NOTICE OF PRIVACY
In compliance with the Federal Law on Protection of Personal Data Held by Private Parties (hereinafter, the "Law") and its Regulations, the Comprehensive Privacy Notice (hereinafter, the "Notice") is presented, which is addressed to ( to the) User(s) (hereinafter, the “Owner”) of the services provided by Aura, Technologies for Health (hereinafter, indistinctly “Aura” or “Responsible”) through a digital platform (the “ Platform"), accessible by mobile devices through computer applications, by desktop computers and through Internet browsers (hereinafter, the "Service"), as well as to people who access and provide information through the Internet domain https://www.aurasalud.mx in the United Mexican States (“Mexico”).
The information collected (hereinafter, the "Personal Data") may be collected at the time the "Holder" expressly consents to this "Notice".
Likewise, the "Holder" is informed that all "Personal Data" will be managed in accordance with the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility contained in the Federal Law on Protection of Personal Data in Possession of Individuals.
In this sense, the "Holder" will be at all times responsible for the "Personal Data" that it provides to the Platform.
I. DEFINITIONS
In addition to the terms defined throughout this "Notice", the terms that appear with the first letter in capital letters, within this Notice, will have the meanings assigned to them below:
"Notice".- Refers to this Comprehensive Privacy Notice, whether issued in a physical, electronic document or in any other format generated by the Responsible Party that is made available to the Owner, prior to the processing of their personal data in order to comply with with the information principle.
“Database”.- Is the ordered set of personal data referring to an identified or identifiable person.
“Cloud Computing”.- Model of external provision of computing services on demand, which implies the supply of infrastructure, platform or software, which are distributed in a flexible way, through virtualization procedures, in dynamically shared resources.
"Cookies".- Data file that is stored on the hard drive of the computer equipment or electronic communications device of a user when browsing a specific internet site, which allows the exchange of status information between said site and the browser. of the user. The state information may reveal means of session identification, authentication or user preferences, as well as any data stored by the browser regarding the website.
“Personal Data”.- Any information concerning an identified or identifiable natural person.
"Sensitive Personal Data".- Those "Personal Data" that affect the most intimate sphere of its "Holder", or whose improper use may give rise to discrimination or entail a serious risk for it. In particular, those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union affiliation, political opinions or sexual preference are considered sensitive.
“ARCO” Rights.- The rights that the “Owner” has against the “Responsible”, in relation to their “Personal Data”, which include the following: the right to access their “Personal Data” and the details of the treatment of the same, as well as to rectify them in case of being inaccurate or cancel them when it considers that they turn out to be excessive or unnecessary for the purposes that justified their obtaining or oppose the "Treatment" of the same for specific purposes. In this regard, section XI of this "Notice" will be elaborated upon.
"Dissociation".- It is the procedure by which the "Personal Data" cannot be associated with the "Holder" nor allow, due to its structure, content or degree of disaggregation, its identification.
"Responsible".- The natural or legal person who alone or jointly with others treats "Personal Data" on behalf of the "Responsible".
"Health Specialists".- Corresponds to the type of user who is a professional who uses the "Website", who is a doctor, dentist, psychologist, physiotherapist, nurse, nutritionist, therapist or other person not mentioned above, who performs activities in the field of health services and provides health, medical or paramedical services.
“Guidelines”.- Privacy Notice Guidelines published in the Official Gazette of the Federation on January 17, 2013.
“Patient”.- Corresponds to the type of user who accesses the “Aura” platform to schedule appointments with “Health Specialists” or ask questions.
“Regulations”.- The Regulations of the Federal Law on Protection of Personal Data Held by Private Parties.
“Responsible”.- Natural or legal person of a private nature that carries out the treatment of “Personal Data”, namely “Aura”.
“Third Party”.- The natural or legal person, national or foreign, other than the owner or the “Responsible” of the “Personal Data”.
“Holder”.- The natural person to whom the “Personal Data” corresponds.
“Treatment”.- The obtaining, use, disclosure or storage of “Personal Data”, by any means. The use includes any action of access, handling, exploitation, transfer or disposition of the "Personal Data".
“Transfer”.- Any communication of “Personal Data” made to a person other than the “Responsible” or “In Charge” of the “Processing”.
“Transfer”.- It is all the communication of “Personal Data” made by a person other than the “Responsible” or “In charge” of the “Treatment”.
“Web Beacons”.- Visible or hidden image inserted into a website or email, which is used to monitor user behavior in these media. Through these you can obtain information such as the source IP address, browser used, operating system, time the page was accessed, and in the case of email, the association of "Personal Data".
II. RESPONSIBLE FOR THE INFORMATION
For purposes of the "Notice", as well as for all legal purposes that may apply, the "Responsible" will be Aura, Tecnologías para la Salud SAS with address at Primera Cerrada Bahía No. 19 int. 2, Col. Ampliación Las Águilas, Alcaldía Álvaro Obregón, CP 01759, Mexico City, who will carry out the “Processing” of the “Personal Data”.
The "Responsible" may be assisted by one or more "Managers", who will act in the name and on behalf of the "Responsible", to provide a more efficient "Treatment" to the "Personal Data". The "Managers" will be informed of the proper treatment that they must provide to the "Personal Data".
The "Responsible" may also carry out the "Processing" of the "Personal Data" using the "Cloud Computing" system, for which the provider of such services will be obliged to sign the "Notice" and comply with the mechanisms of protection and security measures intended to protect the information contained in the "Personal Data", in accordance with the "Law", the "Regulations" and other applicable legal provisions.
III. INFORMATION THAT WILL BE COLLECTED WHEN SUBSCRIBING THE NOTICE
This "Notice" will be made available to the "Holder" at the time the "User" registers on the "Platform" of "Aura". The "Holder" will provide this information, which is considered essential to be able to provide the service, at the time of creating your account and expressly signing this "Notice", as well as at the time of modifying the information contained in your account. The "Personal Data" collected for the three categories of Users are:
In the case of “Patients”:
Name with surnames; and,
Email address.
In the case of "Health Specialists"
Name with surnames;
Specialty or specialties;
specialty fields; Y
Email address.
In case of not having the aforementioned information, the "Responsible" will not be able to open an account for the "Holder" and, therefore, will not be able to provide the Service consisting of the use of the Platform.
In addition to the essential data for the creation of an account that allows the "Responsible" to provide the Service, when creating or modifying said account the "Holder" may provide the following "Personal Data", which will be optional:
In the case of “Patients”:
profile photo
ailments;
Medical history;
Age;
Weight;
Height; and,
Date of birth.
By virtue of the fact that all the numerals are considered as "Sensitive Personal Data" they will receive the treatment indicated in section IV. “Sensitive Personal Data”.
In the case of "Health Specialists"
Profile photograph;
Profile background photography;
Team and venue photos;
Videos of the installations;
Treatment;
Graduate;
Professor);
Doctor); either
Teacher;
professional license;
Academic training;
Certificates;
Experience and achievements;
Publications;
Awards and distinctions;
Contact through social networks;
Facebook;
LinkedIn;
Twitter;
Instagram; either
Youtube.
Address of your office;
Treated Diseases;
Languages; Y
Schedules.
By virtue of the fact that numerals 1, 12 and 15 are considered as "Sensitive Personal Data" they will receive the treatment indicated in section IV. “Sensitive Personal Data”.
We inform you that on our website and mobile application we use "Cookies", "Web Beacons" and other technologies through which it is possible to monitor your behavior as a User" of the Internet, provide you with a better service and User experience when browsing in our page/platform, as well as offer you new products and services based on your preferences.
The “Personal Data” that we obtain from these tracking technologies is as follows:
(i) navigation schedule; (ii) browsing time on our website; (iii) sections consulted; and, (iv) Internet pages accessed prior to ours.
SENSITIVE PERSONAL DATA
"Sensitive Personal Data" is considered to be those "Personal Data" that affect the
most intimate sphere of its "Holder", or whose improper use may give rise to discrimination or entail a serious risk for it. In particular, they are considered sensitive
those that may reveal aspects such as racial or ethnic origin, present and future health status, genetic information, religious, philosophical and moral beliefs, union affiliation, political opinions, sexual preference.
By virtue of the foregoing, the "Holder" may, but will not have the obligation to indicate the following sensitive data:
In the case of “Patients”:
1. Profile photo
2. Ailments;
3. Medical history;
4. Age;
5. Weight;
6. Height; and,
7. Date of birth.
In the case of "Health Specialists"
1. Profile photograph;
2. Languages; Y
3. Contact through social networks.
Notwithstanding the foregoing, said information is strictly optional and, in the event that the "Holder" indicates any or all of them, it must expressly accept by means of any of the following authentication methods:
1. Autograph signature;
2. Electronic signature; either,
3. Handwritten signature through electronic platforms that comply with the Uniform Electronic Transactions Act (UETA) or the eIDAs Regulation "Electronic Identification Authentication and trust Services" in accordance with article 9 of the Federal Law of Protection of Personal Data Held by Private Parties.
INFORMATION THAT WILL BE COLLECTED WHEN USING THE DATING SERVICE
Once the "Owner" has created his User account and has expressly accepted this "Notice", the Controller may collect "Personal Data" similar or different to those provided during the creation or modification of the account. The following "Personal Data" may be collected by different means when the "Owner" uses the Service:
In the case of “Patients”:
1. Ailments;
2. Medical history;
3. Age;
4. Weight; and,
5. Height.
By virtue of the fact that the previous numerals are considered as "Sensitive Personal Data" they will receive the treatment indicated in section IV. Sensitive Data.
In the case of “Health Specialists”:
1. Professional license issued by the General Directorate of Professions of the Ministry of Public Education; and,
2. Documents that certify having completed the subjects corresponding to their work, experience and specialty.
PRIMARY AND ESSENTIAL PURPOSES OF TREATMENT
The "Personal Data" collected by the "Responsible", whether personally, directly or indirectly, will be used for the following primary and essential purposes:
1. Put the “Users” in contact through the “Platform”, specifically the “Patients” with the “Health Specialists”.
2. Inform the "Holder" regarding any inconvenience during the Service;
3. Maintain the necessary information to be able to maintain communication with the Users and obtain feedback regarding any aspect of the service provided by the "Responsible";
4. Identification purposes of the "Holder" for the correct provision of the Service; Y
5. For contact with the "Holder" in case there has been any security breach that occurred in any phase of the Treatment.
The fulfillment of the primary purposes of the Treatment is necessary for the existence, maintenance and fulfillment of the legal relationship between the Responsible and the Owner.
SECONDARY PURPOSES OF TREATMENT
The "Personal Data" collected by the "Responsible", whether personally, directly or indirectly, will be used for the following secondary purposes:
1. Statistical and information purposes for the “Responsible”.
2. Marketing, promotional and commercial prospecting purposes.
3. For sporadic and/or eventual contact with the User, in order to provide information related to the products and/or services provided by the User.
"Responsible", as well as other products for advertising marketing purposes or commercial prospecting.
In case you do not want your Personal Data to be processed for any or all of the secondary purposes, from this moment you can notify us of the above through the means provided in the Contact Section.
TRANSFERS
In the case of “Patients”:
The "Responsible" may transfer the "Personal Data" of the "Patient" object of this "Notice" with the express consent of the "Owner", to a "Health Specialist" in order that the aforementioned service can be provided in a satisfactory manner. The "Personal Data" will only be shared with the "Health Specialist" while the Service is running, which will consist of:
1. Email address;
2. Ailments;
3. Medical history;
4. Age;
5. Weight; and,
6. Height.
In the case of “Health Specialists”:
The “Responsible” may transfer the “Personal Data” of the “Health Specialist” object of this “Notice” with the prior express consent of the “Holder”, to a “Patient” so that the “Patient” can contact the “Specialist in health". The "Personal Data" will only be shared with the "Patient" while the Service is running, which will consist of:
1. Name and surnames;
2. Specialty; and,
3. Email address.
The "Transfers" described here are located in the case of exception provided for in article 37 section VII of the Law, in view of the fact that they are necessary for the provision of the Service performed by the "Responsible" in favor of the "Holder", consisting of contact the "Users" on the "Platform".
To fulfill the purposes described above or others legally required, "Aura" may transfer your "Personal Data" to the companies that are part of the "Aura" corporate group, that is, to the parent companies, controllers, subsidiaries and affiliates of the "Responsible".
In the case of being the "Health Specialists" who collect the "Personal Data" directly by the "Owner", they will do so as "Responsible" substituting only in this case, "Aura" as responsible for the "Personal Data ”, so both the “Health Specialists” must adhere to the provisions of the Federal Law for the Protection of Personal Data Held by Private Parties and inform the “Holder” that they make use of the service of a “Third Party”; in this case "Aura", for scheduling appointments and that therefore, could receive communication from "Aura", as a "Third Party", in accordance with the "Transfer" of "Personal Data".
Based on article 37 of the Law, we inform you that your consent will not be required to make Transfers to controlling companies, subsidiaries or affiliates, or to a parent company or to any company of the same group of "Aura", since said companies are governed by the same standards in terms of privacy.
The purpose of Personal Data Transfers is to improve aspects related to the use of the Platform. In case you do not want your Personal Data to be transferred, from this moment you can communicate the above through the means provided in the Contact Section, with the purpose of revoking your consent regarding any Transfer.
Likewise, the "Personal Data" may be shared with affiliated or related third-party entities for commercial purposes, non-affiliated or non-related third-party entities for commercial purposes, or with a duly contracted "Third Party", or with any company with which the "Responsible "has any commercial relationship, as long as the aforementioned "Third Parties" have the proper privacy controls, know and subscribe to this "Notice" and only use the "Personal Data" for the fulfillment of the purposes referred to in this "Notice" For purposes of consenting to the provisions of this paragraph, we make available to the "Holder" the following clause of acceptance or non-acceptance of Transfers to "Third Parties":
LIMITATION ON THE USE OR DISCLOSURE OF PERSONAL DATA
The "Owner" can indicate to the "Responsible" that he wishes to limit or stop receiving advertising messages, whether by landline or cell phone, as well as by email.
Likewise, the “Holder” may limit the purpose of the “Treatment”. To do this, the "Holder" must send a request to disable the secondary purposes, as well as the purposes that are not essential, the messages and/or advertising emails to any of the means of contact indicated in the Contact section.
For this purpose, the "Holder" must send a request with, at least, the following requirements:
The full name of the “Holder”;
Address or other means to communicate the response to your request;
The official documents that prove the identity of the "Holder"; and
A clear and precise description of whether you want to limit or stop receiving advertising messages, whether by landline or cell phone, as well as by email.
On the other hand, you can also limit or stop receiving advertising messages by registering the "Holder" in the Public Registry of Consumers provided for in the Federal Consumer Protection Law, today the Public Registry to Avoid Advertising and in the Registry Public of Users (REUS) in accordance with the Law for the Protection and Defense of Financial Services Users, in terms of article 111 of the “Regulations”.
Once the request is received, the "Responsible" will have a period of 20 (twenty) days to respond to the "Owner" of the "Personal Data", which will be sent through the means of contact indicated by the "Owner" or , failing that, to the email that is registered.
Regarding the Public Registry to Avoid Publicity, 1 (one) day after the registration is made, it will take effect 30 (thirty) calendar days following the date of its registration and, as regards the Public Registry of Users It will begin to take effect 45 (forty-five) days after registration and is valid for 2 (two) years, after which time it will be automatically unsubscribed.
REVOCATION OF CONSENT
The "Holder" has the right to revoke the "Consent" that has been granted for the performance of the "Treatment", either in relation to one or all of their "Personal Data". For this purpose, the "Holder" must send a request with, at least, the following requirements:
1. The full name of the “Holder”;
2. Address or other means to communicate the response to your request;
3. The official documents that prove the identity of the “Holder”.
4. A clear and precise description of the "Personal Data" with respect to which the rights conferred by the "Law" will be exercised; Y
5. Any element or document that facilitates the location of the "Personal Data" in question.
Once the request is received, the "Responsible" will have a period of 20 (twenty) days to respond to the "Owner" of the "Personal Data", which will be sent through the means of contact indicated by the "Owner" or , failing that, to the email that is registered.
The revocation of consent related to "Personal Data" that is essential for the "Responsible" to deliver a product and/or provide a service to the "Holder" will imply that the "Responsible" will not be obliged to comply with it, because it is impeded for it.
EXERCISE OF ARCO RIGHTS
The “ARCO” Rights are an acronym that groups four rights that the “Owner” can exercise, in relation to their “Personal Data”:
1. Access the "Personal Data" that are subject to "Treatment", that is, request the "Responsible" to allow the "Owner" to know what data is in his possession.
2. Rectify any of the "Personal Data", subject to "Treatment" and in possession of the "Responsible", that were inaccurate, incomplete, erroneous and/or imprecise.
3. Cancel any of the "Personal Data", in possession of the "Responsible", that legitimately considers that they are not being used to fulfill any of the purposes of the "Treatment" and/or that they are being used in contravention of the "Law ”, the “Regulations” or any other applicable legal provision.
4. Oppose the “Treatment” carried out by the “Responsible”, with just cause, provided that it may cause any damage and/or harm, or that it is contrary to the “Law”, the “Regulations” or any other legal provision applicable.
For this purpose, the "Holder" must send a request with, at least, the following requirements:
1. The full name of the “Holder”;
2. Address or other means to communicate the response to your request;
3. The official documents that prove the identity of the “Holder”;
4. A clear and precise description of the "Personal Data" with respect to which the rights conferred by the "Law" will be exercised;
5. Any element or document that facilitates the location of the "Personal Data" in question; Y
6. The modality by which you wish to obtain a response, that is, in electronic documents, in simple copies or by any means.
In the event that the "Holder" makes a request for rectification, the "Holder" must also indicate the modifications to be made and provide the documentation that supports their request.
In the event that the request is valid, the response will be communicated within 15 (fifteen) days following the date on which the request was received. This period may be extended with prior notice only once for an equal period, as long as the extension is justified.
The "Responsible" may deny access to personal data or make the rectification or cancellation or grant opposition to the "Treatment" of the same, in the following cases:
1. When the applicant is not the "Holder" of the "Personal Data", or the legal representative is not duly accredited for it;
2. When the "Personal Data" of the applicant is not found in its database;
3. When the rights of a third party are injured;
4. When there is a legal impediment, or the resolution of a competent authority, that restricts access to personal data, or does not allow their rectification, cancellation or opposition; Y
5. When the rectification, cancellation or opposition has been previously made.
The refusal may be partial, in which case the "Responsible" will make the access, rectification, cancellation or opposition required by the "Owner".
Notwithstanding the foregoing, you will also have the right to request "Aura" to send you an ARCO Rights Form that is easy to fill out, in order to exercise any of the prerogatives set forth herein.
NOTIFICATION OF CHANGES TO THE NOTICE
The "Responsible" may make changes to this "Notice", as long as the applicable legal provisions are respected. When modifications are made to the "Notice", the "Responsible" will make available to the "Owner" the information on the modifications, as well as the new Privacy Notice through the following means and procedures:
1. Through an email to the account that the User has registered;
2. By means of physical dissemination at the address of the Responsible; I
3. Publishing it on the “Aura” web portal, or electronically.
The "Responsible" reserves the right to change and update this "Notice", the "Owner" will be responsible for keeping their email account updated and ensuring that notifications are received in a mailbox that is constantly checked. In case of not receiving a response from the "Holder" within a period of seventy-two (72) hours, it will be understood that he accepts in accordance with the changes that this "Notice" may undergo.
We recommend that you periodically check the date of last modification of this document.
CONTACT
If you wish to obtain more information, answer a question, exercise your “ARCO” Rights and/or clarify any question about the exercise of any right over your Personal Data, you can contact or go directly to the indicated address of the “Responsible”. Below, we provide you with the contact information:
1. Address: First Closed Bay No. 19 int. 2, Col. Las Águilas Extension, Álvaro Obregón Mayor's Office, CP 01759, Mexico City.
2. Email: contacto@aurasalud.mx
COOKIES POLICY
“Aura” uses various technologies to improve the efficiency of its website, including your browsing experience. These technologies include the use of third-party cookies. Cookies are small amounts of information that are stored in the browser used by each user so that the server remembers certain information that can later be used.
This information allows us to identify you and save your personal preferences to provide you with a better browsing experience. We remind you that you can disable or adjust the use of cookies by following the procedures of the Internet browser you use.
