Privacy Notice

María Luisa Sánchez Romero, an individual operating under the commercial name Unique Dental Clinic Oral Rehabilitation and Implantology (“the Clinic”), is responsible for the processing of your personal data.

• Address: Plaza San Basilio, Local 4, El Arenal, Cabo San Lucas, Baja California Sur, Mexico.
• Phone and WhatsApp: +52 624 175 4589
• Email: [email protected]
• Designated Personal Data Representative: Dr. María Luisa Sánchez Romero, who handles requests for ARCO rights and any questions regarding this notice.

We collect your data when you provide it to us in person, by phone, WhatsApp, email, social media, or through our website. We only collect the data necessary for the purposes outlined in Section 3.

2.1 General Personal Data

• Identification: Full name, date of birth, age, sex, nationality, handwritten or electronic signature, and official identification (only the document type, to verify your identity).
• Contact: Physical address, landline and mobile phone numbers, WhatsApp number, and email address.
• Tax Details: RFC (Tax ID), full name or business name, tax regime, tax postal code, and CFDI usage, when requesting an invoice.
• Financial and Payment Details: The last four digits and brand of your card, payment history, and charges related to the Unique Dental Plan. The full card number is directly collected and processed by our payment processor Stripe; the Clinic never sees or stores it. As financial data, we request your express consent to process it.
• Third-Party Data Provided by You: Name, date of birth, and relationship of the beneficiaries you enroll in the Unique Dental Plan, as well as the name and phone number of an emergency contact. By providing this data, you declare that you have authorization from those individuals or that you exercise parental authority or legal guardianship over them.

2.2 Sensitive Personal Data

To provide you with dental care, we process data concerning your present and past health status, which the law classifies as sensitive personal data:

• Medical history, medical, dental, and family health history.
• Conditions, allergies, medications taken, pregnancy or lactation status, and oral health habits.
• Vital signs, clinical examination, odontogram, diagnoses, prognoses, treatment plans, and progress notes.
• X-rays, CT scans, intraoral and extraoral clinical photographs, intraoral scans, and digital or physical models.
• Informed consent forms, prescriptions, laboratory orders, and study results.

We process this data only with your express written consent, obtained through your handwritten or electronic signature, except in emergency situations where you are unable to grant it, as permitted by law. We do not collect data regarding racial or ethnic origin, religious beliefs, political opinions, or sexual orientation, unless clinically relevant and you choose to share it.

3.1 Necessary Purposes

These are essential to provide you with care and to comply with the law. Without them, we cannot deliver the service.

1. Assessing, diagnosing, providing dental treatment, and monitoring your progress, including emergency care.
2. Compiling, retaining, and safeguarding your medical record in compliance with NOM-004-SSA3-2012.
3. Obtaining your informed consent forms prior to each procedure.
4. Taking and analyzing X-rays, clinical photographs, and intraoral scans for diagnosis and treatment planning.
5. Sending work orders to dental laboratories for the fabrication of prostheses, crowns, surgical guides, and other appliances.
6. Referring you to or consulting with specialists when your treatment requires it.
7. Scheduling, confirming, reminding, and rescheduling your appointments by phone, WhatsApp, text message, or email.
8. Preparing quotes and collecting payments for services.
9. Managing your enrollment in the Unique Dental Plan: registering beneficiaries, applying authorized recurring charges, notifying you of renewals, processing cancellations, and calculating settlements.
10. Issuing tax receipts (CFDI) and fulfilling tax obligations.
11. Addressing your questions, complaints, clarifications, warranties, and ARCO rights requests.
12. Complying with legal obligations and responding to requests from health, tax, judicial, or consumer protection authorities.

3.2 Voluntary Purposes

These are not necessary to provide you with care. You may accept or reject them, and refusing will not affect your care or membership.

1. Sending you promotions, updates, and oral health campaigns.
2. Sending you birthday greetings.
3. Inviting you to respond to satisfaction surveys or leave a review.
4. Using photographs or videos of your treatment, such as before-and-after images, on our website, social media, or advertising material. This always requires your express written authorization in a separate form specifying which images will be used and whether your face will be visible. You may revoke this authorization at any time; we will remove the images from our media, though we cannot control copies already made by third parties.
5. Using your clinical case for teaching or academic purposes. If the data is used in an anonymized manner where you cannot be identified, it is no longer personal data; if you can be identified, we will request your express written authorization.

3.3 How to Decline Voluntary Purposes

You may decline from the beginning by checking the corresponding box in your medical history form or Unique Dental Plan contract. You can also do so at any time thereafter by:

• Replying “BAJA” (unsubscribe) to any promotional WhatsApp message.
• Using the unsubscribe link at the bottom of our emails.
• Writing to [email protected] with the subject line “Voluntary Purposes”.
• Requesting it in person at reception.

We do not sell, rent, or transfer your personal data to anyone for advertising purposes. We only share it in the cases described in this section.

4.1 Service Providers Processing Data on Behalf of the Clinic (Data Processors)

Estos proveedores tratan sus datos solo para prestarnos un servicio, bajo nuestras instrucciones y con obligación de confidencialidad. Algunos almacenan información en servidores fuera de México.

• Stripe: Processing card payments and recurring charges for the Unique Dental Plan.
• Dentalink: Scheduling software, electronic medical records, treatment plans, and billing/checkout.
• Google (Gmail and Cloud Services): Email communication and document storage.
• Meta (WhatsApp Business): Appointment messaging, reminders, and notifications.
• Dental Laboratories: Fabricating prostheses, crowns, guides, and appliances using your models, scans, and work orders.
• External Accountant: Issuing tax receipts and fulfilling tax obligations.

4.2 Transfers That Do Not Require Your Consent

The law (Article 36 of the LFPDPPP) permits sharing data without your consent in the following cases:

• External Physicians, Maxillofacial Surgeons, and Other Specialists: Diagnosis and treatment when your case requires consultation or referral (Art. 36, Section II).
• Hospitals and Emergency Services: Medical care during an emergency (Art. 36, Section II).
• Insurance Companies or Your Employer (only when requested by you): Expense reimbursement procedures (Art. 36, Sections IV and VII).
• Health, Tax, Judicial, and Consumer Protection Authorities: Complying with the law or a reasoned and legal order (Art. 36, Sections I and V).
• Attorneys and Competent Authorities: Defending a right in judicial or administrative proceedings (Art. 36, Section VI).

4.3 Transfers That Require Your Consent

Currently, the Clinic does not perform transfers that require your consent. Should we wish to do so in the future, we will request your authorization beforehand, which you may accept or reject.

We inform all third parties receiving your data about this privacy notice and the purposes you authorized, and they remain obligated to respect them.

You or your legal representative may, at any time:

• Access your personal data and know how we process it.
• Rectify your data if it is inaccurate, incomplete, or outdated.
• Cancel your data from our records.
• Oppose the processing of your data for legitimate reasons.

5.1 How to Submit Your Request

Send your request to [email protected] with the subject line “ARCO Request”, or deliver it in writing to reception. It must include:

Your name and a physical address or email to receive the response.

1. A copy of your official identification or, if acting through a representative, the identification of both parties and the document proving representation. For minors, the identification of the mother, father, or guardian and the minor’s birth certificate.
2. A clear description of the data regarding which you wish to exercise your rights (not required for the right of Access).
3. The specific right you wish to exercise or what you are requesting.
4. Any document that helps locate your data. If requesting a Rectification, state the correction and attach supporting documentation.

5.2 Timeframes and Costs

• We will respond within a maximum of 20 business days from receiving your complete request.
• If approved, it will take effect within 15 business days following our response.
• These timeframes may be extended once for an equal period when justified by circumstances; you will be notified accordingly.
• Exercising your rights is free of charge. We would only charge for copying costs or delivery; if you provide the electronic media, delivery is free.
• We will provide the information via email in PDF format or, if preferred, as simple hard copies at reception.

5.3 Legal Limitations

We may deny a request, in whole or in part, only under the circumstances established by law, such as when identity is not verified, when third-party rights are affected, or when a legal impediment exists. In all cases, we will explain the reason through the same medium used for your request.

In particular, we cannot cancel your medical record before the retention period required by NOM-004-SSA3-2012 expires, as the law permits retaining data processed by healthcare professionals bound by professional secrecy for diagnostic purposes and health service management. During that period, the data will be blocked: it will only be retained and not used for any other purpose.

5.4 Revocation of Consent

You may revoke your consent at any time through the same channels described in Section 5.1. Revocation does not have retroactive effects. If you revoke consent for a necessary purpose, we may no longer be able to provide you with care or your Unique Dental Plan may be terminated in accordance with its contract. Revocation is also not applicable when we must retain your data due to a legal obligation.

5.5 How to Limit the Use or Disclosure of Your Data

• Clinic Exclusion List: If you ask to stop receiving promotional communications through any of the channels in Section 3.3, we will add you to our internal exclusion list and stop sending advertising.
• Public Registry to Avoid Advertising (REPEP) by PROFECO: You can register your phone number to avoid receiving promotional calls. It is free of charge.

5.6 If You Are Dissatisfied with Our Response

You may submit a data protection request to the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) within 15 business days following the communication of our response. If we do not respond within the established timeframe, you may submit it as soon as that deadline expires.

Data belonging to patients under 18 years of age is provided and authorized by their mother, father, or guardian, who signs the medical history, informed consent forms, and this notice, and exercises ARCO rights on their behalf.

• Medical Record, X-rays, and Clinical Images: Minimum of 5 years counting from the last medical action, in compliance with NOM-004-SSA3-2012.
• Tax Receipts and Records: 5 years, in compliance with the Federal Tax Code (Código Fiscal de la Federación).
• Unique Dental Plan Contract and Payments: For the duration of the membership and until any legal actions derived from it expire under the statute of limitations.
• Payment Default Data: Deleted no later than 72 months following the default.
• Promotional Data: Retained until you unsubscribe.

At the end of each retention period, the data is blocked and subsequently securely deleted.

We protect your data through administrative, technical, and physical security measures:

• Access to electronic medical records is restricted via personal username and password according to role permissions.
• Physical archives are kept locked with access restricted to authorized personnel.
• Confidentiality agreements signed by all personnel and providers remain valid even after their relationship with the Clinic ends.
• Card payments are processed exclusively by Stripe; the Clinic does not store full card numbers.
• Personnel training on data protection and professional secrecy.

If a security breach occurs that significantly affects your rights, you will be notified immediately, along with the measures you can take to protect yourself.

rma significativa sus derechos, se lo informaremos de inmediato , junto con las medidas que puede tomar para protegerse.

Our website may use cookies and similar technologies for its operation, to measure traffic, and to display Clinic advertising on other platforms. These technologies may collect your IP address, browser type, pages visited, and browsing time. You can disable them through your browser settings; however, some site features might not function properly.

We may update this notice due to changes in the law, our services or our practices. Thecurrent version will always be available at www.uniquedental.com.mx/privacy-notice (English) and www.uniquedental.com.mx/aviso-de-privacidad (Spanish), and atreception, with its last-updated date. If a change is significant, we will also notify you byemail or WhatsApp. If we ever wish to use your data for a new purpose, we will ask foryour consent first.

If you consider that your right to personal data protection has been violated, you may contact the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the authority responsible for overseeing compliance with the LFPDPPP.

Date of last update:
30 de septiembre de 2026.