Comprehensive privacy notice

Last updated: October 14, 2026 · Courtesy translation; the Spanish version prevails · Leer en español

Here we explain, in plain language, what personal data we collect through this website, what we use it for, who we share it with and how you can exercise your rights, in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties), published in the Diario Oficial de la Federación (Mexico’s Official Gazette) on March 20, 2025.

Data controller

Dr. Fernando Beltrán Sánchez, clinical cardiologist. Centro Médico Premier, Antonio Caso 2055, 6th Floor, Office 615, Zona Río, postal code 22010, Tijuana, B.C., Mexico.

What data

Your contact details, what you write in the form or in the chat (including health information, only if you choose to share it) and browsing data obtained through cookies and pixels.

What for

To handle your request, schedule your appointment and follow up on it. With your consent, which you may refuse, also to measure ads, show you advertising and send you informational messages.

Shared with

Providers that perform services for us (web hosting, CRM, chat, artificial intelligence, WhatsApp, Google and Meta), some of them outside Mexico. We do not sell your data.

Your rights

Access, rectification, cancellation and opposition (ARCO), revoking your consent and limiting the use of your data. Message us on WhatsApp at +52 664 319 5209 or deliver your request in writing at the office.

1. Identity and address of the data controller

The party responsible for processing your personal data (the data controller, or “Responsable” under Mexican law) is Dr. Fernando Beltrán Sánchez, a physician specializing in cardiology (in this notice, “the Controller” or “we”).

Address: Centro Médico Premier, Antonio Caso 2055, 6th Floor, Office 615, Zona Urbana Río, postal code 22010, Tijuana, Baja California, Mexico.

Privacy contact: WhatsApp +52 664 319 5209 and office phone +52 664 478 3107, or in writing at the address above, Monday to Friday from 9 a.m. to 1 p.m. and Saturdays from 10 a.m. to 2 p.m.

Website: beltranheart.care (Spanish) and beltranheart.care/en/ (English).

This notice applies to the data we collect through this website (form, chat and browsing technologies) and to the communications that follow from your request by WhatsApp, phone call or email.

2. Personal data we process

We only collect the data we need to assist you. Depending on how you use the site, we may process the following:

2.1 Appointment request form

• Full name.
• WhatsApp number, with your country code.
• Email address, if you choose to provide it (optional).
• Reason for your visit: consultation or checkup, high blood pressure, palpitations, chest pain or shortness of breath, managing a heart condition, pre-op evaluation, a heart test, or other.
• If you choose pre-op evaluation and decide to provide it, what surgery you are having and when.
• Your preferred time and any comment you choose to write (optional), which may include information about your health.
• A record that you checked the consent box.

2.2 Chat with the virtual assistant

• The content of the messages you write.
• The data you choose to share: name, phone, email, reason for your visit and preferred time.

2.3 Technical and browsing data

• IP address, device type and browser.
• Pages you visit and the site you came from (referrer).
• Campaign parameters (utm_*, gclid and fbclid), which are stored in your browser’s local storage (localStorage) and taken into account for up to 30 days to know which ad or source led to your visit. If you submit the form or use the chat, this source information is attached to your request.

The boxes you check in the “When should you see a cardiologist?” section are processed only in your browser and are not sent to anyone, unless you choose to carry them over to the form and submit it. The site also uses cookies and pixels from Google and Meta, which we describe in section 8.

2.4 Sensitive personal data (health)

Information about your health (for example, symptoms, diagnoses, surgeries or tests) is sensitive personal data. You do not have to share it to request an appointment: we only process it if you choose to write it in the form, in the chat or on WhatsApp.

Please do not send test reports, results or clinical photos through the chat. The doctor will review your clinical information during your visit.

We obtain your express consent to process this data through the consent box on the form. In the chat, when the assistant asks for your contact details, it shows you the link to this notice; if you continue and share your information, you give us your consent to process it under this notice.

The health data you share is used only for the primary purposes in section 3.1. We do not use the content of your messages or the health information you describe to us for advertising purposes.

We do not collect financial or asset-related data through this site. If you share another person’s data with us (for example, a relative you are asking about), please make sure you have their permission and let them know about this notice.

3. Purposes of processing

3.1 Primary purposes (needed to assist you)

• Answering your questions and requests for information.
• Scheduling and confirming your appointment or evaluation.
• Contacting you by WhatsApp, phone call or email about the appointment you requested.
• Telling you the cost of the visit or test you need.
• Coordinating your visit if you are traveling from the United States.
• Keeping a record of your request in the office’s patient relationship management system (CRM).

Without this data we could not handle your request. Any health data you choose to share is processed for these purposes with your express consent (section 2.4).

3.2 Secondary purposes (they require your consent, and you may refuse)

• Measuring the performance of our ads and website (Google and Meta), including the enhanced conversions measurement described in section 8.
• Showing you ads related to the office’s services (remarketing).
• Sending you satisfaction and follow-up surveys, as well as occasional informational messages about the doctor’s services.

Don’t want us to use your data for these purposes? At any time, send us a WhatsApp message at +52 664 319 5209 with the text “No deseo finalidades secundarias” (“I do not want secondary purposes”; you can say which ones), or deliver it in writing at the office. For cookies and ads, you can also use the controls described in section 8. Your refusal will not affect the care you requested.

If in the future we want to use your data for a purpose other than those described here, we will ask for your consent again.

4. Chat with a virtual assistant (artificial intelligence)

• The site’s chat is handled by a virtual assistant powered by artificial intelligence. It is not a doctor: it does not give diagnoses and does not replace a medical consultation.
• Decisions about your care are made by the doctor during your visit, not by the assistant.
• A member of the office team may review the conversation and take it over at any time.
• To generate the responses, the content of your messages is processed on the chat platform (Chatwoot) and by the artificial intelligence provider (OpenAI), which act on our behalf (section 5).

Share only what is needed to book, and avoid sending test reports or clinical photos. If you have a medical emergency, call 911 or go to the nearest emergency room.

5. Providers that process data on our behalf

To run the site and handle your request, we rely on providers (processors, or “encargados”) that process personal data on behalf of and under the instructions of the Controller, only to provide their service to us. Under the Law, this communication is not a transfer and does not require your consent.

Several of these providers store or process data on servers located outside Mexico, mainly in the United States.

6. Data transfers

We do not sell your personal data or transfer it to third parties for their own purposes. We could only share it without your consent in the cases allowed by Article 36 of the Law; for example:

• When required by law or by a competent authority, or when necessary for law enforcement or the administration of justice.
• To health institutions or professionals, when necessary for prevention, diagnosis or medical care (for example, to the surgeon who requested your pre-op evaluation or to the specialist you are referred to).
• To your health insurance company, if you ask us to process your care through your policy.
• When necessary to establish, exercise or defend a right in legal proceedings.

If a transfer that requires your consent becomes necessary in the future, we will ask for your consent before making it.

7. Options to limit the use or disclosure of your data

• Office opt-out list: ask us by WhatsApp or in writing to add you to our list of people who do not want to receive surveys or informational messages. We will confirm that you have been added.
• Secondary purposes: send us the message “No deseo finalidades secundarias” (section 3.2).
• Cookies and ads: use the controls described in section 8.
• Phone advertising in general: you can register your number in the Registro Público para Evitar Publicidad (REPEP, Mexico’s public do-not-call registry) of the Procuraduría Federal del Consumidor (PROFECO, Mexico’s federal consumer protection agency).

8. Cookies, pixels and similar technologies

This site uses technologies that collect data automatically while you browse:

• Google Tag Manager and Google tags (Google Ads and Google Analytics): they measure visits and conversions, such as submitting the form or clicks to call or message on WhatsApp, and allow ads to be shown to people who visited the site (remarketing).
• Google Ads enhanced conversions: when you submit the form, the Google tag takes your email (if you entered it), your phone and your name, turns them into an irreversible code (SHA-256 hash) inside your browser and sends only that code to Google, which uses it to know whether the request came from one of our ads. Google does not receive the reason for your visit or what you write.
• Meta pixel: measures visits and actions on the site, such as opening the chat or submitting the form, to measure and show advertising on Meta platforms (such as Facebook and Instagram).
• Browser local storage (localStorage): stores the campaign parameters and the source of your visit, which are taken into account for up to 30 days.
• Chat: the chat platform may store an identifier in your browser to keep your conversation.
• Google Maps: the map only loads if you click “View map”; from that moment on, Google may collect data about your browsing.

These technologies collect data such as your IP address, device type and browser, pages visited, referring site, campaign identifiers, date and time of the visit and the actions you take on the site. We do not send Google or Meta the content of your messages or the reason for your visit. We use these technologies for the secondary purposes of measurement and advertising. Google and Meta also process the information their tags collect under their own privacy policies.

How to turn them off

• Block or delete cookies and site data in your browser settings, or use private browsing or extensions that block trackers.
• Adjust your ad preferences in Google’s My Ad Center and in Meta’s ad preferences.

Turning them off does not prevent you from browsing the site or requesting your appointment.

9. ARCO rights: how to exercise them

You or your legal representative may exercise the following rights at any time:

• Access: to know what data of yours we hold and the conditions under which we process it.
• Rectification: to correct it if it is inaccurate, incomplete or out of date.
• Cancellation: to ask us to delete it from our records. It is first blocked and then deleted, unless the law requires us to keep it.
• Opposition: to object to its use for a legitimate reason or for specific purposes, including automated processing that significantly affects you.

9.1 Where to submit your request

• By WhatsApp at +52 664 319 5209.
• In writing, delivered at the office: Centro Médico Premier, Antonio Caso 2055, 6th Floor, Office 615, Zona Río, postal code 22010, Tijuana, B.C., Monday to Friday from 9 a.m. to 1 p.m. and Saturdays from 10 a.m. to 2 p.m.

If you have questions about the procedure, call us at +52 664 478 3107.

9.2 What your request must include

• Your name and a way to receive our response (your WhatsApp number or a mailing address).
• A document proving your identity (a valid official ID) or, if your representative is acting for you, their ID and the document proving their authority to represent you.
• A clear and precise description of the data regarding which you want to exercise your right (not needed if you are only requesting access).
• The right you want to exercise or what you are requesting.
• Any detail that helps us locate your information, such as the approximate date and the channel you used to contact us.

If you request a rectification, state the change you are asking for and, where applicable, attach supporting documents. You can prove your identity by showing your ID at the office or by sending a legible copy by WhatsApp; we will use it only to verify your identity. If your request is missing information, we will ask you for it.

9.3 Response times and how we respond

We will send you our response within a maximum of 20 business days from the date we receive your request. If your request is granted, we will carry it out within the 15 business days following the date we send you our response. Both periods may be extended once, for an equal period, when the circumstances justify it; in that case, we will let you know.

We will reply through the same channel you used to contact us or through the one you indicate. If you request access, we will provide your data once your identity has been verified, through plain copies, electronic documents or direct review at the office.

9.4 Costs

Exercising your ARCO rights is free of charge. Only justified shipping costs or the cost of reproduction in copies or other formats may be charged; if you provide the electronic medium to reproduce your data, delivery will be free. If you repeat the same request within less than 12 months, the cost may not exceed three times the Unidad de Medida y Actualización (UMA, Mexico’s official reference unit used to calculate fees and fines), unless there are substantial changes to this notice that prompt new requests.

9.5 When we might deny a request

Only in the cases provided for by the Law; for example, if identity or representation is not proven, if we do not hold your data, if the rights of third parties would be harmed, if there is a legal impediment or a ruling by an authority that prevents it, or if the rectification, cancellation or opposition has already been carried out. Cancellation also does not apply when the law requires us to keep the data (for example, the clinical record), and opposition does not apply when the processing is necessary to comply with a legal obligation. In every case, we will tell you the reasons.

9.6 If you disagree with our response

You can file a data protection request with the Secretaría Anticorrupción y Buen Gobierno (Mexico’s Ministry of Anti-Corruption and Good Governance), the authority in charge of overseeing compliance with the Law, within the 15 business days following the date we send you our response. If we do not respond, you may file it once the response period has expired.

10. Revoking your consent

You may revoke the consent you have given us at any time, without retroactive effect. Send your request through the same channels and with the same identification requirements as an ARCO request (section 9), stating which consent you are revoking. We will respond within the same time frames. Please keep in mind that if you revoke your consent for the primary purposes, we may not be able to continue handling your request, and that some data may have to be kept to comply with legal obligations.

11. Retention and security of your data

We keep your data only as long as necessary to fulfill the purposes of this notice and our legal obligations. After that, it is blocked for the statute of limitations period for liabilities arising from its processing and, when that period ends, it is deleted. The campaign parameters stored in your browser are only taken into account for 30 days, and you can delete them at any time in your browser settings.

If you become a patient, your clinical record is created and kept in accordance with NOM-004-SSA3-2012, Del expediente clínico (the Mexican Official Standard on the clinical record), which sets a minimum retention period of 5 years from the date of the last medical act.

We maintain administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing, and we ask our providers to treat it confidentially. If a security breach occurs that significantly affects your property or moral rights, we will inform you immediately so that you can take the appropriate measures.

12. Changes to this privacy notice

We may modify this notice due to changes in the law, in our services or in the way we process data. We will post the current version at beltranheart.care/aviso-de-privacidad/ (and this courtesy translation at beltranheart.care/en/privacy/), with the date of its last update at the top. If a change involves new purposes or transfers that require your consent, we will let you know through the contact channel you gave us (for example, WhatsApp) and ask for your consent before applying it.

13. Authority and applicable law

This notice is issued in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, published in the Diario Oficial de la Federación on March 20, 2025, and in force since March 21, 2025, and with other applicable provisions. The authority in charge of overseeing compliance is the Secretaría Anticorrupción y Buen Gobierno, which took over the functions that the INAI (National Institute for Transparency, Access to Information and Personal Data Protection) had in this area.

This English version of the notice is a courtesy translation. In case of any discrepancy, the Spanish version prevails.

Back to booking