Health data addendum

This addendum supplements the Data processing addendum and the Terms of service between Mariano Arael Romero Texis (ISSA by Alrit.dev) and the clinic. The owner accepts it when turning on ISSA Salud; ISSA records the version, the date and who accepted it. In case of difference, this addendum prevails for health data.

• Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (2025): health data is sensitive and requires the data subject’s express written consent.
• NOM-004-SSA3-2012, on the clinical record, NOM-024-SSA3-2012, on electronic health record information systems, and the General Health Law.
• Where they apply: Article 11 of Brazil’s LGPD and Article 9 GDPR on health data.
• ISSA is not offered as a service under the United States HIPAA law and does not sign business associate agreements (BAA).

The clinic is the controller of its patients’ data and of the clinical record; its health professionals answer for its content and for their clinical decisions. ISSA is a processor and only stores, protects and shows that data to the clinic’s authorized members.

Patient identification and contact, clinical history, notes and addenda, consents and signatures, clinical photos, prescriptions, pre-visit questionnaires, appointments and follow-up answers, as the clinic records them.

The clinic must inform its patients with its own privacy notice and obtain their express written consent to process health data before recording it. ISSA offers notice and consent templates and electronic signature with a verification code, but the clinic must adapt them and is responsible for their validity.

The clinic is responsible for the record’s integrity, its minimum content, its professionals’ signatures and keeping it for at least five years from the last medical act. ISSA helps with notes that, once signed, can only be supplemented with addenda, version history, PDF documents and a full export.

Before deleting the organization or ending the service, the clinic must export its records: deletion cannot be undone and ISSA keeps no copy beyond the backup rotation.

ISSA is not certified by Mexico’s Ministry of Health as an electronic health record information system. It implements controls aligned with that standard, such as authentication, roles, an access log, encryption and integrity of signed notes, but does not guarantee the interoperability standards certification requires. The clinic must assess whether its case requires a certified system.

• Sensitive fields and files encrypted with AES-256-GCM and the organization’s own key.
• Only clinical roles see records; every view, print and export goes into a log that admins can see.
• The links patients receive to sign or fill in questionnaires carry a secret token that is swapped for a 2-hour cookie, so it does not stay in the address.
• Backups of the clinical volume are encrypted a second time.

The clinical record is never sent to the AI model. The follow-up assistant only receives the appointment details and the procedure name, never diagnoses or gives clinical instructions and passes any health question to the professional.

ISSA staff do not access clinical content except when the clinic asks for support or for a security need, under a duty of confidentiality and with the access logged.

ISSA will notify the clinic within 48 hours at the latest after confirming a breach affecting health data, and will help it inform patients and authorities.

The clinic handles its patients’ requests, including the clinical summary NOM-004 provides for. ISSA helps with exporting the record and with corrections through addenda.

Turning off ISSA Salud hides the records without erasing them. When the organization is deleted, clinical data is erased with the rest of its data, under the Data processing addendum.