Privacy Policy

What data we collect

To book and provide care, we collect:

• From the mother, father or guardian: name, phone/WhatsApp and, if you share it, email.
• From the patient (your child): name, date of birth and sex. For a prenatal visit, the estimated due date.
• The reason for the visit you choose to share.
• Basic technical browsing data (for example, your preferred language).

Health data is sensitive, and we treat it with special care and confidentiality.

What we use it for

• Booking, confirming and following up on your visits.
• Providing the medical care and support you request.
• Contacting you by WhatsApp or email (for example, appointment reminders).
• Meeting legal obligations and keeping the clinical record where applicable.

On what basis we process your data

We process your data with your consent, to provide the care you request, and to meet legal obligations and the duties of the doctor-patient relationship.

Children's data

Minors' data is processed only with the consent and under the responsibility of their mother, father or legal guardian, and solely for their health care. That's why, when you book, we ask you to expressly declare that capacity.

The doctor sees patients up to age 21. An adult patient may book and consent for themselves, and exercise the rights described below over their own information directly.

How we protect it

We apply reasonable technical and organizational safeguards: encrypted storage, access controls and trusted technology providers. No system is 100% foolproof, but we work constantly to keep your data safe.

Who we share it with

We do not sell or trade your data, and we don't use it for advertising. We share it only where necessary to operate the service or comply with the law.

These are the providers that process data on our behalf and on our instructions (data processors):

• GadDev (El Salvador) — builds and supports the appointment and records system.
• Render (United States) — hosts the clinical-record database and server.
• Vercel (United States) — hosts this website.
• Netlify (United States) — hosts the system the doctor uses to consult records.
• Google (United States) — sends your appointment's calendar invitation and, for telemedicine, generates the video-call link. The invitation includes the patient's name and your email.
• Resend (United States) — sends the emails carrying your child's documents (prescriptions, certificates, vaccine card).
• Cloudflare (United States) — protects the booking form against automated abuse; to do so it sees your IP address.

We may also share data to comply with a legal obligation or a request from a competent authority.

Transfer outside El Salvador

As the list above shows, most of our technology providers process the information on servers located in the United States. That means your family's data leaves the country.

This is why we ask for a specific, separate authorization for that transfer when you book: it is not bundled into the general consent, and it is not pre-ticked.

If you'd rather not authorize it, that's completely fine: message us on WhatsApp and we'll book your visit that way.

We are completing the international-transfer agreements with each provider as required by law. In the meantime, we choose providers with recognized security standards and encrypt sensitive information.

How long we keep it

The clinical record is kept for ten years, in line with Salvadoran clinical-record rules: five years in the active archive, counted from the last visit, and five more in the passive archive.

Records subject to an investigation or a judicial proceeding are kept in full for as long as the proceeding lasts.

Access logs to the record are kept for at least two years. Once the applicable period ends, the information is securely deleted or anonymized.

Your rights (ARCO-POL)

As the data subject — or as your child's legal guardian — you may exercise these rights at any time:

• Access — know what information we hold about you or your child.
• Rectification — have us correct inaccurate or outdated data.
• Cancellation — have us delete your data, where no legal obligation requires keeping it.
• Objection — object to particular uses of your information.
• Portability — receive your data in a format you can take to another professional.
• Erasure — ask that your information stop being available, in the cases the law allows.
• Restriction — ask us to limit processing while a request is being resolved.

You may also withdraw your consent at any time; withdrawal does not affect care already given or data the law requires us to keep.

To exercise them, write to dravanessa@chiquicuidados.com or send us a WhatsApp. We'll reply within twenty business days; where the case warrants it, we may extend that by a further twenty business days and will let you know.

If you are not satisfied with our response, you may turn to the Agencia de Ciberseguridad del Estado (ACE), El Salvador's data protection authority.

If a security incident happens

If a breach significantly affecting your data were to occur, we will tell you and notify the competent authorities within 72 hours of detecting it, explaining what happened, which data was affected and what we are doing about it.

Cookies and browsing

We use the minimum cookies needed for the site to work (for example, remembering your language). We do not use advertising cookies or sell your browsing activity.

The booking form uses Cloudflare Turnstile to tell a person from a bot. That check sees your IP address and basic browser data, and is used for that purpose only.

Changes to this policy

We may update this policy to reflect improvements or legal changes. We will post the current version on this page with its update date.