Los Barriles Health Clinic · Privacy notice
PRIVACY NOTICE
Los Barriles Health Clinic
Last updated: April 25, 2026
This English version is provided for the convenience of international patients. The Spanish version of this Privacy Notice prevails in case of any discrepancy. This Notice is governed by Mexican law (LFPDPPP).
Dr. Guillermo Jesús Pérez Flores, licensed Medical Doctor with Professional License (Cédula Profesional) number 12816847 issued by the General Directorate of Professions of Mexico's Ministry of Public Education, in his capacity as owner and operator of Los Barriles Health Clinic (hereinafter, indistinctly, the «Data Controller», «LBHC» or your «Physician»), is an individual with business activity dedicated to the provision of professional medical and clinical laboratory services.
Address: Calle Don Antonio Verdugo, Plaza Buenos Aires, local 4, Los Barriles, La Paz Municipality, Baja California Sur, Mexico.
Phone: +52 612 159 0306
Email: info@lbhc.mx
LBHC collects your personal data, including sensitive data, as part of the professional physician-patient relationship and to fulfill its legal and ethical obligations. In respect of every person's right to privacy and informational self-determination, this Privacy Notice is made available to you.
Laboratory Director: LBHC's clinical laboratory services are provided under the technical and professional responsibility of Lic. Cecilia García Jácome, Bachelor in Clinical Chemistry with Professional License number 10340615, member of the LBHC clinical team. Laboratory services are billed under the same fiscal regime as the Data Controller.
The capture, storage and management of your personal data is performed through the ELEONOR technology platform, operated by BIOVERCOME, S.A.P.I. de C.V., as well as through the additional technological tools described in Section 6.
The collection, processing, storage, access, and transfer of your personal data by LBHC are subject to the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and other applicable Mexican regulations, including NOM-004-SSA3-2012 (clinical record) and NOM-024-SSA3-2012 (electronic health information systems).
By providing information to LBHC by any means (verbal or written, physical or electronic), you confirm your agreement with the terms of this Notice. If you do not agree with any of its terms, please do not provide any personal data. Refusal to provide certain data may limit your access to services, without generating any liability for LBHC.
For the purposes of the LFPDPPP and to facilitate understanding of this Notice:
LBHC offers the following professional services, the provision of which motivates the collection of your personal data:
To provide the above services, LBHC may require and process the following categories of personal data:
For minors or legally incapacitated persons, data shall be provided by whoever exercises parental authority, guardianship, or representation, as detailed in Section 8.
LBHC collects your personal data to protect, promote, and recover your health. Primary purposes include:
LBHC may use your data for the following secondary purposes, NOT essential to service provision:
If you do NOT wish your data to be processed for secondary purposes, you may indicate this by checking the corresponding box at the end of this Notice, or by writing to the Controller at any time.
LBHC uses the ELEONOR technology platform, operated by BIOVERCOME, S.A.P.I. de C.V., for creation, administration, safekeeping, and consultation of virtual clinical records. Through this platform, the Physician may use the AI-based virtual assistant called «SofIA» as a support tool.
LBHC may use the AI-powered clinical transcription platform called «Heidi» (hereinafter, «Heidi»), operated by Heidi Health Corp., located at Floor 10, 41 East 11th Street, New York, NY 10003, United States of America, and its related companies in Australia, the United Kingdom, and Canada.
Heidi allows the Physician to capture, through the microphone of a device (computer, tablet, or mobile phone), the audio of the consultation for real-time transcription and AI-assisted generation of structured clinical notes (SOAP format or others).
Heidi's technical and security characteristics:
LBHC uses the Setmore platform (operated by Setmore Inc., based in the United States of America) for medical appointment management. Setmore may process the Data Subject's identification and contact data (name, email, phone) for automated sending of confirmations, reminders, and notifications via email and text message (SMS).
Direct communication between the Physician and the Data Subject may take place through the WhatsApp application, operated by Meta Platforms, Inc. (based in the United States of America). Although WhatsApp messages are transmitted with end-to-end encryption, metadata (phone numbers, communication times, devices) is processed by Meta. If you do NOT wish to use this channel, you may opt for email or phone call instead.
In a complementary manner and WITHOUT entering identifiable personal data of the Data Subject, the Physician may rely on general-purpose generative AI assistants (such as ChatGPT, operated by OpenAI, L.L.C., and Claude, operated by Anthropic, PBC), used exclusively for clinical research support, drafting educational materials, consultation of medical literature, and review of administrative processes, with no access to the clinical record or patient-identifiable information.
The use of the foregoing platforms and tools does NOT in any case replace the Physician's professional judgment, diagnosis, treatment, or responsibility. Every clinical note, hypothesis, or material generated by such tools is reviewed, validated, and, where appropriate, corrected by the Physician before incorporation into the definitive clinical record or use in patient care.
The use of Heidi during consultation is OPTIONAL. The Data Subject has the right to object to the use of this tool without affecting in any way access to medical services or the quality of care. Objection may be expressed verbally at the start of the consultation or in writing to the Controller, at any time.
As part of medical practice, LBHC may take clinical photographs of the Data Subject solely for medical purposes: documentation of lesions, wound evolution, recording before and after medical or aesthetic procedures (including botulinum toxin application, IV therapies, and others), and clinical evidence. These photographs are kept within the clinical record under the same security and confidentiality measures as the rest of the information, and are NOT used for other purposes without additional express consent.
LBHC may, in the future, use images, clinical cases, or testimonials of the Data Subject on its social media, website, or professional communications, ONLY with separate, express, written consent, granted through a specific authorization document. Refusal to grant this consent shall NOT affect the provision of medical service.
LBHC provides medical services to minors and persons with legal incapacity. In such cases:
LBHC provides medical services to national and foreign patients, including tourists and temporary or permanent residents primarily from the United States of America and Canada. This Privacy Notice is governed by Mexican law, particularly the LFPDPPP.
LBHC makes this Notice available to the Data Subject in Spanish and English versions. The Spanish version prevails in case of discrepancy or controversy. Any claim, exercise of ARCO rights, or controversy shall be submitted to the jurisdiction of competent courts in Baja California Sur, Mexico, and to the procedure before the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI).
For Data Subjects with habitual residence in jurisdictions with particular data protection regulations (such as the European Union's General Data Protection Regulation, GDPR, or equivalent legislation), LBHC adopts security and proportionality measures consistent with such regulations, without implying express submission to foreign jurisdictions.
U.S.-based patients are advised that LBHC is a Mexican healthcare provider operating under Mexican law. HIPAA does not apply to LBHC. However, LBHC's primary technology vendors (Heidi Health, Setmore, ELEONOR) maintain HIPAA-aligned security practices, and Heidi Health is HIPAA-certified.
Pursuant to Article 37 of the LFPDPPP, LBHC may transfer your data without additional consent in the following cases:
The following transfers require your consent, granted by signing this Notice or by verbal consent without objection:
Resulting from the use of the tools described in Section 6, LBHC may transfer data to the following Data Processors located outside Mexico:
All international transfers are subject to contractual clauses and security and confidentiality obligations agreed with each provider, as well as applicable international compliance certifications.
As Data Subject, you have the right to: Access your personal data and know its processing; Rectify inaccurate or outdated data; Cancel your data when applicable; and Oppose processing for specific purposes. You may also limit use or disclosure and revoke granted consent.
Procedure. To exercise your ARCO rights, submit a request by:
Each request must: (1) specify the right(s) to exercise; (2) explain the reasons; and (3) include a copy of valid official ID of the Data Subject or legal representative.
If incomplete, LBHC has 5 calendar days to request correction; the Data Subject has 10 calendar days to provide it. If the request is appropriate, LBHC has 20 calendar days to communicate the determination, and an additional 15 calendar days to make it effective.
You may revoke consent granted for processing your personal data, particularly for secondary purposes, use of Heidi, clinical photography for communications purposes, or unnecessary transfers. Submit your request through the same means as Section 11. LBHC will respond within 10 business days.
This Notice may be modified. LBHC will inform you through: (i) notification to the email you provided; (ii) personal notification at the office; or (iii) publication of the updated version on LBHC's website.
LBHC will retain your data for a minimum term of 5 years from the last appointment, pursuant to NOM-004-SSA3-2012, or for the longer term required by applicable legal provisions.
If you decide to change physicians, you may request a copy of your clinical record, which LBHC will deliver in physical or electronic format, against signed receipt, releasing LBHC from further safekeeping obligations.
For any question about this Notice, address your communication to:
Dr. Guillermo Jesús Pérez Flores is the direct responsible party for the privacy of your personal data.
To facilitate understanding of this Notice, plain-language definitions are provided:
Artificial Intelligence (AI): Computer programs that learn to perform tasks from many examples. In medicine they can help transcribe conversations, organize information, or suggest references, but they DO NOT make medical decisions for the doctor.
Ambient AI scribe: Technology that listens to the conversation between doctor and patient, converts it into text, and drafts a clinical note for the doctor to review and correct. The audio is normally NOT saved.
Data Processor: An external company that helps the doctor process your data (for example, a platform to store the medical record, an app to send reminders, or a transcription service). The Processor does not own your data: it only processes it on the doctor's instruction.
Sensitive data: Especially delicate information, such as your physical or mental health, genetic background, or intimate life. By law, it is protected with stricter standards than ordinary data.
International data transfer: When your information is sent to servers located in another country (for example, the United States). This requires your consent and that the receiving company complies with security standards equivalent to Mexican standards.
Encryption: Technology that makes your information unreadable to anyone without the correct key. It is like locking your data with an electronic key so only authorized persons can read it.
De-identification: Technical process that removes data that can identify you (name, address, date of birth, etc.) before processing the information, so that even if someone saw the data, they could not know to whom it belongs.
ARCO Rights: Your four rights over your information: Access it, Rectify it if wrong, Cancel it when no longer needed, and Object to specific uses.
Check the boxes according to your preferences. Primary purposes are required to receive service; the rest are optional and separable.
Important: Consent for use of my images on social media or professional communications is NOT granted through this Notice, but through a separate specific authorization document, pursuant to Section 7.2.
Data Subject or legal representative information:
Full name: ___________________________________________________________________
Address: ____________________________________________________________________
Phone: ______________________________________________________________________
Email: _______________________________________________________________________
For minors or incapacitated persons, relationship to the Data Subject: ____________________________________________________________
By my signature, I declare that: (i) I am informed of the terms of this Privacy Notice; (ii) I grant express authorization for my personal data — including sensitive data — to be processed in accordance with this Notice; (iii) the Notice was made personally available to me, having had it before me, having read it, and agreeing with its content; and (iv) I release LBHC and its Data Processors from any liability arising from the processing of my data, except in cases of fraud or bad faith.
_______________________________________________
Signature of Data Subject or legal representative
Date: ____ / ____ / __________
Document prepared in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and NOM-004-SSA3-2012. The Spanish version prevails over any translation in case of discrepancy.
| ☐ | I AGREE (required to receive service). The processing of my personal data pursuant to this Notice for the PRIMARY PURPOSES described in Section 5.1, as well as the transfers necessary for my medical care and laboratory services. |
| ☐ | I AGREE / ☐ I DO NOT AGREE. The processing of my personal data for the SECONDARY PURPOSES (campaigns, surveys, promotional communications) described in Section 5.2. |
| ☐ | I AGREE / ☐ I DO NOT AGREE. That my medical consultation be transcribed by the AI assistant Heidi (Heidi Health Corp.), described in Section 6.2, with the understanding that audio is NOT stored, data is transferred to infrastructure located in the United States with the security measures described, and that my refusal will NOT affect the medical care I receive. |
| ☐ | I AGREE / ☐ I DO NOT AGREE. That LBHC take clinical photographs solely for medical purposes (documentation of lesions, before and after procedures), pursuant to Section 7.1. |
| ☐ | I AGREE / ☐ I DO NOT AGREE. The international transfer of my data to the Data Processors described in Section 10.3. |