Privacy notice

1. Who the data controller is

[MISSING: legal name] (“Itzli”), with registered address at [MISSING: registered address], is the data controller (“responsable”, in the terms of the law) for the processing of the personal data described in this notice, under Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, the federal data protection law).

For anything concerning your personal data you can write to [MISSING: privacy contact email].

2. Two different relationships, and the difference matters

Itzli processes personal data in two different roles, with different obligations. Telling them apart is not a technicality: it changes who you make your claim to if something goes wrong.

a) Itzli as data controller (responsable)

For the data of people who visit this site, request a demo or open a patient account on the marketplace. We ask for that data ourselves, for our own purposes, and we answer for it.

b) Itzli as data processor (encargado)

For the data of the patients each laboratory enters inside its own system. There, the data controller is the laboratory: it decides what is collected, for what purpose and for how long. Itzli only processes that information on the laboratory’s behalf and according to its instructions, without using it for our own purposes and without sharing it with other laboratories. If you are a patient and want to exercise your rights over the tests a laboratory ran for you, the request goes to that laboratory; we help it respond.

3. What data we process

If you request a demo

• Name, laboratory name, email address and phone number.
• Number of branches and which analyzers you run, when you provide them.
• IP address and the date of submission, as a record of the contact itself.

If you open a patient account

• Identification and contact: first and last names, sex, date of birth, official ID, email address, phone numbers and home address.
• Tax details, if you request an invoice: RFC (Mexican tax ID) and legal name.
• Sensitive personal data: your laboratory test results, your blood type and your allergies. The law treats these as sensitive and processing them requires your express consent, which is obtained before that data is collected, and which is stored together with the exact version of the text you accepted and the date you accepted it.

If you are laboratory staff

• Name, email address, phone number and the role you were assigned.
• Your professional license number (cédula profesional) and its verification, when your work involves reviewing or releasing results. Health regulation requires a record of who signs each report.
• The log of the sensitive actions you perform inside the system.

4. What we use them for

Necessary purposes

Without these purposes we cannot provide you the service:

• Running the laboratory: receiving orders, entering and reviewing results, releasing reports and taking payment.
• Delivering your results to you and keeping your digital health record.
• Keeping a record of who reviewed, released, delivered or corrected each result, and of who received it, under the applicable health regulation.
• Issuing tax receipts when you request them.
• Handling demo requests and following up on them commercially.
• Preventing fraud and protecting the security of accounts.

Additional purposes

You can object to these without it affecting the service: sending you notices about new features or product improvements, and inviting you to answer satisfaction surveys. To object, all you have to do is write to the privacy contact email above.

Itzli does not sell personal data and does not use it for third-party advertising.

5. Who they are shared with

Data is transferred only where it is necessary to provide the service or where the law requires it:

• To the laboratory attending you, the data it needs to process your test and deliver your result. No laboratory sees the history you have with another laboratory.
• To the doctor you authorize, and only for as long as you keep that authorization active; you can revoke it from your account whenever you want.
• To technology providers that host the infrastructure, send emails and messages, and stamp the tax receipts. They process the data only on behalf of Itzli or of the laboratory, under a duty of confidentiality.
• To the competent authorities, where there is a duly grounded and reasoned request.

These transfers do not require your additional consent in the cases set out in article 37 of the LFPDPPP. Any other transfer will be disclosed to you and will require your authorization.

6. How we protect them

• Information travels encrypted (TLS) and is stored encrypted.
• The data that identifies you — name, email address, phone number, results, blood type, allergies and professional license number — is stored encrypted field by field, not just the disk.
• Access is resolved on the server by laboratory and by role: each person sees only what their job requires.
• Sensitive actions land in a log that is append-only: what is already recorded cannot be deleted or edited.
• Reviewing or releasing a result requires a verified professional license number; the role permission alone is not enough.

No security measure is infallible. If a breach were to occur that significantly affects your rights, we will inform you without delay so that you can take action.

7. How long we keep them

Clinical data is kept for a minimum of five years, in line with the clinical record framework in force in Mexico, and for the additional time the laboratory acting as data controller determines. Contact details from commercial inquiries are kept while there is a legitimate interest in following up, or until you ask for them to be deleted.

8. Your ARCO rights

You have the right to access your data, to rectify it if it is inaccurate, to cancel it when you consider it is no longer needed, and to object to certain uses. You can also withdraw your consent.

To exercise them, send a request to the privacy contact email including:

1. Your name and a means of sending you the answer.
2. A copy of an official ID proving your identity, or the corresponding power of attorney if you are acting on someone else’s behalf.
3. A clear description of the data you are seeking to exercise the right over, and exactly what you are asking for.

We will answer within a maximum of 20 business days and, where the request is granted, it will take effect within the following 15 business days.

There are cases where cancellation does not apply: laboratory results already released, and the trail of who reviewed them, form part of a record that health regulation requires to be kept. In those cases we will explain why, and what alternatives exist.

If you believe your right was not addressed, you can turn to the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI, Mexico’s data protection authority): home.inai.org.mx.

9. Cookies and similar technologies

The public pages of this site do not install cookies or trackers in your browser. Inside the application, local device storage is used, strictly to keep you signed in and to remember preferences such as light or dark mode; it is not used to profile you and not used for advertising.

10. Minors

Where the test belongs to a minor or to a person under guardianship, the account and the consent are given by whoever holds parental authority or guardianship, and that is recorded in the delivery receipt.

11. Changes to this notice

This notice may be updated. Any change will be published on this same page with its update date, and substantial changes will also be communicated by email to active accounts. The version in force is always the one published here.