MedicaliX · Desppos
Full privacy notice
This notice explains how Desppos processes data related to MedicaliX and distinguishes its role from each clinic’s responsibility for patient care.
Operator and contact
Desppos
Viento #82, Morelia, Michoacán, Méxicocontacto@medicalix.com.mx
+52 443 410 8033
Controller and scope
Desppos, at the address and contact details on this page, operates MedicaliX and controls processing needed for accounts, contracts, support and security. The clinic controls its patients’ data; MedicaliX processes that data on its behalf as a processor. This notice does not replace the clinic’s own privacy notice or medical consents.
Account and contract data
We process names, email addresses, phone numbers, clinic details, professional profiles, team roles, access identifiers, language and time-zone preferences. We also process plans, countries, currencies, supplied tax details, payment references and statuses, coverage periods and recurring-payment authorizations, along with support inquiries, IP addresses, device and browser information and activity logs needed to operate and protect the service.
Patient data and sensitive data
On the clinic’s instructions, the platform may hold patient identification, photographs, dates of birth, sex, contact details, insurers, appointments, estimates and payments, as well as histories, allergies, diagnoses, treatments, prescriptions, consents, dental and periodontal charts, images and studies. Health information is sensitive. The clinic must have a valid legal basis and, where required, express written consent, verifying representation of minors. An identification photograph does not authorize other biometric uses.
Necessary purposes
We use data to register and authenticate accounts, verify email, enable the purchased service, manage payments and billing, provide support, prevent abuse and meet legal duties. We send operational notices about security, accounts, due dates, renewals and cancellations. For the clinic, we facilitate patient, appointment, record, document, permission, backup and authorized communication management.
Optional purposes
Advertising and promotions are optional and subject to the separate choice required. You may refuse them, unsubscribe or limit data use or disclosure by emailing contacto@medicalix.com.mx with the subject “Privacy preferences”, without losing essential services. The service does not include selling records or using identifiable clinical data for third-party advertising or training general-purpose artificial intelligence models.
Providers and communications
Technical providers support hosting, storage, backups and email; Google reCAPTCHA helps prevent automated registrations. Their involvement must be limited to contracted purposes and applicable confidentiality duties. When selected, Stripe, PayPal and Mercado Pago process payments under their own notices. Do not send passwords, full card numbers or security codes to support.
The clinic verifies recipients and authorizations for email, WhatsApp or calendars. Those providers may process information under their own terms. Links to providers’ privacy information appear at the end of this document.
Disclosures and international processing
We may disclose information to authorities in response to a valid request. Disclosures requiring consent will be explained with their recipient and purpose before they occur. Foreign infrastructure or providers may involve processing outside the user’s country; relevant locations, subprocessors and safeguards must be documented with the clinic. This notice is not blanket permission to disclose records to third parties and does not replace mandatory requirements in other jurisdictions.
Cookies, preferences and reCAPTCHA
We use resources needed for sessions, security and preferences. Google reCAPTCHA evaluates browser signals and may use the _GRECAPTCHA cookie for risk analysis; Google’s privacy policy and terms apply when you interact with it. Cookies can be managed in your browser, although blocking essential ones may affect functionality. Nonessential analytics or advertising technologies require disclosure and the applicable prior choice; accepting the terms does not authorize them generally.
Security and incidents
Desppos must maintain administrative, technical and physical measures proportionate to risk, restricted access and confidentiality. Clinics must protect their devices and manage staff permissions. Reportable breaches will be communicated to affected parties and authorities where required. Report incidents to contacto@medicalix.com.mx without initially attaching complete records or credentials; we will arrange an appropriate channel if further information is needed.
Retention and deletion
We retain account and transaction data as needed for the service, legal duties, inquiries or liabilities, then restrict, delete or anonymize it as appropriate. Records are managed according to lawful clinic instructions and healthcare duties. In Mexico, NOM-004-SSA3-2012 requires record retention for at least five years after the last medical act. Cancelling a subscription neither automatically orders deletion nor includes free hosting for that period. Return, subsequent retention and backup deletion are coordinated with the clinic.
Access, rectification, cancellation and objection
Email contacto@medicalix.com.mx with the subject “ARCO rights”. Include your name, a reply channel, the right requested, data to locate and, for corrections, the proposed correction and supporting information. We verify identity and representation proportionately; do not send a complete identity document initially. For data controlled by Desppos in Mexico, we respond within twenty business days and, if granted, implement the request within the following fifteen; lawful extensions will be justified and communicated. Requests are free except legally permitted reproduction or delivery costs. Record-related requests are directed to the responsible clinic.
Withdrawal and complaints
You may withdraw consent through the same email, identifying the processing to stop. Withdrawal is not retroactive and does not remove legal retention duties; we will explain any restriction or impact on the service. You may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno for processing subject to Mexican law, or the competent authority in your jurisdiction, without first having to exhaust this internal channel.
Changes and specific authorizations
The current notice is published with its date and version. Material changes will be communicated through the account or registered email; new purposes requiring consent will be subject to a prior choice. Reading the notice does not replace specific consent for sensitive data, advertising or recurring charges. Each clinic must inform its patients and maintain its own notice.