Privacy Policy

When you use the Request an Evaluation form, we receive your full name, email address, optional telephone number, and selected area of interest (regenerative medicine, plastic surgery, bariatric surgery, aesthetic medicine, or dental care). We also receive the consent response and version associated with your request and a submission identifier so we can process the request reliably.

The form may record limited referral information: the five standard campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, and utm_content), the landing-page path, and the referring domain. The form is designed not to retain or transmit advertising click identifiers such as gclid, gbraid, wbraid, or fbclid. Website and security providers may separately process technical data needed to deliver pages, mitigate abuse, and operate hosting, such as IP addresses, browser-related information, security challenges, and access logs. Section 5 describes the website analytics information we receive when you browse the site.

Sensitive information: your selected area of medical interest, and any health details you choose to communicate, may reveal information about your present or future health and may be sensitive personal data under Mexican law. The basic web form does not ask you to submit diagnoses, medical records, laboratory results, photographs, or detailed symptoms. Please do not include those materials in the general contact form. If our care team later needs medical information, it will explain the secure intake process and the applicable medical privacy notice and consent requirements.

Necessary purposes for responding to your request: (a) identify and contact you using the channel you provide; (b) understand the specialty for which you seek information; (c) coordinate a preliminary evaluation and, if you choose to continue, refer your request to authorized patient-coordination and clinical staff; (d) document your inquiry and consent; (e) prevent fraudulent or duplicate submissions, protect our systems, and resolve service problems; and (f) meet applicable legal obligations.

Additional purposes that are not required for your inquiry: we do not currently use the evaluation form as an enrollment in newsletters or promotional campaigns. Should we offer optional marketing communications in the future, we will explain that purpose and request separate, optional consent before using your information for it. Refusing marketing will not prevent you from requesting an evaluation.

Sending an inquiry and consenting to contact permits us to respond about that specific request. It does not by itself constitute consent for unrelated marketing, use of clinical records, or all potential international data transfers. If sensitive health data are to be collected or processed on a basis requiring express written consent, we will use an appropriate affirmative consent and authentication process, subject to exceptions permitted by applicable law. You can ask us to stop nonessential communications or withdraw consent using the privacy contact listed in Section 7; withdrawal does not retroactively invalidate earlier lawful handling or override mandatory retention obligations.

We may engage contracted technology providers to host or protect the site, verify form security, measure aggregate website usage, route inquiries, and store request records. We limit provider access to the functions they perform for us and require appropriate confidentiality and security safeguards.

Where an evaluation requires support from an independent physician, specialist, medical facility, or travel coordination provider, we will disclose only the information reasonably necessary for the specific coordination or care purpose, subject to applicable notice and consent requirements. We may also disclose information when legally required or to protect legal rights.

International handling: some service providers and recipients may process data outside Mexico. Applicable transfers will follow Mexican privacy requirements, including informing you of relevant third-party recipients and seeking consent where required. Any transfer for which consent is legally required will be presented as a separate accept-or-decline choice before it occurs. We do not treat a general inquiry checkbox as blanket transfer consent.

The website uses necessary technical functions to display pages and safeguard inquiry submission. Cloudflare Turnstile checks submissions of the evaluation form for abusive traffic.

Website analytics: we use Google Analytics 4, a service provided by Google, to understand in aggregate how visitors use this website, for example which sections are viewed and how many evaluation requests are completed. Google Analytics may set cookies or use similar technologies in your browser. It receives technical and usage information such as the page address (limited to the page path and the five standard campaign parameters described in Section 1), the domain of the website that referred you, browser and device information, an approximate location derived from your network connection, and a notice that an evaluation request was completed. That notice is designed not to carry personal data: it is not intended to include your name, email address, telephone number, area of interest, consent response, receipt, or submission identifier. We have not configured the website to send what you type into the evaluation form to Analytics, and we have turned off Analytics' automatic collection of user-provided data, such as email addresses or telephone numbers.

We have limited Google's advertising features for the data collected through this website. In our Analytics settings, Google signals and advertising personalization are turned off, and the website sets Google's advertising consent controls (advertising storage, advertising user data, and advertising personalization) to denied by default. Advertising click identifiers (such as gclid, gbraid, wbraid, or fbclid) are not included in the page address sent to Analytics and are not collected by the evaluation form. Our Analytics property remains linked to a Google Ads account. We do not use data from this website's Analytics to build advertising audiences or to show you personalized advertising.

For visitors in the European Economic Area, the United Kingdom, and Switzerland, Analytics storage (cookies) is turned off by default, and this website does not currently offer a way to turn it on; Google may still receive limited information that does not depend on cookies. Elsewhere, you can block cookies in your browser settings or use the browser add-on that Google provides to opt out of Google Analytics. We have set Analytics to keep event data for 2 months and user-level data for 14 months; the 14-month period restarts when the same browser or device is active again, and aggregated reports that do not identify individuals may be kept longer. Analytics data is processed by Google as our service provider and may be handled outside Mexico, as described in Section 4.

The site also offers links to WhatsApp, SMS, Google Maps, social media, and YouTube; if you follow those links, the relevant third party may process information under its own terms and privacy notice. Campaign source parameters, if present, are used only to understand where visits and inquiries originated.

We maintain administrative, technical, and physical controls appropriate to the nature and sensitivity of personal data, restrict access to personnel and providers with a legitimate need, and work to reduce unauthorized access, alteration, loss, or disclosure. No electronic transmission or storage method is completely risk-free. For inquiries that do not become patient cases, we retain the inquiry and contact history for up to 12 months after the last meaningful interaction, then delete or de-identify it, unless a specific legal obligation or documented legal claim requires longer preservation. If an inquiry becomes a patient case, records required for care are subject to separate clinical retention rules and notices.

Under applicable Mexican law, you may request access to your personal data, rectification of inaccurate data, cancellation when legally appropriate, or opposition to certain processing (together, ARCO rights). You may also ask to limit certain uses or disclosures, or revoke consent where permitted. Send your request to info@sanmiguelhealth.com with the subject "Privacy Request" and include your name, a means of receiving the response, the right or action requested, enough detail to identify the information involved, and appropriate proof of identity or representative authority. We will use a proportionate, secure method to verify identity; please do not send identification documents through the public contact form.

Under Mexico's federal private-sector privacy law, the ordinary period for notifying you of the determination is up to 20 business days after receipt of a complete request; if granted, the request is ordinarily implemented within the following 15 business days. The law permits justified extensions and exceptions. You may exercise rights through your authorized representative, and some requests may be restricted when legal preservation or third-party rights require it.

The general website inquiry form is intended for adults. A parent or lawful guardian who seeks information about care for a minor should contact the coordination team directly and use the applicable pediatric and guardian authorization process; do not send a child's medical records through the general form. Residents of certain U.S. states may have additional privacy rights where their laws apply to our activities. Please contact the privacy department for questions or a request under potentially applicable law. This notice does not claim that Sanmiguel Health is automatically subject to HIPAA or to every U.S. state privacy law; applicability requires a separate legal assessment.

We may update this notice when our services, technologies, purposes, recipients, or legal duties change. We will post the revised notice at https://sanmiguelhealth.com/privacy-policy/ with a new effective date, and take additional steps or seek fresh consent when legally required. For questions about this notice, please contact info@sanmiguelhealth.com or write to the verified controller address in Section 10.