Privacy Policy

1.1 Personal Information

We collect personal information that you voluntarily provide when registering or using our platform, including:

• Full name, date of birth, and contact information (email, phone, address)
• Government-issued identification (INE, CURP, passport) for identity verification
• Health insurance policy details and beneficiary information
• Medical history, current conditions, and physician referrals
• Payment and billing information for service transactions

1.2 Health & Medical Information

As a healthcare services platform operating in Mexico, we collect and process health-related information, including:

• Laboratory test orders, results, and diagnostic reports
• Cancer screening and risk assessment data
• Doctor consultation notes and treatment recommendations
• Medical imaging requests and specimen tracking information
• Subscription plan details linked to your healthcare coverage

1.3 Technical & Usage Information

We automatically collect certain information when you access our platform:

• IP address, browser type, device model, and operating system
• Session data, page views, and navigation patterns
• Cookies and similar tracking technologies
• Log files, error reports, and analytics data

1.4 Agent & Partner Information

For registered agents, doctors, laboratory partners, managers, and representatives, we additionally collect:

• Professional credentials, licenses, and specialization details
• Bank account and tax identification information (RFC, CURP)
• Commission and salary payment records
• Branch and clinic location data

2.1 Delivering Healthcare Services

We use your information to provide and coordinate our core services:

• Processing laboratory test bookings and delivering results to patients and doctors
• Facilitating doctor consultations, referrals, and follow-up care
• Managing appointments, scheduling, and service reminders
• Coordinating cancer screening programs and preventive health assessments
• Processing insurance claims and coordinating with insurance partners

2.2 Platform Operations & Communications

We use your contact information to:

• Send test results, medical notifications, and appointment reminders
• Provide customer and technical support
• Share educational content on cancer prevention and health screenings
• Notify you of updates to our services, pricing, or policies
• Communicate commission statements, salary slips, and billing records to partners

2.3 Financial & Legal Compliance

We process your information for:

• Billing, payment processing, and invoice generation (CFDI/SAT compliance)
• Commission calculations for agents, doctors, and laboratory partners
• Fraud prevention, security monitoring, and access control
• Compliance with Mexican health regulations (COFEPRIS, NOM standards)
• Statistical and quality analysis using de-identified data only

3.1 Use of AI-Powered Features

AyudaMedico uses artificial intelligence (AI) technology to enhance the quality and efficiency of certain healthcare services on our platform. AI-assisted features currently include:

• AI-generated clinical treatment summaries and care recommendations based on patient medical data
• Automated pre-filling and extraction of insurance claim forms using uploaded documents
• AI-assisted test page content generation for laboratory test descriptions
• Intelligent chat assistance for platform navigation and general health information

3.2 Third-Party AI Provider — OpenAI

To power these AI features, AyudaMedico transmits certain data to OpenAI, L.L.C. ("OpenAI"), a third-party artificial intelligence service provider based in the United States. When you use AI-assisted features on our platform:

• Relevant patient data — including medical history, test results, diagnoses, prescriptions, and clinical notes — may be sent to OpenAI's API for processing
• Insurance documents and form data may be transmitted to OpenAI for automated extraction and form-filling
• OpenAI processes this data solely to generate AI responses and does not use it to train its general models under our API agreement
• Data transmitted to OpenAI is subject to OpenAI's API Data Usage Policy and Privacy Policy (available at openai.com)
• AyudaMedico has entered into a Data Processing Agreement with OpenAI to ensure appropriate data protection safeguards

3.3 Patient Data & AI Processing

When patient data is processed by AI systems, the following applies:

• AI-generated clinical suggestions are for informational and decision-support purposes only and do not constitute a medical diagnosis or treatment plan
• All AI outputs are reviewed by qualified healthcare professionals before being acted upon
• Patients have the right to request that their data not be used for AI-assisted processing by contacting our Privacy Officer
• AI processing is performed only where necessary to deliver the requested service feature
• De-identified or aggregated data may be used to evaluate and improve AI feature performance within our platform

3.4 AI Audit Logs & Transparency

To maintain accountability and transparency in AI usage, AyudaMedico maintains AI audit logs that record:

• The type of AI feature used and the date/time of each AI interaction
• The user role and relevant record identifiers associated with each AI request
• AI model responses and any actions taken based on AI output
• These logs are retained for a minimum of 12 months and are accessible to platform administrators for compliance review

3.5 Data Retention for AI-Processed Data

Data transmitted to and processed by AI systems is subject to the following retention practices:

• AI-generated outputs stored within our platform (e.g., treatment summaries, form extractions) are retained as part of the associated patient or clinical record, subject to the retention periods in Section 7
• Data sent to OpenAI's API is processed in real time and is not retained by OpenAI beyond the duration required to complete the API request, per our API agreement
• AI audit log records are retained for a minimum of 12 months from the date of the interaction
• Upon account deletion or data cancellation request, AI-generated content linked to your records will be deleted in accordance with our standard data disposal procedures

3.6 Your Consent to AI Processing

By using AI-assisted features on our platform, you acknowledge and consent to the following:

• Your relevant personal and health data may be transmitted to OpenAI for the purpose of generating AI-assisted outputs
• AI-generated content is a decision-support tool and does not replace professional medical judgment
• You may opt out of AI-assisted features at any time by contacting our Privacy Officer; opting out may limit the availability of certain platform features
• You have been informed of the involvement of OpenAI as a third-party AI data processor

4.1 Security Safeguards

We implement comprehensive technical and organizational safeguards to protect your data:

• Administrative controls: Security policies, role-based access, and staff training
• Physical safeguards: Secure server facilities and workstation access controls
• Technical safeguards: Encryption in transit and at rest, multi-factor authentication
• Regular security audits, vulnerability assessments, and penetration testing

4.2 Data Protection Measures

We employ industry-standard security practices including:

• End-to-end encryption for all data transmission and storage
• Audit logs and access monitoring for all sensitive data operations
• Incident response plans and breach notification procedures
• Secure data backup and disaster recovery systems
• Business Associate Agreements with all third-party service providers

5.1 Healthcare Operations

We may share your information with authorized parties involved in your care:

• Physicians and specialists coordinating your treatment
• Partner laboratories and diagnostic facilities processing your tests
• Insurance companies for claims processing and coverage verification
• Pharmacies or external contractors involved in your care pathway

5.2 Platform Partners

We share relevant operational data with our registered platform partners:

• Agents receive commission and patient assignment data relevant to their accounts
• Laboratory partners receive test orders and billing information
• Managers receive team performance and operational data within their scope

5.3 Legal Requirements

We may disclose information when required by applicable Mexican or international law:

• Court orders, judicial mandates, or legal processes
• Public health authorities (IMSS, ISSSTE, SSA) for disease surveillance
• Tax authorities (SAT) for fiscal compliance
• Regulatory agencies (COFEPRIS) for compliance audits

5.4 With Your Consent

We will only share your information for purposes not covered above with your explicit written authorization.

6.1 Rights Under Mexican Privacy Law (LFPDPPP)

Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), you have the right to:

• Access: Obtain a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete personal data
• Cancellation: Request deletion of your personal data when no longer necessary
• Opposition: Object to the processing of your data for specific purposes
• Portability: Receive your data in a structured, machine-readable format
• File a complaint with the INAI (Instituto Nacional de Transparencia)

6.2 Healthcare Record Rights

As a patient or healthcare service user, you additionally have the right to:

• Access and obtain copies of your laboratory results and medical records
• Request amendments to inaccurate health information
• Restrict certain uses or disclosures of your health data
• Receive notifications of any unauthorized access to your health records

6.3 Exercising Your Rights

To exercise any of the above rights, please submit a written request to our Privacy Officer via the contact details in the "Contact Us About Privacy" section below. We will respond within 20 business days as required by law.

7.1 Retention Periods

We retain your information in accordance with legal and operational requirements:

• Medical and laboratory records: Minimum 5 years from last service date (longer for minors, per NOM-004-SSA3-2012)
• Billing and fiscal records: 5 years as required by SAT regulations
• Agent and partner commission records: Duration of the business relationship plus 3 years
• Marketing communications: Until you unsubscribe or withdraw consent

7.2 Secure Disposal

When information is no longer needed, we securely dispose of it through:

• Encrypted data deletion for electronic records
• Secure shredding for physical documents
• Verification of complete removal from all active and backup systems

8.1 Types of Cookies We Use

We use the following types of cookies on our platform:

• Essential cookies: Required for core platform functionality (login sessions, security)
• Analytics cookies: Help us understand usage patterns and improve our services
• Functional cookies: Remember your preferences and settings
• Advertising cookies: Deliver relevant health-related advertisements via Google AdSense

8.2 Cookie Management

You can control cookies through:

• Your browser settings to block or delete cookies
• Our cookie preference center accessible from the website footer
• Third-party opt-out tools for advertising cookies (e.g., Google Ad Settings)

Our platform is not directed to children under 13 years of age. We do not knowingly collect personal information from children without verified parental or guardian consent. For minors between 13 and 17 years old, we require explicit parental or guardian authorization before providing healthcare services. If you believe we have collected information from a minor without appropriate consent, please contact us immediately so we can take corrective action.

AyudaMedico primarily operates within Mexico and processes data in accordance with Mexican privacy law (LFPDPPP). If any data is transferred outside Mexico — for example, to cloud infrastructure providers — we ensure appropriate contractual safeguards are in place, including data transfer agreements consistent with INAI guidelines and, where applicable, Standard Contractual Clauses for users in the European Economic Area.

We may update this Privacy Policy periodically to reflect changes in our practices, services, or legal requirements. We will notify you of material changes through:

• Email notification to your registered address
• Prominent notice on our website and platform dashboard
• Updated "Last Updated" date at the top of this policy

Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.