Privacy notice

Who is responsible for your data

Dr. David Alejandro Rojas Hernández, Internal Medicine specialist, Mexican professional license 12106541 and specialty license 15925743, board-certified by the Mexican Council of Internal Medicine, is responsible for the processing of your personal data.

Address: Mariano Escobedo 339, Primer Cuadro, 80000 Culiacán Rosales, Sinaloa, Mexico. Email: david_alerojas@hotmail.com.

This notice applies to his patients —seen in Culiacán and La Cruz de Elota, online, at home, in hospital and in care homes—, to anyone who writes to request an appointment, and to anyone visiting this website.

What data is collected

Depending on the case, the following is collected:

• Identification and contact: name, date of birth, sex, phone number and address.
• Health data, which is sensitive personal data: history, conditions, medication, test results, physical examination, diagnoses and clinical course.
• Tax details, only if you request an invoice.
• Browsing data from this site: pages visited, device type and traffic source, in aggregate and without identifying you.

The data is provided by you or a family member, appears in the studies and records you bring, or is generated at each consultation. This website collects nothing beyond browsing data: what you write to book travels through WhatsApp from your own phone and the site does not store it.

How it is used

These purposes are necessary for your care:

• Providing medical care, issuing prescriptions and test requests.
• Creating and keeping your medical record.
• Contacting you or your family member, by WhatsApp or phone, about appointments, results and treatment adjustments.
• Charging for the consultation and, if you request one, issuing an invoice.
• Meeting the obligations the law places on a physician.

Some purposes require your consent and are not carried out without it: using your case, images or studies for teaching, outreach or publication. Your data is not used for advertising, and no photograph, image or data of yours is published on social media or any other medium without your written authorization.

Your consent for health data

Health data is sensitive personal data. Mexico's Federal Law on Protection of Personal Data Held by Private Parties requires the patient's express written consent to process it (article 8); that is why your signature is requested when your record is created.

The same law lists cases in which your consent is not required (article 9). For example: an emergency in which you are not in a position to give it, provided your data is indispensable for your care and whoever handles it is bound by professional secrecy; an obligation imposed by law; or a duly grounded order from a competent authority. If the reason was an emergency, your consent is requested as soon as you are able to give it. In all cases your data is handled under professional secrecy.

How it is stored and for how long

The medical record is electronic, protected by security measures and kept in cloud storage services; communication with you goes through WhatsApp. These third-party platforms are used only for what your care requires.

The record is kept for at least five years from the last episode of care, under Mexican standard NOM-004-SSA3-2012 on the clinical record. After that period it is securely deleted, unless the law requires keeping it longer.

Who it is shared with

Your data is never sold or transferred. It is shared only:

• With other physicians, laboratories, imaging centres or hospitals, when your care requires it or you request it.
• With the care-home staff looking after you, if that applies, and only what is needed for your care.
• With a health or judicial authority that requires it under the law, or with whoever treats you in an emergency.

How to limit the use or disclosure of your data

In addition to your ARCO rights, you may ask at any time, without this affecting your care:

• That you not be contacted via WhatsApp and that phone calls be used instead.
• That information not be shared with a particular family member, carer or care-home staff.
• That your case, images and studies not be used for teaching or outreach.
• That you not be sent appointment reminders or follow-up messages.

Simply say so during your consultation or write to the contact email or WhatsApp number. It is noted in your record.

Cookies and site measurement

This site is hosted on Vercel and measures its use with Vercel Web Analytics and Speed Insights. Without identifying you, they record the page visited, the page you came from, your approximate city, device type, operating system and browser, as well as loading speed. They do not use third-party cookies: each visit is counted with a temporary identifier that is discarded after 24 hours.

When someone completes the booking form and taps «Send via WhatsApp», the site counts, without identifying you, which format was chosen: in person in Culiacán, in person in La Cruz de Elota, or online. Your name, your reason for the visit and anything you write are never recorded.

This site does not use the Meta pixel or any other advertising tool that follows your browsing. The practice's Facebook ads run inside Facebook and install nothing on this site; what happens inside Facebook is governed by Meta's privacy policy. If such a tool is ever enabled, this notice will be updated beforehand.

The only thing the site stores in your own browser is the language you chose (Spanish or English).

Your rights

You may access your data, rectify it if it is wrong, cancel it or object to its use (ARCO rights), as well as withdraw your consent or ask that the use of your data be limited.

To do so, send your request to david_alerojas@hotmail.com or via WhatsApp to the contact number, stating your name, a copy of your ID, what you are requesting and, where applicable, the data you wish corrected. You will receive a reply within 20 days at most and, if your request is granted, it takes effect within the following 15 days; the law allows each period to be extended once when the case justifies it (article 31).

If you ask to cancel your data, this is what happens:

• Data that is not part of the clinical record and that no law requires keeping is deleted.
• The clinical record cannot be deleted immediately: Mexican standard NOM-004-SSA3-2012 requires keeping it for at least five years from the last episode of care, and the law allows it to be kept, solely for that purpose, while liability arising from your care can still be claimed (article 24).
• During that time the record is blocked: it is kept separately, no longer used for follow-up, reminders or any other purpose, and only consulted if you request it, if a competent authority requires it, or to address liability arising from your care.
• Once that period ends, the record is securely deleted and you are notified.
• The reply to your request states which data was deleted, which was blocked, and why.

If you believe your rights have not been respected, you may turn to the Secretaría Anticorrupción y Buen Gobierno, the authority that took over the functions of the former INAI in matters of data protection.

Changes to this notice

Any change is published on this same page, with its new update date. We suggest reviewing it if you send information through the site again.

Last updated: October 2026.