOSES FOR PROCESSING YOUR PERSONAL DATA

We process your personal data in order to provide and manage the Doctor Cigna service, as well as to administer the healthcare, guidance, follow-up, and support functionalities associated with that service.

In particular, we use your personal data for the following purposes:

To manage registration, authentication, access to, and use of the Portal/App or private area through which Doctor Cigna is provided.
To enable remote telemedicine consultations with qualified healthcare professionals.
To manage video consultations, electronic communications, or asynchronous chat interactions between the user and Doctor Cigna for the exchange of information, opinions, or advice.
To provide initial clinical and healthcare guidance regarding health-related matters raised by the user, including the interpretation or prescription of diagnostic tests, the prescription of treatment where appropriate, or referral to a specialist or emergency services based on the medical condition and professional judgment.
To create and maintain the patient's Medical Record in accordance with applicable healthcare and data protection legislation, with access restricted to duly authorized healthcare personnel.
To generate, retain, and make available medical reports where the healthcare professional considers it appropriate as part of the patient's Medical Record.
To prescribe medication where clinically appropriate, including the issuance of medical prescriptions in accordance with applicable legal requirements and the limitations of the service.
To prescribe diagnostic tests that the healthcare professional considers relevant for the patient's diagnosis, including simple X-rays, standard laboratory tests, ultrasounds, or other examinations based on professional judgment.
To securely share with the user documentation generated during the consultation, such as prescriptions, referrals for diagnostic tests, or medical reports, once the consultation has been completed.
To provide guidance regarding contracted products, procedures related to Cigna products, hospitals, medical centers, and healthcare professionals, without replacing direct medical assessment or the user's freedom to choose a healthcare provider.
To manage voluntary enrolment in coordinated physician-patient programs for the management of certain medical conditions, including clinical monitoring of acute and/or chronic diseases, where applicable.
To provide health coaching programs aimed at promoting healthy lifestyles and behavioral changes to improve physical and emotional wellbeing, without constituting a medical act or replacing a medical consultation.
To enable access to psychological counselling services provided by a specialized third-party provider duly authorized by Cigna, where the user has the relevant coverage and meets the Service requirements.
To enable access to virtual physiotherapy services provided by a specialized third-party provider duly authorized by Cigna, where the user has the relevant coverage and meets the Service requirements.
Where appropriate and subject to the policyholder's express, informed, and revocable consent, to facilitate Cigna's access to certain data generated through psychological counselling or physiotherapy services in order to ensure comprehensive and holistic clinical guidance in the context of related telemedicine consultations.
To apply the clinical, healthcare, technical, and security limitations established for Doctor Cigna, including recommending emergency or in-person healthcare services where required by the user's clinical situation.
To ensure the confidentiality, security, restricted access, and professional secrecy of the personal and health data processed as part of the Service.
To comply with applicable legal, healthcare, regulatory, contractual, or record-keeping obligations relating to the Service.
To manage incidents, enquiries, requests, or complaints relating to the access to, use of, or provision of the Service.

TELEMEDICINE SERVICES

Through Doctor Cigna, you may access telemedicine and digital healthcare services. These services include, as the primary offering, remote telemedicine consultations with qualified healthcare professionals.

Video consultations involve the exchange of information, opinions, or advice between the user and Doctor Cigna through digital channels, videoconferencing, or chat. The Terms and Conditions distinguish between medical consultations, which address health-related matters, and non-medical consultations, which address other matters covered by the Service.

As part of a medical consultation, the healthcare professional may provide clinical and healthcare guidance, request or interpret diagnostic tests, prescribe treatment where appropriate, or refer the user to a specialist or emergency services based on the medical condition presented and the professional's clinical judgment.

Doctor Cigna does not replace or constitute an equivalent to in-person medical care and is not an emergency medical service. Where the healthcare professional identifies a situation that may pose a risk to the patient's life or health, the patient will be instructed to attend the nearest emergency department or healthcare facility without delay.

Within the framework of Doctor Cigna, the physician providing the video consultation may create and maintain the patient's Medical Record in accordance with applicable healthcare and data protection legislation. In addition, each time a patient participates in a medical consultation, and where considered appropriate by the healthcare professional, a Medical Report may be generated and stored as part of the patient's Medical Record.

The Service may include the prescription of medication and diagnostic tests, always subject to the healthcare professional's clinical judgment, applicable clinical limitations, and legal requirements. Any documentation generated during the consultation may be securely shared with the user following completion of the consultation.

In addition to telemedicine consultations, Doctor Cigna may include guidance services, clinical follow-up programs, health coaching, psychological counselling, and virtual physiotherapy services, depending on the coverage contracted by the client company and the applicable service conditions.

Certain additional services may be provided by specialized third-party providers duly authorized by Cigna. In particular:

Psychological counselling services are provided by a network of professionals belonging to Teladoc, S.L., which acts as an independent controller in respect of the personal and health data processed in connection with that service.
Virtual physiotherapy services are provided by professionals belonging to Servicios de Fisioterapia, S.A., which acts as an independent controller in respect of the personal data processed in connection with that service.

In both cases, Cigna may, subject to obtaining the policyholder's express, informed, and revocable consent, access certain information generated through these services for the purpose of ensuring comprehensive and holistic clinical guidance in connection with related telemedicine consultations. Such access shall not interfere with the professional independence or clinical autonomy of the psychologist, physiotherapist, or other relevant healthcare professional.

LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

We process your personal data on the basis of the legal grounds provided for under applicable data protection legislation. The specific legal basis will depend on the nature and purpose of the processing activity in each case.

The legal bases that may apply include the following:

Performance of a contract or provision of the Service, where the processing is necessary to manage access to, use of, and provision of the Doctor Cigna service.
Compliance with legal, regulatory, and healthcare obligations, where the processing is necessary to create and maintain Medical Records, medical reports, prescriptions, clinical documentation, or to comply with legal requirements associated with the provision of healthcare services.
The policyholder's express, informed, and revocable consent, where required for Cigna to access certain data generated through psychological counselling or physiotherapy services for the purpose of ensuring comprehensive and holistic clinical guidance.
Cigna's legitimate interests, where the processing is necessary to ensure service security, manage incidents, prevent misuse, or establish, exercise, or defend legal claims.

DISCLOSURE OF PERSONAL DATA

Where necessary to provide the Doctor Cigna service or for the purposes described in this Notice, we may disclose your personal data to certain categories of recipients or allow them access to such data, strictly to the extent necessary.

In particular, personal data may be disclosed or made accessible to:

Healthcare and non-healthcare professionals appointed by Cigna to manage the various services offered through the platform or by any other means.
Duly authorized healthcare personnel, with restricted access to the Medical Record and medical documentation generated as part of the Service.
Specialized third-party providers delivering services associated with Doctor Cigna, including Teladoc, S.L. for psychological counselling services and Servicios de Fisioterapia, S.A. for virtual physiotherapy services, to the extent that such entities provide the relevant services as independent controllers of the personal data processed in connection with those services.
Emergency healthcare facilities, specialists, or other healthcare providers where a healthcare professional determines that a referral, recommendation, or further medical assistance is necessary, and where such disclosure is required and permitted under applicable law.
Technology, support, hosting, security, communications, or document management service providers that process personal data on behalf of Cigna in their capacity as data processors.
Public authorities, regulatory bodies, judicial authorities, or healthcare authorities where disclosure is required by applicable law.

INTERNATIONAL DATA TRANSFERS

To the extent necessary for the provision of the Doctor Cigna services or for the operation and support of the platform (for example, through technology providers, healthcare providers, or digital service providers), your personal data may be transferred outside the European Economic Area ("EEA").

Such transfers will be limited to what is strictly necessary and will be carried out in accordance with applicable data protection laws.

Notwithstanding the above, the hosting and storage of the Medical Record and the clinical documentation generated through Doctor Cigna are carried out by Costaisa within the European Economic Area (Spain), and such data are not subject to international transfers.

Where international transfers of personal data take place, Cigna will implement the appropriate safeguards required under applicable data protection legislation to ensure a level of protection equivalent to that provided within the European Economic Area. In particular, such safeguards may include European Commission adequacy decisions or the execution of Standard Contractual Clauses, together with any additional supplementary measures that may be required following the relevant transfer assessment.

You may request further information regarding these international transfers and the safeguards implemented by contacting us using the contact details provided in this Notice.

RETENTION PERIOD

We will retain your personal data for as long as necessary to provide the Doctor Cigna service, manage consultations, maintain and administer the clinical documentation generated in connection with the Service, handle potential claims, and comply with applicable legal, regulatory, and healthcare obligations.

Personal data processed in the context of healthcare services, including the patient's Medical Record, medical reports, prescriptions, referrals for diagnostic tests, and any other related clinical documentation, will be retained for the periods required under applicable healthcare legislation and any other relevant legal requirements in force from time to time.

In addition, certain personal data may be retained for the statutory limitation periods applicable to the establishment, exercise, or defense of legal claims, as well as for demonstrating compliance with legal or contractual obligations.

Such clinical documentation is stored on the platform provided by Costaisa, acting as a data processor on behalf of Cigna. The applicable retention periods, as well as data restriction and secure deletion measures, are implemented in accordance with Cigna's instructions.

Once the applicable retention periods have expired, personal data will be deleted or, where required by applicable law, retained in a duly restricted form for the period necessary to address potential legal liabilities, after which they will be securely and permanently deleted.

YOUR RIGHTS

Under applicable data protection legislation, you have certain rights in relation to your personal data. These include:

Right of access: to obtain confirmation as to whether we process your personal data and to receive a copy of such data, together with information on how it is used.
Right to rectification: to request the correction of inaccurate or incomplete personal data.
Right to erasure: to request the deletion of your personal data, subject to applicable legal limitations, particularly in relation to medical records or healthcare documentation that must be retained by law.
Right to object and right to request restriction of processing in certain circumstances.
Right to data portability, where applicable.
Right not to be subject to a decision based solely on automated processing, where legally applicable.
Right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out prior to the withdrawal of such consent.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos - AEPD).

You may exercise your rights at any time in relation to the personal data processed by Cigna in connection with Doctor Cigna by contacting Cigna using the contact details provided in the "Contact Us" section.

However, with regard to personal data processed in connection with psychological counselling services and virtual physiotherapy services, which are provided by third-party entities acting as independent controllers, you must exercise your rights directly with those entities using the contact details set out in their respective privacy notices, available in the "Third-Party Services" section of this Notice.

MARKETING ACTIVITIES

As part of the Doctor Cigna service, Cigna will not send you marketing or promotional communications. Cigna will only send you operational or service-related notifications that are strictly necessary for the provision of Doctor Cigna, such as notifications concerning the management, confirmation, reminder, or modification of your appointments and medical consultations booked through the platform.

These notifications form an integral part of the Service and are sent on the basis of the performance of the contractual relationship and the provision of the Service. Accordingly, they are not considered marketing communications and do not require your consent.

THIRD-PARTY SERVICES

Certain features or services associated with Doctor Cigna may be provided by specialized third parties or partner organizations duly authorized by Cigna.

In particular, psychological counselling services, virtual physiotherapy services, and other complementary services may be provided by:

Teladoc Health International, S.A.U. with registered address at Vía Augusta 252-260, 08017 Barcelona, Spain. Privacy Notice
Fisiogestion, provider of virtual physiotherapy services, with registered address at C/ Casp, 79, 5th Floor, 08013 Barcelona, Spain. Privacy Notice
Costaisa, S.A., as the provider of the technology platform and the hosting and support services for Doctor Cigna, acting in its capacity as a data processor, with registered address at Avinguda de la Riera de Cassoles, 61, 08012 Barcelona, Spain. Privacy Notice

These entities act as independent controllers in relation to the personal data they process in connection with their respective services, except where they act on behalf of Cigna as a processor.

The provision of these third-party services is subject to the applicable service terms and conditions and, where relevant, to the third party's own privacy notice or privacy policy.

References to third-party services are provided for informational purposes only and do not imply that Cigna assumes responsibility for any processing activities carried out by such third parties outside Cigna's scope of responsibility.

SECURITY

Cigna has implemented appropriate technical and organizational measures to ensure that the processing of personal data, including health data, whether carried out through electronic or manual means, enables Cigna personnel to maintain their duty of professional confidentiality and guarantees patients' rights to privacy and confidentiality, in accordance with the GDPR and applicable Spanish legislation.

Within the framework of Doctor Cigna, access to Medical Records and the medical documentation generated through the Service is restricted to duly authorized healthcare professionals. Documentation generated during a consultation, such as prescriptions, referrals, or medical reports, may be securely shared with the user following completion of the consultation, ensuring the confidentiality of and restricted access to such information.

Medical Records and the clinical documentation generated through Doctor Cigna are hosted and stored on the technology platform provided by Costaisa, acting as a data processor on behalf of Cigna. Costaisa implements the appropriate technical and organizational measures required under Article 32 of the GDPR and processes personal data solely in accordance with Cigna's documented instructions and the applicable data processing agreement executed between the parties.

Access to Medical Records is limited to duly authorized healthcare personnel and is protected through access control mechanisms, authentication measures, and audit trail capabilities designed to ensure the security, integrity, and confidentiality of the information.

UPDATES TO THIS DATA PROTECTION NOTICE

We may update this Data Protection Notice from time to time to ensure that it remains accurate and appropriately reflects the features, services, and processing activities associated with Doctor Cigna.

Where changes to this Notice have a material impact on the way in which your personal data is processed or otherwise significantly affect you, we will provide you with prior notice where required under applicable law.

This Data Protection Notice was last updated in August 2026.

CONTACT US

If you have any questions about this Notice or wish to exercise your rights in relation to the processing of your personal data in connection with Doctor Cigna, you may contact us at: CignaGlobalPrivacyOffice@Cigna.com

For additional information regarding the processing of personal data carried out by Cigna, please refer to our Privacy Notice available at: Privacy Notice