Privacy notice

Draft for legal review. Last updated: November 4, 2026. The Spanish “Aviso de privacidad” is the controlling version under Mexican law; this English version is provided for international patients.

This notice is issued under the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP, published in the Official Gazette on March 20, 2025) and other applicable regulations.

1. Who is responsible for your data

The practice of Dr. David Orozco, Plastic and Reconstructive Surgery, the “Controller”, located at Piso 4, Consultorio 410 · Calle Tarascos 3473, Fracc. Monraz, Guadalajara, Jalisco, C.P. 44670 (Guadalajara) and with an office at Core Medical & Surgery Center, Piso 2, Consultorio 207 · Blvd. Padre Kino #10014, Zona Urbana Río, Tijuana, Baja California, C.P. 22010 (Tijuana). Privacy contact: [email protected].

2. Personal data we collect

Identity and contact data: name, phone or WhatsApp number and, if provided, email.
Request data: procedure of interest and any notes you choose to write.
Sensitive (health) data: if you choose to share it through WhatsApp or another channel (the website form does not ask for medical information), such as photographs of your body or face, medical history, weight, height, medications or goals. Sensitive data is processed only with your express consent.
Browsing data: IP address, device and browser type, pages visited and interaction events (for example, clicking the WhatsApp button), collected through cookies and similar technologies.

3. Why we use your data

Necessary purposes (we cannot assist you without them):

Answer your inquiry and schedule an in-person or virtual consultation.
Make a preliminary assessment of your case and prepare a plan and written quote.
Create your medical record if you become a patient, as required by health regulations.
Follow up on your care and meet legal obligations.

Additional purposes (you may object without affecting your care):

Measure website and campaign performance (analytics and advertising).
Send information about services, check-ups or reminders.
Publish result photographs only if you sign a specific written authorization for that purpose.

To object to the additional purposes, email [email protected] with your name and request.

4. Sharing

We do not sell your personal data or share it without your consent, except where the law allows (for example, requests from competent authorities) and with service providers that help us run the website, email, messaging (for example WhatsApp, by Meta) and analytics (for example Google and Meta) under confidentiality obligations. Some of these providers may store or process data outside Mexico. If your care requires coordination with a hospital, anesthesiologist, laboratory or nursing service, only the data needed for your treatment is shared.

5. Your rights (ARCO), withdrawal and limits

You may exercise your rights of access, rectification, cancellation and objection (ARCO), withdraw your consent, or limit use or disclosure of your data by writing to [email protected] with: (i) your name and a way to reply; (ii) a copy of an official ID; (iii) a clear description of the right you wish to exercise and the data involved; and (iv) any document that helps locate your data. We will reply within the legal deadlines. Your medical record must be retained for the period required by health regulations (for example, Mexican standard NOM-004-SSA3-2012, at least five years from the last medical act), so cancellation may be subject to those periods.

6. Cookies and tracking

This site may use cookies and tools such as Google Analytics, Google Tag Manager and Meta Pixel to understand how the site is used and to measure campaigns. You can accept or reject non-essential cookies in the site’s cookie notice, or disable them in your browser settings and with the opt-out tools those providers offer. Doing so may limit some site features.

7. Security

We apply reasonable administrative, technical and physical safeguards. Please share medical photos only through the channels our team indicates.

8. Changes

We may update this notice to reflect legal or practice changes. The current version is always available on this site with its update date.

9. Authority

If you believe your data protection rights have been violated, you may contact the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the Mexican authority for the protection of personal data held by private parties.