Privacy notice

Legacy Wellness is responsible for the processing of your personal data, including health data, which is sensitive data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties.

Name, phone, email, date of birth, CURP, address, emergency contact and, during medical care, history, allergies, diagnoses, treatments and test results.

Booking and reminding visits, keeping your clinical record (NOM-004-SSA3-2012), providing medical care and, only with your authorisation, sending you information and promotions from the clinic.

By booking you accept this notice. Consent for health data is collected in writing or through a verifiable means at the practice. You may decline informational messages without affecting your care.

You may access, rectify, cancel or object to the processing of your data, and revoke your consent, at the practice or through Legacy Wellness's contact channels. For WhatsApp messages, replying STOP is enough.

To exercise your rights of access, rectification, cancellation or objection (ARCO rights), revoke your consent or limit the use of your data, send your request to the data controller:

Data controller

Legacy Wellness

You can also file it in person at the practice.

Your request must include your name, a way to send you the answer, an official ID (yours or your legal representative's), a clear description of the data and the right you want to exercise, and any document that helps locate your data. We will answer within 20 business days at most and, if applicable, give effect to it within the following 15 business days.

Cancellation may not apply to data the law requires us to keep, such as the clinical record (NOM-004-SSA3-2012).

If you believe your request was not handled as the law requires, you may turn to the personal data protection authority.

We do not sell or share your data with third parties for their own purposes. We use infrastructure providers (hosting, database, messaging) under contract and with security measures; the record is kept for as long as health regulations require.

This part applies to the Legacy Wellness mobile app for iPhone and Android. Using it is optional: you can browse treatments and offers without signing in.

Data the app processes

• Your mobile number, to send you the sign-in code by SMS, sign you in and identify your appointment requests.
• The first and last name you enter, your preferred language and whether you agree to receive offers on WhatsApp.
• Your account identifier and session. The session token is stored in your phone's secure storage (Keychain on iPhone, Keystore on Android); on our servers we keep only an irreversible version (hash) of the token, the phone's system (iOS or Android) and when it was created and last used.
• Your device's notification token, only if you turn reminders on. Notifications never show details of your treatment.
• Your appointment requests, appointments, waitlist places and the aftercare instructions for your recent treatments. The app shows them to you; authorised clinic staff see them in the clinic's system.
• Your date of birth, only to confirm that the record is yours when you link your account: we compare it with the one the clinic already has and the app does not store it.
• Your IP address and number, turned into an irreversible version (hash), to limit sign-in attempts and prevent abuse. We do not store your IP in our database (the hosting provider may record it temporarily in its technical logs); these records are deleted after 30 days.

Purposes of the app

Signing you in, showing your appointments and aftercare, receiving and confirming your requests, sending appointment reminders (on WhatsApp if you allow it, or as a notification if you turn it on in the app) and, only with your authorisation, sending you offers on WhatsApp. Offers are never based on your health data or on the treatments you have had.

The app shows no advertising, uses no tracking or advertising tools, does not track you across other companies' apps or websites and does not sell your data.

Processors

Providers that process data on behalf of Legacy Wellness, only to provide their service:

• Twilio (Twilio Verify): sends and checks the SMS code; receives your mobile number.
• Vercel and Neon: hosting of the app and the site, and database.
• Meta (WhatsApp): only if you agree to receive WhatsApp messages.
• Google Firebase (Firebase Cloud Messaging): only to deliver notifications, when they are enabled and you turn them on; receives your device token and a generic text.

Processors act under contract and with security measures, and may process data on servers located outside Mexico. We do not transfer your data to third parties for their own purposes.

Deleting your account

You can delete your account at any time in the app, under Profile › Delete my account. Your number and name are erased from the account, you are signed out on all your devices, your notification tokens are deleted and your pending requests and waitlist places are cancelled. Requests and waitlist entries that never became part of a clinical record also lose your name, number and email; only an anonymous history remains (date, service and status).

Deleting the account does not delete your clinical record: Legacy Wellness keeps it for at least 5 years, as Mexican regulation NOM-004-SSA3-2012 requires.

Any change will be published on this same page.