1. Identity and Address of the Data Controller
COORDINACIÓN MÉDICA MARCAR, SOCIEDAD DE RESPONSABILIDAD LIMITADA DE CAPITAL VARIABLE (hereinafter, “COORDINACIÓN MÉDICA MARCAR, S. de R.L. de C.V.”), operating commercially under the name MACA Medical Journey (“MACA”), is responsible for the processing of personal data collected from prospective patients, patients, family members, caregivers, and individuals requesting information about its orthopedic care coordination services.
Address:
Av. Aztecas No. 539, Col. Monraz, C.P. 44670, Guadalajara, Jalisco, Mexico.
Email for privacy and personal data matters:
contact@macamedicaljourney.com
2. Nature of the Service and Scope of this Notice
MACA provides orthopedic care coordination services for international patients.
MACA is not a hospital, does not perform surgeries, and does not determine medical treatment. Clinical evaluation, diagnosis, treatment decisions, and other medical decisions are the responsibility of the healthcare professionals and institutions involved in each patient’s care.
MACA coordinates communication, documentation, appointment scheduling, logistics, and follow-up around the care plan established by the relevant healthcare professionals.
This Privacy Notice applies to personal data collected by MACA through:
the MACA website;
the medical evaluation request form;
email;
telephone calls;
video calls;
WhatsApp;
additional forms;
documents later provided through channels indicated by MACA; and
communications related to the coordination and follow-up of care.
MACA’s services are intended for individuals 18 years of age or older.
3. Personal Data We Process
Depending on the stage of the process, MACA may process the following categories of information:
A. Identification and Contact Information
full name;
age;
country of residence;
email address;
telephone number;
information about family members, caregivers, companions, or authorized contacts, when applicable.
B. Sensitive Personal Data Related to Health
To review and coordinate a request for care, MACA may process information related to a person’s present or future health status, including:
orthopedic procedure of interest;
reason for consultation;
description of the condition;
symptoms;
previous or potential diagnoses;
medical history;
previous surgeries;
treatments received;
medications;
allergies;
laboratory studies;
imaging studies, X-rays, MRIs, or CT scans;
medical photographs;
medical records or clinical documents;
medical instructions; and
any other health-related information voluntarily provided by the individual or reasonably necessary to coordinate the review of the case.
MACA processes sensitive personal data only when necessary for the purposes described in this Privacy Notice and seeks to limit such processing to the minimum information required.
C. Administrative and Logistical Information
As the process progresses, MACA may process information necessary to coordinate administrative and logistical matters related to:
appointments;
hospitalization;
lodging;
transportation;
rehabilitation;
companion support;
follow-up; and
other services related to the process coordinated by MACA.
MACA may also retain administrative payment records, such as amounts due, deposits received, outstanding balances, or payment status.
MACA does not request or store full credit or debit card numbers, bank account numbers, passwords, banking credentials, or other information used directly to authorize electronic payments.
When a payment is processed by a third party, that provider may process the information necessary to complete the transaction in accordance with its own applicable terms and privacy notices.
4. Purposes of Processing
MACA uses personal data for the following purposes related to the provision of its services:
receiving and responding to requests for information or evaluation;
understanding the reason for the consultation;
determining whether sufficient information is available to continue the process;
coordinating review of the case with the appropriate healthcare professionals or institutions;
requesting additional information when necessary;
communicating the next steps in the process;
coordinating consultations, video calls, and other communications related to the case;
coordinating documentation and scheduling;
coordinating logistical matters related to the hospital, lodging, transportation, rehabilitation, and follow-up;
sharing strictly necessary information with healthcare professionals, hospitals, and other providers involved in the patient’s care;
maintaining administrative and operational records;
managing administrative matters related to payments;
responding to requests related to personal data rights;
complying with legal obligations and requests from competent authorities; and
protecting information and, when necessary, establishing, exercising, or defending legal rights.
5. Use of Information for Advertising and Testimonials
MACA does not use clinical information provided through an evaluation request for advertising, marketing, or commercial profiling purposes.
MACA will also not use photographs, videos, testimonials, medical information, or any other content that identifies an individual for promotional purposes without first obtaining a separate and specific authorization for such use.
Refusing to provide authorization for a testimonial, photograph, or promotional content will not affect the care or coordination services requested.
6. Consent for Sensitive Personal Data
The processing of sensitive personal data related to health requires the express consent of the data subject, except in cases permitted by applicable law.
On the website evaluation form, MACA requests such consent through a mandatory, non-preselected checkboxbefore the request may be submitted.
The checkbox states that the individual has read the Privacy Notice and expressly consents to the processing of their personal data, including sensitive health information.
MACA retains electronic evidence of the consent associated with the corresponding submission.
If MACA later requires additional sensitive information through another communication channel, it may make this Privacy Notice available again and obtain the applicable consent before processing such information.
If the necessary consent for the processing of health information is not provided, MACA may be unable to coordinate the clinical review of the case.
The data subject may revoke consent as described in this Privacy Notice.
7. Access and Confidentiality
Access to personal data within MACA is limited to authorized individuals who need the information to fulfill the purposes described in this Privacy Notice.
Treating physicians, clinical personnel, hospitals, and other healthcare institutions participating in the patient’s care are independent professionals or entities and are not part of MACA.
MACA adopts reasonable measures to limit access to personal information and maintain its confidentiality.
8. Technology Providers and Data Storage
To operate its services, MACA uses technology providers that may be involved in the storage, transmission, or processing of information.
These may include providers of:
website hosting and publishing;
online forms;
email;
file storage and backup;
communications and messaging;
video conferencing; and
technical support.
Some providers may use infrastructure located outside Mexico.
MACA seeks to limit the information made available to each provider to what is necessary for the corresponding function and to use services that maintain reasonable security measures.
9. Transfers of Personal Data
Depending on the stage of the process, MACA may share the personal data necessary with:
treating physicians and medical specialists;
hospitals and clinics;
laboratories;
diagnostic imaging centers;
rehabilitation centers or providers; and
other healthcare professionals or service providers involved in the patient’s care.
MACA limits the information shared to that which is reasonably necessary for the corresponding purpose.
On the evaluation form, MACA separately requests authorization to share the information necessary with the physicians, hospitals, and healthcare providers involved in reviewing and coordinating the case.
Without such authorization, MACA may be unable to coordinate medical review or other stages of the process that require information sharing.
When a transfer may legally be made without consent, MACA will only make such transfer within the circumstances permitted by applicable law.
Logistical Service Providers
When necessary to coordinate services such as lodging or transportation, MACA may share with external providers only the identification, contact, or logistical information required to provide the corresponding service.
MACA does not share clinical information with logistical service providers unless there is a specific need, an applicable legal basis, and such sharing is strictly necessary for the relevant purpose.
10. Options to Limit the Use or Disclosure of Personal Data
The data subject may request that the use or disclosure of their personal data be limited by writing to:
contact@macamedicaljourney.com
Suggested subject line:
Privacy Request — Limitation of Use or Disclosure
The request should clearly describe the use or disclosure the individual wishes to limit.
MACA will review the request considering the purposes necessary to provide the requested services and applicable legal obligations.
Certain limitations may prevent MACA from continuing to coordinate the requested evaluation or care.
11. Revocation of Consent
The data subject may request the revocation of previously granted consent for the processing of personal data by writing to:
contact@macamedicaljourney.com
Suggested subject line:
Privacy Request — Revocation of Consent
MACA may request information or documentation reasonably necessary to verify the identity of the person making the request.
Revocation will not have retroactive effect and may not result in the immediate deletion of certain information where a legal, contractual, or administrative obligation justifies its retention.
Revocation of consent to process health information may prevent MACA from continuing to coordinate the corresponding evaluation or care.
12. ARCO Rights
The data subject or their legal representative may request at any time the exercise of the following rights:
Access: to know what personal data MACA retains and the general conditions under which it is processed.
Rectification: to request correction or updating of inaccurate or incomplete information.
Cancellation: to request cancellation of personal data when legally appropriate.
Objection: to request that a specific processing activity cease when there is a legitimate basis to do so.
To exercise these rights, an email should be sent to:
contact@macamedicaljourney.com
Subject line:
ARCO Request — [Access / Rectification / Cancellation / Objection]
The request should include, as applicable:
the individual’s name and a means of receiving the response;
information or documents sufficient to verify the identity of the data subject or their representative;
a clear description of the personal data involved in the request;
the right the individual wishes to exercise; and
any additional information or documentation that may facilitate processing of the request.
For rectification requests, the individual should specify the information to be corrected and, where applicable, provide supporting documentation.
MACA will communicate its determination within a maximum period of 20 business days from receipt of the request.
If the request is granted, it will be implemented within the 15 business days following communication of the decision.
These periods may be extended when permitted by applicable law and justified by the circumstances.
The exercise of ARCO rights is free of charge, without prejudice to reasonable reproduction or delivery costs that may apply.
If an individual believes that their personal data protection rights have been violated, they may contact the competent personal data protection authority in accordance with applicable law.
13. Data Retention and Deletion
MACA retains personal data only for the period necessary to fulfill the purposes described in this Privacy Notice and to comply with legal, administrative, contractual, or potential liability-related obligations.
When determining the retention period, MACA may consider, among other factors:
the stage of the request or process;
whether an evaluation request progressed;
the existence and duration of a contractual relationship;
applicable legal, tax, or administrative obligations; and
periods related to potential liabilities.
When personal data is no longer necessary for the relevant purposes, MACA will apply the blocking, cancellation, or deletion processes that may be legally appropriate.
Sensitive personal data will be retained only for the period reasonably necessary for the purposes that justified its processing and for applicable obligations.
14. Security Measures
MACA adopts reasonable administrative, technical, and physical measures to protect personal data against damage, loss, alteration, destruction, unauthorized access, or unauthorized processing.
These measures may include:
limiting access to information to individuals who need to know it;
minimizing the amount of information requested at each stage of the process;
using reasonable access and storage controls; and
maintaining confidentiality obligations regarding processed information.
No electronic system, email service, messaging platform, storage tool, or web form can guarantee absolute security.
If MACA becomes aware of a security breach that may significantly affect the rights of data subjects, MACA will act in accordance with the obligations established by applicable law.
15. WhatsApp, Email, and Digital Communications
MACA uses WhatsApp, email, telephone calls, and video calls to provide guidance, organize the process, and communicate next steps.
These platforms are operated by third parties, and their operation and security are not entirely under MACA’s control.
For this reason, MACA applies data minimization principles and recommends that individuals do not send complete medical records, imaging studies, or other sensitive medical documents through WhatsApp until MACA provides an appropriate channel for sharing them.
16. Information About Other Individuals
If an individual provides MACA with personal data relating to a family member, caregiver, companion, or another adult, that individual should have sufficient authorization to share such information and should make reasonable efforts to inform the other person about the existence of this Privacy Notice.
17. Minors
MACA’s services are intended for individuals 18 years of age or older.
MACA does not intentionally request information about minors through its evaluation form.
If MACA identifies that it has received information concerning a minor, it may suspend processing until the appropriate measures are determined and, where applicable, obtain authorization from the person exercising parental authority or guardianship or delete such information.
18. Website Technologies
Our website may use technologies necessary for site operation, security, and basic analytics.
Framer Analytics is used to measure general website activity, such as page views and unique visits. According to Framer, this analytics service does not use cookies or persistent identifiers and does not collect information that identifies individual visitors.
As of the date of this Notice, MACA does not use Meta Pixel, Google Analytics, or Google Tag Manager for advertising tracking or external analytics. If tracking technologies, cookies, pixels, or similar tools are implemented in the future, this Privacy Notice and any applicable consent mechanisms will be updated accordingly.
MACA does not intentionally transmit information submitted through the medical evaluation form or other health-related information to advertising platforms.
19. Changes to this Privacy Notice
MACA may modify this Privacy Notice to reflect legal, operational, or technological changes.
The current version will be available at:
https://macamedicaljourney.com/legal/privacy-policy
and will indicate the date of its most recent update.
When a change is material and affects the purposes of processing or the nature of the data collected, MACA may also communicate the change through available contact channels when appropriate.
20. Privacy Contact
For questions, comments, requests to limit use or disclosure, revocation of consent, or the exercise of ARCO rights:
COORDINACIÓN MÉDICA MARCAR, S. de R.L. de C.V.
Operating commercially under the name MACA Medical Journey
Av. Aztecas No. 539
Col. Monraz, C.P. 44670
Guadalajara, Jalisco, Mexico