Data Processing Addendum (DPA)
Last updated: August 14, 2026
This is a courtesy English translation and a summary for reference. The legally binding, executable version is the Spanish original on docenlinea.mx; the signed agreement is provided on request.
Purpose
This addendum governs how OnlineDoc (DocEnLinea) processes personal data on behalf of a controller when providing the connection platform. It forms part of the service agreement between OnlineDoc and each affiliate, medical office, or Responsable Sanitario establishment. A signed, executable version is available on request.
Roles
- Controller (responsable): the medical reviewer's establishment / Responsable Sanitario for clinical data, and the affiliate for the patient identity/contact it collects.
- Processor (encargado): OnlineDoc, which stores and surfaces data solely on the controller's documented instructions.
- OnlineDoc is the controller only for its own platform, account, billing, and audit data.
Scope & instructions
OnlineDoc processes personal data only to operate the connection (intake transport, storage, case display, video/voice, and fulfillment coordination) and only on the controller's instructions. We do not use the data for our own purposes, and we do not sell it or use it for advertising.
Security measures
OnlineDoc maintains administrative, technical, and physical safeguards appropriate to sensitive health data — encryption in transit and at rest, access control, mandatory 2FA, and audit logging. See our Security overview.
Subprocessors
OnlineDoc engages subprocessors under equivalent obligations (sub-encargo). The current list is published on the Subprocessors page; controllers are notified of material changes.
Data-subject rights (ARCO)
Access, Rectification, Cancellation, and Opposition (ARCO) requests are directed to the controller; OnlineDoc assists as processor within the response window set out in the Privacy Notice.
Breach notification
OnlineDoc notifies the affected controller without undue delay upon becoming aware of a security breach affecting personal data, with the information needed to meet notification duties under the LFPDPPP.
International transfers
Where data is stored or processed outside Mexico, the transfer is disclosed in the Privacy Notice and consented at intake, and is subject to contractual commitments of equivalent protection (LFPDPPP Arts. 36–37).
Retention & deletion
Clinical records are retained per NOM-004-SSA3-2012 (at least 5 years from the last medical act) under the controller's custody. On termination or on the controller's instruction, OnlineDoc returns or securely deletes personal data, subject to legal retention duties.
Contact
To request the signed DPA or for any data-processing matter, contact our Personal Data Department at compliance@docenlinea.mx.