Privacy Notice

1. Identity and address of the responsible party

The party responsible for processing your personal data is Dr. Jorge Reyes Mendiola, an general and bariatric surgeon practicing as an individual physician (in this notice, the “Responsible Party”, “we” or “us”).

• Address: Surgery Room, Av. Diego Rivera 2311, int. 601, Zona Urbana Río, C.P. 22010, Tijuana, Baja California, Mexico.
• Privacy contact: WhatsApp +1 747 799 7107, or in writing at the address above, every day, 8:00 am to 8:00 pm (Tijuana time).
• Website: reyesmendiola.1andonly.care (English) and reyesmendiola.1andonly.care/es/ (Spanish). Patient coordination: 1andonly.care.

This notice applies to the data we collect through this website (form, chat and browsing technologies) and to the follow-up communications about your request by WhatsApp, phone or email.

2. Personal data we process

We only collect the data we need to assist you. Depending on how you use the site, we may process the following:

2.1 Evaluation request form

• Full name.
• WhatsApp or phone number, with your country code.
• Email address (optional).
• Procedure of interest: gallbladder, hernia, weight-loss surgery, reflux or “not sure”.
• Any free-text message you choose to write (optional), which may include information about your health.
• The record that you checked the consent box.

2.2 Chat with the virtual assistant

• The content of the messages you write.
• The details you choose to share: name, phone, email, reason for consultation and preferred schedule.

2.3 Technical and browsing data

• IP address, device type and browser.
• Pages you visit and the site you came from (referrer).
• Campaign parameters (utm_*, gclid and fbclid), which are saved in your browser’s local storage (localStorage) and taken into account for up to 30 days to know which ad or source brought you to the site. If you submit the form or use the chat, this source information is attached to your request.

The site also uses cookies and pixels from Google and Meta, described in section 8.

2.4 Sensitive personal data (health)

Information about your health (for example, symptoms, diagnoses or test results) is sensitive personal data. You do not have to share it to request an evaluation: we only process it if you choose to write it in the form, in the chat or on WhatsApp.

• Please do not send imaging studies, X-rays or clinical photos through the chat. The doctor will review your clinical information during your evaluation.
• We obtain your express consent to process this data through the consent box on the form. In the chat, when the assistant asks for your contact details it shows you a link to this notice; if you continue and share your information, you consent to its processing under this notice.
• Any health data you share is used only for the primary purposes in section 3.1. We do not use the content of your messages or the health information you describe for advertising.

We do not collect financial or asset-related data through this site. If you share data about another person (for example, a relative you are asking about), please make sure you have their permission and let them know about this notice.

3. Purposes of processing

3.1 Primary purposes (necessary to assist you)

These are essential to respond to your request and for the relationship you establish with the practice:

1. Answering your questions and requests for information.
2. Scheduling and confirming your evaluation or appointment.
3. Contacting you by WhatsApp, phone or email about the evaluation you requested.
4. Preparing your personalized quote.
5. Coordinating your visit if you are traveling from the United States.
6. Keeping a record of your request in the practice’s patient-relationship system (CRM).

Without this data we could not handle your request. Any health data you choose to share is processed for these purposes with your express consent (section 2.4).

3.2 Secondary purposes (require your consent; you may refuse)

These are not necessary to assist you, but they help us improve and promote the practice’s services:

1. Measuring the performance of our ads and website (Google Ads and Meta).
2. Showing you ads related to the practice’s services (remarketing).
3. Sending you satisfaction and follow-up surveys, as well as occasional informational messages about the doctor’s services.

If we ever want to use your data for a purpose other than those described here, we will ask for your consent again.

4. Chat with a virtual assistant (artificial intelligence)

• The chat on this site is handled by a virtual assistant powered by artificial intelligence. It is not a doctor: it does not provide diagnoses and does not replace a medical consultation.
• Decisions about your care are made by the doctor during your evaluation, not by the assistant.
• A member of the practice’s team may review the conversation and take it over at any time.
• To generate replies, the content of your messages is processed on the chat platform (Chatwoot) and by the artificial intelligence provider (OpenAI), which act on our behalf (section 5).
• Share only what is needed to schedule your visit and avoid sending imaging studies or clinical photos. If you have a medical emergency, go to the nearest emergency room.

5. Providers that process data on our behalf

To run the site and handle your request, we rely on service providers (processors, encargados) that process personal data on behalf of and under the instructions of the Responsible Party, only to provide their services to us. Under Mexican law, this is not a transfer and does not require your consent.

Several of these providers store or process data on servers located outside Mexico, mainly in the United States.

6. Data transfers

We do not sell your personal data, and we do not transfer it to third parties for their own purposes.

We may only share it without your consent in the cases permitted by Article 36 of the Law, for example:

• When required by law or by a competent authority, or when necessary for the administration of justice.
• With health institutions or professionals, when necessary for prevention, diagnosis or medical care (for example, the hospital where a procedure is scheduled).
• With your health insurance company, if you ask us to process your care through your policy.
• When necessary to establish, exercise or defend a right in court.

If a transfer that requires your consent ever becomes necessary, we will ask for it before making the transfer.

7. Options to limit the use or disclosure of your data

• Practice opt-out list: ask us by WhatsApp or in writing to add you to our list of people who do not wish to receive surveys or informational messages. We will confirm your registration.
• Secondary purposes: send us the opt-out message described in section 3.2.
• Cookies and ads: use the controls described in section 8.
• Telemarketing in general (Mexican phone numbers): you can register your number in the Registro Público para Evitar Publicidad (REPEP), run by Mexico’s consumer protection agency (PROFECO).

8. Cookies, pixels and similar technologies

This site uses technologies that collect data automatically while you browse:

• Google Ads tag (gtag, ID AW-18123781550): measures conversions, such as form submissions or clicks to call or message us on WhatsApp, and allows ads to be shown to people who visited the site (remarketing).
• Meta Pixel (ID 1565355917893145 / 1129941328967819): measures visits and actions on the site, such as opening the chat or submitting the form, to measure and show advertising on Meta platforms (such as Facebook and Instagram).
• Browser local storage (localStorage): stores the campaign parameters and the source of your visit, which are taken into account for up to 30 days.
• Chat: the chat platform may store an identifier in your browser to keep your conversation going.
• Google Maps: the map only loads if you click “View map”; from that moment Google may collect browsing data.

These technologies collect data such as your IP address, device type and browser, pages visited, referring site, campaign identifiers, date and time of your visit, and the actions you take on the site (including the type of service you select when submitting the form). We use them for the secondary purposes of measurement and advertising. Google and Meta also process the information their tags collect under their own privacy policies.

How to disable them

• Block or delete cookies and site data in your browser settings, or use private browsing or tracker-blocking extensions.
• Adjust your ad preferences in Google’s My Ad Center and in Meta’s ad preferences.

Disabling them does not prevent you from browsing the site or requesting your evaluation.

9. ARCO rights: how to exercise them

You or your legal representative may exercise the following rights at any time:

• Access: to know what data we hold about you and how we process it.
• Rectification: to correct it if it is inaccurate, incomplete or out of date.
• Cancellation: to ask us to delete it from our records. It is first blocked and then deleted, unless the law requires us to keep it.
• Opposition: to object to its use on legitimate grounds or for specific purposes, including automated processing that significantly affects you.

9.1 Where to submit your request

• By WhatsApp at +1 747 799 7107.
• In writing, delivered at the office: Surgery Room, Av. Diego Rivera 2311, int. 601, Zona Urbana Río, C.P. 22010, Tijuana, B.C., Mexico, every day, 8:00 am to 8:00 pm (Tijuana time).

If you have questions about the procedure, message us at the same number.

9.2 What your request must include

1. Your name and a way to receive our response (your WhatsApp number or a mailing address).
2. A document proving your identity (valid official ID) or, if your representative acts for you, their ID and the document proving their authority.
3. A clear and precise description of the data involved (not required if you only request access).
4. The right you wish to exercise or what you are requesting.
5. Any detail that helps us locate your information, such as the approximate date and the channel you used to contact us.

For a rectification, state the change you are requesting and, where applicable, attach supporting documents. You can prove your identity by showing your ID at the office or by sending a legible copy via WhatsApp; we will use it only to verify your identity. If your request is missing information, we will ask you for it.

9.3 Response times and format

• We will send you our response within a maximum of 20 business days (Mexican business days) from the date we receive your request.
• If your request is granted, we will carry it out within 15 business days after we communicate our response.
• Both periods may be extended once, for an equal period, when circumstances justify it; we will let you know if that happens.

We will reply through the same channel you used or the one you indicate. For access requests, we will deliver your data once your identity is verified, as plain copies, electronic documents or for direct review at the office.

9.4 Costs

Exercising your ARCO rights is free of charge. We may only charge justified shipping costs or the cost of reproducing copies or other formats; if you provide the electronic medium to reproduce your data, delivery is free. If you repeat the same request within less than 12 months, the cost may not exceed three times the Unidad de Medida y Actualización (UMA, a Mexican reference unit), unless substantial changes to this notice prompt new requests.

9.5 When we may deny a request

Only in the cases provided by law; for example, if identity or representation is not proven, if we do not hold your data, if the rights of third parties would be harmed, if a legal impediment or an authority’s decision prevents it, or if the rectification, cancellation or opposition has already been carried out. Cancellation also does not apply when the law requires us to keep the data (for example, clinical records), nor does opposition when processing is necessary to comply with a legal obligation. In every case we will tell you the reasons.

9.6 If you disagree with our response

You may file a data protection request (solicitud de protección de datos) with the Secretaría Anticorrupción y Buen Gobierno, the Mexican government authority that oversees compliance with the Law, within 15 business days after we communicate our response. If we do not respond, you may file it once the response period has expired.

10. Withdrawing your consent

You may withdraw the consent you have given us at any time, without retroactive effect. Send your request through the same channels and with the same identification requirements as an ARCO request (section 9), stating which consent you are withdrawing. We will respond within the same time limits.

Please note that if you withdraw your consent for the primary purposes, we may be unable to continue handling your request, and some data may have to be kept to comply with legal obligations.

11. Retention and security of your data

We keep your data only for as long as necessary to fulfill the purposes of this notice and our legal obligations. After that, it is blocked for the limitation period of any liability arising from its processing and then deleted.

• Campaign parameters saved in your browser are only taken into account for 30 days, and you can delete them at any time in your browser settings.
• If you become a patient, your clinical record is created and kept in accordance with Mexican Official Standard NOM-004-SSA3-2012 on clinical records, which sets a minimum retention period of 5 years from the date of the last medical act.

We maintain administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction, or unauthorized use, access or processing, and we ask our providers to treat it confidentially. If a security breach significantly affecting your property or moral rights were to occur, we will inform you immediately so you can take appropriate action.

12. Changes to this privacy notice

We may update this notice due to changes in the law, in our services or in how we process data. We will publish the current version on this page and on the Spanish page (reyesmendiola.1andonly.care/aviso-de-privacidad/), with the last-updated date at the top. If a change involves new purposes or transfers that require your consent, we will notify you through the contact channel you gave us (for example, WhatsApp) and ask for your consent before applying it.

13. Authority and applicable law

This notice is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation (DOF) on March 20, 2025 and in force since March 21, 2025, and other applicable provisions. The authority that oversees compliance is the Secretaría Anticorrupción y Buen Gobierno, which took over the functions previously held by INAI in this area.

This English version is a courtesy translation. In case of any discrepancy, the Spanish version prevails.