01Who is responsible
The controller is Dra. Elinor Vázquez Zapata, a natural person who practices private medicine — general and laparoscopic surgery — at Office 501, Hospital Galenia, Av. Tulum Mz 1 Lt 1 Sm 12, Tower B, 5th floor, CP 77504, Cancún, Quintana Roo. Hospital Galenia is the building where the office is located; that does not make the hospital jointly responsible for data the office collects, except when it receives the transfers that hospital care requires.
The personal-data department is the office itself. The designated person is Dr. Elinor Vázquez Zapata. For this notice, including the exercise of ARCO rights, the channel is WhatsApp 998 550 0002, the office phone 998 550 0002, or in person at the professional address. The Hospital Galenia switchboard does not receive or process ARCO requests.
02What this notice covers — and what it does not
It governs processing by the office: scheduling, consultation, the office clinical record, quotes, billing, insurance paperwork and communications by WhatsApp or phone.
Hospital Galenia and Hospital Azura are separate establishments. For the operating room, admission, studies, anesthesia and the record each of them generates, they are independent controllers. You should consult their respective notices. This document also does not replace informed-consent forms or the clinical record required by the General Health Law and NOM-004-SSA3-2012.
If first contact is by WhatsApp, phone or another electronic means, a simplified notice — identity, data, purposes and this link — will be made available, in accordance with article 16 of the Federal Law on Protection of Personal Data Held by Private Parties.
03What data are processed
Identification and contact: name, phone, WhatsApp, address, date of birth, official ID and, where applicable, the name of a relative or companion.
Financial data, when there is private payment or invoicing: RFC, payment method and receipts. Coverage data: insurer, policy number, validity and reports you provide.
Sensitive personal data, under the Federal Law on Protection of Personal Data Held by Private Parties, include those relating to your present or future health: history, diagnosis, surgical indication, studies, progress notes, allergies, medicines, intraoperative findings and any other data in the record. Ethnic origin, religion, political opinions and sexual preference are not collected systematically; if you provide them, they are treated under the same sensitivity and secrecy regime.
04Where they come from
As a rule, from you or your representative, in the office, by phone or by WhatsApp. They may come from a relative, a referring physician, your insurer, the hospital, a laboratory or an imaging centre, when indispensable for care.
This site — draelinorvazquez.com — is predominantly static. It does not operate a patient portal or collect a clinical record online. Browsing may generate technical data (IP address, device type, pages visited), described later.
05What they are used for
Necessary purposes, tied to care and to the law: identifying you; booking and confirming appointments; compiling and keeping the record; assessing, diagnosing, indicating and, where applicable, operating; follow-up; issuing written quotes, prescriptions and reports; invoicing; and responding to a competent authority.
Purposes that require your consent, and that you may revoke without conditioning medical care: non-urgent reminders or instructions by WhatsApp beyond appointment logistics; handling claims with your insurer when you chose that payment route; and any testimonial or image for the site. There is no mass marketing and no paid transfer of databases.
06How to limit use or disclosure
In addition to ARCO rights, you may limit use or disclosure through the same channels in this notice. In particular you may: ask not to receive non-urgent reminders or instructions by WhatsApp; refuse or revoke the use of testimonials or images; and choose private payment, which does not authorize transfer to insurers.
Those refusals do not condition strictly necessary medical care or transfers to the hospital or an authority. The hospital switchboard is not a channel of this office.
07Express consent: health and financial data
Processing of health data requires express written consent — handwritten or electronic signature or an equivalent mechanism — except for the legal exceptions: a legal provision, an emergency that may harm you, and data indispensable for medical care, diagnosis or health management while you are unable to consent, provided the processing is done by someone bound by professional secrecy.
Processing of financial data (RFC, payment method, receipts, policy data) also requires express consent, except for legal exceptions. That consent is collected at the first in-person visit or, if the relationship starts on WhatsApp, is confirmed in writing at the office before invoicing or handling insurance.
The privacy form is collected at the first in-person visit and reinforced with informed-consent forms when there is a procedure. Privacy consent does not replace clinical informed consent, and the reverse is also true.
08Medical secrecy and the record
Independently of data-protection law, professional secrecy and confidentiality of the record apply: General Health Law, its Regulation on the provision of medical-care services, NOM-004-SSA3-2012 and articles 210 and 211 of the Federal Criminal Code. Staff and anyone involved in processing remain bound even after the relationship ends.
The office clinical record belongs to the establishment; you are the holder of your health information. That record is not Hospital Galenia’s or Hospital Azura’s. Clinical information is not disclosed to third parties — relatives, employers or intermediaries — except with your written authorization, a founded order of an authority, or the public-health cases provided by health legislation.
09Transfers to Hospital Galenia and Hospital Azura
Identification data and the health data strictly necessary to schedule an operating room, admission, anesthesia, nursing and the hospital record will be communicated to the hospital where the act takes place. Each hospital processes those data under its own notice.
You may accept or refuse this transfer. Refusal may make the procedure impossible.
10Transfers to insurers
If you request care through private health insurance, identification data, policy data and the clinical data indispensable for authorization, scheduling, claims and payment will be transferred to the insurer — and, where applicable, its network. The office works with Allianz, AXA, GNP, Inbursa, Mapfre, MetLife, Seguros Atlas, Seguros Monterrey, BUPA, Zurich, BX+, Prevem Seguros y Pan American Life. That list is informative: it does not mean your policy covers the case or that payment is assured.
You may accept or refuse this transfer. Refusal does not prevent care by private payment. Because you may choose that route, express consent will be collected for the transfer to the insurer.
11Other communications
Transfers may be made without consent when a law or an authority’s order requires it. Laboratories, imaging centres and the anesthesiologist are usually controllers of their own act.
No international transfers of clinical data to hospitals, laboratories or insurers are planned. WhatsApp and the site infrastructure may involve processing abroad of technical identifiers and, if you send studies or accounts of illness through that channel, of health data. That risk is disclosed here; the channel does not replace the record.
12Processors and WhatsApp
The office’s administrative staff act as processors. WhatsApp (Meta Platforms) is not a clinical record or a processor under the law: it is a third party with its own policy and infrastructure outside Mexico. It is used to book, confirm and give guidance. Sending studies, clinical images or accounts of illness through that channel is discouraged.
If you send them anyway, they do not replace the record. What is indispensable for care will be transcribed into the office record, or you will be asked to deliver it in person. The site host is not authorized to use the office’s clinical data.
13Security measures, blocking and retention
Administrative, technical and physical measures proportional to the sensitivity of health data are maintained: access control to the office and the file, custody of the record and a minimum-necessary criterion.
Security breaches that significantly affect your property or moral rights will be communicated to you immediately. When cancellation proceeds, the data will be blocked for the limitation period of actions arising from care and, once that period ends, they will be deleted, and you will be notified. If they would already have been transferred to a hospital, insurer or laboratory, the rectification or cancellation will be communicated to them so they carry it out as well.
The clinical record is kept for at least five years from the last medical act, in accordance with NOM-004-SSA3-2012, and for any additional period required by professional-liability limitation, tax obligations or a pending proceeding. ARCO cancellation does not proceed when the law requires retention or when the data are necessary for diagnosis, treatment or health management.
14ARCO rights: how to exercise them
You, or your representative, may access, rectify, cancel or object to processing, and revoke consent without retroactive effect. Access to the record is harmonized with NOM-004: delivery after identification, with only reproduction or shipping costs chargeable.
The request is submitted at the office, to 998 550 0002 or by WhatsApp 998 550 0002. It must contain your name, a means to notify you, proof of identity or representation — official ID —, the right you exercise and a description of the data. For rectification, say what is corrected and provide support. The controller will respond within a maximum of twenty business days, and what is granted will be executed in fifteen further business days. Those periods may be extended once for the same length if the circumstances of the case justify it.
A request submitted on consultation days and hours is deemed received; those sent outside that time are deemed received on the next business day of care. There are no automated decisions or algorithmic health profiles.
15If you do not receive a response
You may file a data-protection request with the Secretaría Anticorrupción y Buen Gobierno within fifteen days of being notified of the response. If you received no response, you may file it once the controller’s response period has expired. The means of filing are those published by the Secretaría.
As of this notice, that federal function sits with the Secretaría Anticorrupción y Buen Gobierno, through the administrative unit for the private sector, or whichever succeeds it. Historical references to INAI are understood as made to the authority that holds those powers under the current framework. The deconcentrated body Transparencia para el Pueblo and Quintana Roo’s local institute do not hear cases against private parties.
16This site: cookies and infrastructure
There is no user account or online clinical record. The dra_lang cookie remembers your chosen language. The site loads fonts and third-party infrastructure — including Google Fonts, hosting, content delivery and animation libraries — that may collect IP address, device type and pages visited. That processing is of technical data, not clinical data.
Google Analytics 4 (Google) loads only if you accept optional analytics. It uses cookies such as _ga to measure visits and interactions and may process technical data outside Mexico. You can reject it or withdraw your choice using the Cookies button; your preference is stored in this browser for 180 days. We do not send form fields or the message text. If you accept, Google receives the page path, the site you came from without that address’s query string, campaign parameters on the link (utm, gclid, fbclid and equivalents) and an event when you tap WhatsApp or the phone number. Google Analytics advertising features are disabled. Meta Pixel is enabled separately only if you accept marketing, and only on Home and The team in Spanish and English, without URL parameters or non-approved referrers. The pixel and Conversions API send the same PageView event with a shared ID to avoid duplicates. With your marketing consent, the server sends Meta the general page visited, event time, IP address, browser user agent and _fbp identifier when available; the dra_marketing_consent cookie communicates that choice to the server. No form fields or clinical information are sent; it does not load on forms, procedures or clinical guides. It may use _fbp and _fbc cookies, and Meta may process technical identifiers abroad. You can withdraw both choices under Cookies. The authentic text of this notice is Spanish; it can be explained in English in consultation.
17Minors and representatives
Processing of data of children or adolescents is done through the person who holds parental authority or guardianship. A third party — spouse, child, insurance manager or travel assistant — does not access the record without accredited representation or your written authorization.
18Changes and validity
Amendments are published on this page. If you are in active care, you will be told in the office or by WhatsApp or phone. A substantial change in purposes or transfers of health data will require new written consent.
This notice enters into force on 1 September 2026 and replaces previous versions. It is available in printed form at the office.
