Privacy notice

Cary H. Rothenberg, with address at Av. Tizoc 595B, 45050 Zapopan, Jalisco, México, is responsible for processing your personal data. This notice explains what data we process, why we use it, who we share it with, and how you can exercise your rights under the Federal Law on Protection of Personal Data Held by Private Parties published in the Official Gazette on March 20, 2025, effective March 21, 2025.

Who is responsible for your data

Cary H. Rothenberg is an individual who provides professional chiropractic services, with address at Av. Tizoc 595B, 45050 Zapopan, Jalisco, México.

He decides how personal data you provide on this site, on WhatsApp, by phone, or during care at the office is processed. You may contact him in writing at that address or at hey@caryrothenberg.com.

What personal data we process

To respond and schedule your visit we process: your name; your phone number; reason for consultation and what you write in site forms or WhatsApp; attribution data (which ad, search, or page brought you here); and billing data when you request a tax receipt.

When you browse this site we use our own session cookie (ro_guest_session) to measure visits and demand: pages viewed, referrer, and UTM parameters when present. We may link that anonymous session to a hold or a WhatsApp door you use in the same visit. We do not store your name in that cookie until you enter it in a form.

During care at the office we also generate clinical data for your record: history, examination, studies you bring, and notes from each visit.

Your health status and reason for consultation are sensitive personal data. Law protects them with stricter rules: processing requires your express written consent, and penalties for improper processing are higher. We do not ask for sensitive data unrelated to your health.

The contact form on this site is a demonstration and does not send data to our systems.

Why we use your personal data

Necessary purposes without which we cannot serve you: respond to your message or information request; schedule, confirm, reschedule, or cancel your visit; provide consultation care; integrate and keep your clinical record; and meet tax obligations and competent authority requirements.

Purposes that require your consent and that you may refuse without changing your care: send appointment reminders; contact you after consultation for follow-up; and publish your testimonial or opinion about the service.

Refusing these second purposes is not grounds to deny the services you request. You may state refusal now or at any later time, as explained in the next section.

How to limit use or disclosure of your data

To stop reminders, post-visit follow-up, or publication of your testimonial, write to hey@caryrothenberg.com stating which you want to stop. You do not need to justify your decision and clinical care is not affected.

In the WhatsApp conversation you may ask at any time to be served by a person instead of the automated assistant. Write it: the assistant stops replying and the conversation waits for the clinic team during office hours. This is resolved in the same conversation and is not an ARCO rights request, which follows the procedure below.

Your access, rectification, cancellation, and opposition rights

You have the right to access personal data we hold about you and know how we process it; rectify it when inaccurate or incomplete; cancel it when you consider it unnecessary for the purposes of this notice; and oppose processing for specific purposes, including automated processing described later.

Send your request to hey@caryrothenberg.com, or deliver it in writing at the address in this notice. To process it, the request must include: your name and how you want the response; copy of ID or legal representation if applicable; a clear description of the data and right you exercise; and any element that helps locate your data.

We will respond within twenty business days of receipt. When granted, it takes effect within fifteen days after we communicate the decision. If information is insufficient or wrong, we may ask you to complete it.

The responsible party has designated a person to handle these requests and questions about processing. Contact at hey@caryrothenberg.com or the address stated.

Cancellation and opposition are not absolute. They do not apply when we must keep data for a legal obligation: in particular minimum retention of the clinical record and tax receipts, both described below. When that applies we explain in writing what is kept and why.

If you believe your data protection right was violated, you may contact the Secretaría Anticorrupción y Buen Gobierno, the competent authority.

How to revoke your consent

You may revoke consent for processing your personal data, including sensitive data, at any time without justification. Write to hey@caryrothenberg.com or deliver in writing at the stated address, with your name, response channel, and which consent you revoke: all processing, or only some purposes that require it.

Revocation is not retroactive. It does not invalidate processing while consent was valid, nor require deletion of data we must keep by law. Revoking consent for necessary purposes means we can no longer schedule visits or continue care through these channels.

Within the same twenty business day period for ARCO requests we confirm in writing what processing stopped, what data was deleted, and what is kept and on what basis. If you do not receive confirmation, you may request it at the same address.

Transfers and providers outside Mexico

We do not sell or market your personal data, nor give it to third parties for advertising. To operate this site and WhatsApp, Meta Platforms, Anthropic, Neon, Vercel, and Google are involved as described below. All are outside Mexico, so your data leaves Mexican territory and is subject to each country's law. Anthropic, Neon, and Vercel process only on our instructions; Meta Platforms and Google also process under their own policies for their own purposes, which we do not control.

Whether we can ask consent before a transfer depends on when it happens, not who receives it: one company may receive data through more than one channel, with different rules. We describe each channel separately and state who receives what and whether consent can be required.

When any page loads, including this one: Vercel receives technical connection logs; Neon stores the visit session (ro_guest_session cookie, pages viewed, referrer, UTM when present). This happens before we can ask anything, so it cannot be conditioned on consent.

When you open the contact page: Google receives your IP, browser data, and referring page because the map loads from its servers, under its policies. This happens when the map loads and cannot be conditioned on consent. To avoid it, do not open that page.

When staff confirm your visit in our systems: Google receives name, phone, service, and notes to create an event on the clinic Google Calendar. The email you gave in booking is not written in that event. Google also sends busy blocks from that calendar to calculate available times. This is internal operation and cannot be conditioned on consent if you already requested the visit.

When you open a WhatsApp conversation with the clinic, by writing to the number or tapping WhatsApp buttons on this site: Meta Platforms receives your phone number and full conversation content. Those buttons only open WhatsApp with prefilled text you may edit or delete. You initiate the conversation from your app, so this cannot be conditioned on consent.

When each WhatsApp message arrives: Vercel receives the full message (your number and text) because the receiver runs on its infrastructure; Neon stores it in AWS us-east-1 (Virginia, United States). This happens before any other decision, including if you booked by phone and never used a site form, so it cannot be conditioned on consent. Anthropic receives the conversation only when the assistant will reply: not if the assistant is off, a person has the thread, you asked for a person, or you opposed automated processing.

When Anthropic does receive the conversation, only so the assistant can draft a reply, it receives: message text (up to the twelve most recent, yours and the clinic's); the name in our records; whether the query is spine or knee; first visit or follow-up; and when you already have a visit, date and time. Full conversation state is sent each message; body area is also health-related data.

Automated processing of your messages

When you write to the clinic WhatsApp, messages are read and classified automatically by a system using a language model. Two purposes: identify whether your query is spine or knee, to route scheduling; and offer and record available times.

This system does not issue diagnosis or clinical decisions. It does not interpret studies, recommend treatments, tell you if your case is severe, or replace consultation. All clinical matters are resolved by Cary H. Rothenberg with you in person.

You may oppose this processing. If you ask (in the WhatsApp conversation or in writing to hey@caryrothenberg.com) messages stop going to the language model and a clinic team member serves you. Opposition has no cost, does not affect your care, and does not cancel your visit.

Your clinical record and how long we keep data

Your clinical record (history, examination, studies, notes from each visit) is kept on paper at the office under the responsible party's custody. That information is not captured on the site or WhatsApp and does not reach the providers above. What you write on WhatsApp before your visit is not part of the clinical record: it is kept separately in the systems above, with the periods below.

Mexican official standard NOM-004-SSA3-2012 on clinical records applies to establishments that provide medical and similar care, and governs integration of this practice's record. Under it, the record is kept at least five years from the last recorded visit; each new visit restarts that period.

For digital data we also apply: WhatsApp message text is deleted from the log at twelve months; we keep that you sent a message and from which number, not what it said. Appointment times offered and not taken are deleted at ninety days. Site visit sessions (ro_guest_session and linked logs) are kept up to ninety days from last session activity. Tax receipts are kept for the period tax law requires, even after a cancellation request.

How holding your time works

When you hold a time on WhatsApp or this site, that time is reserved under your name from when we receive the request and is no longer offered to others. The hold lasts 24 hours, or until the visit starts if sooner. If staff do not confirm in time, the hold expires and the time is available again.

Canceling or moving your visit is done by our team. Write on WhatsApp at +52 33 3443 2223 or to hey@caryrothenberg.com; you do not need an ARCO request to change a visit.

Changes to this privacy notice

This notice may change when our purposes, providers, practices, or applicable law change. We communicate changes by publishing updated text at https://caryrothenberg.com/aviso-de-privacidad, where the last update date is always shown.

The version in force is only the one published at that address. We record which version each person accepted when holding through this site.

Cary H. Rothenberg