Patient privacy notice (template)

This template is a starting point for the clinic, which is the controller of its patients’ data. Replace the text between « » with your details, remove what does not apply, review it with your lawyer and publish it on your site, at your front desk and in the messages where you ask for data. ISSA is not responsible for the final text.

«Name of the clinic or professional», located at «address», is the controller of your personal data. Privacy contact: «email or phone».

Identification and contact, billing data and, because they are needed for your care, sensitive health data: history, conditions, treatments, clinical notes, clinical photos, consents and answers to questionnaires and follow-ups.

• Providing you with medical or aesthetic care and building your clinical record under NOM-004-SSA3-2012.
• Booking, confirming and reminding you of your appointments, and following up after your procedure by WhatsApp, Messenger, Instagram, email or phone.
• Obtaining your consents and invoicing.

Sending you promotions and satisfaction surveys. If you do not want them, write to «email» or reply STOP to any message; opting out does not affect your care.

We will only process your health data with your express written consent, which we will ask for with a handwritten or electronic signature before recording it.

You are served by a virtual assistant with artificial intelligence, supervised by our team, that answers general questions, books appointments and follows up. It gives no diagnoses or medical instructions; a professional handles those questions. You can ask to talk to a person at any time.

We use providers that process your data on our behalf, such as ISSA (records, calendar and messaging) and its sub-processors. We only transfer your data to third parties, such as laboratories or insurers, with your consent, or to health authorities when the law requires it.

We keep your clinical record for at least five years from your last visit, as NOM-004-SSA3-2012 requires, and the rest of your data while it is needed.

You can access, rectify, cancel or object to the processing of your data, withdraw your consent and ask for a clinical summary by writing to «email» with your name and identification. We will reply within the legal deadlines.

We will publish any change at «where the notice is published».