Privacy policy

Torre Médica Santa Inés administers this website and is the contact point for questions about data it receives through its channels. You may write to info@torremedicasantaines.com or visit 100 m sur de la Escuela Monseñor Sanabria, San Rafael de Oreamuno, Cartago, Costa Rica.

Privacy requests may use the subject line ‘Data protection’. Reasonable information may be requested to verify the identity of the data subject or an authorized representative and prevent improper access or changes.

This policy applies to browsing the website, information or appointment requests initiated through its links, and resulting administrative communications. It does not replace the consent notices or confidentiality duties applicable to specific medical care.

Processing is governed by Costa Rican Law No. 8968 on the Protection of Individuals with regard to the Processing of Personal Data, Executive Decree No. 37554-JP, and other applicable rules, including professional confidentiality obligations in healthcare.

The website currently provides no user accounts, online payments, medical-record uploads, clinical-result portal, or first-party form that stores requests on its server. Specialty and professional selections remain temporarily in the browser and are added to WhatsApp only when the user chooses to open and send the message.

Technical logs needed to deliver, protect, and maintain the website may be generated while browsing.

WhatsApp, email, telephone, and map buttons open external services or applications installed on the device. Torre Médica Santa Inés does not receive a message until the person actually sends it through the selected channel.

Depending on the communication, we may receive a name, telephone number, email address, message content, professional or specialty of interest, availability, insurance details, and other information voluntarily shared. The platform may also process account, device, and connection data under its own policies.

Health information is sensitive. Please do not send diagnoses, results, clinical photographs, identification numbers, or other sensitive data that is unnecessary for initial administrative coordination. When such information is essential, use the channel and instructions provided by the professional or medical center.

Communications concerning minors should be made by a parent, legal representative, or authorized person, except where applicable law permits otherwise. This website is not designed for minors to submit sensitive data without responsible adult support.

Data received is used only for purposes compatible with the interaction initiated by the person and the requested services.

Depending on the circumstances, processing is based on informed consent expressed by voluntarily initiating contact, steps necessary to respond to a request or provide a service, and compliance with legal or professional duties.

If sensitive data is needed for a purpose beyond the requested coordination, the relevant consent will be obtained or only a legally authorized exception will be used. Consent may be withdrawn for future processing without affecting prior lawful actions or information that must be retained by law.

Information may be processed by providers strictly necessary for hosting, email, telephone, messaging, security, or technical support, subject to applicable terms and safeguards. It may also be shared with professionals involved in care, confidential advisers, or competent authorities where there is consent, a care-related need, or a legal obligation.

WhatsApp and Facebook are Meta Platforms services; the map is provided by Google. Using those services may involve processing or international transfers under the provider's policies. Torre Médica Santa Inés does not sell or rent personal data or share it for third parties' independent advertising.

Technical records are kept for the time reasonably necessary for security, troubleshooting, and hosting administration. Communications are retained while needed to answer, coordinate the request, document the relationship, or meet legal and professional retention periods.

When a communication becomes part of a clinical or administrative record, the rules governing that record apply. Once the purpose and applicable retention periods expire, information will be deleted, anonymized, or kept under restricted access where archiving is legally required.

Data subjects may request access, correction of inaccurate or outdated information, deletion where legally available, information about uses and recipients, and withdrawal or restriction of consent for future processing. Requests may be sent to info@torremedicasantaines.com.

A request should identify the person, describe the right being exercised, and provide a response channel. Some data cannot be deleted immediately where a legal, clinical, contractual, or legal-defense duty requires retention. A person may also contact Costa Rica's Data Protection Agency (PRODHAB) if they believe their rights have been infringed.

Reasonable technical and organizational measures are applied according to the nature of the information to prevent loss, alteration, unauthorized access, disclosure, or use. Access should be limited to those who need it for their functions and are bound by confidentiality duties.

No Internet transmission is completely infallible. Users should also protect their devices, avoid insecure networks, and verify the recipient before sending sensitive information. Relevant incidents will be handled under applicable law and response procedures.

As of this version, the website does not use behavioral advertising or an external analytics tool. The server and hosting platform may use technical mechanisms essential for security and content delivery.

Embedded Google Maps may set cookies or collect data when loaded. Browser settings can manage or block cookies, although doing so may limit maps or other external features. If measurement, advertising, or preference tools requiring consent are added later, this policy and the relevant controls must be updated before activation.

This policy may be updated to reflect legal, operational, or technical changes. The new version will be published at this address with an updated date. Where a change requires new consent, it will be requested separately and will not be applied retroactively in a manner incompatible with the purpose originally disclosed.