Comprehensive Privacy Notice

1. Identity and address of the Data Controller

Dra. Sofía Rincón Montes, Plastic, Aesthetic, and Reconstructive Surgeon, with a professional license in good standing before the CMCPER, with an address for purposes of this Notice at Diego Rivera 2311, 4th Floor, Suite 409, Edificio Corporativo Central, Zona Urbana Río, Tijuana, Baja California, Mexico, is the individual responsible for collecting, using, storing, and, where applicable, transferring your personal data in accordance with this document.

2. Applicable legal framework

This Privacy Notice is based, among others, on the following provisions:

In Mexico

• Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.
• Privacy Notice Guidelines issued by the National Institute for Transparency, Access to Information and Personal Data Protection (INAI).
• NOM-004-SSA3-2012, on clinical records, and NOM-024-SSA3-2012, regarding the confidentiality and exchange of health information.
• General Health Law, regarding medical professional secrecy and the confidentiality of clinical records.

In the United States

• California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) — we voluntarily observe its principles for visitors and patients who are California residents.
• Where applicable to the physician-patient relationship with patients from the United States, we also observe, as a best practice, health-information confidentiality principles aligned with HIPAA (Health Insurance Portability and Accountability Act), even though the Practice, operating in Mexico, is not directly subject to that law.

In the event of a conflict or uncertainty regarding the application of one framework or another, the standard offering the greatest protection to the data subject will prevail.

3. Personal data we collect

We collect your personal data directly (when you provide it through our contact and prequalification forms, by phone, WhatsApp, email, or during an in-person consultation) and automatically (through cookies and similar technologies as you browse this site).

4. Sensitive data and express consent

Under Article 3, Section VI, and Article 9 of the LFPDPPP, data on present or future health status that we collect through our surgical prequalification form is considered sensitive personal data, the improper handling of which could give rise to discrimination or pose a serious risk to the data subject.

For this reason, before collecting this type of data we request your express, written consent through a specific acceptance checkbox within the form itself, which clearly describes the purpose of the processing. If you do not grant this consent, the prequalification form cannot be submitted or processed.

5. Purposes of processing

Primary purposes (necessary for our relationship with you)

• Contacting you to follow up on your request for information or a consultation.
• Conducting a preliminary medical prequalification prior to your in-person or virtual evaluation.
• Scheduling, confirming, and following up on appointments and medical evaluations.
• Providing medical care, maintaining your clinical record, and following up on your treatment.
• Complying with legal, health, and regulatory obligations applicable to the practice of medicine.

Secondary purposes (not necessary — you may object)

• Sending informational or promotional communications or newsletters about procedures and content.
• Satisfaction surveys and internal quality-of-service studies.
• Internal statistics and continuous improvement of our services and this website.

You may object to the processing of your data for secondary purposes at any time, without this affecting the processing of your data for primary purposes, by writing to the email address listed in the Contact section.

6. Transfers and data processors

We do not sell, rent, or share your personal data with third parties for marketing purposes unrelated to this Practice. To operate this site and process the prequalification form, we rely on the following data processors (service providers who process data on our behalf, under their own security policies):

• Formspree, Inc. (formspree.io) — securely receives and stores information submitted through our prequalification form, based in the United States.
• Cloudflare, Inc. — provides the hosting infrastructure, content delivery network, and security for this website.

These transfers are necessary to fulfill the primary purposes described in this Notice and do not require your additional consent under Article 37 of the LFPDPPP, as they involve services rendered on behalf of and for the account of the Data Controller.

7. ARCO rights and withdrawal of consent

You have the right, at any time, to Access your personal data held by us and the details of its processing; to Rectify it if it is inaccurate or incomplete; to Cancel it when you believe it is no longer required for any of the purposes stated in this Notice; and to Object to its processing for specific purposes (together, the "ARCO" rights, per Mexican data-protection law). You may also withdraw any consent you have previously given us.

To exercise any of these rights, please send a request to the email address listed in the Contact section, including:

1. Your full name and contact details so we can respond to you.
2. A document proving your identity (or that of your legal representative, if applicable).
3. A clear and precise description of the data and the right you wish to exercise.

We will respond to your request within a maximum period of 20 business days from the date of receipt, in accordance with Article 32 of the LFPDPPP, a period which may be extended once for an equal period when the circumstances of the case so justify.

8. Cookies and tracking technologies

This site uses cookies and similar technologies (such as browser local storage) to enable the site to function correctly, remember your preferences, measure the performance of our pages, and, where applicable, analyze browsing behavior in aggregate.

As a general retention period, cookies used on this site are kept for a maximum of 12 (twelve) months from the time they are set, after which they expire automatically. Once that period elapses, if you continue browsing the site, new cookies may be generated in accordance with the terms described here.

You may disable, delete, or block cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of some sections of the site, such as the prequalification form.

9. Security measures

We have implemented reasonable administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, including:

• Encryption of communication between your browser and our site through the HTTPS/TLS protocol.
• Restricted access to health information, limited to authorized medical and administrative staff, subject to the professional secrecy established under the General Health Law.
• Use of infrastructure providers (data processors) with recognized information-security standards.

No electronic transmission or storage system is 100% infallible; however, we are committed to keeping our security measures up to date with industry standards.

10. Minors

This site and its services are directed at persons over the age of 18. We do not knowingly collect personal data from minors without the verifiable consent of a parent or legal guardian. Any procedure or medical evaluation involving a minor will require the express, written consent of their legal representative, in accordance with applicable law.

11. Additional rights for California, U.S. residents

If you are a resident of the state of California, United States, and you provide us with personal information (for example, by using a phone number with a +1 area code or by identifying yourself as a resident of that state), we voluntarily recognize the following rights, in line with CCPA/CPRA principles:

• Right to know what personal information we collect, use, and disclose, and the sources of that information.
• Right of access to a copy of the specific personal information we have collected about you.
• Right to deletion of your personal information, subject to applicable legal and regulatory exceptions (for example, clinical-record retention obligations).
• Right to correction of inaccurate personal information.
• Right to opt out of the sale or sharing of your personal information — we expressly state that we do not sell or share personal information as those terms are defined under the CPRA.
• Right to limit the use and disclosure of sensitive personal information, including health information.
• Right to non-discrimination for exercising any of the rights above.

To exercise any of these rights, you may write to us at the email address listed in the Contact section, stating your request and, if you are a California resident, explicitly noting this so we can handle your request accordingly.

12. Changes to this Privacy Notice

We reserve the right to update, modify, or supplement this Privacy Notice at any time, whether to address legislative developments, internal policies, requirements of new services or products, or industry best practices. Any changes will be published on this same page along with the corresponding update date. We recommend that you review this Notice periodically.

13. Contact

For any questions, comments, or to exercise your ARCO rights regarding the processing of your personal data, you may contact us through the following channels: