Privacy notice for patients

«Name of the practice», with its address at «Address», is the controller of your personal data.

For any matter regarding your data, contact «Privacy contact person or area»:

• email: «Privacy email»;
• phone: «Phone»;
• at our address, during «Office hours».

We use CoreDoc, an electronic medical record and scheduling system by Core Suite S.A.S. Core Suite processes your data solely on our behalf and to provide that service to us. It does not use your data for its own purposes or sell it.

Identification and contact: name, date of birth, age, sex, CURP, address, mobile number and email, and insurer and policy number if you use health insurance.

About other people, if you provide it: name, relationship and phone number of your emergency contact, and the details of your parent, guardian or representative. If you provide another person's data, we ask that you inform them of the content of this notice.

Health data. This is sensitive personal data:

• your past, present and future state of health;
• personal and family history, conditions, allergies and habits such as tobacco or alcohol use;
• vital signs, physical examination, clinical notes, diagnoses, treatments, prescriptions and instructions;
• laboratory and imaging results, clinical photographs and other files in your medical record;
• only if your care requires it: genetic information, information about your sexual life or reproductive health, and about your ethnic origin.

Payments and invoicing: recorded payments and, if you request an invoice, RFC, name or company name, tax regime, postal code, CFDI use and email.

Consents and preferences: the channels through which you agree to receive notices, your responses to them, your opt-outs and the date and time of each consent.

Necessary purposes for the care you request from us:

1. Providing medical care: consultation, diagnosis, treatment and follow-up.
2. Creating, keeping and safeguarding your medical record, as required by NOM-004-SSA3-2012.
3. Scheduling, confirming, changing or cancelling your appointments and, if you ask, offering you times that open up earlier.
4. Sending you notices and reminders about your appointments and your medical instructions through the channel you authorize.
5. Asking how you feel after your visit to follow up on your treatment.
6. Referring you to other healthcare professionals, laboratories or hospitals when your care requires it.
7. Recording your payments and issuing your invoices.
8. Verifying your identity before showing you information about your health, for example with your date of birth.
9. Meeting our health and tax obligations and responding to requests from authorities.
10. Handling your requests, questions and complaints about your data.

Non-necessary purposes, only if the practice carries them out:

1. Only if you authorize it in advance: sending you information by email about the practice's services, health campaigns or promotions. We never send it by WhatsApp or SMS.
2. If you do not object: inviting you to rate your care or answer satisfaction surveys.
3. If you do not object: greeting you on your birthday.

You can refuse these purposes, or withdraw your authorization, when you sign the form in section 4 or at any time by writing to «Privacy email». If this notice was not given to you in person, you have 5 business days to refuse before we use your data for those purposes. Refusing does not affect your care.

To process your health data we need your express written consent. You can give it in any of these ways:

• with your handwritten signature on the form in this section, at the practice;
• through an electronic means that identifies you: by tapping "I accept" in the WhatsApp message we send to the mobile number you gave us, together with the link to this notice; on the page reached through a personal link we send to your mobile phone or email; or with your electronic signature.

No option is pre-selected. We keep the date, time, channel, number or email and the version of this notice with which you gave your consent.

If the patient is a minor or cannot decide for themselves, consent is given by whoever exercises parental authority or guardianship.

Without your consent we may process your health data only in the cases the law allows; for example, in an emergency in which you cannot give it, or to meet a legal obligation. If you do not wish to give it, you may ask us how it affects your care.

Consent form

I have read this privacy notice and:

• ☐ Yes ☐ No I consent to «Name of the practice» processing my personal data, including my health data, for the necessary purposes in section 3.
• ☐ Yes ☐ No I agree that my data may be shared with my insurer in the cases in section 6.
• ☐ Yes ☐ No I agree to receive information by email about the practice's services, health campaigns and promotions.
• ☐ I do not want to receive satisfaction surveys or birthday greetings.

With your authorization, we send you notices about your appointments (confirmation, reminder, change or cancellation), times that open up, follow-up questions, your instructions and your invoice.

• You authorize each channel separately: WhatsApp, SMS or email. A link received by SMS can only be used to authorize SMS.
• Notices never contain information about your health: only the practice's name (or its name for notices), the date, time and place and, when needed, a link. They do not include the name of the person who cares for you or data that reveals the specialty, unless the practice decides otherwise.
• Your instructions may reach you as a document by WhatsApp, or by SMS or email as a link that asks for your date of birth. They do not include the diagnosis unless the person who provided your care decides to include it.
• Opening a link does not record any response. Your response is recorded only when you select the corresponding option.
• You may stop receiving notices through a channel at any time, from the message itself: on WhatsApp, with the option to stop receiving messages or by replying "BAJA"; by SMS, by replying "BAJA"; by email, with the option "Stop receiving emails from this practice" at the end of each email. You can also ask us through any of the channels in section 1.

Without your consent, because the law allows it:

• with laboratories, imaging centers, other healthcare professionals and hospitals to which we refer you, for your diagnosis or treatment;
• with health authorities, in the cases in which the law requires us to inform them;
• with the Tax Administration Service (SAT), through an authorized certification provider, when issuing your invoice;
• with judicial or administrative authorities that require it under the law.

Only with your consent:

• with your insurer, for payment or reimbursement procedures, if you accept it on the form in section 4;
• with the people you authorize in writing to receive information about your health.

Whoever receives your data takes on the same obligations as we do. If the practice changes controller, we will tell you who the new controller is and give you their privacy notice.

Your data is stored in CoreDoc, by Core Suite S.A.S., on servers located in Mexico. To send you notices and invoices, CoreDoc uses WhatsApp, SMS, email and invoicing providers, and a network that protects the connection. Some of them process data outside Mexico, mainly in the United States, and receive only what is needed for each message. All of them act on our behalf and are bound by confidentiality and security obligations. The full list is in the CoreDoc data processing addendum.

• Choose the channel through which you receive notices, or stop receiving them (section 5).
• Ask us to add you to our exclusion list so that you do not receive information about services, campaigns or promotions, by writing to «Privacy email».
• Refuse the non-necessary purposes (section 3).

You can access your data, rectify it if it is inaccurate or incomplete, request its cancellation or object to its use (ARCO rights).

How to request it. Write to «Privacy email» or deliver a written request at our address, with:

• your name and an email or address where we can reply;
• a copy of your official ID and, if you act on behalf of someone else, the document proving your representation (for example, the minor's birth certificate or a power of attorney);
• the right you are exercising and the data it refers to, except for access;
• any detail that helps us locate your information and, if you request a rectification, the documents that support it.

Deadlines. We reply within 20 business days at most from the day we receive your request. If it is granted, we carry it out within the following 15 business days. If the case justifies it, we may extend each period once by an equal period, and we will tell you.

Reply and delivery. We reply through the same channel you used to write to us. We give access through paper copies or an electronic document. For the medical record, we give you a clinical summary or the copies that apply under NOM-004-SSA3-2012.

Cost. The process is free. There may only be a cost for copies or delivery. If you repeat the request within 12 months, the cost will not exceed 3 Units of Measure and Update (UMA), unless this notice changes substantially.

Limits. We cannot cancel your medical record while we must keep it (section 11): during that time we block it, and afterwards we delete it. Objection does not apply when the law requires us to process your data. If we deny your request, we explain why.

If you write to Core Suite about your data, Core Suite will tell you to contact us and will forward your request to us.

You can withdraw your consent at any time, through the channels in section 9 or through the same channel you used to give it. It is free. We reply within the same deadlines and confirm when we have stopped using your data for what you withdrew, including the messages sent by our providers.

Withdrawal has no retroactive effect. If you withdraw consent to process your health data, we may not be able to continue caring for you, and we must still keep your medical record for the period required by law.

• Medical record: at least 5 years after your last visit, as required by NOM-004-SSA3-2012.
• Invoices and payment records: 5 years, as required by the Federal Tax Code.
• Other data: while we care for you and afterwards, blocked, until the legal actions arising from our relationship expire.

When those periods end, we delete your data securely.

Your data is protected by professional secrecy. All practice staff keep your information confidential, as required by NOM-004-SSA3-2012. CoreDoc protects your information with encryption, individual access with permissions according to each person's role, and a record of who views or edits your medical record. The pages our links take you to only use technically necessary cookies to work and to protect themselves against attacks; they do not use advertising or tracking cookies.

If a security breach significantly affects your rights, we will inform you immediately of the nature of the incident, the data affected, the measures adopted and the actions you can take.

We may change this notice due to changes in the law, in our services or in the way we process your data. We will make the new version available at the practice and at the link that accompanies our messages. If the change requires new consent, for example to process different sensitive data or for new purposes or transfers, we will ask you for it first.

If you believe we did not handle your request or that we processed your data against the law, you can go to the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno), through its Personal Data Protection Unit and its General Directorate of Personal Data in the Private Sector:

• Avenida Insurgentes Sur 1735, Colonia Guadalupe Inn, Alcaldía Álvaro Obregón, C.P. 01020, Mexico City;
• email: updp.privado@buengobierno.gob.mx;
• phone: 55 2000 3000.

You have 15 business days to file your request from the day we reply to you or from the day the deadline to reply expires.

Short text that accompanies our messages and forms:

«Name of the practice», with its address at «Address», is the controller of your personal data. We process your identification, contact and invoicing data, and your health data, which is sensitive, to care for you, keep your medical record, schedule your appointments, send you notices and issue invoices. If you do not object, also to send you surveys and birthday greetings; and, only if you authorize it, to send you promotions by email. You can choose the channel for notices, refuse what is not necessary and exercise your rights at «Privacy email». Full notice: coresuite.mx/en/legal/aviso-pacientes-coredoc.