Full privacy notice.

Last updated: October 4, 2026.

Who is responsible and how to contact us

Alejandra Grueso Baron, responsible for ALDental, is the controller of the personal data described in this notice. Address: Cristóbal Colón 1032, Zona Centro, 22000 Tijuana, Baja California, Mexico.

For privacy matters and requests about your data: [email protected]. You may also visit the address above or call +52 663 431 2400 for guidance. Address your request to ALDental’s data controller.

Data we may process

Depending on the service or request, and only as needed, we may collect:

• Identification and contact: name, date of birth, telephone, email, address, signature, information to verify identity and emergency contact.
• Administration and billing: appointments, tax information and payment details needed for the requested service.
• Sensitive health data: medical history, allergies, medications, studies, radiographs, clinical photographs, diagnoses and treatments.
• Browsing: technical and analytics data explained in the website section of this notice.

You do not need to send clinical records or photographs to browse this website. Avoid including health information or identification documents in messages that do not require them.

Why data is used

Necessary purposes: coordinating appointments; assessing and providing dental care; maintaining and following up clinical records; coordinating studies and consultations; answering questions; managing payments, billing and, where applicable, insurance matters; and meeting applicable obligations.

Optional purposes: prevention and educational communications, promotions and satisfaction surveys. You may refuse these uses or ask that they stop by emailing [email protected] and specifying which uses you wish to limit. Refusing optional purposes does not affect your access to dental care.

Processing sensitive data requires express written consent, except where a legal exception applies. This notice and closing the website banner do not replace that consent. Promotional use of clinical photographs or cases requires specific authorization separate from their use in care.

Who may receive data

Depending on your care needs or the requested procedure, relevant data may be shared with:

• Laboratories: to carry out studies or laboratory work related to your dental care.
• External specialists: for consultations, referrals and continuity of care.
• Insurers: to manage coverage, authorizations or reimbursements related to your care, where applicable. This does not mean that every treatment is covered.

Sharing is limited to the data needed for the relevant purpose. Providers processing data on the controller’s behalf must be distinguished from third parties receiving it as independent controllers.

Your choice about transfers: when a transfer requires your consent, it will be requested before the transfer takes place. You may state “I accept” or “I do not accept” transfers requiring consent in the relevant document, or communicate your decision to [email protected]; sensitive data requires the applicable form of consent. Browsing or closing the banner does not imply acceptance. Legal exceptions are assessed case by case, not as blanket authorization to share data.

Access, rectification, cancellation and opposition

You may request access to your data, corrections, cancellation or opposition to its processing (ARCO rights under Mexican law). Email [email protected] with the subject “Privacy — ARCO request” and include:

• Your name and a way to receive a response.
• The right you wish to exercise and a description of your request; identify the data where relevant.
• Information to help locate the record and, for corrections, the requested change and supporting information.

Your identity must be verified and, if you act on someone else’s behalf, your authority to represent them. Before sending identification or clinical documents, ask through the same channel how to provide them appropriately. Access may be provided through electronic documents after identity verification.

The legal deadline for communicating a decision is up to 20 business days after receipt of the request and, if granted, up to a further 15 business days after the response to implement it; the law permits a justified extension for an equal period. Exercising these rights is free, subject to legally permitted reproduction or delivery costs.

Withdraw consent or limit use of your data

You may use the same email to request withdrawal of consent or limits on use or disclosure, identifying the processing or communication you wish to stop. Withdrawal is not retroactive. Some obligations may prevent immediate cancellation or ending retention of certain data; the response must explain the applicable reasons.

Retention and care of information

Clinical records and administrative documents are retained according to care purposes and applicable health, tax and other obligations. The website analytics periods below do not apply to clinical records. When retention is no longer necessary, data is blocked or deleted as appropriate.

You can use the privacy contact to ask about the criteria applicable to a particular record or report a concern about access or disclosure. No transmission or storage method can promise absolute security.

Navigation analytics

Analytics start by default when you visit this website, with a visible notice and an option to disable them. They help us understand visited pages, viewed sections, active time, reading progress and WhatsApp clicks.

We record the page path, language, device category, traffic source and campaign labels, along with random session and page identifiers. These identifiers are pseudonymous, not fully anonymous. Events are processed using Supabase.

This analytics system does not capture form contents, WhatsApp conversations or clinical records. A WhatsApp click does not confirm a conversation, appointment or treatment.

Navigation events are retained for approximately 90 days and can only be viewed by authorized administrative accounts. To limit abusive submissions, we use a technical connection-derived identifier, kept separately from events for approximately two days.

Your analytics controls

Select “Disable analytics” in the notice or open “Privacy preferences” at the bottom of any page. Disabling analytics stops new submissions and removes the session identifier in this browser; it does not delete previously submitted events. The initial banner hides automatically after five seconds and does not reappear as you move between pages in this tab. If you interact with it or open “Privacy preferences”, it stays available until you close it. Hiding it, automatically or with “Close”, does not record explicit acceptance or change your analytics choice.

Your preference is saved in this browser’s local storage. Analytics sessions use session storage and renew after 30 minutes of inactivity. If you clear site data or change browsers, you will need to set your preference again. We honor Global Privacy Control and Do Not Track signals.

Technical services and external links

The website uses Cloudflare for delivery, protection and technical statistics, and Supabase for its own functions and analytics. It may also load Google maps and fonts. These services receive technical information needed for requests, such as IP address and browser details. When you use WhatsApp or open an external video or link, those providers are also involved under their own policies.

“Disable analytics” controls the first-party analytics described above; it does not configure external services or disable technical requests needed to deliver the website. You can manage website permissions and data in your browser.

Updates and ongoing access

Updates are published at this address with an updated date. You may request information or a copy at [email protected]. The full notice remains available after the initial banner disappears.

Legal reference: Mexico’s Federal Law on Protection of Personal Data Held by Private Parties (Spanish).