Privacy Policy

Legal Basis

This Comprehensive Privacy Policy (Notice) is issued in compliance with Articles 15 and 17 of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), Articles 6, 9, 11, and 17 of the Privacy Notice Guidelines, and Articles 23, 25, and 31 of its Regulations (Principle of Information).

In consideration of the above and based on Article 1 and Article 16, second paragraph, of the Political Constitution of the United Mexican States regarding human rights and the protection of personal data internationally, this Privacy Notice is provided for national and international interested parties.

Data Controller Information

Dr. Tomás Esteban Pacheco Pérez operating under the brand MAVENN Facial Rejuvenation Surgery, with physical address at Calle 33 No. 494C Interior 12, Colonia Centro, Mérida, Yucatán, Mexico, Zip Code 97000, acts as the Data Controller responsible for processing your personal data in accordance with this Comprehensive Privacy Notice.

How do we ensure the security and protection of your personal data?

Through strict Security Measures and Privacy Policies.

Pursuant to Article 19 of the Law and Article 57 of its Regulations, we have established and maintain administrative, physical, and technical security measures aligned with health sector standards. This ensures the correct processing of your personal data and protects it against damage, loss, alteration, destruction, or unauthorized use, guaranteeing compliance with Guiding Legal Principles, Confidentiality, Duty of Security, and timely response to your ARCO Rights.

What personal data do we collect and for what purposes?

Dr. Tomás Esteban Pacheco Pérez, through MAVENN Facial Rejuvenation Surgery, will perform the proper processing of your "Personal Data" necessary for the adequate provision of our services. We may collect your data through: (1) direct or in-person interactions, (2) email communications, (3) contact links on our official website https://www.mavenn.mx/, (4) telephone calls, and/or (5) our official social media channels.

What categories of personal data do we process?

To fulfill the purposes described in this privacy notice, we process the following categories of personal data:

• Identification data: (Full name, age, signature, etc.).
• Contact data: (Phone number, email address, physical address).
• Physical characteristics data: (Weight, height, scars, skin type, facial structure details).
• Billing & Tax data: (Tax ID/RFC, tax address for official invoices).
• Financial & Payment data: (Transaction data required for service fee collection).
• Sensitive Data: Specifically Health Data (medical history, allergies, clinical antecedents, lifestyle habits) which require special statutory protection under Mexican law.

Primary Purposes

Your personal data will be processed for the following primary purposes, which are necessary to render the medical and surgical services requested:

• Provision of professional services: Medical consultations, clinical evaluations, diagnostics, and surgical or non-surgical treatments.
• Identification and contact: Patient registration, appointment scheduling, and clinical follow-ups.
• Medical Record Integration: Creation and maintenance of your clinical chart in strict compliance with official Mexican health regulations (NOM-004-SSA3-2012).
• Assessment and Procedures: Preoperative evaluation, specialized plastic, aesthetic, or reconstructive procedures, and postoperative recovery care.
• Clinical Photographic Record: Taking clinical photographs for your confidential medical chart to document evolution, anatomical changes, and surgical outcomes (strictly internal and medical use).
• Emergency Communication: Contacting designated emergency contacts or relatives in case of medical eventualities.
• Administrative & Legal: Billing, tax compliance, official fee receipts, and satisfying legal mandates from health or judicial authorities.
• ARCO Rights Processing: Managing requests to exercise your rights of access, rectification, cancellation, or opposition.

Secondary Purposes

Additionally, we may process your personal data for secondary purposes that are not essential for the requested service, but allow us to enhance your patient experience:

• Educational, marketing, and promotional campaigns.
• Informational updates regarding new procedures or practice announcements.
• Quality control assessments and satisfaction surveys.
• Media Image Usage: Video recordings, testimonials, or clinical photographs for publication on social media or website (requires separate, explicit written consent).

Sensitive Data and Financial Information

To fulfill the purposes outlined in this Privacy Policy, please be informed that sensitive personal data and financial information requiring heightened legal protection WILL be collected and processed.

• Health Data: Comprehensive past and present physical health state, medical history, surgical background, and clinical allergies.
• Biometric Data & Imaging: Physical features and photographic records for medical chart documentation and outcome tracking.
• Financial Data: Tax registration and banking/payment information necessary for payment processing and legal invoicing.

Data Subject Consent

By making this Comprehensive Privacy Notice available to you—whether in person, electronically, or through our website and social channels—and without explicit objection from you, it is understood that you grant your consent to the processing of your personal data according to the terms specified herein.

Providing your data verbally, in writing, or via electronic, digital, or optical means constitutes express consent for the processing of said information.

Furthermore, the Data Subject declares under oath that all personal data provided is accurate, authentic, and complete, authorizing the Data Controller to verify its veracity when necessary for medical service delivery.

Data Transfers and Sharing

Your personal data may be shared or transferred to third parties to fulfill contractual, legal, or medical obligations related to your care. Formal confidentiality agreements are executed with all third parties to guarantee information security.

Receiving third parties are bound to maintain physical, technical, and administrative security measures equivalent to those mandated by law and this Privacy Notice.

Additionally, data may be transferred to competent federal, state, or municipal authorities upon official, legally grounded request or judicial order.

Third parties with whom data may be shared include:

• Hospitals and Surgical Facilities: For surgery scheduling and operating room logistics.
• Supporting Medical Personnel: (Anesthesiologists, surgical nurses, clinical laboratories, pathology labs) necessary for comprehensive patient care.
• Strategic Service Partners: Administrative, IT, or professional service partners operating under strict confidentiality agreements.

If you do not express explicit opposition to these transfers, consent for data sharing as described above is deemed granted.

How to exercise your ARCO Rights (Access, Rectification, Cancellation, and Opposition)?

You have the right to know what personal data we hold about you, what we use it for, and the conditions of its use (Access). You may also request corrections to outdated, inaccurate, or incomplete information (Rectification); request removal from our records or databases when you consider data is not being handled according to legal principles (Cancellation); or oppose data processing for specific secondary purposes (Opposition). These are known as ARCO Rights.

Procedure for exercising ARCO Rights: To exercise any ARCO right, submit a formal request through either of the following channels:

• Via Email: Send your request to privacidad@mavenn.com.mx
• In Person: Submit a written request at our office address listed at the top of this Privacy Notice during regular business hours.

Request Requirements: To process your request, please include the following information and attachments:

• a) Verification: Copy of your valid official photo ID (Passport, Driver's License, or National ID) or legal power of attorney if acting via a legal representative.
• b) Contact Info: Full name, physical address, and email address to receive official responses.
• c) Clear Description: Clear, precise description of the specific personal data and ARCO right(s) you wish to exercise.
• d) Specifics: Relevant details (such as consultation dates or treatment received) that facilitate locating your records.

For complete details regarding processing timelines and procedures, call +52 (999) 354-4523 or contact us at the email provided above.

Usage Limitation, Disclosure, and Data Retention

The Data Controller will retain your personal medical record for a minimum period of 5 years following the last clinical interaction, strictly in accordance with Mexican Official Standard NOM-004-SSA3-2012 governing clinical records. After this statutory period, or as mandated by applicable tax and administrative laws, data will be blocked and securely destroyed.

You may limit the use or disclosure of your data for non-medical purposes (such as opting out of promotional emails) by emailing us. Your contact details will be added to an internal exclusion list to prevent marketing communications.

Privacy Notice Modifications

We reserve the right to amend or update this privacy notice at any time due to legal requirements, healthcare regulations, operational changes, or service updates. Any modifications will be posted visibly in our clinic reception area, published on our official website https://www.mavenn.mx/, or sent directly to the most recent email address you provided.

Best Practices and Regulatory Oversight

Contact & Privacy: We are committed to maintaining maximum confidentiality over your clinical records. If you have questions or concerns about data handling, please contact us directly for personalized assistance.

Regulatory Authority (INAI): If you believe your personal data protection rights have been infringed upon by our actions, or suspect a violation of the Federal Law on Protection of Personal Data Held by Private Parties, you may lodge a formal complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI).

For more information, visit their official website: www.inai.org.mx