Privacy notice

Cary H. Rothenberg, with address at Av. Tizoc 595 B, 45050 Zapopan, Jalisco, México, is responsible for processing your personal data. This notice explains what data we process, why we use it, who we share it with, and how you can exercise your rights under the Federal Law on Protection of Personal Data Held by Private Parties published in the Official Gazette on March 20, 2025, effective March 21, 2025.

Who is responsible for your data

Cary H. Rothenberg is an individual who provides professional chiropractic services, with address at Av. Tizoc 595 B, 45050 Zapopan, Jalisco, México.

He decides how personal data you provide on this site, on WhatsApp, by phone, or during care at the office is processed. You may contact him in writing at that address or at hey@caryrothenberg.com.

What personal data we process

To respond and schedule your visit we process: your name; your phone number; reason for consultation and what you write in site forms or WhatsApp; attribution data (which ad, search, or page brought you here); browsing data (IP address, browser, pages visited, ad click identifier); and billing data when you request a tax receipt.

When you browse this site we use our own session cookie (ro_guest_session) to measure visits and demand: pages viewed, referrer, and UTM parameters when present. We may link that anonymous session to a hold or a WhatsApp door you use in the same visit. We do not store your name in that cookie until you enter it in a form.

During care at the office we also generate clinical data for your record: history, examination, studies you bring, and notes from each visit.

Your health status and reason for consultation are sensitive personal data. Law protects them with stricter rules: processing requires your express written consent, and penalties for improper processing are higher. We do not ask for sensitive data unrelated to your health.

The contact form on this site stores your name, your phone, your email if given and your message, and takes you to WhatsApp to send it. If you request the review of your studies on this site, we also process your email, the link to your studies that you give us and what Cary H. Rothenberg sees when he opens it (your X-rays, your MRI or other studies you choose to share), which are sensitive personal data.

Why we use your personal data

Necessary purposes, without which we cannot care for you: answering your message or information request; booking, confirming, rescheduling or cancelling your visit; telling you on WhatsApp that your visit is confirmed and reminding you of it before the date; following up after your consultation, on WhatsApp or by phone; providing care in consultation; building and keeping your clinical record; and meeting our tax obligations and requests from competent authorities. Notices, reminders and follow-up are part of the care you ask for, so we do not ask for a separate consent for them; even so, you may ask us at any time to stop sending them, as explained in the section “How to limit the use or disclosure of your data”, and your care does not change.

Purpose that requires your consent and that you may refuse without changing your care: publishing your testimonial or opinion about the service.

Review of your studies, if you request it on this site: for Cary H. Rothenberg to review the studies you choose to share and reply to you by email. It is a general review; diagnosis happens at the evaluation. It requires your express consent to the processing of that sensitive data, which you give with its own checkbox in the form, and you may revoke it as explained below.

Secondary purpose: measuring the performance of the clinic's ads on Google and the use of this site. If you do not want your browsing data used for this purpose, you can turn it off with the “Don't measure my visit” link at the bottom of every page, or limit it as described in the transfers section.

Refusing these second purposes is not grounds to deny the services you request. You may state refusal now or at any later time, as explained in the next section.

How to limit use or disclosure of your data

To stop WhatsApp appointment reminders, tap the «No enviar recordatorios» (“Do not send reminders”) button in any of those messages, ask reception on WhatsApp or by phone, or write to hey@caryrothenberg.com. That decision applies to your phone number and also stops the visit confirmation message the clinic would send you without your having written first; if you write to us, we answer as always. To stop post-visit follow-up, or to withdraw publication of your testimonial, ask reception or write to hey@caryrothenberg.com. You do not need to justify your decision and clinical care is not affected: your visit stays booked.

In the WhatsApp conversation you may ask at any time to be served by a person instead of the automated assistant. Write it: the assistant stops replying and the conversation waits for Dr. Cary H. Rothenberg or a member of his team to pick it up in the same chat; the reply may take a while, especially outside office hours. If four hours pass with no messages in the conversation and no one from the clinic has written to you, the assistant will reply again when you next write; if you would rather keep talking to a person, just ask again. This does not apply if you opposed automated processing, nor after a safety message. Also, once Dr. Cary H. Rothenberg or a member of his team writes to you in that conversation from the office's WhatsApp Business app, the assistant permanently stops conversing with you in it. That chat still carries the automated messages about your appointments (for example, confirmations, reminders and replies to the buttons in those reminders) and, when needed, safety messages. This is resolved in the same conversation and is not an ARCO rights request, which follows the procedure below.

Your access, rectification, cancellation, and opposition rights

You have the right to access personal data we hold about you and know how we process it; rectify it when inaccurate or incomplete; cancel it when you consider it unnecessary for the purposes of this notice; and oppose processing for specific purposes, including automated processing described later.

Send your request to hey@caryrothenberg.com, or deliver it in writing at the address in this notice. To process it, the request must include: your name and how you want the response; copy of ID or legal representation if applicable; a clear description of the data and right you exercise; and any element that helps locate your data.

We will respond within twenty business days of receipt. When granted, it takes effect within fifteen days after we communicate the decision. If information is insufficient or wrong, we may ask you to complete it.

The responsible party has designated a person to handle these requests and questions about processing. Contact at hey@caryrothenberg.com or the address stated.

Cancellation and opposition are not absolute. They do not apply when we must keep data for a legal obligation: in particular minimum retention of the clinical record and tax receipts, both described below. When that applies we explain in writing what is kept and why.

If you believe your data protection right was violated, you may contact the Secretaría Anticorrupción y Buen Gobierno, the competent authority.

How to revoke your consent

You may revoke consent for processing your personal data, including sensitive data, at any time without justification. Write to hey@caryrothenberg.com or deliver in writing at the stated address, with your name, response channel, and which consent you revoke: all processing, or only some purposes that require it.

Revocation is not retroactive. It does not invalidate processing while consent was valid, nor require deletion of data we must keep by law. Revoking consent for necessary purposes means we can no longer schedule visits or continue care through these channels. Asking us to stop reminders, notices or follow-up is not that kind of revocation: it is handled as explained in the section “How to limit the use or disclosure of your data” and does not affect your care.

Within the same twenty business day period for ARCO requests we confirm in writing what processing stopped, what data was deleted, and what is kept and on what basis. If you do not receive confirmation, you may request it at the same address.

Transfers and providers outside Mexico

We do not sell or market your personal data. To measure the results of the clinic's ads and the use of this site we use Google tools, as described below. To operate this site and WhatsApp, Meta Platforms, Anthropic, Supabase, Vercel, Resend, and Google are involved as described below. All are outside Mexico, so your data leaves Mexican territory and is subject to each country's law. Anthropic, Supabase, Vercel, and Resend process only on our instructions; Meta Platforms and Google also process under their own policies for their own purposes, which we do not control.

Whether we can ask consent before a transfer depends on when it happens, not who receives it: one company may receive data through more than one channel, with different rules. We describe each channel separately and state who receives what and whether consent can be required.

When any page loads, including this one: Vercel receives technical connection logs; Supabase stores the visit session (ro_guest_session cookie, pages viewed, referrer, UTM when present). This happens before we can ask anything, so it cannot be conditioned on consent.

When any public page of this site loads: Google receives, through Google Tag Manager, Google Ads, and Google Analytics, your IP address, your browser data, the pages you visit and, if you arrived from a Google ad, that click's identifier, and may store cookies in your browser. When you submit an appointment request, tap a WhatsApp button, or tap the study review link on the home page, Google receives only that the event happened, without your name, phone, email, notes, the link to your studies, or the service you chose. Google processes this data under its own policies, to measure the performance of the clinic's ads and the use of this site. This happens when the page loads, before we can ask you anything; you can turn it off with the “Don't measure my visit” link at the bottom of every page, limit it with a tracker blocker or your browser's privacy settings, and turn off ad personalization in your Google account settings.

When you open the contact page: Google receives your IP, browser data, and referring page because the map loads from its servers, under its policies. This happens when the map loads and cannot be conditioned on consent. To avoid it, do not open that page.

When clinic staff edit in our systems an appointment that comes from the clinic's Google Calendar: Google receives the event title, which may include your name, its time and the office address; it does not receive the service or your notes. Google also sends us the events of that calendar (title, description and time) to calculate available times and show them in the Panel. This happens in internal operation and cannot be conditioned on your consent.

When you open a WhatsApp conversation with the clinic, by writing to the number or tapping WhatsApp buttons on this site: Meta Platforms receives your phone number and full conversation content. Those buttons do not send your number or the text of your message to any other provider: they only open WhatsApp with prefilled text you may edit or delete (Google receives only that a button was tapped, as described above). You initiate the conversation from your app, so this cannot be conditioned on consent.

When each WhatsApp message arrives: Vercel receives the full message (your number and text) because the receiver runs on its infrastructure; Supabase stores it in us-east-2 (Ohio, United States). The same happens with each message Dr. Cary H. Rothenberg or a member of his team writes to you in that conversation from the office's WhatsApp Business app: Meta Platforms sends a copy to Vercel, with your number and the message text, and Supabase stores it with the conversation. This happens before any other decision, including if you booked by phone and never used a site form, so it cannot be conditioned on consent. Anthropic receives the conversation only when the assistant will reply: not if the assistant is off, a person has the thread, or you opposed automated processing. If you asked for a person, Anthropic does not receive it while the conversation stays with that person; if the assistant replies to you again, as explained in the section on limiting the use of your data, Anthropic receives it again.

When Anthropic does receive the conversation, only so the assistant can draft a reply, it receives: message text (up to the twelve most recent, yours and the clinic's); the name in our records; whether the query is spine or knee; first visit or follow-up; and when you already have a visit, date and time. Full conversation state is sent each message; body area is also health-related data.

When your visit is recorded with a mobile number, whether you booked it on WhatsApp, on this site, by phone or in person: the clinic sends you, from the office's WhatsApp number and through Meta Platforms, a message when your visit is confirmed and a reminder before the date, both with the date and time of your visit, even if you never wrote to us on WhatsApp. This reveals to Meta your number and that you are a patient of this office; Meta also receives the button you tap and what you reply, and tells us whether the message was delivered or read. Vercel carries out the sending and Supabase stores the record of each message, your answer and, if you asked not to receive them, that decision (who recorded it and when). It is part of the care you ask for, so we do not make it depend on a separate consent; you may stop it at any time with the «No enviar recordatorios» (“Do not send reminders”) button, by messaging reception on WhatsApp or by phone, or by email.

When you hold a time on WhatsApp or on this site, confirm your attendance from a reminder, or move your visit: the clinic sends a notice, through Meta Platforms, to reception's WhatsApp (+52 33 3615 6676). The notice contains your name, the channel you used (WhatsApp or this site), the service you chose (for example, first spine or knee evaluation), the date and time of your visit (if you moved it, the old and the new one) and a link to the visit in the clinic's internal panel, which only staff can open with their account. This reveals to Meta that you are a patient of this office and the area of your consultation, which is health-related data. It is necessary for the team to confirm your visit in time, so it cannot depend on your consent. If you book by phone or in person, reception does not receive the notice of your hold; it does receive the one for your confirmation from a reminder and for a change of visit.

When you submit the booking form on this site (/reservar): Vercel and Supabase receive what you entered (type of visit —first spine or knee evaluation, or follow-up visit—, name, phone, email if given, notes, chosen time). This channel is necessary to hold your visit; we require express acceptance of this notice in the form. Without it we do not create the hold. When you hold, reception receives the notice described above, and when your visit is confirmed you receive the WhatsApp confirmation message, also described above. If you gave us your email in the form, Resend, the service the site uses to send email, receives your email address and the date and time of your appointment, to send you the acknowledgment of your request and, once the clinic confirms it, the confirmation. The emails do not mention your name, the type of visit or your notes.

When you submit the study review form on this site (/contacto): Vercel and Supabase receive what you entered (name, phone, email, the link to your studies, and your notes); the site stores only the link, never the files. Resend, the service the site sends email with, receives only the clinic's email address and a notice that a new request arrived, with none of your data. The service where you host your studies (your hospital's portal, Google, WeTransfer, or another) is chosen by you and is outside the clinic's control; Cary H. Rothenberg opens the link on his own computer to review them. This channel depends on your express consent to the processing of your sensitive data, which you give with its own checkbox in the form; without it we do not record the request.

When clinic staff capture data from phone or in-person care: Supabase stores it through the same Vercel infrastructure. This is internal and not while you face a screen, so it cannot be conditioned on consent. If the number you give us is a mobile number, you also receive the WhatsApp confirmation message and reminders described above.

If you prefer not to use this site or WhatsApp, call the office or come in person: you avoid the channels above except capture by clinic staff, which matches that care, and except the WhatsApp confirmation message and reminders, which you may stop as explained in the section “How to limit the use or disclosure of your data”.

We may also disclose personal data without consent when law allows, including when a competent authority requires it.

Automated processing of your messages

When you write to the clinic's WhatsApp, your messages are read and classified automatically by a computer system that uses a language model. It does so for these specific purposes: identifying whether your query is about spine or knee, to route your visit to the right area; offering and recording available times; moving your visit to another time when you ask; and, when relevant, offering you the study review described in this notice.

This system does not issue diagnosis or clinical decisions. It does not interpret studies, recommend treatments, tell you if your case is severe, or replace consultation. All clinical matters are resolved by Cary H. Rothenberg with you in person.

You may oppose this processing. If you ask (in the WhatsApp conversation or in writing to hey@caryrothenberg.com) messages stop going to the language model and Dr. Cary H. Rothenberg or a member of his team serves you personally. Opposition has no cost, does not affect your care, and does not cancel your visit.

Your clinical record and how long we keep data

Your clinical record (history, examination, studies, notes from each visit) is kept on paper at the office under the responsible party's custody. That information is not captured on the site or WhatsApp and does not reach the providers above. What you write on WhatsApp before your visit is not part of the clinical record: it is kept separately in the systems above, with the periods below.

Mexican official standard NOM-004-SSA3-2012 on clinical records applies to establishments that provide medical and similar care, and governs integration of this practice's record. Under it, the record is kept at least five years from the last recorded visit; each new visit restarts that period.

For digital data we also apply: the text of the WhatsApp messages in your conversation, yours and those the clinic writes to you, is deleted from the log at twelve months; we keep that you sent a message and from which number, not what it said. Each WhatsApp appointment reminder's record (the number it went to, whether it was delivered or read, and how you answered) is deleted twelve months after the visit date. The record of your preferences about those messages (whether you asked not to receive them, who recorded it and when, with its history) is kept while the clinic keeps sending them, so that none is sent to you again by mistake. The records of notices sent to clinic staff and of your visit confirmation messages are deleted at twelve months; of the confirmation message, as of other messages, only the fact that it was sent and to which number is kept. Messages as WhatsApp delivers them to our systems, which include your number and text, and the copies of what the clinic writes to you from the app, are deleted at ninety days. Appointment times offered and not taken are deleted at ninety days. Study review requests (your data and the link to your studies) are deleted at ninety days, whether answered or not. Site visit sessions (ro_guest_session and linked logs) are kept up to ninety days from last session activity. Tax receipts are kept for the period tax law requires, even after a cancellation request.

How holding your time works

When you hold a time on WhatsApp or this site, that time is reserved under your name from when we receive the request and is no longer offered to others. The hold lasts 24 hours, or until the visit starts if sooner. If staff do not confirm in time, the hold expires and the time is available again. If you move a visit that was already confirmed, the new time stays held in your name, with no expiry, until the team confirms it.

You may move your visit with the WhatsApp assistant, for example by tapping «Cambiar cita» (“Change appointment”) in a reminder, and the team confirms the new time. Cancelling it, or moving it another way, is done by our team: write to us on WhatsApp at +52 33 3443 2223 or to hey@caryrothenberg.com and we resolve it in that same conversation; you do not need to exercise an ARCO right to change a visit.

Changes to this privacy notice

This notice may change when our purposes, providers, practices, or applicable law change. We communicate changes by publishing updated text at https://caryrothenberg.com/en/privacy-notice, where the last update date is always shown.

The version in force is only the one published at that address. We record which version of this notice each person accepted when holding through this site or on WhatsApp, and which version was in force when each change to their reminder preferences was recorded, so the text communicated to them can always be identified.

Dr. Cary H. Rothenberg, D.C.