Last Updated: September 2, 2026

This Privacy Policy establishes the terms under which Dr. José Antonio Castañeda Cruz and/or his team, hereinafter referred to as the “Data Controller,” collects, uses, stores, and protects personal information provided by users who visit doctorjosecastaneda.com and use its contact forms or appointment request forms.

The protection of your personal information is a priority. The processing of personal data is carried out in accordance with the Federal Law on Protection of Personal Data Held by Private Parties, its applicable regulations, and other applicable provisions in Mexico.

1. Data Controller

The entity responsible for the processing of personal data collected through this website is:

Dr. José Antonio Castañeda Cruz

The Data Controller's address shall be the address indicated in the contact information and/or at the facilities where the corresponding medical services are provided.

For any matter related to the processing of your personal information, you may use the telephone or messaging contact methods available on this website.

2. Personal Information We May Collect

Through this website, we may request the following personal information:

• Full name.
• Telephone number.
• Email address.
• Information related to an appointment or consultation request.
• Any information the user voluntarily provides through comments or messages.

If, during the course of medical care, the user provides information concerning their health condition, medical history, illnesses, treatments, procedures, medications, or other medical information, such information may be considered sensitive personal data under applicable Mexican law.

The Data Controller will seek to limit the collection of personal information to data that is necessary, appropriate, and relevant for the purposes described in this Privacy Policy.

3. Purposes for Processing Personal Information

Personal information provided through this website may be used for the following purposes:

Primary Purposes

These purposes are necessary to respond to your request:

• Receive and manage requests for information.
• Contact users to follow up on their requests.
• Schedule and confirm appointments or consultations.
• Provide information regarding requested medical services.
• Carry out administrative processes related to patient care.
• Follow up on patient care and communications.
• Respond to questions, comments, or requests submitted through the website.
• Comply with applicable legal and administrative obligations.

Secondary Purposes

Where applicable and in accordance with applicable law, personal information may also be used to:

• Send information regarding services, updates, or content related to the medical practice.
• Conduct promotional, communication, or informational activities.
• Improve the user experience on the website.
• Generate internal statistics and analytics regarding website performance and usage.

Users may refuse the processing of their personal information for secondary purposes by using the contact methods available on the website.

Refusing the use of personal information for secondary purposes will not affect the provision of the services or attention requested.

4. Processing of Sensitive Personal Data

Due to the nature of the medical services provided, sensitive personal information concerning a patient's health may be processed during the course of medical care.

Such information will only be processed to the extent necessary to provide medical care, conduct evaluations, follow up with patients, maintain the corresponding medical records, and comply with applicable legal obligations.

The Data Controller will implement reasonable administrative, technical, and physical security measures to protect sensitive personal data against damage, loss, alteration, destruction, unauthorized access, or unauthorized processing.

5. Information Submitted Through the Website

Information voluntarily submitted by users through forms available on the website will be used solely for the purposes described in this Privacy Policy.

Users are advised not to submit medical records, official identification documents, financial information, or other sensitive information through publicly accessible forms unless such information is specifically requested through an appropriate and secure channel.

6. Transfer of Personal Information

The Data Controller does not sell, rent, or commercially distribute users' personal information.

Personal information may be shared with third parties only when necessary to fulfill the purposes described in this Privacy Policy, provide services related to medical care, operate the website, or comply with a legal obligation.

Where applicable law requires the user's consent for a transfer of personal information, such consent will be obtained in accordance with the applicable legal provisions.

Personal information may also be disclosed to competent authorities when required pursuant to a valid legal request.

7. Security Measures

The Data Controller implements reasonable administrative, technical, and physical measures designed to protect personal information under its responsibility.

These measures are intended to reduce the risks of loss, alteration, destruction, unauthorized access, use, or processing of personal information.

Although reasonable security measures are implemented, no method of transmission or storage of information over the Internet can guarantee absolute security.

8. ARCO Rights

Under applicable Mexican law, data subjects have the following rights:

Access: The right to know what personal information we hold and how it is being used.

Rectification: The right to request the correction of personal information that is inaccurate, incomplete, or outdated.

Cancellation: The right to request the deletion of personal information when the data subject considers that it is not being processed in accordance with applicable law.

Opposition: The right to object to the processing of personal information for certain purposes.

To exercise any of these rights, the data subject may submit a request through the telephone or messaging contact methods available on the website.

The request should include, at a minimum:

• The data subject's full name.
• A means through which the response may be provided.
• Documentation establishing the identity of the data subject or, where applicable, proof of legal representation.
• A clear and precise description of the personal information for which the ARCO right is being exercised.
• Any other information or documentation that may facilitate the identification and location of the relevant personal information.

The Data Controller will process the request in accordance with the deadlines and procedures established by applicable law.

9. Withdrawal of Consent

Where applicable, the data subject may withdraw consent previously granted for the processing of their personal information.

Withdrawal of consent will not have retroactive effect and will not apply where the processing of personal information is necessary to comply with legal obligations, provide medical services, exercise or defend legal rights, or under any other circumstance permitted by applicable law.

Requests may be submitted through the contact methods available on the website.

10. Limitation on the Use or Disclosure of Personal Information

Data subjects may request limitations on the use or disclosure of their personal information, particularly with respect to promotional communications or secondary purposes.

The Data Controller will process such requests in accordance with applicable law.

11. Cookies and Tracking Technologies

This website may use cookies, similar technologies, and third-party tools intended to facilitate website functionality, improve the user experience, analyze website usage, and, where applicable, measure advertising or promotional activities.

The use of these technologies is described in greater detail in the website's Cookie Policy.

12. Third-Party Websites

This website may contain links to third-party websites, platforms, or services.

The Data Controller is not responsible for the privacy practices, content, or data processing activities of such third parties. Users are encouraged to review the applicable privacy policies of those third parties before providing personal information.

13. Retention of Personal Information

Personal information will be retained only for as long as necessary to fulfill the purposes described in this Privacy Policy and to comply with applicable legal, administrative, medical, or regulatory obligations.

Once personal information is no longer necessary for such purposes, it will be deleted, blocked, or otherwise handled in accordance with applicable law and the Data Controller's internal procedures.

14. Changes to this Privacy Policy

The Data Controller may modify or update this Privacy Policy when necessary due to changes in data processing practices, modifications to the services provided, changes in applicable law, or other circumstances that warrant an update.

Any modifications will be published on this page, together with the corresponding date of the latest update.

Users are encouraged to review this Privacy Policy periodically to remain informed of any changes.

15. Consent

By voluntarily providing personal information through the forms available on this website, the user acknowledges that they have read and understood this Privacy Policy and, where legally required, consents to the processing of their personal information for the purposes described herein.

When sensitive personal information or processing activities requiring specific consent are involved, such consent will be obtained through the appropriate mechanisms.

16. Competent Authority

If a data subject believes that their rights regarding the protection of personal information have been violated, they may contact the competent data protection authority in Mexico, in accordance with applicable law.

Dr. José Antonio Castañeda Cruz

Website: doctorjosecastaneda.com

Last Updated: September 2, 2026