Comprehensive Privacy Notice

1. Identity of the Data Controller

OnlineDoc (also published as DocEnLinea in Spanish — hereinafter "the Platform" or "we"), with domicile in Mexico and email address contact@docenlinea.mx, is the controller of your identification, contact, and platform-usage data in accordance with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

With respect to clinical data generated in the medical act, the controller is the medical office or licensed medical reviewer handling the case; OnlineDoc acts as the data processor, following the controller's instructions and without using such data for its own purposes.

To exercise your rights or for any personal-data protection matter, we have designated a Personal Data Department (Art. 30 LFPDPPP), reachable at compliance@docenlinea.mx.

2. Personal data we collect

• Identification data: full name.
• Contact data: email address, phone number.
• Data related to the reason for contact: service type of interest, organization type (platform, medical office, pharmacy, lab), message.
• Clinical data (where applicable): collected and processed by the medical reviewer or office as controller, under medical confidentiality. OnlineDoc processes it only as a processor.

We do not collect sensitive data through the contact form. Clinical data is treated under medical professional secrecy by the corresponding controller.

3. Purposes of processing

Your data will be used for the following purposes:

Primary purposes (necessary):

• Respond to your contact and connection requests.
• Facilitate the connection with the appropriate medical reviewer or office.
• Coordinate, where appropriate, with partner compounding pharmacies and labs.
• Provide support on the use of the Platform.
• Comply with legal obligations applicable to the Platform.

Secondary purposes (optional):

• Send you information about new services or promotions.
• Conduct statistical analysis to improve the Platform.

If you do not want your data used for secondary purposes, you can let us know by emailing compliance@docenlinea.mx.

4. ARCO rights

You have the right to Access, Rectify, Cancel, or Object to the processing of your personal data (ARCO rights), and to revoke your consent at any time.

To exercise any of these rights, send a request to compliance@docenlinea.mx with your name, a clear description of the right you wish to exercise, and a copy of an official ID. We will respond within a maximum of 20 business days.

5. Transfer of data

Your data may be transferred to:

• The medical reviewer or medical office handling your case.
• Where appropriate, partner compounding pharmacies and labs to coordinate the service.
• Technology providers that operate the Platform (hosting, video/voice communication, transactional messaging), always under strict confidentiality clauses.
• Competent authorities when there is a legal requirement.

The data OnlineDoc (DocEnLinea) processes is kept under its control, with the security measures described below. We do not sell, rent, or transfer your data to third parties for commercial purposes.

6. Security measures

We implement reasonable administrative, technical, and physical measures to protect your data: encryption in transit (HTTPS) and at rest, access control, human verification (anti-bot) and two-step verification (2FA) on accounts, high-complexity passwords checked against breached-password databases, and access audit logging. In addition, DocEnLinea is on a path toward Business Associate Agreements (BAAs), PHI-grade safeguards, and HIPAA-aligned controls, and is working toward SOC 2 — as a voluntary security baseline that adds to, but never replaces, compliance with Mexican law.

7. Use of cookies

The Platform uses minimal functional cookies necessary for its operation. We do not use advertising or third-party tracking cookies. For analytics we use Cloudflare Web Analytics, which is privacy-respecting and does not require cookie consent.

8. Changes to this notice

We may update this Privacy Notice. Any change will be published on this page with the corresponding update date.

9. Regulatory authority

If you believe your rights have been infringed, you may turn to the National Institute of Transparency, Access to Information, and Protection of Personal Data (INAI): home.inai.org.mx.