Privacy notice

This notice explains what personal data we collect at the office and on this website, what we use it for, with whom we may share it and how you can exercise your rights. It is drafted in accordance with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and the Privacy Notice Guidelines in force in Mexico. This is a translation for information purposes; in case of discrepancy, the Spanish version prevails.

1. Data controller

Irina Nathalia González Sáez, physician and surgeon specialized in Otolaryngology, with an address for notices at:

CAB Medical Headquarters
Av. Paseo de los Leones 2341, Office 6, 2nd floor
Cumbres 2.º Sector
64610 Monterrey, Nuevo León

Get directions

Email for privacy matters and ARCO rights: soy@drairinagonzalez.com. Office phone: (81) 1569 5744.

2. Personal data we collect

Depending on how you contact us and the service you receive, we may collect the following categories of data:

Identification and contact: full name, date of birth and age, phone and WhatsApp, email, address, signature.
For minors or represented patients: name and contact details of the parent, guardian or legal representative, and proof of that representation.
Billing and payment: tax ID (RFC), tax regime, CFDI use, tax postal code and health insurance details (insurer, policy number), only when you request an invoice or use your insurance.
Health data (sensitive personal data): reason for the visit, personal and family history, allergies, medications, symptoms, physical examination, test results (for example audiometry, nasal or laryngeal endoscopy, sleep studies, imaging), diagnoses, treatments, progress, clinical images and videos, and all the information in your medical record.
Browsing: IP address, device and browser type, pages visited and similar technical data, collected automatically by the website and by the services described in the cookies section.

We collect it directly from you (at the office, by phone, WhatsApp, email or this website’s form), from your representative where applicable, and from other health professionals or institutions that refer you or take part in your care, always with your knowledge.

Website contact form. It only asks for your name, phone number, general reason for the visit and, optionally, email and a short message. There is no need to include clinical information; we discuss your health in person. The message is sent by email to the office and is not stored on the website.

3. Purposes of processing

Primary purposes (necessary for the relationship you request):

Scheduling, confirming, rescheduling and reminding you of appointments, and answering your requests for information.
Providing medical care: evaluation, diagnosis, treatment, procedures and follow-up.
Creating, keeping and updating your medical record in accordance with Mexican Official Standard NOM-004-SSA3-2012.
Issuing prescriptions, test orders, reports, certificates and clinical summaries, and coordinating consultations or procedures with hospitals, laboratories and diagnostic centers.
Managing payments, invoicing and, when you request it, procedures with your insurer.
Complying with legal, health, tax and security obligations, and responding to requests from competent authorities.

Secondary purposes (not necessary, but useful to improve the service):

Sending you reminders of periodic check-ups and care recommendations related to your treatment.
Inviting you to answer satisfaction surveys.
Informing you about the office’s services, hours or news.

If you do not want your data to be used for the secondary purposes, you can say so at any time by writing to soy@drairinagonzalez.com or at the office. Declining does not affect your medical care.

4. Sensitive data and consent

Health data is sensitive personal data. To process it for the primary purposes, we obtain your express written consent at the office, using the form you sign (by hand or electronically) when your care begins. For minors or represented persons, consent is given by the parent, guardian or legal representative.

For the identification and contact data you provide when writing to us or booking, consent is understood to be given when you contact us and, on the website form, when you tick the acceptance box. You may revoke it as described in section 7.

5. Data transfers

We may transfer your data, only to the extent necessary, to:

Hospitals, clinics, laboratories and diagnostic centers where your tests, procedures or surgeries take place, and the health professionals involved in your care (anesthesiology, consultations, referral and counter-referral).
Insurers and insurance administrators, when you ask to use your policy, for the procedures you authorize.
Health, tax, judicial or administrative authorities, when there is a well-founded request or a legal obligation.

Transfers the Law allows without consent (for example, those necessary for medical care, by legal obligation or to protect life) are made in accordance with it. Any other transfer will be made only with your consent.

Processors. To run the office and this website we use providers that process data on our behalf and under our instructions, including: web hosting and email, messaging services (WhatsApp, from Meta Platforms), maps and website analytics (Google), a service that protects the contact form against automated messages (Cloudflare), and the booking and reviews platform Doctoralia, which has its own privacy notice when you use it directly. Some of these providers are outside Mexico; in that case, the transfer is made with the safeguards required by the Law.

6. Data retention

We keep your medical record for at least five years from the date of the last medical act, as required by NOM-004-SSA3-2012, and billing data for the periods set by tax legislation. Contact data received by WhatsApp, phone, email or the website form is kept only as long as needed to handle your request; if you become a patient, it becomes part of your medical record. Once these periods end, the data is securely deleted or anonymized.

7. ARCO rights, revocation and limitation of use

You have the right to access your personal data, to rectify it if it is inaccurate or incomplete, to cancel it when you consider it is not needed for any of the purposes of this notice, and to object to its processing for specific purposes. You may also revoke the consent you have given us and request the limitation of the use or disclosure of your data. Please note that we may not always be able to fulfil your request immediately: sometimes the law requires us to keep the medical record or tax information.

To exercise these rights, send a request to soy@drairinagonzalez.com or submit it at the office, stating:

Your name and a way to send you the answer (email or phone).
A copy of an official ID or, if you act on behalf of another person, the document proving your representation.
A clear description of the data and the right you wish to exercise, and any document that helps locate the information.

We will reply within a maximum of twenty business days from receipt of your complete request and, if appropriate, will carry it out within the following fifteen business days. Exercising these rights is free of charge; only justified shipping or reproduction costs may be charged. If you consider that your right to data protection has been violated, you may contact the data protection authority in Mexico.

8. Security measures

We apply administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing: restricted access to the medical record, physical and digital safekeeping with passwords, an encrypted connection (HTTPS) on the website, backups and providers with equivalent security measures. If a breach significantly affecting your rights were to occur, we would inform you without delay.

9. Cookies and similar technologies

This website uses technical cookies necessary for its operation and security, which do not require consent. The embedded maps and the WhatsApp and Doctoralia buttons connect to third-party services (Google, Meta Platforms, Doctoralia) that may set their own cookies when you interact with them. To measure website use in aggregate (page views and clicks on WhatsApp, call, directions, Doctoralia and form submissions) we use Google Analytics 4, from Google LLC, configured with a truncated IP address, without Google signals or ad personalization, and disabled for browsers that send the “Do Not Track” signal. These statistics do not allow us to identify you. To prevent automated messages, the contact form uses a Cloudflare service that checks that the person writing is human; to do so it reviews basic technical data from your browser and connection, and does not use it for advertising. You can prevent measurement by enabling that signal in your browser or with the Google Analytics opt-out add-on. You can block or delete cookies in your browser settings; some features may stop working.

10. Minors

Services are provided to minors only with the consent and participation of their parent, guardian or legal representative, who provides and authorizes the processing of the minor’s data. If we detect data from a minor collected without that authorization, we will delete it.

11. Changes to this notice

This notice may be amended to reflect legal changes or changes in our services or practices. The current version will always be published on this page with its update date. If a change significantly affects the processing of your data, we will notify you through the contact details you provided.

12. Short privacy notice

Irina Nathalia González Sáez, with an address in Monterrey, Nuevo León, will use your identification and contact data to schedule and confirm appointments and answer your requests, and your health data to provide medical care and create your medical record. To learn about the secondary purposes, transfers and how to exercise your ARCO rights, see the full notice on this page or write to soy@drairinagonzalez.com.

Last updated: October 14, 2026 (Spanish version). English translation: October 2026.