CoreDoc privacy notice

CoreDoc is a clinic management application of Core Suite S.A.S. ("Core Suite"), tax ID (RFC) CSU260324P42, with its address for notices at Calle 72C número 499, Cerrada Lluvia de Oro, entre Calle 13J, Colonia Gran Santa Fe, Mérida, Yucatán, C.P. 97314, Mexico.

The Core Suite Personal Data Department (Departamento de Datos Personales de Core Suite) handles all matters related to personal data: privacidad@coresuite.mx and +52 999 102 0534.

CoreDoc holds two kinds of data, with different controllers:

• Data of CoreDoc users: the practice owner, healthcare professionals and practice staff. Core Suite is the controller of this data.
• Patient data: the controller of this data is the practice, that is, whoever provides the care: a healthcare professional or a clinic. Core Suite is a processor: it processes this data solely on the practice's behalf and in accordance with its instructions.

This notice supplements the Core Suite privacy notice, which governs the CoreSuite account, sign-in, payments and invoices. Anything not covered by this notice is governed by that notice.

• From the CoreSuite account, upon entering CoreDoc: identifier, name, email, language and theme.
• Role in each practice: healthcare professional, front desk or another role defined by the practice, and its permissions.
• Professional details, for healthcare professionals: professional license number (cédula profesional) and specialty, which CoreDoc requires to activate that role, and the institution, address and phone number shown on the prescriptions, test requests and instructions they issue.
• Activity: the log of who views or changes the clinical record and visits, with date and time, and technical logs for diagnostics and security.
• Practice data: its name, its locations, its name for notices, address, phone, email and logo, and the number of active users, professionals and locations. These may be personal data when the practice bears a person's name or uses their contact details.
• Communications: what the user writes to Support.

Core Suite does not request sensitive personal data from users.

Core Suite uses this data for the following purposes that are necessary to provide CoreDoc:

1. Provide access to CoreDoc with the CoreSuite account and apply the permissions of each role.
2. Activate the healthcare professional role and show their professional details on the documents they issue, as health regulations require.
3. Record who views or changes the clinical record and when, as required by NOM-004-SSA3-2012 and NOM-024-SSA3-2012.
4. Show the practice's branding to its patients in messages, documents and the self-invoicing portal.
5. Report to CoreSuite the practice's name and the number of active users, professionals and locations, to apply its Plan and limits.
6. Send service notices within CoreDoc and by email: invitations, role changes, Balance and notices that could not be sent.
7. Provide support, protect the service, diagnose failures and comply with legal obligations.

Core Suite does not use CoreDoc user data for non-essential purposes. Core Suite's commercial communications, such as the newsletter or the Free Plan weekly email, are described in the general notice and have their own opt-out mechanism.

Each practice decides what patient data it records in CoreDoc, for what purpose and for how long. It may include:

• identification and contact: name, date of birth, age, sex, CURP, address, mobile number and email, and insurer and policy number if there is health insurance;
• sensitive health data: medical history, diagnoses, conditions, treatments, prescriptions, test results, progress notes, files and images, and the rest of the electronic clinical record;
• their consents and contact preferences;
• the data of whoever represents a minor or a person who cannot decide for themselves;
• tax details, if an invoice is requested.

Core Suite processes this data solely to provide CoreDoc to the practice: storing and displaying the clinical record, the schedule and appointments; sending the notices the practice sets up; generating its documents; stamping the invoices the practice issues to its patients and operating the self-invoicing portal; making backups; protecting the information; and providing support when the practice requests it.

Core Suite does not:

• use patient data for its own purposes;
• sell or rent it;
• use it for advertising or to build profiles;
• disclose it, except to the providers in section 8 or when a competent authority requires it;
• own the clinical record: the record belongs to whoever provides the health service and creates it (NOM-004-SSA3-2012, section 5.4).

To apply the Plan and provide the practice with its summaries, CoreDoc only sends CoreSuite counts without patient data, such as the number of appointments in the week.

The terms of this processing are set out in the CoreDoc data processing addendum, which the practice owner accepts when creating the practice.

The practice, as controller, must give its patients its own privacy notice and obtain their express written consent to process their health data (article 8 of the LFPDPPP). For patients who are minors, consent is given by whoever holds parental authority or guardianship.

Core Suite makes available a patient privacy notice template that the practice completes with its details.

CoreDoc allows the practice to record each patient's consent, signed at the practice, given by tapping "I accept" in the WhatsApp message they receive with the link to the notice, or given on the page of a personal link, and keeps the evidence: date, time, notice version and channel. Core Suite does not take over this obligation from the practice.

This consent for personal data is different from the informed consent forms that NOM-004 requires for medical procedures.

The practice decides which notices it sends to its patients (appointment confirmations and reminders, appointment changes, instructions and follow-up) and through which channel: WhatsApp, SMS or email.

• Only a channel each patient has accepted is used. If a channel is not accepted or the message is not delivered, CoreDoc uses the next one in this order: WhatsApp, SMS and email. It never uses a channel that was not accepted.
• Messages are sent in the practice's name, with its name for notices if it has one, "via CoreDoc". WhatsApp messages are sent from CoreDoc's number, using templates approved by Meta.
• The text of the messages does not contain health data: only the practice's name (or its name for notices), the date, time and place and, when required, a link. It does not include the name of the person providing care or data that reveals the specialty, unless the practice decides otherwise.
• Medical instructions are delivered through a link that requests the date of birth before opening or, by WhatsApp, as a PDF document. The diagnosis is only included if whoever issues the instructions selects that option. SMS never carries health data, only the link.
• Opening a link is not considered a response: confirming or cancelling requires an express action.
• Each patient may ask the practice, at any time, to stop receiving messages through a channel. The practice records it in CoreDoc.

Patients of a practice that uses CoreDoc exercise their rights of access, rectification, cancellation and objection, and the withdrawal of their consent, with their practice, which is the controller of their data.

If a patient writes to privacidad@coresuite.mx, Core Suite informs them who the controller is and forwards their request to the practice without delay, within the period set in the data processing addendum. Core Suite does not respond on its own: it provides the practice with the tools to view, correct and export the data.

The clinical record cannot be cancelled while it must be kept: at least 5 years from the last medical act (NOM-004-SSA3-2012, section 5.4; article 25 of the LFPDPPP).

Core Suite relies on the following providers, which process data solely on Core Suite's behalf, under contract and in accordance with its instructions. The full list and the procedure for notifying changes are set out in the data processing addendum.

Messaging providers only receive each patient's name and contact details, the appointment details, the practice's name and the links, except for the instructions PDF sent by WhatsApp.

Core Suite's test environment is located in the United States and is not used with customer or patient data.

CoreDoc protects the clinical record with the following measures:

• access only with a CoreSuite account: a password with minimum rules and two-step verification available, recommended for practice owners;
• roles and permissions: each person accesses only what their role allows;
• a log of access to and changes in the clinical record;
• encrypted connections and data encrypted at rest;
• databases on a private network, with no direct access from the internet;
• automatic backups that allow the information to be restored;
• Support access only when necessary, with a record.

CoreDoc is designed in accordance with NOM-024-SSA3-2012.

If a security breach affects patient data, Core Suite informs the practice without delay, so that the practice can inform its patients immediately. If it affects user data, Core Suite informs those users directly.

• Clinical record: the period is determined by the practice, with a minimum of 5 years from the last medical act (NOM-004-SSA3-2012). Core Suite keeps it while the practice uses CoreDoc.
• Cancellation, payment not approved, read-only or Free Plan: no data is deleted.
• Closing the practice: before closing, the owner may request an export of its data, which Support delivers within 5 business days. After closure, no one can access the practice. Patient data is kept blocked and at no cost for at least 5 years from the closure, which covers the 5 years from the last medical act required by NOM-004-SSA3-2012. During that time, Core Suite only accesses it to deliver an export to the practice owner, or to whoever proves their right, once their identity has been verified, or to comply with a legal obligation. Its subsequent deletion is governed by the data processing addendum.
• Users: the role and professional details are kept while the user has access to the practice. Those already appearing on issued documents are kept with the clinical record. The access log is kept for 5 years.

CoreDoc users exercise their rights of access, rectification, cancellation and objection, and the withdrawal of their consent, by request to privacidad@coresuite.mx, with the requirements and deadlines of the general notice: a reply within 20 business days at most and, if granted, implementation within the following 15 business days. Each deadline may be extended once for an equal period.

Limits specific to CoreDoc:

• Professional details that already appear on issued prescriptions, requests or instructions are not changed, because they form part of the clinical record.
• The access log is not deleted while it must be kept.
• Removing or restoring access to a practice is the practice's decision.

Withdrawing consent for a necessary purpose prevents further use of CoreDoc.

Core Suite does not use CoreDoc user data for non-essential purposes. To limit the use or disclosure of their data, users have the means in section 14 of the Core Suite privacy notice:

• unsubscribing from commercial communications through the link in each email or from My account;
• asking privacidad@coresuite.mx to add their email to Core Suite's exclusion list;
• setting their browser to block cookies (section 14 of this notice).

Users. The practice and its team can see each user's name, role and professional details, and its patients see the professional details on the documents the user issues, as part of the service. Core Suite also discloses data to competent authorities when they require it under the law. It makes no other transfers.

Patients. Core Suite does not transfer patient data. If the practice shares it, for example with a laboratory, the decision and the disclosure are the practice's. If an authority requests patient data from Core Suite, Core Suite informs the practice unless the law prohibits it.

CoreDoc (app.coredoc.mx) and the pages patients reach through a link, such as those to confirm appointments, view instructions or request an invoice, only use technically necessary cookies and browser storage to:

• keep the session signed in to CoreDoc and prevent third parties from sending actions on the user's behalf;
• protect the service against attacks and bots, through Cloudflare's security cookies;
• remember the chosen language and theme.

Core Suite does not use advertising cookies, social media pixels, session recorders or cross-site tracking. Because these cookies are necessary, their acceptance is not requested in a pop-up. They can be deleted or blocked in the browser; without them it is not possible to sign in to CoreDoc or open some links. Details of CoreAccount's and Cloudflare's cookies are set out in section 9 of the Core Suite privacy notice.

Core Suite publishes each version of this notice at coresuite.mx/legal, with its number, effective date and a summary. Earlier versions remain available. If a change significantly affects users, Core Suite gives notice by email at least 30 days before it takes effect.

This notice does not require a separate acceptance. Each user's account has already accepted the general notice, and this notice details what is specific to CoreDoc.

Anyone who believes their right to the protection of their personal data has been violated may go to the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno, SABG), Personal Data Protection Unit, General Directorate of Personal Data in the Private Sector: Avenida Insurgentes Sur 1735, Colonia Guadalupe Inn, Alcaldía Álvaro Obregón, C.P. 01020, Mexico City; updp.privado@buengobierno.gob.mx; 55 2000 3000. Patients go first to their practice and may also go to the SABG.