Los Barriles Health Clinic · Privacy notice
PRIVACY NOTICE
Los Barriles Health Clinic
Last updated: September 27, 2026
This English version is provided for the convenience of international patients. The Spanish version of this Privacy Notice prevails in case of any discrepancy. This Notice is governed by Mexican law (LFPDPPP).
Dr. Guillermo Jesús Pérez Flores, licensed Medical Doctor with Professional License (Cédula Profesional) number 12816847 issued by the General Directorate of Professions of Mexico's Ministry of Public Education, in his capacity as owner and operator of Los Barriles Health Clinic (hereinafter, indistinctly, the «Data Controller», «LBHC» or your «Physician»), is an individual with business activity dedicated to the provision of professional medical and clinical laboratory services.
Address: Plaza Elena, Calle El Ancón esquina Marlin s/n, suite 5, Los Barriles, La Paz Municipality, Baja California Sur, Mexico.
Phone: +52 612 159 0306
Email: docmemoperez@lbhc.mx
LBHC collects your personal data, including sensitive data, as part of the professional physician-patient relationship and to fulfill its legal and ethical obligations. In respect of every person's right to privacy and informational self-determination, this Privacy Notice is made available to you.
Laboratory Director: LBHC's clinical laboratory services are provided under the technical and professional responsibility of Lic. Cecilia García Jácome, Bachelor in Clinical Chemistry with Professional License number 10340615, member of the LBHC clinical team. Laboratory services are billed under the same fiscal regime as the Data Controller.
The capture, storage and management of your personal data is performed through the ELEONOR technology platform, operated by BIOVERCOME, S.A.P.I. de C.V. Document safekeeping and information backup are additionally performed in Google Workspace, operated by Google LLC, pursuant to Section 6.4, as well as through the other technological tools described in Section 6.
The collection, processing, storage, access, and transfer of your personal data by LBHC are subject to the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation on March 20, 2025, its Regulations to the extent they do not conflict with it, and other applicable Mexican regulations, including NOM-004-SSA3-2012 (clinical record) and NOM-024-SSA3-2012 (electronic health information systems).
By providing information to LBHC by any means (verbal or written, physical or electronic), you confirm your agreement with the terms of this Notice. If you do not agree with any of its terms, please do not provide any personal data. Refusal to provide certain data may limit your access to services, without generating any liability for LBHC.
For the purposes of the LFPDPPP and to facilitate understanding of this Notice:
LBHC offers the following professional services, the provision of which motivates the collection of your personal data:
To provide the above services, LBHC may require and process the following categories of personal data:
For minors or legally incapacitated persons, data shall be provided by whoever exercises parental authority, guardianship, or representation, as detailed in Section 8.
LBHC collects your personal data to protect, promote, and recover your health. Primary purposes include:
LBHC may use your data for the following secondary purposes, NOT essential to service provision:
If you do NOT wish your data to be processed for secondary purposes, you may indicate this by checking the corresponding box at the end of this Notice, or by writing to the Controller at any time.
LBHC uses the ELEONOR technology platform, operated by BIOVERCOME, S.A.P.I. de C.V., for creation, administration, safekeeping, and consultation of virtual clinical records. Through this platform, the Physician may use the AI-based virtual assistant called «SofIA» as a support tool.
LBHC uses the Setmore platform (operated by Setmore Inc., based in the United States of America) for medical appointment management. Setmore may process the Data Subject's identification and contact data (name, email, phone) for automated sending of confirmations, reminders, and notifications via email and text message (SMS).
Direct communication between the Physician and the Data Subject may take place through the WhatsApp application, operated by Meta Platforms, Inc. (based in the United States of America). Although WhatsApp messages are transmitted with end-to-end encryption, metadata (phone numbers, communication times, devices) is processed by Meta. If you do NOT wish to use this channel, you may opt for email or phone call instead.
LBHC uses Google Workspace, operated by Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, California 94043, United States of America, under a corporate account on the lbhc.mx domain, for institutional email, the clinic calendar, and document storage and backup (Google Drive).
Scope of processing. In Google Workspace, LBHC keeps:
Delimitation. The primary clinical record does NOT reside in Google Workspace. Its repository is the ELEONOR platform described in Section 6.1. What is hosted in Google Workspace has the character of backup and administrative archive.
Security measures applied by LBHC:
Provider security measures. Google LLC encrypts information in transit and at rest, undergoes regular independent third-party audits, and holds, among others, the ISO/IEC 27001:2022 certification applicable to Google Workspace.
In a complementary manner and WITHOUT entering identifiable personal data of the Data Subject, the Physician may rely on general-purpose generative AI assistants (such as ChatGPT, operated by OpenAI, L.L.C., and Claude, operated by Anthropic, PBC), used exclusively for clinical research support, drafting educational materials, consultation of medical literature, and review of administrative processes, with no access to the clinical record or patient-identifiable information.
The use of the foregoing platforms and tools does NOT in any case replace the Physician's professional judgment, diagnosis, treatment, or responsibility. Every clinical note, hypothesis, or material generated by such tools is reviewed, validated, and, where appropriate, corrected by the Physician before incorporation into the definitive clinical record or use in patient care.
As part of medical practice, LBHC may take clinical photographs of the Data Subject solely for medical purposes: documentation of lesions, wound evolution, recording before and after medical or aesthetic procedures (including aesthetic medicine procedures, IV therapy, and others), and clinical evidence.
Where they are stored. These photographs are kept within the clinical record on the ELEONOR platform and, as backup, in LBHC's document storage on Google Workspace, in restricted-access folders identified by a code and not by the Data Subject's name, pursuant to Section 6.4. They are held under the same security and confidentiality measures as the rest of the information and are NOT used for other purposes without additional express consent. Under no circumstances are they shared with communications or marketing service providers, external agencies, or third parties unrelated to the Data Subject's care.
LBHC may, in the future, use images, clinical cases, or testimonials of the Data Subject on its social media, website, or professional communications, ONLY with separate, express, written consent, granted through a specific authorization document. Refusal to grant this consent shall NOT affect the provision of medical service.
LBHC provides medical services to minors and persons with legal incapacity. In such cases:
LBHC provides medical services to national and foreign patients, including tourists and temporary or permanent residents primarily from the United States of America and Canada. This Privacy Notice is governed by Mexican law, particularly the LFPDPPP.
LBHC makes this Notice available to the Data Subject in Spanish and English versions. The Spanish version prevails in case of discrepancy or controversy. Any claim, exercise of ARCO rights, or controversy shall be submitted to the jurisdiction of competent courts in Baja California Sur, Mexico, and to the rights protection procedure before the data protection authority, which under the current LFPDPPP is the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Government).
For Data Subjects with habitual residence in jurisdictions with particular data protection regulations (such as the European Union's General Data Protection Regulation, GDPR, or equivalent legislation), LBHC adopts security and proportionality measures consistent with such regulations, without implying express submission to foreign jurisdictions.
U.S.-based patients are advised that LBHC is a Mexican healthcare provider operating under Mexican law. HIPAA does not apply to LBHC. However, LBHC's technology vendors (ELEONOR, Setmore, Google Workspace) maintain security practices aligned with international standards.
Pursuant to Article 36 of the LFPDPPP, LBHC may transfer your data without additional consent in the following cases:
The following transfers require your consent, granted by signing this Notice or by verbal consent without objection:
Resulting from the use of the tools described in Section 6, LBHC may transfer data to the following Data Processors located outside Mexico:
All international transfers are subject to contractual clauses and security and confidentiality obligations agreed with each provider, as well as applicable international compliance certifications.
As Data Subject, you have the right to: Access your personal data and know its processing; Rectify inaccurate or outdated data; Cancel your data when applicable; and Oppose processing for specific purposes. You may also limit use or disclosure and revoke granted consent.
Procedure. To exercise your ARCO rights, submit a request by:
Each request must: (1) specify the right(s) to exercise; (2) explain the reasons; and (3) include a copy of valid official ID of the Data Subject or legal representative.
If incomplete, LBHC has 5 calendar days to request correction; the Data Subject has 10 calendar days to provide it. If the request is appropriate, LBHC has 20 calendar days to communicate the determination, and an additional 15 calendar days to make it effective. Exercising ARCO rights is free of charge; only justified shipping or copying costs may be charged, where applicable.
You may revoke consent granted for processing your personal data, particularly for secondary purposes, clinical photography for communications purposes, or unnecessary transfers. Submit your request through the same means as Section 11. LBHC will respond within 10 business days.
This Notice may be modified. LBHC will inform you through: (i) notification to the email you provided; (ii) personal notification at the office; or (iii) publication of the updated version on LBHC's website.
LBHC will retain your data for a minimum term of 5 years from the last appointment, pursuant to NOM-004-SSA3-2012, or for the longer term required by applicable legal provisions.
If you decide to change physicians, you may request a copy of your clinical record, which LBHC will deliver in physical or electronic format, against signed receipt, releasing LBHC from further safekeeping obligations.
For any question about this Notice, address your communication to:
Dr. Guillermo Jesús Pérez Flores is the direct responsible party for the privacy of your personal data.
To facilitate understanding of this Notice, plain-language definitions are provided:
Artificial Intelligence (AI): Computer programs that learn to perform tasks from many examples. In medicine they can help transcribe conversations, organize information, or suggest references, but they DO NOT make medical decisions for the doctor.
Data Processor: An external company that helps the doctor process your data (for example, a platform to store the medical record, an app to send reminders, a transcription service, or an email and storage service). The Processor does not own your data: it only processes it on the doctor's instruction.
Backup: An additional copy of your information kept somewhere other than the main system, so it is not lost if the main system fails. The copy is protected with the same security measures as the original.
Sensitive data: Especially delicate information, such as your physical or mental health, genetic background, or intimate life. By law, it is protected with stricter standards than ordinary data.
International data transfer: When your information is sent to servers located in another country (for example, the United States). This requires your consent and that the receiving company complies with security standards equivalent to Mexican standards.
Encryption: Technology that makes your information unreadable to anyone without the correct key. It is like locking your data with an electronic key so only authorized persons can read it.
De-identification: Technical process that removes data that can identify you (name, address, date of birth, etc.) before processing the information, so that even if someone saw the data, they could not know to whom it belongs.
ARCO Rights: Your four rights over your information: Access it, Rectify it if wrong, Cancel it when no longer needed, and Object to specific uses.
Check the boxes according to your preferences. Primary purposes are required to receive service; the rest are optional and separable.
Important: Consent for use of my images on social media or professional communications is NOT granted through this Notice, but through a separate specific authorization document, pursuant to Section 7.2.
Data Subject or legal representative information:
Full name: _________________________________________________________________
Address: ___________________________________________________________________
Phone: _____________________________________________________________________
Email: _____________________________________________________________________
For minors or incapacitated persons, relationship to the Data Subject: ______________________________________________
By my signature, I declare that: (i) I am informed of the terms of this Privacy Notice; (ii) I grant express authorization for my personal data, including sensitive data, to be processed in accordance with this Notice; (iii) the Notice was made personally available to me, having had it before me, having read it, and agreeing with its content; and (iv) I release LBHC and its Data Processors from any liability arising from the processing of my data, except in cases of fraud or bad faith.
Signature of Data Subject or legal representative
Date: ____ / ____ / __________
Document prepared in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, published March 20, 2025), its applicable Regulations, and NOM-004-SSA3-2012. The Spanish version prevails over any translation in case of discrepancy.
| LOS BARRILES HEALTH CLINIC Privacy Notice (English) |
| ☐ | I AGREE (required to receive service). The processing of my personal data pursuant to this Notice for the PRIMARY PURPOSES described in Section 5.1, as well as the transfers necessary for my medical care and laboratory services. |
| ☐ | I AGREE / ☐ I DO NOT AGREE. The processing of my personal data for the SECONDARY PURPOSES (campaigns, surveys, promotional communications) described in Section 5.2. |
| ☐ | I AGREE / ☐ I DO NOT AGREE. That LBHC take clinical photographs solely for medical purposes (documentation of lesions, before and after procedures), and that such images be kept and backed up pursuant to Sections 6.4 and 7.1. |
| ☐ | I AGREE / ☐ I DO NOT AGREE. The international transfer of my data to the Data Processors described in Section 10.3, which are BIOVERCOME (ELEONOR), Setmore Inc., Meta Platforms, Inc. (WhatsApp), and Google LLC (Google Workspace). |