NOTICE OF PRIVACY

Medical Trip Comprehensive Medical Tourism Services in Mexico, we reiterate the commitment to conduct our privacy policies under the administrative, physical and technical security measures necessary for the proper processing of the personal data of our Owners, under the principles of legality, consent, information, quality, purpose, loyalty, proportionality and responsibility in the service.

This PRIVACY NOTICE is made available to the general public and to the owners from whom personal data is received, which will be used for the purposes established in this format, under its terms and those established in the Federal Law for the Protection of Data. Personal Data Held by Private Parties (LFPDPPP), its Regulations and Guidelines.

Hereinafter it is understood by:

Responsible: Private natural or legal person who decides on the processing of personal data

Owner: The natural person to whom the personal data correspond.

Processor: Natural or legal person who, alone or jointly with others, processes personal data on behalf of the person responsible.

Third party: Natural or legal person, national or foreign, other than the owner or person responsible for the data.

IDENTITY AND ADDRESS OF THE RESPONSIBLE

PALM PROVEEDORA DE INSUMOS SC by its commercial name “MEDICAL TRIP” indicates as its address for all purposes and obligations related to this PRIVACY NOTICE, the one located in Escobedo, number 156, Esquina con Fronteras, Postal Code 83190, Colonia San Benito in Hermosillo, Sonora, Mexico. Contact telephone: (662) 127 8222 and Email: atencionalcliente@serviciosdeturismomedico.com

PURPOSES OF DATA PROCESSING

Our main purpose is to provide you with national and international facilitation, promotion and development services, on the provision of medical services, tourism services, medical and health tourism, facilitating access to medical and tourist care in accordance with policies, procedures, protocols, applicable regulations and others that must be used, to fulfill the purpose of the services requested by the owner and the correct use of their Personal Data. Purposes within which your Data may be used, including but not limited to the following:

Main purposes

Formalize a legal/contractual relationship between the Owner (person requesting our services) and the Medical Trip Manager, with the obtaining of the requested services through the media, via telephone, electronic and/or instant messaging, digital platforms, official websites. or physically; enforce the activities and obligations arising from any legal/contractual relationship originated by the provision of our services. Guide the Owner to obtain health services, tourism, travel, hotels, restaurants, clinics, hospitals, transportation and mobilization, care medical, and the activities and/or services demanded by the medical and health tourism industry, providing the necessary information for this, without clinical diagnoses being issued through our services by Medical Trip. Request under formats and accounts official, information necessary to facilitate obtaining our services and that of medical and health service providers, as well as those tourist services with which Medical Trip has a contractual and/or commercial relationship. The information requested constitutes an important factor for the quality of our service, always taking care of the sphere of your privacy and your clinical status, which will integrate a file that facilitates the provision of requested services. Medical Trip acts as an agent, intermediary, broker, facilitator, third-party administrator, liaison and/or representative in the plans/packages of the medical, surgical, health and wellness service providers, as well as those tourist services with which Medical Trip has any contractual and/or commercial relationship. Therefore, your personal data will be shared with third parties related to the nature of our requested services, with our business partners and/or suppliers, only when required by the relationship, applicable legislation, including compliance with the Federal Law for Prevention and Identification of Operations with resources of illicit origin and other relatives. Celebrate all types of agreements that may arise from the nature of provision and obtaining of our services. Request and incorporate personal data, sensitive personal data, images, videos, public and private documents to our physical and/or electronic files for administrative activities, creation of your file, monitoring and conclusion of the provision of the service and other activities necessary for the proper conclusion of the relationship between Controller and Owner. Share your data with family members and/or institutions hospital in case of medical emergency, surgical intervention, accidents, acts of God or force majeure, derived from any service requested with Medical Trip and its suppliers. Carry out administrative activities, payment processes, billing, credits, collections, via electronic transfers and/or payments with bank cards, or checks if applicable when purchasing our products and/or services. For which you may be requested information and physical and/or digital documentation, concerning the payment of the requested services, such as the data necessary to make tax receipts (invoicing), as well as keep records and control of them. Request public and private documents in general (official identifications, powers of attorney, insurance policies, etc.) Administration and management of applications, systems and websites related to the provision of our services. Communicate personal data with individuals and/or legal entities that appear as Managers derived from a legal relationship with the Controller. Monitoring, surveillance control and general security activities of access and protection of the rights and property of both the Owners and the Controller to prevent or detect fraud, abuse, illegal use, violations of our Terms of Service, Conditions and to comply with judicial decisions, government or law requests.

Secondary purposes

Follow up on service requests, suggestions, complaints, doubts, clarifications, or any other that the Owner requires for the provision of our services. Sending notifications, notices and/or messages of offers and promotions of our services. Use your data for statistical purposes, to improve service processes, academic and/or research, market studies, chat participation, for which care will be taken to ensure that you cannot be identified.

Advertising purposes

Send the owner quality and satisfaction evaluation surveys regarding the products and/or services or our website. Your personal contact information (address, telephone and/or email) may be used to send you information about the promotions and characteristics of the products and/or services offered by the Controller, either by the Controller or by advertising and marketing agencies hired by the Controller. Your personal data such as photographs and/or videos regarding the satisfaction of any service provided in your person, may be used for the sole purpose of advertising our work. (See the Consent section and the Options and means section to limit the use or disclosure of data in this PRIVACY NOTICE).

DATA TO COLLECT

To fulfill the purposes established in this PRIVACY NOTICE, the person responsible informs you that the personal data necessary for the adequate provision of our activities and/or services may be collected from you. This procedure may be personal or electronic. , directly or indirectly, through our offices, or by remote means, including but not limited to, and may include all or some of the following:

Personal identification data: Name and surname, email address, address, cell phone or landline, age, sex, nationality, marital status, date of birth, photographs and signature; Federal Taxpayer Registry (RFC), Voting Credential with Photography (INE), Single Identification Card of the Population Registry (CURP), Passports; name, address and telephone number of a family member that you designate as a responsible family member and with whom we can communicate in case of emergency.

In accordance with the applicable health legislation, exclusively for the purpose of a link in the medical or health care that you request to receive, and when the Law on the matter so requires, the following will be requested:

Sensitive personal data: past and present illnesses or diseases, photographs and/or videos about the current situation of the area of your body to be treated medically, genetic information, blood type, physical characteristics (height, weight, complexion, eating habits, etc. ), relevant pathological diseases or operations, vaccines, drug addictions, medical diagnoses, disabilities, educational level, occupation, names of relatives and their clinical history, customs, language or dialect, ideological data such as religious, philosophical or moral beliefs, origin ethnic or racial, photographs or videos (in some cases), among others.

Financial data (if necessary): policy number and other information related to the medical expenses insurance that you have contracted or will be contracted, bank account information and tax information. If you make payment for services by check, we inform you that it may be transferred to any natural or legal person with whom the Controller has entered into a contract for the provision of support services and check transactions.

CONSENT

It is understood that the Owner gives his consent to the processing of his personal data, at the time of having this PRIVACY NOTICE at his disposal and not expressing any opposition.

You are informed that based on sections IV (fourth) and VI (sixth), of article 10 of the Federal Law on Protection of Personal Data Held by Private Parties and other related data, the Responsible Party is not obliged to collect the consent of the Owner for the processing of their personal data, whenever the personal data is essential for medical care, prevention, diagnosis, provision of health care, medical treatments or the creation of health services; as well as the purpose of fulfilling obligations derived from a legal/contractual relationship between the Owner and the Controller. Consent will not be necessary for the processing of personal data when it appears in a public source.

The processing of your personal data, sensitive personal data, financial and property data, is carried out based on the provisions of articles 1, 2, sections V and VI of 3, 8, section VII, of article 26 of the Federal Law of Protection of Personal Data Held by Private Parties (LFPDPPP), article 17 of its Regulations and other relatives. In the event that your personal data such as photographs and/or videos, regarding our services provided, may be used for the advertising purposes established in this PRIVACY NOTICE, the Responsible Party must previously request your written consent and be informed. sent this PRIVACY NOTICE.

In the case of national or international personal data transfers, they may be carried out without the consent of the Owner, when the transfer is necessary for prevention or medical diagnosis, the provision of health care, medical treatment or the management of health services. , among those considered in article 37 of the Federal Law on Protection of Personal Data Held by Private Parties and other relatives.

With clarification regarding the personal data that you provide regarding third parties, it is presumed that you have obtained the consent of the owner in question to carry out said delivery to the Controller, who may request documents or information that proves it. In the case of personal data of minors and people in a state of prohibition or declared incapacity, it is presumed that you have the legal representation provided for in the civil or family legislation that is applicable to you.

OPTIONS AND MEANS TO LIMIT THE USE OR DISCLOSURE OF DATA

If you do not wish to receive any type of information related to the secondary purposes and advertising purposes of this PRIVACY NOTICE, or that your personal data are not used for any of them, we request that you inform the Controller by sending an email to atencionalcliente@serviciosdeturismomedico.com with the following:

Name and surnameClarification of the relationship you have or had with the Controller.Reason or cause why you wish to limit the use or disclosure of your data, as well as the specific data to be limited.

Subsequently, you will receive a response if your request has been received and you will be informed of the deletion or safeguarding of your data for use or disclosure within a period of 20 days, and the period may be extended for justified cause.

It is reported that the Owner has a period of 5 days to express his/her refusal to process his/her personal data with respect to the secondary and advertising purposes of this PRIVACY NOTICE, or those that do not give rise to the legal relationship with the Responsible, being free to exercise their rights to revoke or oppose their consent.

EXERCISE OF YOUR ARCO RIGHTS AND REVOCATION OF CONSENT TO THE PROCESSING OF DATA FOR ANY OF THE PURPOSES ESTABLISHED IN THIS PRIVACY NOTICE

In the event that the owner requires to exercise his rights of Access, Rectification, Cancellation and Opposition (ARCO Rights) to the Processing of his Personal Data in any of its modalities, he will need to do so by sending an email to atencionalcliente@serviciosdeturismomedico.com accrediting with the respective documents, minutes, contracts, etc., accompanied by the following information:

a) Full name and contact information (address with street, number, zip code, city, state, country, telephone, email).

b) Official identification with photograph.

c) Clarification of the relationship/service you have or had with the person responsible.

d) Reason for your request and specify the right (ARCO) that you wish to exercise, accompanied by a clear and precise description regarding the data that you seek to apply these rights.

e) In the case of minors or interdicts, you must verify their legal representation (birth certificate and credential with their photograph).

f) In the case of requesting data rectification, indicate the modifications to be made, providing the documentation that supports the request.

The Controller may ask the Owner to prove that his/her personal data is owned or used by the Owner, as well as require him/her to present the information and documentation described above, physically at the Controller's address on business days and during established working hours.

The response time for your request will be subject to the legal time of 20 business days, counting from the date of receipt of the information and complete documentation, your request being appropriate, what is requested will be granted within a period of 15 business days. . The Responsible Party may extend the response deadlines with justified cause, as established by article 97 of the LFPDPPP Regulations.

In the event that the Owner or his representative does not provide contact information such as address, or other means to send the response to his request, it will be considered not submitted.

DATA TRANSFERS CARRIED OUT BY THE CONTROLLER

It is reported that the Controller may carry out national or international transfers of data without the consent of the Owner, when one of the cases established in article 37 of the Federal Law on Protection of Personal Data in Possession of Individuals (LFPDPPP) occurs.

Article 37.- National or international data transfers may be carried out without the consent of the owner when any of the following situations occur: I. When the transfer is provided for in a Law or Treaty to which Mexico is a party; II. When the transfer is necessary for prevention or medical diagnosis, the provision of healthcare, medical treatment or the management of healthcare services; III. When the transfer is made to holding companies, subsidiaries or affiliates under the common control of the responsible party, or to a parent company or to any company in the same group of the responsible party that operates under the same internal processes and policies; IV. When the transfer is necessary by virtue of a contract concluded or to be concluded in the interest of the owner, by the person responsible and a third party; V. When the transfer is necessary or legally required for the safeguarding of a public interest, or for the procurement or administration of justice; SAW. When the transfer is necessary for the recognition, exercise or defense of a right in a judicial process, and VII. When the transfer is necessary for the maintenance or fulfillment of a legal relationship between the person responsible and the owner.

Medical Tip reserves the right to inform about communications of personal data that exist between it and whoever may be determined as the person in charge of processing personal data, derived from any legal relationship and/or from the provision of a service to process them on behalf of the Medical Tip. Responsible or other Responsible, in the terms of the last paragraph of the twenty-sixth Guideline of the LFPDPPP Privacy Notice Guidelines.

All natural and legal persons, who have individual or joint responsibility, whether of a labor, legal and/or commercial nature, are informed of the treatment, use and/or disclosure of personal data to be collected through the request for Medical Trip services. , has the obligation to conduct itself at all times with the measures and principles established in this PRIVACY NOTICE and those required by Law.

USE ELECTRONIC MEDIA (COOKIES and WEB BEACONS)

In the event that the Owner makes use of platforms, sites, applications or requests the services of the Controller through the use of electronic devices and provides their Personal Data through these channels, it will be understood that they ACCEPT and ACKNOWLEDGE that electronic means can include links to various websites of third parties other than the Controller, of which the latter does not assume any ownership, obligation or responsibility.

When interacting with our website http://serviciosdeturismomedico.com/ through Electronic Means, information may be collected from the owner such as type of browser, operating system, storing their preferences on access sites or identifying them as a User. , through “cookies” or “web beacons”, thereby making it easier for the Controller to analyze the information, improving the performance in speed and loading of the site and/or applications, in order to personalize content and advertising, improving the experience. of the site and eliminating the need to repeatedly specify the same information. The person responsible acknowledges his authorization for the use of “cookies” or “web beacons” with the use of electronic media and the interaction of our website.

If you need to disable these programs, the Owner must do so from the section similar to “Settings”, following the “Privacy and Security” section and after that from the options related to “Cookies and other site data”, this at all times from your browser.

CHANGES TO THE PRIVACY NOTICE.

In the event that this PRIVACY NOTICE is modified and/or updated, the Controller reserves the right to do so at any time, due to changes in legislation, policies, procedures or internal purposes, as well as renewal of requirements for the provision of our services, by communicating through our website http://serviciosdeturismomedico.com/, with the right to oppose modifications and/or additions by notifying us at the email address atencionalcliente@serviciosdeturismomedico.com

Update date of this PRIVACY NOTICE, May 1, 2023.