Privacy notice

1. Who is responsible for your data

The person responsible for processing and protecting your personal data is Yuliana Morales Gándara (Dr. Yuliana Morales), a dental surgeon whose practice is located at Blvd. Puerto Cancún, Mz 27 Lt 1-02, Edificio Diomeda, offices 310 and 311, Puerto Cancún, Zona Hotelera, ZIP 77500, Cancún, Benito Juárez municipality, Quintana Roo, Mexico. This is also the address for legal notices.

For anything related to your data, email us at drayulianamorales.dental@gmail.com or call or message us on WhatsApp at +52 998 340 4643, Monday to Friday from 10 AM to 6 PM and Saturdays from 10 AM to 1 PM. Formal requests about your data (sections 6 and 7) are received by email or at the practice, and are handled directly by Dr. Yuliana Morales.

This notice is governed by the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in the Official Gazette of the Federation on March 20, 2025.

2. What data we collect and how

We collect your data when you message us on WhatsApp, social media or email; when you use the booking calendar or the newsletter form on this website; when you register your details before paying with the payment link we send you; and when you come in for an appointment.

Identification and contact data

• Full name, date of birth, age and gender.
• Phone, WhatsApp, email and home address.
• City and country of residence, occupation, workplace and education.
• Name and phone number of an emergency contact.
• How you heard about us or who referred you.
• If you travel from another city or country, the dates you will be in Cancun and the days you are available.

Payment and billing data

• The cost of your treatment, your deposits, payments and balance.
• If you pay with a payment link, we first ask for your name, WhatsApp and email to identify your payment; they are kept in the practice’s system.
• If you request an invoice, the tax details you give us.
• Your card details are captured by the payment platform, a provider separate from the practice that has its own privacy notice and also asks for your name, email and phone. We never see or store your card details.

Sensitive data: your health

To treat you we need health data, which the law considers sensitive data:

• The reason for your visit and what you want to change about your smile.
• Your medical and family history: heart, respiratory, digestive or thyroid conditions, diabetes, blood pressure, epilepsy, hepatitis, HIV and other sexually transmitted infections, bleeding disorders and cancer.
• The medications you take, your allergies and any medical treatment you are receiving.
• Whether you smoke or use other substances.
• Whether you are pregnant and the date of your last period.
• Your height, weight and blood type.
• Your dental history: clinical photographs, X-rays, scans and models of your mouth.

Please do not send medical records or health information through the forms on this website: we ask for that information at your appointment.

Data from your visit to this website

IP address, browser and device type, the pages you visit, date and time, and the site you came from. Details are in section 8.

3. What we use your data for

Necessary purposes

Without these we cannot treat you, so they do not require additional permission:

• Replying to your message and booking your consultation call or appointment.
• Assessing you, making your diagnosis and proposing a treatment plan.
• Treating you, following up, and checking your treatment after it is finished.
• Creating and keeping your clinical record, as health regulations require.
• Sending the dental laboratory the information it needs to make your veneers or other pieces.
• Coordinating your appointments if you travel from another city or country.
• Charging, recording your payments and issuing your invoice.
• Complying with legal, health and tax obligations, and responding to requests from the authorities.

Optional purposes

These only with your permission. If you do not accept them, we will treat you just the same:

• Sending you our newsletter, news and promotions.
• Asking for your opinion in satisfaction surveys.
• Using photos or videos of your case, or your testimonial, on this website, on social media or in the practice’s materials. We will only do this if you authorize it in writing: we will give you a separate authorization where you choose what can be shown. Unless you say otherwise, your face will not be shown and your name will not be published.

If you do not want us to use your data for these optional purposes, or want to unsubscribe from the newsletter, email us at drayulianamorales.dental@gmail.com with the subject “No to optional purposes”, or tell the team at your appointment.

4. How you give us permission for your health data

Before opening your clinical record we will ask for your express written consent, with your signature, to process your health data.

To use images or testimonials of your case we will ask for a separate authorization, also signed. You can withdraw it whenever you want: we stop using those images and remove them from this website and our social media. We cannot recover copies other people made before you withdrew it.

If the patient is a minor, consent is given by their mother, father or legal guardian.

5. Who we share your data with

We do not sell your data.

We share it without asking for additional permission, because the law allows it, in these cases:

• With the dental laboratory that makes your pieces, for your treatment.
• With other health professionals we refer you to, or that you ask us to send your information to, for example your dentist back home.
• With health, tax or judicial authorities, when the law requires it.

Google and Meta. In addition, this website uses Google and Meta tools that receive the browsing data described in section 8 (IP address, the pages you visit, clicks on WhatsApp or the booking calendar, and cookie identifiers) to measure the website and know which ads work. These companies also use it for their own purposes, under their own privacy policies. If you do not agree, you can limit it with Google’s opt-out add-on, a tracker blocker in your browser or the ad settings in section 8; your care does not change.

The providers we use for scheduling, forms, messaging, email, contact management and hosting of this website process your data only on our behalf and under a duty of confidentiality. Some store information on servers outside Mexico, for example in the United States. The payment platform processes the data you give it there on its own account, under its own privacy notice.

If we ever needed to share your data with anyone else for something that requires your permission, we will ask you first.

6. Your rights: see, correct, delete or object

You have the right to access your data and know how we use it; to rectify it if it is wrong or incomplete; to cancel it, that is, ask us to delete it; and to oppose its use for a given purpose. Mexican law calls these ARCO rights.

To exercise them, email us at drayulianamorales.dental@gmail.com or hand in your request at the practice, including:

• Your name and how you want us to reply.
• An official ID. If someone represents you, their ID and the document that proves they represent you.
• Which data and which right you want to exercise.
• If you want to correct something, what change and a document that supports it.
• Any detail that helps us find your information.

We reply within 20 business days of receiving your request. If something is missing, we ask you for it within the following 5 business days and the period counts from when you provide it. If it applies, we carry it out within the 15 business days after our reply. If the case justifies it, either period may be extended once for the same length of time, and we will tell you. We reply through the channel you indicate. Access is given as a copy or an electronic file. It is free; only copies or shipping, if any, are charged.

One important limit: we must keep your clinical record for at least 5 years after your last appointment, as required by the Mexican official standards on clinical records and oral health (NOM-004-SSA3-2012 and NOM-013-SSA2-2015). During that time we cannot delete it even if you ask; we can correct it and limit its use to what is strictly necessary.

If you disagree with our reply, or we do not reply, you can go to the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the authority that protects personal data in Mexico today.

7. How to withdraw your permission or limit the use of your data

You can withdraw the permission you gave us at any time. To unsubscribe from the newsletter or refuse the optional purposes we do not ask for ID: an email to drayulianamorales.dental@gmail.com or telling us at your appointment is enough. To withdraw permission over your health data we ask for the same details as in the previous section (your name, your ID and how you want us to reply) and reply within the same periods. Withdrawing it does not apply retroactively. If it concerns data we need to treat you, it may prevent us from continuing your treatment, and we will explain this to you first.

If you ask not to receive promotions, we record your choice so we do not send them to you again. To stop advertising calls from any company in Mexico, you can also register your number in Profeco’s Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad).

8. Cookies and other tools on this website

This website uses cookies and similar tools: small files or pieces of code that store information in your browser. Through them, your IP address, your browser, device and operating system, the pages you visit, the date and time, and the site you came from are obtained. They are used as follows:

• Google Analytics (Google): counts visits, page views and clicks on buttons such as WhatsApp or the booking calendar, so we know what works on the website. It does not receive your name or phone number.
• Meta Pixel (Facebook and Instagram): records visits and actions such as opening WhatsApp, so we know which ads bring us visitors and, where applicable, show our ads on Facebook and Instagram to people who have already visited the website.
• Google Map in the footer: when it loads, Google receives your IP address and browser details.
• Booking calendar and newsletter: these forms are served by an external provider, which may use its own cookies to make them work and protect them from abuse.
• Your light or dark theme preference: one cookie of our own that is only saved if you change the theme.

You can block or delete cookies in your browser settings; the website keeps working, although the booking calendar or the map may not load. For Google Analytics there is also Google’s opt-out browser add-on: tools.google.com/dlpage/gaoptout. You can control the ads you see on Facebook and Instagram at facebook.com/adpreferences.

This website does not currently respond to browser “Do Not Track” signals.

9. How long we keep your data

• Clinical record: at least 5 years after your last appointment. It is then blocked and securely destroyed.
• Payment and invoice data: for as long as tax laws require.
• If you contacted us but did not start treatment: for as long as needed to handle and follow up on your request. If you ask us to delete it, we do.
• Newsletter: until you unsubscribe.
• Authorized images and testimonials: for as long as your authorization remains in effect.

10. How we protect your data

We apply administrative, technical and physical measures to protect your data. Your clinical record and clinical images are only accessed by the staff who treat you and, when needed, by the providers who serve us, under confidentiality. The whole team is bound by confidentiality and professional secrecy. If a security breach significantly affected your rights, we would notify you without delay so you can take action.

11. Changes to this notice

Any change is published on this page with its new update date. If the change is significant, for example new purposes that require your permission, new sensitive data or sharing your data with someone else, we will also notify you through the contact details you gave us and, when the law requires it, ask for your consent again.

12. Language

This notice is available in Spanish and English. If there is any difference between the two versions, the Spanish version prevails.