Privacy Policy Mexico

Data Protection Instituto Médico del Prado CDMX

1.- IDENTITY AND ADDRESS OF THE DATA CONTROLLER

In compliance with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the INAI Guidelines, it is hereby disclosed that the data controller responsible for the processing of personal data is:

Data Controller: Dr. Hiram Abif Espinosa Custodio
Trade name: Instituto Médico del Prado México
Address: Calle Leibnitz 20, despacho 401, Colonia Anzures, Alcaldía Miguel Hidalgo, C.P. 11590, Ciudad de México.
Phone: +52 55 4590 9909
Contact email: info@drespinosacustodio.com
COFEPRIS Operating Notice: 2409135036X00306

2.- PERSONAL DATA COLLECTED

For the provision of medical and administrative services, the Institute may collect the following personal data:

  • Identification and contact data: full name, age, phone number, email, official identification, address.
  • Sensitive health data: clinical history, diagnoses, medical treatments, clinical photographs, and test results.
  • Tax or billing data: RFC (tax ID), billing address, bank details for payments or invoicing.

In compliance with Article 9 of the LFPDPPP, the processing of sensitive health data requires, and is carried out under, your express written consent.

3.- PURPOSES OF PROCESSING

The personal data collected will be used for the following purposes:

a) Primary purposes (necessary for the medical and contractual relationship):

  • Providing specialized medical services and clinical follow-up.
  • Preparing and maintaining clinical records in accordance with NOM-004-SSA3-2012.
  • Scheduling consultations, procedures, and check-ups.
  • Issuing tax receipts, managing payments, and complying with legal obligations.
  • Communicating with the patient for appointment reminders and medical follow-up.

b) Secondary purposes (optional):

  • Sending information about treatments, promotions, or news related to the clinic.
  • Satisfaction surveys or service evaluations.

If you do not want your data to be used for secondary purposes, you may state so by sending an email to info@drespinosacustodio.com. Declining the use of your data for these purposes will not affect the provision of the contracted medical services.

4.- TRANSFERS OF PERSONAL DATA

The Institute does not share your personal data with third parties, except in the following cases:

  • Legal obligation or request from a competent authority.
  • Billing: tax data may be shared with the external accountant exclusively for tax purposes.
  • Service providers: subcontracted laboratories or medical specialists, solely to fulfill the purposes described and under confidentiality clauses.

No international transfers of personal data are carried out.

5.- LEGAL BASIS AND CONSENT

The processing of your personal data is carried out in accordance with the following legal grounds:

  • Express consent of the data subject, in accordance with Articles 8, 9, and 12 of the LFPDPPP.
  • Compliance with obligations arising from the medical and contractual relationship.
  • Legal obligations arising from the General Health Law and applicable regulations.

6.- ARCO RIGHTS AND WITHDRAWAL OF CONSENT

You have the right to Access, Rectify, Cancel, or Object (ARCO) to the processing of your personal data, as well as to withdraw your consent at any time.

To exercise these rights, you must send a request to info@drespinosacustodio.com including:

  • Full name of the data subject.
  • Copy of valid official identification.
  • Clear description of the data and the right you wish to exercise.

Legal deadlines:

  • Response to your request within a maximum of 20 business days.
  • If applicable, implementation of the requested measure within the following 15 business days.

7.- MEANS TO LIMIT THE USE OR DISCLOSURE OF DATA

If you wish to limit the use or disclosure of your personal data (for example, to stop receiving promotional information), you may request this by email at info@drespinosacustodio.com. The Institute will register your request in its internal exclusion list.

8.- DATA SECURITY

Instituto Médico del Prado México implements the necessary administrative, technical, and physical measures to protect personal data against damage, loss, alteration, destruction, or unauthorized access, in accordance with Article 19 of the LFPDPPP and Article 61 of its Regulations.

Access to data is restricted exclusively to authorized personnel who need it to fulfill the purposes established.

9.- USE OF COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies or similar technologies to improve the user experience.

These technologies allow us to remember your language preference, geographic region, or session.

You can disable them directly from your browser settings.

For more information, please see our Cookie Notice available at: https://drespinosacustodio.com/en/legal-notice/mexico-legal-notice/

10.- CHANGES TO THE PRIVACY POLICY

This Privacy Policy may be modified to adapt to regulatory or internal changes. Updates will be published on the Institute’s official website, indicating the date of its last modification.

Last updated: October 8, 2025

11.- DATA PROTECTION AUTHORITY

If you believe your right to personal data protection has been violated, you may contact:

Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI)
Website: www.inai.org.mx
Phone: 800-835-4324

12.- RECOGNITION OF HEALTH REGULATIONS

Instituto Médico del Prado México declares that it complies with the General Health Law, its Regulations regarding the provision of medical care services, and NOM-004-SSA3-2012 (Clinical Records), as well as applicable provisions of COFEPRIS.

LEGAL REVIEW CLAUSE

This Privacy Policy was prepared in accordance with the Federal Law on Protection of Personal Data Held by