This Privacy Policy (and Mexican Privacy Notice) explains how Dr. Francisco Bucio, Plastic Surgery collects, uses, shares and protects your personal data, including your health information, and what rights you have. It applies to this website, to our contact forms, email, phone and video-call consultations, and to the care we provide. It is written to meet Mexican law (the Federal Law on the Protection of Personal Data Held by Private Parties, “LFPDPPP”, and its regulations) and the privacy laws that apply to visitors and patients in the United States.
1. Who is responsible for your data
The data controller (“responsable”) is Dr. Francisco Bucio, Plastic Surgery (“we”, “us”, “Dr. Bucio’s practice”), with its address for this notice at Brasilia 1-Interior 310, Colonia El Paraíso, 22106 Tijuana, Baja California, Mexico.
Surgeries and hospital care take place at VIDA Wellness and Beauty, an independent hospital at the same address. The hospital keeps its own records and is responsible for the data it collects for admission, billing and hospital care; this notice covers the data handled by Dr. Bucio’s practice.
- Privacy contact: info@doctorbucio.com
- Phone (US): +1 619-738-2144. Phone (Mexico): +52 664-748-0003
2. Personal data we collect
We collect only what we need to answer you, evaluate whether a procedure may be right for you, and look after you safely.
Data you give us
- Identification and contact data: full name, email, phone number, country or city, preferred language.
- Consultation preferences: whether you want an in-person consultation or a video call, the procedure you are interested in, your questions and goals.
- Health and body data (sensitive personal data): medical history, medications, allergies, previous surgeries, weight, height, measurements, goals, and the photographs and videos you send for evaluation.
- Records generated during care: consultation notes, photographs taken by our team, surgical and anesthesia consent forms, treatment plans, post-operative follow-up, and clinical records.
- Billing data: the information needed to issue receipts or invoices and to receive payments.
- Communications: messages and call or video-call notes between you and our team.
Data collected automatically
- Basic technical data processed by our website host and content network when you visit: IP address, browser and device type, pages requested, date and time. We use it to deliver the site and keep it secure.
We do not need, and ask you not to send us, government ID numbers, bank card numbers or passwords through the website or the contact form.
If you send information about another person (for example, a family member), you confirm that you are allowed to do so.
3. Health data and your consent
Health information and your medical photographs are sensitive personal data. Under Mexican law we process them only with your express consent, and in the clinical setting with your written consent (including by electronic signature or an equivalent mechanism).
When you send us health information or photos for an evaluation, or tick or sign the consent we provide, you consent to our team and the hospital team involved in your care using it for the purposes described in this notice. You may withdraw that consent at any time (see section 9), understanding that we may need to keep a record of care already provided.
Do not use the website or the contact form for medical emergencies. If you have an emergency, call local emergency services (911 in the United States and in Mexico) or go to the nearest hospital.
4. Why we use your data
Primary purposes (needed for the service you ask for)
- Reply to your questions and contact requests.
- Schedule and hold in-person consultations and video calls.
- Evaluate your goals and whether a procedure is appropriate and safe for you (pre-qualification).
- Plan and perform procedures, coordinate with the hospital, anesthesia and recovery teams, and provide post-operative follow-up.
- Create and keep your clinical record, as required by Mexican health regulations.
- Billing, payments, accounting and tax compliance.
- Protect our rights, prevent fraud, keep the site secure and comply with legal obligations and requests from competent authorities.
Secondary purposes (optional)
- Send you information about our services, educational content and follow-up messages after your inquiry.
- Publish your testimonial, results or photographs on our website or social networks, only if you give us a separate written authorization that says exactly what will be shown.
- Quality improvement and satisfaction surveys.
You can refuse the secondary purposes at any time, now or later, by writing to info@doctorbucio.com with the subject “No secondary purposes” (“Finalidades secundarias”). Refusing them will never affect the care or the answers you receive.
We never publish identifiable photographs, videos or testimonials of patients without your prior written authorization, and you can revoke it. If you revoke it, we will stop new uses and remove the material from our own channels within a reasonable time, though we cannot control copies that others have already shared.
5. Who we share your data with
We do not sell your personal data and we do not share it for cross-context behavioral advertising. We share it only when needed, and only the part that is needed, with:
- VIDA Wellness and Beauty (the hospital) and the clinical team involved in your care: anesthesiologists, nurses, laboratories, imaging, pharmacies and other health professionals you or we refer you to.
- Service providers acting on our behalf under confidentiality obligations: email, phone, video-call and messaging tools, secure cloud storage, website hosting, scheduling, accounting and payment processing.
- Recovery, lodging or transportation services in Tijuana, only if you ask us to arrange them.
- Your other doctors or a US provider, only if you ask us to or authorize us in writing.
- Competent authorities, courts or regulators when the law requires it.
- A successor to the practice in a lawful transfer of the business, who must respect this notice.
Some of these recipients are located outside Mexico, including in the United States. For transfers that need your consent under Mexican law, your consent to this notice and to the consent we provide in the clinical setting covers them. Transfers that are necessary for your care, to comply with a contract with you, or required by law do not need additional consent.
6. Our website, cookies and third-party content
When you first visit, a cookie banner lets you accept or reject optional cookies. Necessary cookies keep the site working, protect the contact form from spam and remember your choice; they cannot be turned off. Analytics cookies (Google Analytics, through Google Tag Manager) and advertising cookies stay off until you accept them. You can change your choice at any time with the cookie button in the lower-left corner of every page.
With your permission, we use Google Analytics to measure visits, page interactions, consultation-button sources and campaign attribution. We do not send your name, email address, phone number, form answers or health information to these analytics tools through our custom events. If you reject analytics cookies, Google may still receive limited, cookieless signals under its Consent Mode, without identifiers stored on your device.
Our contact form is protected by Cloudflare Turnstile, a security check that helps block automated spam. Turnstile may process technical data such as your IP address and browser information under Cloudflare’s privacy policy.
Some pages include content from other companies: a Google Maps embed (loaded with the page), and YouTube, Facebook and TikTok video players (loaded only when you press play). Links lead to Instagram, Facebook, TikTok and Google. Those companies may set cookies or collect data such as your IP address under their own privacy policies, which we do not control.
Our contact form transmits the information you provide through a form-processing provider so it can be delivered to Dr. Bucio’s team. Please provide only the information requested and do not use the form for emergencies.
We do not use your form answers or health information for advertising or cross-site behavioral tracking.
7. How long we keep your data and how we protect it
- Clinical records are kept for the period required by Mexican health regulations (currently at least five years from the last entry, per NOM-004-SSA3-2012) and longer when the law or a legal claim requires it.
- Inquiries that do not become patients are kept for up to 24 months, then deleted or anonymized.
- Billing and tax records are kept for the periods set by tax law.
- Marketing preferences are kept until you withdraw them.
We use administrative, technical and physical safeguards appropriate to the sensitivity of the data: restricted access on a need-to-know basis, confidentiality commitments for staff and providers, encryption and secure storage for digital files. No system is completely secure. If a security breach significantly affects your property or moral rights, we will tell you promptly and explain what you can do, as required by applicable law.
8. Your rights in Mexico (ARCO rights)
Under the LFPDPPP you have the right to:
- Access the personal data we hold about you and how we use it.
- Rectify your data if it is inaccurate or incomplete.
- Cancel your data, so that we stop using it and delete it once any blocking period and legal retention period have ended.
- Oppose the use of your data for specific purposes.
- Revoke your consent and limit the use or disclosure of your data at any time.
To exercise any of these rights, send a request to info@doctorbucio.com with: your full name and a contact address or email for our reply; a copy of an official identification (or your representative’s, with a power of attorney or authorization letter); a clear description of the data and the right you wish to exercise; and any document that helps us find your data.
We will answer within the legal deadline (currently 20 business days from receiving your complete request) and, if it is granted, apply it within 15 business days after that. Where the law allows, we may charge only the cost of reproduction or shipping. We may refuse a request in the cases the law allows, and we will tell you why.
If you believe your rights were violated, you may file a complaint with the authority that supervises personal data protection in Mexico (currently the Secretaría Anticorrupción y Buen Gobierno, which took over the functions of INAI) or with the authority that replaces it.
9. Your rights in the United States
HIPAA
Dr. Bucio’s practice and VIDA Wellness and Beauty operate in Mexico and are generally not “covered entities” under the US Health Insurance Portability and Accountability Act (HIPAA). Even so, we apply confidentiality and security safeguards comparable to those expected of a medical practice. If you ask us to exchange records with a US provider, we will do so only with your written authorization.
State privacy laws, including California
Depending on where you live (for example California under the CCPA/CPRA, and states such as Colorado, Connecticut, Virginia, Texas, Oregon and others with comprehensive privacy laws), you may have the right to know and access the personal data we hold, to correct it, to delete it, to receive a copy in a portable format, to limit the use of sensitive personal information, to opt out of the sale or sharing of personal data or targeted advertising, and to be free from discrimination for using these rights. In some states you may appeal a refusal.
- In the past 12 months we have collected the categories of data listed in section 2 (identifiers, contact data, health and body data, commercial information about your inquiry, and basic internet data), from you and from our website host, for the purposes in section 4.
- We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not knowingly sell or share the data of anyone under 18.
- We use sensitive personal information (health data, photographs) only to provide the services you request and as permitted by law, so there is no “limit the use” choice to make beyond withdrawing your consent.
- We do not use your data for automated decisions that have legal or similarly significant effects on you.
Consumer health data (Washington, Nevada, Connecticut and similar laws)
We collect health-related information only with your consent and only to provide the service you ask for. We do not sell it and do not use geofencing around health facilities. You can withdraw consent and ask us to delete this data by writing to info@doctorbucio.com.
California “Shine the Light”
We do not disclose personal information to third parties for their own direct marketing purposes.
How to make a request
Write to info@doctorbucio.com or call +1 619-738-2144, stating your state and the right you want to exercise. We will verify your identity (for example by confirming the contact details you gave us), and answer within 45 days, which we may extend once by another 45 days when permitted. You may use an authorized agent with your written permission. If we refuse, you can ask us to reconsider, and you may contact your state attorney general or privacy authority.
10. Emails, calls and text messages
We contact you in response to your inquiry and to coordinate your care. We send marketing emails or texts only if you agreed to receive them. Every marketing email has an unsubscribe link, and you can reply STOP to any marketing text. Message and data rates may apply. We do not use automatic dialers or pre-recorded messages for marketing without your prior express written consent. Consent to marketing is never a condition for receiving care.
11. Minors
Our services and website are intended for adults. We do not knowingly collect personal data from anyone under 18 without the verifiable consent of a parent or legal guardian, and we do not knowingly collect data from children under 13. If you believe a minor has sent us data, write to info@doctorbucio.com and we will delete it.
12. Visitors from outside Mexico and the United States
Your data is processed in Mexico and, through our service providers, possibly in the United States. By contacting us you understand that Mexican law applies to our processing, together with the US laws mentioned above where they apply to you. This website is not directed at residents of the European Economic Area or the United Kingdom; if you are one of them and contact us, write to info@doctorbucio.com to exercise any rights you have under your local law.
13. Changes to this notice
We may update this notice for legal, technical or business reasons. The current version is always on this page with its “last updated” date. If a change is significant, for example a new purpose or recipient that needs your consent, we will tell you by email or on our website before it applies to your data.
This notice is available in English and Spanish. If the two versions differ, the Spanish version (“Aviso de Privacidad”) prevails for data subjects in Mexico.
14. Questions and contact
For any question, request or complaint about your personal data, contact our privacy team:
- Email: info@doctorbucio.com
- Phone (US): +1 619-738-2144. Phone (Mexico): +52 664-748-0003
- Mail: Dr. Francisco Bucio, Plastic Surgery, Brasilia 1-Interior 310, El Paraíso, 22106 Tijuana, B.C., Mexico