Privacy notice

Who is responsible for your data

Dr. Cary H. Rothenberg is an individual practitioner providing chiropractic services, with his professional address at Av. Tizoc 595B, 45050 Zapopan, Jalisco, México.

He decides how the personal data you provide through this site, over WhatsApp, by telephone or during your care at the office is processed. You may write to him at that address or at privacidad@caryrothenberg.com.

What personal data we process

To answer you and book your appointment we process: your name; your telephone number; your reason for consulting and whatever you write in the site's forms or in the WhatsApp conversation; attribution data, that is, which advertisement, search engine or page brought you to this site; and your billing details when you ask for a tax receipt. We also keep a value derived from your IP address — not the address itself — for the sole purpose of limiting abuse of the forms.

Your care at the office additionally generates the clinical data that makes up your record: history, examination, any studies you bring, and the notes from each visit.

Your state of health and your reason for consulting are sensitive personal data. The law protects them more strictly: processing them requires your express written consent, and penalties for mishandling them are increased. We do not ask you for sensitive data other than that relating to your health.

What we use your personal data for

Necessary purposes, without which we cannot attend to you: answering your message or your request for information; booking, confirming, rescheduling or cancelling your appointment; providing your care in consultation; compiling and keeping your clinical record; and meeting our tax obligations and any requirement from a competent authority.

Purposes that require your consent and that you may decline without your care changing in any way: sending you appointment reminders; contacting you after your visit to follow up on your progress; and publishing your testimonial or review of the service.

Declining these second purposes is never a reason for us to refuse you the services you ask for. You may decline now, or at any time afterwards, as explained in the next section.

How to limit the use or disclosure of your data

To stop receiving reminders or follow-up contact, or to withdraw the publication of your testimonial, write to privacidad@caryrothenberg.com saying which of them you want stopped. You do not have to give a reason, and your clinical care is not affected.

In the WhatsApp conversation you may ask at any time to be attended by a person instead of the automated assistant. Simply write it: the assistant stops replying to you and the conversation waits for the clinic's team to pick it up, within opening hours. This request is settled inside that same conversation and is not an ARCO rights request, which follows the procedure described below.

Your rights of access, rectification, cancellation and objection

You have the right to access the personal data we hold about you and to know how we process it; to rectify it when it is inaccurate or incomplete; to have it cancelled when you consider it is not needed for the purposes in this notice; and to object to its processing for specific purposes, including the automated processing described below.

Send your request to privacidad@caryrothenberg.com, or hand it in writing at the address given in this notice. So that we can act on it, the request must contain: your name and the means by which you wish to receive our answer; a copy of a document proving your identity or, where applicable, the legal representation of whoever submits the request; a clear and precise description of the personal data concerned and of the right you wish to exercise; and any element or document that helps us locate your data.

We will communicate our determination within a maximum of twenty business days from the day we receive the request. Where it is well founded, it will be given effect within the fifteen days following the date on which we communicate that determination to you. If the information you give us is insufficient or mistaken, we may ask you to complete it.

The controller has designated a person responsible for handling these requests and for answering any question about the processing of your personal data. You may contact them at privacidad@caryrothenberg.com or at the address given above.

Cancellation and objection are not absolute. They do not apply where we must keep the data in order to comply with a legal obligation: in particular, the minimum retention of the clinical record and the retention of tax receipts, both described below. Where that is the case we will explain it to you in writing, stating what data is kept and why.

If you believe your right to the protection of your personal data has been infringed, you may take the matter to the Secretaría Anticorrupción y Buen Gobierno, which is the competent authority in this field.

How to withdraw your consent

You may withdraw at any time the consent you gave for the processing of your personal data, including sensitive data, without having to give a reason. Write to privacidad@caryrothenberg.com or hand a written request in at the address given above, stating your name, a means of receiving our answer, and which consent you are withdrawing: all processing, or only some of the purposes that require it.

Withdrawal has no retroactive effect. It does not invalidate processing carried out while the consent was in force, nor does it oblige us to delete data we must keep under a legal obligation. Withdrawing consent for the necessary purposes means we will no longer be able to book your appointments or continue attending to you through these channels.

Within the same twenty business days provided for ARCO requests we will confirm to you in writing which processing has ceased, which data has been deleted, and which is kept and on what basis. If you do not receive that confirmation, you may request it at the same address.

Transfers and providers outside Mexico

We do not sell or trade your personal data, and we do not hand it to third parties for advertising purposes. Running this site and the WhatsApp channel involves the companies named in each route described below: Meta Platforms, Anthropic, Neon, Vercel and Google. All of them are established outside Mexico, so your data leaves Mexican territory and becomes subject to the law of the country where each one processes it. Anthropic, Neon and Vercel process it solely on the controller's behalf and on his instructions; Meta Platforms and Google, by contrast, also process it under their own policies and for their own purposes, over which the controller does not decide.

What decides whether we can ask for your consent before a communication is when it happens, not who receives it: the same company can receive your data by more than one route, under a different regime in each. So we describe each route separately below, and for each one we say who receives what and whether we can make it conditional on your consent.

As any page of this site loads, including the one you are reading: Vercel receives the technical logs of the connection and, on your first visit, the attribution record the site sends by itself — which advertisement, search engine or page brought you here, and which page you landed on. It happens before we can ask you anything, so it cannot be made conditional on your consent.

As the contact page opens: Google receives your IP address, your browser details and the page you came from, because the map loads from its servers, and it processes them under its own policies. It happens as the map loads, so it cannot be made conditional on your consent. The way to avoid it is not to open that page.

When you open a WhatsApp conversation with the clinic, whether by writing to the number yourself or by tapping any of the WhatsApp buttons this site shows on several of its pages outside of submitting a form: Meta Platforms receives your telephone number and the entire content of the conversation, both what you write and what the clinic replies. Those buttons send your data to no other provider: they only open WhatsApp, with an opening line already written that you can edit or delete before sending it. In both cases you are the one who starts the conversation and who sends the message from your own application, so it cannot be made conditional on your consent. Those buttons keep working even if you decline the transfers you are asked about when submitting a form on this site.

As each message of yours arrives over WhatsApp: Vercel receives the message in full — your number and your text — because the program that receives it runs on its infrastructure; and Neon stores it, in the database hosted in the AWS us-east-1 (Virginia del Norte, Estados Unidos) region. This happens before any other decision, and it happens just the same if you booked your appointment by telephone and never filled in a form on this site, so it cannot be made conditional on your consent. Anthropic, by contrast, receives the conversation only when the assistant is about to reply to you: it does not receive it if the assistant is switched off, if the conversation is already in the hands of a member of the clinic's team, if you have asked to be attended by a person, or if you have objected to the automated processing.

When Anthropic does receive the conversation, and for the sole purpose of allowing the assistant to compose its reply, it receives: the text of the messages (up to the twelve most recent, both what you write and what the clinic replies); the name under which you appear in our records, which may be the one you gave us in writing or the one clinic staff typed in if you booked by telephone; whether your enquiry concerns the spine or the knee; whether this is a first visit or a follow-up; and, once you have an appointment, its date and time. The full state of the conversation is sent with every message, so this list describes what it holds today and should not be read as a closed one. The body-area indication is itself data relating to your health.

When you submit a form on this site: Vercel and Neon receive the data you entered, and Meta Platforms receives it too, because the submit button opens WhatsApp with your name, your telephone number and your message already written into the conversation. This route we can make conditional on your consent, and we do: these transfers require your express consent, which is asked of you separately from your general acceptance of this notice; if you do not give it, we do not carry them out, and your silence does not amount to giving it. You may withdraw it at any time by writing to privacidad@caryrothenberg.com.

When clinic staff enter the details of your care by telephone or in person — your name, the details of your consultation and of any package you take out: Neon stores them, through the same Vercel infrastructure. It happens inside our own systems and not while you are in front of a screen, so it cannot be made conditional on your consent.

If you would rather not use this site or the WhatsApp channel, you may telephone the office or come in person: that avoids every route described above, except the capture of your details by clinic staff, which is precisely the route that care itself follows.

We may also disclose your personal data without needing your consent in the cases the law allows, among them where a competent authority requires it in the exercise of its powers.

Automated processing of your messages

When you write to the clinic's WhatsApp, your messages are read and classified automatically by a computer system that uses a language model. It does so for two specific purposes: to identify whether your enquiry concerns the spine or the knee, so your appointment goes to the right area, and to offer you available times and record the one you choose.

So that it is unmistakably clear: this system issues no diagnosis and takes no clinical decision whatsoever — in the controlling Spanish text, «este sistema no emite diagnóstico ni decisión clínica alguna». It does not interpret studies, it does not indicate treatments, it does not tell you whether your case is serious, and it does not replace the consultation. Everything clinical is decided by the doctor with you, in person.

You may object to this processing. If you ask us to — in the WhatsApp conversation itself, or in writing to privacidad@caryrothenberg.com — your messages stop being sent to the language model and a member of the clinic's team attends to you. Objecting costs nothing, does not affect your care and does not cancel your appointment.

Your clinical record and how long we keep your data

Your clinical record — history, examination, studies and the notes from each visit — is compiled and kept on paper, at the office, in the controller's custody. That information is not captured on the site or in the WhatsApp channel, and so it never reaches the providers named in the previous section. What you write over WhatsApp before your appointment is not part of the clinical record: it is kept separately, in the systems described above, and for the periods set out next.

Mexican Official Standard NOM-004-SSA3-2012, on the clinical record, applies to establishments and offices in the public, social and private sectors that provide medical and similar care, and on that footing it governs how this practice's record is compiled. Under it, the record is kept for a minimum of five years counted from the last attention recorded, and each new attention restarts that period.

For digital data we apply these periods as well: the text of your WhatsApp messages is removed from the log after twelve months — a record remains that you sent a message, and from which number, but not of what it said. Appointment times we offered you and you did not take are deleted after ninety days, and the value derived from your IP address is deleted after thirty days. Tax receipts are kept for the period tax law requires, even after a cancellation request.

Changes to this privacy notice

This notice may change when our purposes, our providers, our processing practices or the applicable law change. The means by which we will communicate any change is the publication of the updated text at https://caryrothenberg.com/en/privacy-notice, where the date it was last updated is always shown. The Spanish text, which is the one that governs, is published at https://caryrothenberg.com/aviso-de-privacidad.

Only the text published at those two addresses is in force, and where they differ the Spanish one governs; this text is version 2026-09-02. We recommend you consult it before giving us new personal data. We keep a record of which version of this notice each person accepted, so that the text communicated to them can always be identified.