ViaFERT comprehensive privacy notice

1. Identity and address of the data controller

VIAFERT, Sociedad Civil, located at Calle Mariano Escobedo número 185, Colonia Centro, Culiacán, Sinaloa, C.P. 80000, México, is responsible for processing the personal data described in this notice. This notice applies to services provided by ViaFERT at its Culiacán and Mazatlán locations and through its digital channels.

2. Personal data we may process

Depending on your relationship with ViaFERT and the channel you use, we may process the following categories:

• Identification and contact: name, age or date of birth, telephone number, email, country or city of residence, and details of an accompanying person or representative.
• Appointments and care: location, professional, consultation type, date, preferred times and communications related to care.
• Clinical and sensitive data: medical history, tests, diagnoses, treatments, images, genetic or reproductive information, and other health data needed to provide medical care.
• Billing and payments: tax information, receipts and data needed to document payments. ViaFERT does not ask for passwords or banking security codes.
• Digital data: IP address, device, browser, pages viewed, cookies, consent preferences and website interaction data.
• Voluntary content: messages, files or information you choose to provide through forms, email, telephone, WhatsApp, the digital appointment system or other authorised channels.

3. Purposes of processing

Primary and necessary purposes

• Respond to requests and coordinate, confirm, reschedule or follow up on appointments.
• Provide assessment, diagnosis, treatment, follow-up and continuity of medical care.
• Compile and retain clinical records in accordance with applicable health obligations.
• Verify identity, maintain clinical communication and address requests from patients or representatives.
• Process payments, billing, clarification requests, and administrative, accounting, tax or legal obligations.
• Maintain website security, prevent abuse, fraud or unauthorised access, and document consent.
• Address ARCO rights, complaints, requests from authorities and regulatory obligations.

Secondary or optional purposes

• Send educational content, general reminders, updates, surveys or service communications.
• Measure the website experience and improve content, campaigns and care channels through authorised analytics.

You may object to secondary purposes or withdraw your consent by writing to informes@viafert.com. Refusing will not affect your medical care or the response to your request.

Sensitive personal data

When processing sensitive data requires express consent, ViaFERT will request it through the appropriate means. Its use will be limited to what is necessary for care, health obligations and other authorised purposes.

Retention

Data will be retained only for as long as necessary to fulfil the stated purposes and the applicable clinical, health, tax, contractual and legal retention periods. Once those periods end, the data will be securely deleted, blocked or anonymised, as appropriate.

4. Data processors, third parties and transfers

ViaFERT may use providers that process data on behalf of the clinic, such as appointment scheduling, messaging, web hosting, technology support, billing, security, laboratories or complementary clinical services. These providers must process information in accordance with applicable instructions, confidentiality requirements and security measures.

Data will be transferred to third parties only when there is a legal basis, it is necessary for the care requested, it is required by a competent authority, or the corresponding consent has been obtained. If a transfer requires specific authorisation, it will be requested before the transfer takes place.

5. ARCO rights, withdrawal of consent and limitation

You may request access, rectification, cancellation or opposition to the processing of your data (ARCO rights); you may also withdraw your consent or request that its use or disclosure be limited.

Send your request to informes@viafert.com with the subject “Privacidad / Derechos ARCO” and include:

• Your name and a means of receiving notifications.
• Documents proving your identity or authority to represent the person concerned.
• A clear description of the data and the right you wish to exercise.
• Any information that helps locate the data.
• For rectification, the requested change and supporting information.

ViaFERT will communicate its decision within a maximum of twenty days after receiving a complete request and, where applicable, will implement it within the following fifteen days. These periods may be extended once when circumstances justify doing so, in accordance with the law.

6. Security and confidentiality

ViaFERT maintains reasonable administrative, technical and physical measures to protect data against damage, loss, alteration, destruction, unauthorised use or access. Access is limited to staff and providers who need it for authorised duties and are subject to confidentiality obligations.

If ViaFERT identifies a breach that significantly affects the rights of data subjects, it will carry out the communications and actions required under applicable regulations.

7. Minors and people acting through a representative

When processing involves a minor or a person who requires legal representation, ViaFERT will request the involvement and proof of authority of the person exercising parental responsibility, guardianship or representation, except where applicable regulations permit otherwise.

8. Cookies and similar technologies

The website may use cookies essential to its operation and, when you authorise them, measurement or communication tools. You can change your preferences through the website’s cookie privacy panel. Disabling non-essential technologies does not prevent you from viewing ViaFERT’s main information.

9. Changes to this notice

Changes will be published at this same URL and will indicate the date of the update. If a change requires new consent, ViaFERT will request it through an appropriate mechanism before applying the new purpose.