Mexico Compliance

In plain language

OnlineDoc (DocEnLinea) is a telemedicine connection platform. We connect platforms and medical offices with a network of licensed medical reviewers in Mexico, via video, voice, or data review. We do not provide medical services, nor offer medical information, diagnosis, or treatment, and we do not market medications, therapies, or procedures.

Every clinical decision is made independently by a physician with a valid cédula profesional. If you are experiencing a medical emergency, call 911 immediately.

1. Responsable Sanitario (Article 19 RLGSMP)

Article 19 of the General Health Law's Regulation on Advertising (RLGSMP) requires any health-related advertising in Mexico to identify the responsible physician (responsable sanitario) and disclose their credentials.

• Responsable Sanitario: Dr. Luigi Palermo
• Cédula Profesional: 7606055
• Establishment: General medicine practice (SCIAN 621111), Playacar Fase 2, Solidaridad, Quintana Roo
• Aviso de Funcionamiento (COFEPRIS): 2323035036X00089
• Aviso de Publicidad (COFEPRIS): Filing no. 2323032002A00007

The responsable sanitario's Aviso de Publicidad is on file with COFEPRIS. Even so, we limit Mexico-targeted communication to informational, non-promotional content only and link to this transparency page from every public-facing surface in compliance with Article 19.

2. Regulatory framework we operate under

• Ley General de Salud (LGS) — Title XIII (Articles 300–310). Governs all health-related advertising in Mexico.
• Reglamento de la LGS en Materia de Publicidad (RLGSMP) — Article 17 (information by correspondence/web), Article 18 (prohibited advertising), Article 19 (credential-disclosure requirement), Article 86 (Aviso de Publicidad).
• Ley Federal de Protección de Datos Personales (LFPDPPP) — How we process and protect personal data, including sensitive health data which requires express consent. See our Privacy Notice.
• NOM-024-SSA3-2012 — Standards for electronic health-record information systems (SIRES).
• NOM-004-SSA3-2012 — Clinical-file standards for integration, use, and confidentiality of the clinical record.
• COFEPRIS — Federal Commission for the Protection against Sanitary Risks. Enforcement authority for health advertising and health services.
• 2025 GHL Amendment — Formally recognizes telehealth as the use of information technologies to offer health services at a distance.

3. What we do — and what we don't do

We do

• Connect platforms and medical offices with a network of medical reviewers holding a valid cédula profesional.
• Provide the technology connection infrastructure: video, voice, and clinical data review.
• Facilitate the capture and recording of informed consent between the patient and the medical reviewer.
• Coordinate, where appropriate, with partner compounding pharmacies and labs.
• Encrypt personal information at rest and in transit.
• Maintain a verifiable Privacy Notice with INAI escalation rights.

We don't

• Provide medical services, or offer medical information, diagnosis, or treatment.
• Make clinical decisions or prescribe — that is exclusively the medical reviewer's role.
• Market, sell, or advertise medications, therapies, or procedures.
• Dispense or sell medications.
• Make curative, miracle, or guaranteed-outcome claims.
• Offer emergency care — if you have an emergency, call 911.
• Sell, rent, or trade your personal data.

4. Service types we connect

We facilitate connection with medical reviewers for lanes such as GLP-1s, TRT (male hormone replacement therapy), HRT (female hormone replacement therapy), and longevity. These protocols may involve prescription medications in Mexico (sujeto a receta médica). Every clinical decision, including eligibility and prescription, is made exclusively by a physician with a valid cédula profesional.

Peptides are listed for informational purposes only: we do not connect, market, or facilitate their prescription.

Consult a healthcare professional before starting any protocol.

5. Communication practices for Mexico-targeted content

In any communication or content directed to Mexican audiences we commit to:

• Listing only the service types and options available, without marketing medications, therapies, or procedures.
• Displaying the responsable sanitario name and credentials on every relevant surface (Article 19 RLGSMP).
• Filing the Aviso de Publicidad with COFEPRIS through DIGIPRiS before running any paid campaign.
• Avoiding curative claims, guarantee language, unsubstantiated superlatives, and outcome promises.
• Not directing prescription-drug brand-name advertising to the general public.
• Not using manipulated before/after imagery or unverifiable testimonials.

6. Telemedicine and teleconsultation

OnlineDoc (DocEnLinea) provides the connection infrastructure that supports teleconsultation, in accordance with the 2025 Amendment to Mexico's General Health Law recognizing telehealth. The medical act belongs to the reviewer. Our model provides for:

• Responsable Sanitario: A physician with a valid cédula profesional designated as responsible.
• Clinical independence: Clinical decisions belong to the medical reviewer; OnlineDoc does not intervene.
• NOM-024-SSA3-2012: Standards for electronic health-record information systems.
• Informed consent: Captured before the teleconsultation and documented in the record managed by the reviewer.
• Privacy Notice: LFPDPPP-compliant data handling with express consent for sensitive health data.

7. Data privacy (LFPDPPP)

Mexican personal-data protection is governed by the LFPDPPP. In the connection model, OnlineDoc acts as the platform and data processor, while the medical office or reviewer is the controller (responsable) of the clinical data generated in the medical act.

You retain ARCO rights (Access, Rectification, Cancellation, Opposition) and the right to revoke consent. Full details and INAI escalation are in our Privacy Notice.

8. Informed consent & the consent token

Processing sensitive health data requires express, written consent under Article 9 of the LFPDPPP. Consent is requested and accepted at intake, before any medical review.

Every case submitted through the platform carries a consent token with a timestamp (granted_at) and the version of the accepted text, retained auditable. The consent covers:

• (a) Treatment (the medical act) by the medical reviewer with a valid cédula profesional.
• (b) The transfer of data from the affiliate (platform, app, influencer, or medical office) to the medical reviewer.
• (c) The remisión of data to OnlineDoc (DocEnLinea) as data processor.
• (d) Storage location, including when data may be stored outside Mexico.

You may revoke your consent at any time. See our Privacy Notice and the Informed Consent for Telehealth.

9. Account & access security

Every account — affiliate and user — is protected with hardened access controls:

• Human verification (anti-bot) at signup and login.
• Two-step verification (2FA) required for all accounts.
• High-complexity passwords: upper-case, lower-case, numbers, and symbols, checked against public breached-password databases (leaked passwords are rejected).
• Encryption in transit (TLS) and at rest.
• Audit logging of access: who accesses, what they view, and when.
• Per-affiliate authentication with revocable credentials and signed webhooks.

10. Jurisdictional separation (Mexico / United States)

We maintain a red line between Mexico and the United States, with no data crossing between jurisdictions:

• We record the jurisdiction where each account is created (Mexico or abroad).
• We verify the IP on every login to detect access from Mexico or from abroad.
• Cases originating in Mexico are handled by reviewers with a cédula profesional in Mexico, under Mexican law.
• Cases originating in the United States are handled by US-licensed providers, under US law.
• Each jurisdiction's data is kept isolated: Mexican and US records are never commingled.

The binding regime for the Mexican pipeline is Mexican law (LFPDPPP, applicable NOMs, and the LGS).

11. PHI security standard & voluntary baseline (HIPAA/BAA/SOC 2)

We treat clinical data at a PHI-grade security standard. DocEnLinea is on a path toward Business Associate Agreements (BAAs), PHI-grade safeguards, and HIPAA-aligned controls, and is working toward SOC 2, as a voluntary security baseline. These US standards are not required by Mexican law; the binding framework in Mexico is the LFPDPPP, applicable NOMs, and the LGS. We adopt those controls as an additional security floor, never as a substitute for Mexican compliance.

12. Cookies

We use minimal functional cookies necessary for the platform to operate. See our Cookie Policy for details.

13. Notice

OnlineDoc (DocEnLinea) is a connection platform and does not offer medical information, diagnosis, or treatment. Any information on this site is general information about the platform and the service types available. Consult a healthcare professional before making any health-related decision.

If you are experiencing a medical emergency, call 911 (or your local emergency number) immediately.

14. Compliance contact

Questions about Mexican compliance, communication practices, data rights, or credentials can be sent to:

• Email: compliance@docenlinea.mx
• Privacy / ARCO requests: compliance@docenlinea.mx

If you believe your rights have been violated, you may file a complaint with the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI): www.inai.org.mx.