Privacy Policy

The party responsible for the processing of personal information is:

Ramos Dental Nuevo Progreso, Tamaulipas, Mexico

Website: ramosdental.clinic

Privacy Contact: [PRIVACY EMAIL TO BE DEFINED]

Legal Name / Responsible Party: [LEGAL ENTITY OR RESPONSIBLE PERSON TO BE DEFINED]

Privacy Address: [LEGAL ADDRESS TO BE DEFINED]

Depending on the nature of your interaction with Ramos Dental, we may collect personal information such as:

• name;
• age or date of birth;
• country or place of residence;
• telephone number;
• email address;
• preferred method of communication;
• appointment requests;
• information relating to travel for dental treatment;
• previous dental treatment information;
• communications with our team;
• information voluntarily provided when requesting an estimate or consultation.

When you request dental care or use our Virtual Consultation, we may also process sensitive personal and health information, including:

• medical and dental history;
• present or previous health conditions;
• medications;
• allergies;
• previous surgeries or treatments;
• intraoral photographs;
• dental photographs;
• facial photographs submitted for clinical purposes;
• panoramic radiographs;
• periapical radiographs;
• CBCT studies;
• DICOM files;
• intraoral scans;
• STL or similar digital dental files;
• laboratory or diagnostic studies;
• previous dental records;
• clinical notes;
• proposed diagnoses;
• treatment plans;
• information relating to dental implants;
• bone condition and volume;
• maxillary sinus anatomy;
• mandibular anatomy;
• other anatomical or clinical findings;
• communications with our clinicians;
• documents voluntarily uploaded by the patient.

Health information is treated as sensitive personal information and receives enhanced protection.

The Ramos Dental Virtual Consultation allows prospective and existing patients to submit information for preliminary clinical review, including medical and dental history, photographs, radiographs, CBCT studies, DICOM files, intraoral scans and other documents relevant to potential dental treatment.

Because this information may reveal an individual's present or past health status, anatomical characteristics, diagnoses, treatment history or other health-related information, some or all of the information submitted through the Virtual Consultation may constitute sensitive personal information under applicable Mexican law.

The submission of information through the Virtual Consultation does not, by itself, constitute a definitive diagnosis, establish a final treatment plan or replace an in-person clinical examination.

Information submitted during a Virtual Consultation may initially be maintained as consultation information.

Where Ramos Dental accepts the individual as a patient and the information becomes clinically relevant to diagnosis, treatment, patient safety or continuity of care, some or all of that information may subsequently be incorporated into the patient's clinical record.

Information incorporated into the clinical record becomes subject to the corresponding healthcare documentation, confidentiality and retention requirements.

Ramos Dental may process personal and health information for purposes directly related to dental care, including:

• evaluating consultation requests;
• reviewing submitted clinical information;
• communicating with patients;
• scheduling appointments;
• determining whether additional diagnostic information is required;
• preparing preliminary treatment recommendations;
• preparing preliminary treatment estimates;
• treatment planning;
• diagnosis;
• coordination of specialist care;
• documentation of dental treatment;
• maintaining the clinical record;
• continuity of care;
• follow-up;
• laboratory coordination;
• imaging and diagnostic coordination;
• billing and administrative management;
• patient safety;
• regulatory compliance;
• legal obligations.

Limited contact information may also be used for appointment reminders, treatment-related communications and follow-up associated with the patient's care.

Uses for advertising or promotional purposes are governed separately and are not a condition of receiving dental treatment.

Ramos Dental processes health information and other sensitive personal information on an appropriate lawful basis and, where required by applicable law, after obtaining the individual's express consent.

When a patient or prospective patient voluntarily submits medical or dental history, photographs, radiographs, CBCT examinations, DICOM files, intraoral scans, clinical records or other sensitive health information through the Virtual Consultation or another authorized electronic mechanism, Ramos Dental may request a separate affirmative consent specifically covering the collection and processing of such information.

This consent is separate from general acceptance of the Website Terms of Use.

The electronic consent mechanism should generate a verifiable record of the individual's affirmative action, including, where appropriate:

• information identifying the consultation or individual;
• date and time of consent;
• version of the Privacy Policy displayed;
• purpose of the consent;
• exact or verifiable version of the consent statement;
• source or channel through which consent was obtained.

Consent controls relating to sensitive health information must not be preselected.

The Virtual Consultation may use substantially the following statement:

“I have read the Ramos Dental Privacy Policy and expressly authorize Ramos Dental to collect, receive, securely store, review, use and otherwise process the personal and sensitive health information that I voluntarily submit, including medical and dental history, photographs, radiographs, CBCT/DICOM studies, scans and other clinical files, for purposes related to my Virtual Consultation, diagnosis, treatment planning, communication, continuity of care and potential dental treatment.”

Withdrawal of consent operates prospectively.

Withdrawal does not require Ramos Dental to erase or destroy information that must continue to be retained under applicable healthcare, clinical-record, legal, regulatory, contractual or evidentiary obligations.

Information generated during dental care and information incorporated into the patient's formal clinical documentation may become part of the clinical record.

Ramos Dental maintains clinical documentation taking into account applicable Mexican healthcare requirements, including NOM-004-SSA3-2012.

The clinical record is subject to healthcare confidentiality, integrity, documentation and retention requirements.

Information contained in a clinical record may therefore need to remain preserved even when an individual subsequently exercises certain privacy rights.

Under NOM-004-SSA3-2012, clinical records must be retained for a minimum period of five years from the date of the patient's last clinical or medical act, without prejudice to a longer retention period that may result from another applicable legal, regulatory, contractual, judicial, professional or evidentiary obligation.

A request for cancellation of personal information therefore does not automatically require the immediate destruction of a clinical record.

Ramos Dental uses electronic information systems and may engage specialized technology providers to operate its website, Virtual Consultation, secure file-upload services, clinical information systems, backups, cybersecurity infrastructure, communications and other services necessary for the operation of the clinic.

Depending on the service and infrastructure used, personal and health information may be stored, backed up or technically processed on servers located in Mexico, the United States, Canada or another jurisdiction in which an authorized service provider operates.

Ramos Dental remains responsible for determining the purposes and means for which patient information is processed within its operations, subject to applicable law.

The use of cloud infrastructure or another technology service provider does not authorize that provider to independently use patient information for unrelated purposes.

Where a service provider processes personal information on behalf of Ramos Dental, Ramos Dental seeks to implement contractual, organizational and technical measures appropriate to the nature and sensitivity of the information, including, where applicable:

• confidentiality obligations;
• limitations on permitted purposes;
• appropriate access controls;
• security requirements;
• incident-reporting obligations;
• appropriate controls concerning subcontractors;
• secure return or deletion where legally appropriate;
• reasonable mechanisms for accountability and oversight.

Ramos Dental may use infrastructure located outside Mexico where reasonably necessary to provide secure, reliable or specialized technology services.

Where personal information is processed in another jurisdiction, it may also become subject to lawful-access requirements applicable in that jurisdiction.

International processing does not eliminate the protections and obligations imposed on Ramos Dental under applicable Mexican law.

Ramos Dental implements administrative, physical and technological safeguards proportionate to the sensitivity and volume of information processed and to the risks associated with electronic healthcare information.

Where electronic systems are used to maintain or manage information forming part of the clinical record, Ramos Dental seeks to preserve the confidentiality, integrity, availability, authenticity and reliability of that information in accordance with applicable Mexican healthcare and data-protection requirements.

Security measures may include, as appropriate:

• encryption of information in transit;
• encryption of sensitive information at rest where technically appropriate;
• identity and authentication controls;
• role-based access controls;
• least-privilege principles;
• audit and access logging;
• secure backups;
• segregation of clinical and administrative permissions;
• monitoring and incident detection;
• access-revocation procedures;
• staff confidentiality obligations;
• cybersecurity updates;
• vulnerability management;
• recovery and business-continuity procedures.

No electronic system can be guaranteed to be completely immune from unauthorized access, cyberattack, loss or technical failure.

Ramos Dental therefore applies a risk-based information-security approach rather than representing that any particular technology provides absolute security.

Ramos Dental may use third-party service providers to support its clinical, administrative and technological operations.

These providers may include:

• cloud infrastructure providers;
• cybersecurity services;
• communications platforms;
• diagnostic imaging providers;
• dental laboratories;
• healthcare professionals;
• scheduling services;
• technology vendors;
• other organizations necessary to provide or support patient care.

Access to personal or health information will be limited, to the extent reasonably practicable, to information necessary for the relevant function.

Ramos Dental evaluates third-party providers according to the nature of the service, the sensitivity of the information involved, applicable legal requirements and available safeguards.

Third-party providers acting on behalf of Ramos Dental are expected to process information only for authorized purposes and subject to appropriate confidentiality, security and contractual requirements.

U.S. HIPAA and HITECH Relationships

Ramos Dental is a healthcare provider established and operating in Mexico.

The fact that an individual resides in the United States or receives dental treatment in Mexico does not, by itself, make every interaction with Ramos Dental subject to the U.S. Health Insurance Portability and Accountability Act (“HIPAA”) or the Health Information Technology for Economic and Clinical Health Act (“HITECH”).

HIPAA and related HITECH requirements will be treated as legally applicable where a particular activity, entity relationship or contractual arrangement falls within their scope.

If Ramos Dental enters into a relationship in which it is legally required to act as a Business Associate of a HIPAA Covered Entity, Ramos Dental will evaluate and implement the contractual and regulatory requirements applicable to that relationship, including a Business Associate Agreement where required.

Where HIPAA is not legally applicable, Ramos Dental may nevertheless voluntarily adopt privacy and security practices informed by recognized healthcare-information protection principles, including principles reflected in HIPAA and HITECH.

The voluntary adoption of such safeguards does not constitute a representation that Ramos Dental is universally subject to, certified under or regulated by HIPAA.

Similarly, a technology provider's ability to support HIPAA-regulated organizations does not, by itself, establish that the entire Ramos Dental information environment is “HIPAA compliant.”

Ramos Dental is established in Mexico and provides dental services from Nuevo Progreso, Tamaulipas, Mexico.

Accordingly, the collection and processing of personal and clinical information by Ramos Dental is primarily governed by applicable Mexican healthcare and data-protection law.

Ramos Dental regularly assists individuals who reside in the United States, Canada and other countries.

A patient's nationality, citizenship or country of residence does not automatically replace the Mexican legal framework applicable to healthcare services and clinical records created and maintained by Ramos Dental in Mexico.

However, certain foreign privacy, healthcare or consumer-protection requirements may apply to a particular transaction, technology relationship, transfer, contractual arrangement or processing activity according to the jurisdictional scope of those laws.

Where foreign legal requirements are legally applicable, Ramos Dental will evaluate and seek to comply with those requirements in addition to applicable Mexican obligations.

Nothing in this Privacy Policy is intended to:

• exclude a mandatory right granted to an individual under a law legally applicable to a particular processing activity;
• cause Ramos Dental to disregard mandatory obligations imposed by Mexican healthcare or data-protection law; or
• create by contract the universal application of a foreign statute that would not otherwise legally apply.

United States

For individuals residing in the United States, Ramos Dental may employ privacy and information-security safeguards informed by HIPAA and HITECH principles.

HIPAA or HITECH will apply only where the corresponding legal requirements and jurisdictional conditions are satisfied.

Canada

For individuals residing in Canada, Ramos Dental recognizes that Canadian privacy requirements may arise under federal or applicable provincial legislation depending upon the circumstances.

Where such requirements legally apply, Ramos Dental will consider principles including meaningful consent, transparency, proportional safeguards, accountability and appropriate protection for sensitive health information.

Patients should understand that information voluntarily transmitted to Ramos Dental for dental treatment in Mexico will be received and processed in connection with healthcare services provided from Mexico and may also be processed through authorized technological infrastructure located in other jurisdictions.

Cross-Border Processing

Where information is processed in another country, it may become subject to lawful access by courts, regulators, law-enforcement authorities or other governmental authorities having jurisdiction over the service provider or infrastructure involved.

Ramos Dental seeks to limit cross-border processing to circumstances reasonably necessary for clinical, administrative, technological or security purposes and applies safeguards proportionate to the sensitivity of the information.

When reasonably necessary for patient care, information may be shared with authorized:

• dentists;
• specialists;
• radiologists;
• imaging centers;
• dental laboratories;
• hospitals;
• healthcare professionals;
• other providers participating in diagnosis or treatment.

Only information reasonably necessary for the relevant clinical purpose should be shared.

Such disclosure remains subject to professional confidentiality and applicable legal requirements.

Ramos Dental may disclose information when required or permitted by applicable law, including in response to:

• competent healthcare authorities;
• judicial orders;
• legally valid government requests;
• regulatory obligations;
• circumstances involving patient or public safety;
• circumstances reasonably requiring the protection of legal rights.

Any disclosure will be evaluated according to applicable legal requirements and the sensitivity of the information involved.

Clinical care and promotional authorization are separate purposes.

Ramos Dental will not condition dental treatment, access to care, quality of care or treatment price upon authorization to use clinical photographs or images for advertising or promotional purposes.

Clinical photographs, radiographs, treatment images and similar materials may be considered for educational, scientific or promotional use only where Ramos Dental has an appropriate legal basis and, when required, specific authorization from the patient.

Where images are intended for promotional use, authorization should be obtained separately from the consent required to process health information for clinical purposes.

The optional authorization may state substantially:

“I voluntarily authorize Ramos Dental to use selected photographs, radiographs and/or clinical images related to my treatment for educational, scientific, website, social media or promotional purposes, subject to the scope of the authorization presented to me. I understand that this authorization is optional, that refusing it will not affect my treatment, and that I may withdraw this authorization prospectively by contacting Ramos Dental.”

The system should provide:

[ ] I authorize [ ] I do not authorize

Neither option may be preselected.

Where feasible and appropriate, Ramos Dental will remove:

• patient name;
• contact information;
• clinical record number;
• unnecessary metadata;
• other directly identifying information.

However, removing a patient's name does not automatically make an image anonymous.

A facial photograph, distinctive anatomy, tattoo or other characteristic may still permit identification.

Accordingly, identifiable facial photographs or other materials capable of identifying the patient should be treated as identifiable media and should be subject to an appropriately specific authorization rather than being described as anonymous merely because the patient's name has been removed.

A patient may withdraw authorization for future promotional use by contacting Ramos Dental.

Withdrawal operates prospectively.

Withdrawal will prevent new uses under Ramos Dental's control after the request has been appropriately processed, but may not always permit complete retrieval or elimination of material that was lawfully published, distributed, shared or otherwise used before withdrawal.

Ramos Dental will make reasonable efforts regarding media remaining under its direct control.

Withdrawal of promotional authorization does not affect the patient's dental treatment.

Under applicable Mexican data-protection law, individuals may exercise rights of Access, Rectification, Cancellation and Opposition (“ARCO Rights”) with respect to their personal information.

These rights include the ability to:

Access personal information held by Ramos Dental and obtain information regarding its processing;

Rectify personal information that is inaccurate, incomplete or outdated;

Request Cancellation when continued processing is no longer necessary or legally justified; and

Oppose certain forms of processing where permitted by applicable law.

The exercise of ARCO Rights, particularly Cancellation, remains subject to applicable healthcare, clinical-record, legal, regulatory, contractual and evidentiary retention obligations.

Clinical Records and Mandatory Retention

Once personal information, diagnostic studies, photographs, radiographs, CBCT scans, DICOM files, treatment records, clinical notes or other information become part of a patient's clinical record, Ramos Dental may be legally required to preserve that information even if the patient subsequently requests cancellation.

Under NOM-004-SSA3-2012, clinical records must be retained for a minimum period of five years from the date of the patient's last clinical or medical act, without prejudice to any longer retention period resulting from other applicable legal, regulatory, contractual, judicial, professional or evidentiary obligations.

Accordingly, a Cancellation request does not necessarily result in the immediate physical or electronic destruction of information contained in the clinical record.

Where Ramos Dental is legally required to retain information, processing may instead be restricted or otherwise limited, where appropriate, so the information is no longer used for purposes lacking a valid legal basis while the applicable retention requirement remains in effect.

Once mandatory retention requirements and other applicable legal preservation periods have expired, Ramos Dental may securely delete, anonymize or otherwise appropriately dispose of the information, provided there is no remaining legal basis requiring continued preservation.

Distinction Between Clinical Records and Other Personal Information

Information that has not become part of a clinical record and is no longer necessary for the purpose for which it was collected may be subject to cancellation or deletion according to applicable data-protection requirements.

For example, certain marketing preferences, non-clinical communications or preliminary inquiry information may be subject to a different retention period than the formal clinical record.

ARCO Requests

Requests may be submitted to:

Ramos Dental Privacy Contact: [PRIVACY EMAIL TO BE DEFINED]

The request should contain sufficient information to verify the identity of the requester, identify the personal information concerned and describe the right the individual wishes to exercise.

Ramos Dental will evaluate each request according to applicable law and will inform the requester whether it may be fulfilled in whole or in part.

Where a request cannot be fully granted because Ramos Dental is legally required to retain certain information, Ramos Dental may explain the applicable basis and, where appropriate, restrict processing of that information to legally permitted purposes.

Patients may request limitations on certain non-essential uses or communications involving their personal information.

Processing necessary for:

• dental care;
• patient safety;
• maintenance of the clinical record;
• regulatory compliance;
• legal obligations;
• continuity of care;

may continue where permitted or required by applicable law.

Where required by applicable law, a parent, guardian or other legally authorized representative must provide the authorization necessary for processing information concerning a minor or person who cannot legally provide consent independently.

An individual submitting health information concerning another person represents that they have the authority or lawful basis required to provide that information.

Ramos Dental may request additional verification where appropriate.

If a patient elects to communicate with Ramos Dental through email, WhatsApp, SMS or another electronic messaging service, the communication may involve infrastructure operated by the corresponding provider.

Patients should understand that different communications platforms provide different levels of privacy and security.

Where a secure file-upload mechanism is available, Ramos Dental may recommend using that mechanism for particularly sensitive or large clinical files, including CBCT or DICOM information, rather than ordinary messaging.

Choosing to initiate communication through a particular third-party communication platform does not authorize Ramos Dental to use the information for purposes unrelated to the patient's request or care.

Ramos Dental retains personal information for the period reasonably necessary to fulfill the purposes for which it was collected and for any additional period required by healthcare, legal, regulatory, contractual, judicial, professional or evidentiary obligations.

Information that becomes part of the patient's clinical record is subject to specific healthcare-record retention requirements.

In accordance with NOM-004-SSA3-2012, clinical records must be retained for a minimum period of five years from the date of the patient's last clinical or medical act.

This minimum retention period may be extended where another applicable legal, regulatory, contractual, professional, judicial or evidentiary obligation requires preservation for a longer period.

During a mandatory retention period, a patient's request for cancellation does not require Ramos Dental to destroy information that it is legally obligated to preserve.

Where appropriate, Ramos Dental may restrict or limit further processing so that retained information is used only for legally permitted or required purposes.

After all applicable mandatory retention periods have expired, and provided no legal basis remains for continued preservation, Ramos Dental may securely delete, anonymize or otherwise dispose of the information according to its information-governance and security procedures.

Personal information that never becomes part of a clinical record may be subject to different or shorter retention periods depending upon the purpose for which it was collected.

Ramos Dental maintains procedures intended to identify, evaluate, contain, investigate and remediate unauthorized access, acquisition, use, disclosure, alteration, loss or destruction of personal and health information.

If a privacy or security incident occurs, Ramos Dental may evaluate factors including:

• the nature and sensitivity of the information;
• whether information was encrypted or otherwise protected;
• the individuals or systems affected;
• whether information was actually acquired, viewed, altered or disclosed;
• risks of re-identification;
• potential consequences for affected individuals;
• containment and mitigation measures;
• applicable legal and contractual obligations.

Ramos Dental will take reasonable measures to contain and remediate material incidents and will provide notifications to affected individuals, authorities, contractual partners or other parties where and within the periods required by applicable law or binding contractual obligations.

The specific notification requirements applicable to an incident depend upon the jurisdiction, type of information, entities involved and legal relationship under which information was processed.

HIPAA/HITECH-Regulated Information

If a particular incident involves information processed under a relationship that is legally subject to HIPAA or HITECH, Ramos Dental will follow breach-response and notification requirements applicable to its role in that relationship.

Where Ramos Dental acts as a Business Associate, applicable obligations may include notifying the corresponding Covered Entity.

Nothing in this section should be interpreted as representing that every security incident involving information concerning a U.S. resident is automatically governed by HIPAA or HITECH.

Ramos Dental may maintain appropriate internal records of material security incidents, findings, remediation actions and required notifications.

Ramos Dental may update this Privacy Policy to reflect legal, regulatory, technological, security or operational changes.

The current version and effective date will be made available through this website.

Where a material change introduces a substantially different purpose for processing sensitive information, Ramos Dental may provide additional notice or request additional consent where legally required.

Questions concerning this Privacy Policy, exercise of ARCO Rights, privacy concerns, withdrawal of optional promotional authorization or other personal-data matters may be directed to:

Ramos Dental Nuevo Progreso, Tamaulipas, Mexico

Website: ramosdental.clinic

Privacy Contact: [PRIVACY EMAIL TO BE DEFINED]