Notice of Privacy

Instituto Médico Láser SA de CV, with address at Mozart Number 717 Colonia Obispado, in Monterrey Nuevo León, Postal Code 64060, Telephone (81) 2872 9690, is responsible for collecting your personal data, the use that is given to them and of your protection; also complying with respect for the right to privacy and the informative self-determination of people in compliance with the provisions of the Law on Protection of Personal Data Held by Private Parties and its Regulations, in accordance with the principles of legality, consent, information, quality, purpose , loyalty, proportionality and responsibility. Your information will be used to provide the services and products you have requested, inform you about changes in them and evaluate the quality of the service we provide; as well as to:Provide medical care (diagnostic, therapeutic, research services, etc.), complying with standards through internal processes to ensure quality and patient safety in our facilities; agreeing the possible transfer to third parties such as, but not limited to: Various health professionals, technicians and auxiliaries, as well as other private entities for subrogated services in relation to care (hospitals, laboratories, cabinets, insurers, among others) .Invoicing and collection. Comply with the obligations derived from the adhesion contract. Comply with current applicable legislation. Respond to requirements of competent authorities. Attend to their comments related to the provision of services. Send notices and information about our services. Contribute to the continuous improvement process. For the aforementioned purposes, we need to obtain your personal identification data and sensitive personal data provided directly by you or by an authorized third party.

The personal data considered as identification are all those related to the identification of the person (full name, address, landline and/or cell phone, company for which he works, fingerprints, date of birth, nationality, place of birth, occupation , medical history of the patients and/or their direct relatives). The personal data considered as sensitive are all those related to the health of the person (clinical history, habits, way of life, apparent illnesses, allergies and medications taken at the time of requesting the provision of services, state of health in general present, genetic information, religious, philosophical or moral beliefs, and sexual preferences, among others), which will be kept under the strictest confidentiality and may not be given a use other than those mentioned above, unless there is a change in this Notice of Privacy. Likewise, we inform you that your personal data may be transferred and processed inside and outside the country, by people other than this company. In this sense, your information may be shared with: Person or family member authorized by the patient.II. Health professionals for health reasonsIII. Insurance Companies and/or Financial Institutions legally constituted and authorized by Mexican and foreign laws that have granted an insurance policy in favor of a patient, for the purpose of collecting premiums or deductibles pending from patients, or for the purpose to request the payment of fees in favor of Clínica María Luisa. IV. Manage loyalty programs.V. Business partners of the person in charge, in order for them to manage and operate complementary services to those of the person in charge. VI. Companies or third parties that operate jointly with the person in charge any product, service or any software or computer infrastructure that serves as a platform for carrying out operations or services. VII. Third-party providers of services or sellers of products necessary for the operation of the person in charge, as well as commission agents that carry out operations or provide services to the person in charge that it may carry out in accordance with current legislation and its bylaws, such as, among others, commission agents , data processors, marketing material delivery companies, courier companies, security companies, securities transport companies, advertising agencies, information guards, in order for them to assist in carrying out the purposes set forth in this privacy notice .VIII. Professionals, advisors or external consultants, for the purpose of managing sales operations, services and other acts that the person in charge may carry out in accordance with current legislation and its bylaws, as well as for the defense of its interests in the event of any dispute. legal that arises due to said operations and services, such as collection agencies, external auditors, legal, accounting, etc. IX. All those governmental and/or judicial dependencies that by ministry of law request and/or require personal data of their clients and/or relatives from the person in charge, necessary for the fulfillment of diverse legislations. In any case, the full content of this notice and the purposes to which the owner subject its treatment will be communicated to said third parties, who will assume the same obligations that correspond to the person in charge who transfers the data, making their treatment consistent and attached to this notice. of privacy. If you do not express your opposition so that your personal data is transferred, it will be understood that you have given your consent for it. We reserve the right to change this Privacy Notice at any time.

We will not be responsible if you do not receive the notification of changes in the Privacy Notice, if there is any problem with your email account or data transmission over the Internet. Once the purpose of processing personal data is fulfilled, these will be blocked for the sole purpose of determining possible responsibilities in relation to their treatment, until the term of legal or contractual prescription of these. During this period, the personal data may not be processed and after this, it will be canceled in the corresponding database, if you do not express your opposition so that your personal data is transferred, it will be understood that you have granted your consent to it. You have the right to access, rectify and cancel your personal data, as well as to oppose their treatment or revoke the consent that you have given us for this purpose, through the procedures that we have implemented: To activate said procedures, please submit a written request (request to exercise ARCO Rights) addressed to Administrative Management and containing the following information: I. The name of the holder and address, as well as any additional information that serves to contact him, including his email.II. The documents that prove the identity or, where appropriate, the legal representation of the owner.III. The clear and precise description of the personal data with respect to which one seeks to exercise any of the aforementioned rights and in case of requesting data rectification, must accompany the documentation that supports your request. IV. Any other element or document that facilitates the location of personal data and/or attention to the request; Handwritten signature of the owner.- The Controller will respond to your Request to Exercise ARCO Rights and the reasons for its decision, by certified mail (at an additional cost) or to your email address, within a maximum period of 20 business days. The exercise of the ARCO Rights will be free, but you must cover the justified costs of sending the documentation if necessary, any questions or comments you can contact our personal data department. The presentation of the document must be done at the following address: Mozart Number 717 Colonia Obispado, in Monterrey Nuevo León, Postal Code 64060, Telephone (81) 2872 9690 or with Juancarlos Langle Duarte We guarantee the protection of your data by appointing a person in charge to attend to your requests for access, rectification, cancellation and opposition of your personal data. Having the necessary security measures to guarantee your data against improper or illicit use, unauthorized access, or against the loss, alteration, theft or modification of your personal information. Training staff. Informing you about the use that will be given to your information. What and what are the guiding principles of the protection of personal data? They are a series of minimum rules that must be observed by private entities that process personal data (natural or legal persons), guaranteeing the proper use of personal information. These principles are:- Principle of Legality: It refers to the commitment that private entities (individuals or legal entities) that process your information must assume when the provision of a service is requested, respecting at all times the trust granted to them to the good use that will be given to the data.- Principle of Consent: For the private entities to which the information is granted, it implies the duty to request express authorization in writing so that the information can be processed. - Principle of Quality: It refers to the fact that the personal data held by individuals must be updated, be true; that are used to comply with the purposes that justified their treatment.- Principle of Information: Refers to the right granted by the Law to know the main characteristics of the treatment of your personal data prior to sharing them; and this is contained in the "Privacy Notice".- Principle of Proportionality: Companies may only collect the data that is strictly necessary and essential to fulfill the objective.- Principle of Responsibility: Private entities (whether natural or legal persons) and those who make them up, who handle personal data, must ensure that, whether inside or outside our country, the essential principles of personal data protection are complied with, committing to always ensure compliance with these principles and to be accountable in the event of breach. ARCO Rights ARCO means: Access, Rectification, Cancellation and Opposition- Right of Access: It is the right granted by law to request the private entity to inform you if any of your personal data exists in its database.- Right of Rectification: It is the right granted by the Law to have your personal data corrected in the database of the private entities that contain them; this applies when the data is incorrect, imprecise, incomplete or not updated.- Cancellation Right: It is the right granted by the Law to request the cancellation of your data from the bases of a private entity; and therefore these must be blocked and subsequently deleted from the databases. It is only appropriate when the personal information is no longer necessary for the activities related to the private entity that has it in its bases.- Right of Opposition: It is the right granted by the Law to request the private entity that plans to carry out the treatment of your personal data to refrain from doing so in certain situations. In the event that you do not want your personal data to be processed for these additional purposes, or if you consider that your right to the protection of your personal data has been injured by any conduct or omission on our part, or presumes any violation of the provisions set forth in the Federal Law for the Protection of Personal Data Held by Private Parties, its regulations and other applicable ordinances, you may file your disagreement or complaint with the National Institute for Access to Information and Data Protection (INAI).

For more information, we suggest you visit its official website www.ifai.org.mx. Any change made to this privacy notice will be incorporated into it by the person in charge and will be made known through any of the following means: I.- Visible advertisements in our establishments II.- Leaflets or brochures available in our establishments III .- On our website: www.iml.com.mx Privacy Notice for Video Surveillance We inform you that you are being recorded by the security cameras of Instituto Médico Láser SA de C.V. with address Mozart Number 717 Colonia Obispado, in Monterrey Nuevo León, Zip Code 64060. The sounds and images will be used to provide security to you and other visitors. For more information on the terms and conditions under which your personal data will be processed, you can consult our Comprehensive Privacy Notice in our facilities in the reception area, sales area and in the administrative area Responsible for personal data purpose of data management personal treatment of sensitive data transfer limitation of use and disclosure of personal data, means to exercise arch rights (access, rectification, cancellation and opposition) consent video-recorded area.