Privacy notice

The controller responsible for processing your personal data is Dr. Nelson Eloy Ochoa Becerra, specialist in Cardiology and Internal Medicine. His contact details and address appear at the top of this page; that address is also the one designated to receive notifications related to this notice.

This notice is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and the Privacy Notice Guidelines.

What data is collected

Through this site, only what you type into the contact form is collected: your name, a way to reply to you — email or phone — and the text of your message. The form does not ask for, and should not be used to send, detailed clinical information.

At the visit, and only there, identification and billing data are also collected, along with the health data needed to care for you: history, symptoms, examination, test results, diagnoses and treatments.

Sensitive personal data

Health data is sensitive personal data. The law treats it differently and so does this notice: processing requires your express, written consent, is limited to the purposes necessary for medical care, and is not used for any secondary purpose.

That consent is obtained at the office, not on this site. The form on this page is not the place to send health information, and whatever is written in it is treated as a contact message, not as a medical record.

What it is used for

Primary purposes — those that give rise to the relationship, and for which no separate consent is required:

• Replying to your message and, if you ask, scheduling an appointment.
• Providing medical care: creating and keeping your clinical record, issuing prescriptions, test orders, reports and certificates.
• Following up on your treatment and scheduling review visits.
• Meeting the health and tax obligations the law imposes on the controller, including keeping the clinical record for the period set by Mexican standard NOM-004-SSA3-2012.

There are no secondary purposes. Your data is not used for marketing, advertising, commercial prospecting or profiling.

Who it is shared with

Your data is not sold or transferred for commercial purposes. It is transferred or disclosed only in these cases:

• To the laboratories, imaging centres and hospitals you are referred to for a test or procedure, and only what is needed to perform it.
• To other health professionals taking part in your care, when a consultation is necessary.
• To your insurer, only if you request it for a reimbursement or medical expenses claim.
• To health, judicial or administrative authorities that require it under the law, in the terms and to the extent the law provides.

The transfers listed in article 37 of the law do not require your consent. You will be asked before any other transfer.

The contact form on this site is processed by an external service that receives the message and forwards it by email to the office; that provider acts as a processor and does not use the information for its own purposes.

How to exercise your ARCO rights

You have the right to access your data, to rectify it when it is inaccurate or incomplete, to cancel it when you consider it is not required for any of the stated purposes, and to object to its processing for specific purposes.

To exercise them, send a request to the controller’s email or address shown at the top of this page. The request must include:

• Your name and an address or email where the reply can be sent.
• A document proving your identity, or the legal representation of whoever acts on your behalf.
• A clear description of the data concerned and of which right you wish to exercise.
• Any detail that helps locate the data.

The reply is communicated within a maximum of twenty business days and, if granted, takes effect within the following fifteen business days.

ARCO rights have limits where the clinical record is concerned. Health regulations require it to be kept for a minimum period, so a cancellation request cannot delete records the law requires to be retained. In that case you are told in writing which ones and why.

How to withdraw your consent

You may withdraw the consent you have given at any time, through the same channel used for ARCO rights. Withdrawal takes effect going forward: it does not reach processing already carried out or records that health regulations require to be kept, and it may prevent continued care if the withdrawn data was necessary to provide it.

Limiting use or disclosure

Through the same channel, you may ask that your data be limited so you stop receiving appointment reminders or communications from the office, without this affecting your care.

Changes to this notice

This notice may change because of legal reforms, changes in how the office operates, or new privacy practices. The version in force is always the one published on this page, with its last-updated date visible.