Privacy Notice

1. Who is responsible for your personal data

Imar Medical Group (the «Clinic») is the controller responsible for processing your personal data.

Our address, which is also the address for submitting personal data requests, is: Grand Hotel Medical Building, Floor 4, Suite 401, Blvd. Agua Caliente 4558, Col. Aviación, ZIP 22014, Tijuana, Baja California, Mexico.

For any matter concerning your personal data you may write to contacto.imargroup@gmail.com or call +52 664 340 3000 during our business hours: every day from 8:00 a.m. to 3:00 a.m.

ARCO rights requests, consent withdrawals and use limitations are handled by the Clinic's Personal Data Department, at the same email address and phone number indicated above.

2. Which laws we apply

This notice is issued under the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in Mexico's Official Gazette on March 20, 2025 and in force since March 21, 2025, particularly articles 14, 15 and 16. This law entirely replaced the previous one dated July 5, 2010.

We also observe, to the extent they do not conflict with the current Law, the Regulations to the LFPDPPP (Official Gazette, December 21, 2011) and the Privacy Notice Guidelines (Official Gazette, January 17, 2013).

Because we provide medical and dental care, we additionally apply the General Health Law, its Regulations on the provision of medical care services, and Mexican Official Standard NOM-004-SSA3-2012 on clinical records, as well as the professional secrecy binding on all healthcare personnel.

3. What personal data we collect

We collect data through three channels: the form on this website, conversations by WhatsApp or telephone, and your in-person care at the Clinic. Not all data is collected in every case.

Through the form on this website:

• Full name.
• Phone number.
• Email address (optional).
• Service of interest (optional). This item may be sensitive: choosing gynecology, psychiatry or a specific treatment may reveal information about your health.
• The free text you write in the message field. We expressly ask you not to include symptoms, diagnoses or clinical details there.

When you write to us on WhatsApp: your phone number, your profile name and picture, message content, any files you send, and the metadata generated by the platform itself (date, time and delivery status).

When you come in for an appointment, and only to the extent necessary to care for you:

• Identification data: name, date of birth, sex, address, official ID.
• Contact details and, where applicable, those of a relative or emergency contact.
• Billing data when you request a tax invoice: RFC, tax regime and tax address.
• Your insurer or payer details, if you are processing a reimbursement or coverage.
• Sensitive health data: reason for consultation, personal and family history, conditions, allergies, medications, diagnoses, treatment plan and progress. All of this forms your clinical record.
• Clinical images and studies: X-rays, intraoral and treatment-progress photographs, dental models and scans. These are also sensitive data.

When you visit our premises: your image is recorded by the video surveillance system, as explained in section 8.

When you browse this site: the technical data described in section 9.

Data of our staff and collaborators: In order to ensure transparency and comply with health regulations, we collect the full name, position and professional license number of our medical team, with their prior written consent, for the purpose of displaying them on our official website.

We do not collect data on racial or ethnic origin, religious or philosophical beliefs, political opinions or sexual preference, unless strictly necessary for a diagnosis and you provide it during your consultation.

4. Sensitive health data and your express consent

The Law treats as sensitive personal data that which affects your most intimate sphere or whose misuse could lead to discrimination or serious risk. Data about your present or future health is expressly sensitive.

To process it, article 8 of the Law requires your express, written consent. We obtain it as follows:

• On the website: through a checkbox that is not pre-ticked and that you must actively check before submitting the form. If you do not check it, the form is not submitted.
• At the Clinic: through the informed consent form that is explained to you and that you sign before any treatment begins, which is kept in your record.

There is an exception in article 9, section VI of the Law: your consent is not required where processing your data is essential for medical care, prevention, diagnosis, the provision of healthcare assistance or the management of health services. This exception covers your clinical care, but it does not cover advertising, marketing or web analytics.

If in the future we needed to process your health data for a purpose other than those described in this notice, we would ask for new, specific consent.

5. What we use your data for: necessary purposes

These purposes are essential. Without them we could not care for you:

• Contacting you to answer your request and to confirm, schedule, reschedule or remind you of an appointment.
• Identifying you as a patient and verifying your identity.
• Providing the medical, dental and aesthetic services you request.
• Creating, updating and keeping your clinical record in accordance with NOM-004-SSA3-2012.
• Preparing diagnoses, treatment plans, prescriptions, instructions and ancillary studies.
• Coordinating referrals with our specialists and with the dental laboratory.
• Issuing payment receipts and invoices, and meeting tax and accounting obligations.
• Responding to health, administrative or judicial authorities where a legal obligation exists.
• Providing post-operative or follow-up care when your treatment requires it.

These purposes do not rest on your consent alone: medical care is grounded in article 9, section VI of the Law, and invoicing and record-keeping derive from legal obligations and from the service relationship between you and the Clinic.

6. Purposes you can refuse

These purposes are not necessary in order to care for you. If you refuse them, your medical care will not be affected in any way:

• Sending you satisfaction surveys about your experience at the Clinic.
• Informing you about promotions, packages, new services or preventive health campaigns.
• Sending you greetings or reminders on relevant dates.
• Measuring the use of this website through analytics tools, as explained in section 9.

How to refuse them:

• For commercial contact purposes: write to contacto.imargroup@gmail.com with the subject «No promotional communications», or simply tell us at reception or via WhatsApp. Your refusal is recorded and you do not need to justify it.
• For website analytics: click «Reject» on the cookie notice, or use «Cookie settings» in the footer at any time.

The Clinic does not publish patient photographs, cases, testimonials or results on this site or on its social media. Should this ever change, we would first ask for your express, written and specific consent, separate from your consent to treatment.

7. How the contact form and WhatsApp actually work

We want you to understand exactly what happens when you fill in the form, because it does not work the way most people assume.

The form does not send your data to any server of ours. When you press «Send message», your browser assembles a text with the information you entered and opens WhatsApp so that you can send it to the Clinic's number, +52 664 340 3000. The message does not go out until you send it from your own WhatsApp account, and at that moment the conversation is stored in your history and in ours.

This has two consequences you should know about:

• This website keeps no database of the form information. If you do not send the message, your data goes nowhere.
• The conversation takes place inside WhatsApp, a service operated by WhatsApp LLC (Meta group), subject to its own policies and with servers outside Mexico. The Clinic does not control that platform, its servers or its security measures.

That is why we ask you not to share detailed clinical information, test results or medical images over WhatsApp. That is what the consultation is for, where the information is protected in your record and covered by professional secrecy.

If you would rather not use WhatsApp, you can call us, email us or come to the Clinic directly.

8. Video surveillance on our premises

The Clinic operates a closed-circuit video surveillance system (CCTV) at entrances and in common areas. When you enter our premises, your image is recorded.

• Purpose: solely the safety of people, the protection of property and the prevention or clarification of incidents.
• Scope: there are no cameras inside consulting rooms, restrooms, or any area where procedures are performed or where there is a reasonable expectation of privacy.
• Audio: the system does not record conversations.
• Retention: recordings are kept for 30 calendar days and are then automatically overwritten, unless they must be preserved due to an incident under investigation or an authority's request.
• Access: only authorized Clinic personnel and, where applicable, competent authorities that lawfully request them.

Recordings are not used for advertising, commercial or staff-evaluation purposes, and are not transferred to third parties except upon legal request.

9. Cookies, local storage and web analytics

This site uses technologies that store information on your device and that may obtain personal data, primarily your IP address.

Strictly necessary storage (no consent required):

• imar_cookies_accepted: stores your decision about cookies, precisely so we do not ask you again on every visit. It is the only information this site stores on your device.

It is stored in your browser's local storage, remains on your device and is not sent to any server of ours. Your language is not stored: each version of the site has its own web address.

Web analytics (requires your consent): we may use Google Analytics, a service of Google LLC, to know how many people visit the site and which sections they view. It obtains data such as your IP address, browser and device type, operating system, pages visited and time spent.

This tool is only activated if you click «Accept» on the cookie notice. If you click «Reject», or simply make no choice, nothing is loaded and no data is sent to Google. As of the last update of this notice, analytics is disabled on the site: even if you accept, no measurement runs until it is configured. When it is activated, this notice will be updated with the corresponding date.

Third-party resources: the site loads fonts from Google Fonts and an icon stylesheet from Cloudflare when the page opens; the Google Maps map loads only when you reach the contact section. Merely by serving those files, those providers receive your IP address, even if you reject cookies. This is a technical consequence of how the web works and we disclose it transparently.

How to change your mind: your decision does not expire; it is kept until you change it. You can do so at any time through the «Cookie settings» link in the footer, which reopens the notice so you can choose again. You can also clear the site data from your browser settings. And you can install the Google Analytics opt-out add-on available at tools.google.com/dlpage/gaoptout.

10. Who we share your data with

We do not sell, rent or trade your personal data. Ever.

Providers that process data on our behalf (remisiones, i.e. processors), under the Clinic's instructions and with no purposes of their own:

• Hostinger International Ltd., the provider where this website is hosted.
• Our own in-house dental laboratory, for the manufacture of prostheses, crowns and appliances.

Third parties that determine their own purposes (transfers). They do not act under our instructions and have their own privacy policies:

• WhatsApp LLC (Meta group), United States, when you choose to contact us through that channel.
• Google LLC, United States, for Google Maps, Google Fonts and, where you authorize it, Google Analytics.
• Cloudflare, Inc., United States, for delivery of site resources.

Transfers that do not require your consent, as provided in articles 9 and 36 of the Law:

• Specialist physicians, clinical analysis laboratories and imaging centers we refer you to, where necessary for your diagnosis or treatment.
• Health, administrative or judicial authorities, where there is a duly grounded and reasoned request.
• Healthcare institutions, in a medical emergency that puts your health or life at risk.

Transfers that do require your express, written consent:

• Insurers or payers, when you ask us to process a reimbursement, a coverage letter or a direct payment. Because this involves health data, this transfer is only made when you request and authorize it in writing, case by case. Your silence does not amount to consent.
• Grand Hotel Tijuana, only if you ask us to arrange the preferential accommodation under the agreement for out-of-town patients. In that case we share only your name and the dates of your stay, never clinical information, and only with your prior authorization.

In every case we communicate this privacy notice to the recipient and require them to process your data in accordance with it.

11. Your ARCO rights and how to exercise them

You have four rights over your personal data, known in Mexico as ARCO rights:

• Access (Acceso): to know what data of yours we hold and on what terms we process it.
• Rectification (Rectificación): to correct it if it is wrong, incomplete or out of date.
• Cancellation (Cancelación): to ask us to delete it when you consider it is not being processed in accordance with the Law.
• Opposition (Oposición): to ask us to stop using it for specific purposes, on legitimate grounds.

How to submit your request. Send it to contacto.imargroup@gmail.com with the subject «ARCO Rights», or deliver it in writing at our address. It must contain:

• Your full name and an address, email or means for us to communicate our response.
• A copy of a valid official ID proving your identity. If you act through a representative, the document evidencing that representation and the ID of both parties.
• A clear and precise description of the data concerned and of the right you wish to exercise.
• Any element or document that helps us locate your data.
• For rectification, the requested amendments and supporting documentation.

Deadlines. We will communicate our determination within a maximum of 20 business days from receipt of your request. If it is granted, we will give it effect within the 15 business days following that communication. Both periods may be extended once for an equal period where circumstances justify it, and we will notify you if that happens.

Cost. Exercising your ARCO rights is free of charge. We could only charge you justified shipping costs or the cost of reproduction in copies or other formats.

When cancellation or opposition may not proceed. Article 25 of the Law sets out cases in which we are not obliged to delete your data. The most relevant one in a clinic is the clinical record: NOM-004-SSA3-2012 requires us to keep it for a minimum of five years from the last medical act. In that case we will explain the reason to you in writing, and will restrict use of the record to what the health standard strictly requires. It may also not proceed where your data is necessary to comply with a legal obligation or for an ongoing legal relationship with you.

The Law in force does not recognize a standalone right to data portability for the private sector, so we cannot offer it. You can, however, obtain a copy of your clinical record through an access request.

12. Withdrawing your consent

You may withdraw the consent you have given us at any time, without having to justify it. Write to contacto.imargroup@gmail.com with the subject «Withdrawal of consent», following the same identification requirements as in the previous section, or tell our reception staff directly.

The same 20 and 15 business-day deadlines apply.

Two honest clarifications:

• Withdrawal has no retroactive effect on processing already lawfully carried out.
• In some cases we will not be able to give it full effect, because keeping your clinical record derives from a health obligation that depends neither on your consent nor on ours. We will explain this clearly if it happens.

If what you want to withdraw is your cookie consent, you do not need to write to us: use the «Cookie settings» link in the footer.

13. How to limit the use or disclosure of your data

In addition to your ARCO rights, you may ask us to limit the use or disclosure of your data without going as far as deleting it. For example, to stop receiving promotional communications, or to avoid being contacted through a particular channel.

The available means are:

• Writing to contacto.imargroup@gmail.com with the subject «Use limitation».
• Asking us by WhatsApp or by phone at +52 664 340 3000.
• Telling us at reception during your visit.

We record your request in an internal exclusion list and stop using your data for the purposes you have limited. Your medical care is never affected by exercising this right.

14. How we protect your information

We apply reasonable administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction, or unauthorized use, access or processing, in accordance with article 18 of the Law:

• Access to clinical records is restricted to the healthcare personnel involved in your care.
• All personnel are bound by the duty of confidentiality and by medical professional secrecy, an obligation that survives the end of their relationship with the Clinic.
• Paper records are kept in access-controlled areas.
• The Clinic's computers are password protected.
• The devices and institutional account used to handle WhatsApp are for the Clinic's exclusive use.
• This website is served over an encrypted connection (HTTPS).

No security measure is infallible. Should a breach occur that significantly affects your property or moral rights, we will notify you without delay so that you can take action, in accordance with article 19 of the Law.

15. How long we keep your data

We keep your data only for as long as necessary to fulfill the purposes described and the applicable legal obligations:

• Clinical record: a minimum of five years from the date of the last medical act, under NOM-004-SSA3-2012. The record is the property of the Clinic, but the information it contains is yours.
• Tax receipts and accounting records: five years, under Mexico's Federal Tax Code.
• Contact messages from people who did not become patients: 12 months, after which they are deleted.
• Video surveillance recordings: the period indicated in section 8.
• Exclusion lists: indefinitely, precisely so that we can continue to honor your refusal.

Once the period has elapsed, data is blocked and subsequently securely deleted.

16. Data of minors and of people under legal representation

We treat pediatric patients. Where the patient is a minor or is under guardianship or legal representation, consent for the processing of their personal data must be given by the person exercising parental authority, guardianship or representation, and this is recorded in the file.

This website is not directed at minors and we do not knowingly collect their data through the form. If we detect that a minor has provided data without authorization from their representative, we will delete it.

The person exercising representation may exercise ARCO rights on the minor's behalf, evidencing the relationship and their own identity.

17. Patients contacting us from abroad

We receive patients from the United States and other countries. It is important that you know the following:

• The Clinic is established in Mexico and your data is processed and stored in Mexico, in accordance with the Mexican legislation described in section 2.
• The rules governing this notice are Mexican. We are not subject to the U.S. HIPAA merely because we treat American patients, and we do not claim to comply with it.
• You can exercise your ARCO rights from abroad through the same means described in section 11, with no need to attend in person.

This notice is available in Spanish (imarmedicalgroup.com/aviso-privacidad.html) and in English (imarmedicalgroup.com/en/privacy-notice.html). Both versions have the same content; in the event of a discrepancy in interpretation, the Spanish version prevails, as it corresponds to the applicable Mexican legislation.

18. Competent authority

If you believe your right to the protection of personal data has been infringed, or that we did not properly handle your request, you may turn to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), which has been Mexico's data protection authority since INAI was dissolved in 2025.

You can consult information and procedures at anticorrupcionybg.gob.mx/datospersonales.

The rights protection procedure must be initiated within 15 days following the date you receive our response or the date the deadline to provide it expires.

Before going to the authority we would appreciate you writing to us: most matters are resolved directly and faster.

19. Changes to this privacy notice

This notice may be amended due to changes in legislation, in our services, in our internal practices or in the tools we use.

Any amendment will be published on this same page, www.imarmedicalgroup.com/en/privacy-notice.html, updating the «Last updated» date shown at the top. We recommend reviewing it periodically.

If the change substantially affects the purposes of processing, and in particular if it involves your sensitive data, we will inform you directly through the most recent contact details you provided, and where applicable we will ask for new consent.

20. Acceptance of this notice

By using the contact form on this site and ticking the consent checkbox, you state that you have read this notice and that you give your express consent to the processing of the data you provide, including any sensitive data that may arise from the service of interest you select.

Browsing the site, on its own, does not imply your consent to the non-necessary purposes described in section 6: those require an affirmative act by you, whether ticking the checkbox, accepting cookies or expressly authorizing it.

For in-person care, consent is documented through the informed consent form you sign at the Clinic before your treatment begins.

If you do not agree with the terms of this notice, we ask that you not use the contact form and that you let us know so we can assist you through another channel.

Imar Medical Group
Grand Hotel Medical Building, Floor 4, Suite 401, Blvd. Agua Caliente 4558, Col. Aviación, ZIP 22014, Tijuana, Baja California, Mexico
contacto.imargroup@gmail.com · +52 664 340 3000

Last updated: July 26, 2026.