Privacy and Personal Data Protection Notice

1. Data controller

The controller responsible for processing personal data is:

Dr. Jocsan Osteopata
Responsible professional: Jocsan Guerrero Quesada
Address: 75 m east of Gasolinera Los Reyes, Orotina Centro, Alajuela Province, Orotina, 20901, Costa Rica
Clinic telephone and WhatsApp: +506 6411 7298
Privacy requests: privacy@drjocsan-osteopata.com

This notice explains how we collect, use, retain, and protect the personal data of people who visit our website, request an appointment, receive care, or communicate with the clinic.

2. Who this notice applies to

This notice applies to:

• website visitors;
• people who request an appointment;
• current and former patients;
• authorized representatives;
• parents, guardians, or legal representatives acting on behalf of a minor;
• people who communicate with the clinic through WhatsApp, telephone, email, or other authorized channels.

3. Personal data we may collect

Depending on how you interact with the clinic, we may collect:

• first and last name;
• date of birth;
• telephone and WhatsApp number;
• email address;
• preferred language;
• requested service;
• requested date and time;
• information needed to coordinate, confirm, cancel, or reschedule an appointment;
• clinical information and relevant history that you choose to provide during care;
• information related to professional care notes;
• information about communications, requests, responses, and consent;
• limited technical information needed to protect and operate the website.

We request only the information needed for the relevant purpose. We do not request detailed clinical information in the public appointment-request form unless it is strictly necessary and expressly indicated.

4. How we use personal data

We use personal data to:

• receive and manage appointment requests;
• securely verify identity and prevent duplicate profiles;
• coordinate schedules and availability;
• confirm, cancel, or reschedule appointments;
• provide professional services and maintain clinical records;
• communicate with you about your appointments and requests;
• send authorized operational communications through WhatsApp, email, or other approved channels;
• respond to requests for access, correction, privacy assistance, or copies of clinical records;
• maintain the security, availability, and operation of the system;
• comply with legal, professional, administrative, or security obligations;
• investigate and resolve incidents, errors, complaints, or requests;
• produce limited aggregate internal statistics that are not intended to identify you individually.

We do not use clinical data for personalized advertising, selling information, commercial profiling, or purposes incompatible with the clinic’s care and administrative operations.

5. Appointments and communications

An appointment request does not mean that the appointment has been confirmed.

The clinic may send a confirmation request through WhatsApp and use recognized responses to manage the appointment status. Delivery, acceptance, or reading of a message by a messaging provider does not by itself confirm an appointment or change its status.

Appointment communications may include only limited operational information, such as your name, date and time, service, clinic location or contact details, instructions needed to respond to or manage the appointment, and a non-sensitive appointment reference.

We do not include diagnoses, clinical history, treatment notes, detailed medical information, or other unnecessary clinical data in appointment messages, operational emails, or calendar events.

6. Providers and third parties

We may use carefully selected providers to operate technical and administrative services, such as hosting and database services, authentication and access control, messaging, email, operational calendar services, backup storage, and technical monitoring and security.

These providers receive only the information necessary to provide the relevant service and must be subject to confidentiality, security, and limited-processing obligations.

Google Calendar and messaging or email providers are operational tools. They are not the clinic’s authority over your appointments, clinical record, or care decisions.

We use a technical traffic-analysis service that operates at the network level, without installing tracking software or identifiers in your browser. This service records only aggregated technical information about requests to the site, such as number of visits, pages viewed, approximate country, response codes, and data volume. It does not receive your name, email address, telephone number, date of birth, appointment information, or any clinical data. We do not use this service on the clinic’s administrative pages.

In addition, we use a first-party product-measurement service, run from the clinic’s own server, that records limited steps in the appointment-request form to understand where people complete or abandon the process. This service does not install trackers or programs in your browser. It records only the selected service, the language, the form step reached, the request outcome, and the day of the week. It does not receive your name, email address, telephone number, date of birth, IP address, free text, appointment identifier, or any clinical data. We delete individual events within thirty days, retaining only aggregate per-day counts that cannot identify you individually.

We do not sell personal data.

7. Clinical records and confidentiality

Information obtained in connection with your professional care is treated as confidential and is limited to authorized personnel who need it to provide, administer, protect, or audit the clinic’s services.

Clinical notes are maintained as a revision history. A correction does not silently delete the previous text or rewrite the clinical history without evidence. Corrections must preserve the reason, responsible person, and relevant date according to the clinic’s procedure.

We do not include clinical notes, diagnoses, medical history, or free-text clinical information in Google Calendar events, statistical analysis, operational messages, or communications that do not require it.

8. Security

We apply reasonable administrative, technical, and organizational security measures, which may include role-based access control, individual user accounts, authentication and permission reviews, relevant activity records, separation between development, testing, and production environments, data minimization in messages, calendars, reports, and technical logs, protected backups, and procedures to detect, investigate, and respond to incidents.

No system can guarantee absolute security. If an incident occurs that may affect your data, the clinic will assess it and act according to its legal, professional, and operational obligations.

9. Retention

We retain each category of personal data only for as long as necessary for its relevant purpose, continuity of care, protection of rights, compliance with applicable legal and professional obligations, and clinic security.

The clinic keeps separate retention categories for:

• appointment requests that did not become care;
• contact information;
• appointments and appointment history;
• clinical records;
• consent records;
• communications and operational evidence;
• audit and security records;
• backups.

The retention period may differ by category. The clinic will not permanently delete clinical records until it has formally adopted and approved a retention schedule compatible with its legal and professional obligations.

Clinical records are not deleted merely because a patient withdraws communications consent, stops using a communication channel, cancels an appointment, or requests that future communications stop.

When personal data is no longer needed and no valid obligation requires its retention, it will be securely deleted, anonymized, or destroyed, as appropriate.

Backups may continue to contain information for the documented backup-retention period. Backup expiry does not replace the clinic’s obligation to protect the information while it remains in backup storage.

The clinic will document retention decisions, review the schedule when legal or professional requirements change, and avoid retaining data indefinitely without a documented reason.

10. Your rights

You may request, as applicable and subject to identity verification and legal limitations:

• access to your personal data;
• a copy of your clinical record;
• information about how your data is used;
• correction or updating of inaccurate data;
• addition of information or a correction to your clinical record;
• review of a request for deletion or restriction where appropriate;
• information about the people or entities authorized to receive your data;
• withdrawal of consent when processing is based on consent;
• submission of a privacy question, complaint, or request.

Correction of a clinical record does not mean deleting or destroying the original history. The clinic will document the correction in a traceable manner.

11. How to submit a request

You may submit a privacy request by email at privacy@drjocsan-osteopata.com or by WhatsApp at +506 6411 7298.

A request received by email or WhatsApp does not by itself establish the identity or authority of the person making the request.

Before releasing a clinical record or a copy containing sensitive information, the clinic will require appropriate identity verification. For the release of a copy of a clinical record, the currently approved operating rule requires in-person verification using an official photo ID, unless an applicable legal obligation provides otherwise.

Requests should include, where possible, the data subject’s name, a secure method of contact, a description of the request, the information or period to which the request relates, and, if you are acting for another person, the authority that permits you to do so.

The clinic will respond to and track requests according to its internal procedure and applicable deadlines.

12. Minors and representatives

When the person receiving care is a minor, the clinic will apply the consent and representation rule approved for Costa Rica and for the relevant service.

The clinic may request evidence of the representative’s identity and authority. A parent, guardian, or representative’s involvement does not automatically authorize unrestricted access to all information if applicable law recognizes confidentiality or consent rights belonging to the minor.

The detailed rule for consent, confidentiality, access, and communications involving minors will be explained before care when applicable.

13. Withdrawal of consent

When an activity depends on your consent, you may request withdrawal through the privacy channels listed in this notice.

Withdrawal applies going forward from the time the clinic can verify and record the request. It does not automatically invalidate treatment or actions carried out before withdrawal, and it does not require the deletion of information that the clinic must retain for legal, professional, security, audit, rights-protection, or continuity-of-care reasons.

Withdrawal may prevent the clinic from continuing to use a communication channel or provide a function that depends on that consent. It does not necessarily cancel an appointment or care that has already been arranged, unless you expressly request cancellation and the clinic can process it under the appointment rules.

The clinic will confirm the practical consequences of withdrawal and, where possible, offer an alternative channel for essential operational communications.

14. Changes to this notice

We may update this notice to reflect legal, professional, technical, or operational changes.

Each version will have an identifier, effective date, and, where applicable, an explanation of relevant changes. The version presented when your data is collected must match the version recorded in the related consent evidence.

15. Communications and withdrawal of consent

Consent for operational communications about an appointment is limited to WhatsApp, email, telephone, or other authorized clinic channels. These communications may include your name, appointment date and time, requested service, clinic location or contact details, instructions for managing the appointment, and a non-sensitive appointment reference.

They will not include diagnoses, clinical history, treatment notes, or other unnecessary clinical information. Receiving, reading, accepting, or responding to a message does not by itself confirm, cancel, or change the status of an appointment. The clinic’s appointment system is the authority for appointment status.

You may withdraw this consent for future communications by contacting privacy@drjocsan-osteopata.com or WhatsApp at +506 6411 7298. Withdrawal does not automatically cancel an appointment, erase records, or invalidate communications already sent.

For other privacy questions, requests, or complaints, you may use the same channels. You may also submit a complaint to the competent Costa Rican data-protection authority, as applicable.