Comprehensive Privacy Notice

At Sesamet, we take care to protect access to your information.

Data Controller and Contact

The data controller is Consultores en Salud, Seguridad y Metrología, S.A. de C.V., located at Jabín No. 84, second floor, Colonia 23 de Julio, postal code 24154, Ciudad del Carmen, Campeche, Mexico. For privacy matters and the exercise of rights, contact Dr. Luis David Pérez Maza at the above address or by email at drluismaza@sesamet.com. The current notice is available at https://sesamet.com/aviso.

Processing of Personal Data

We collect your name, contact details, age or date of birth, sex when clinically relevant, signature, reference number, employer details, job title, activities, and occupational exposure. When necessary, we verify identity and process billing information. We avoid requesting identifiers or copies that are not essential.

Sensitive personal data include health history and findings, medical history, physical examination, diagnoses, treatments, allergies, disabilities, laboratory and diagnostic test results and, where applicable and authorized, substance screening results. We collect only information relevant to the contracted assessment and medical care.

The data comes from you and from the examinations performed. Health information received from other sources will be processed on a valid legal basis and for the stated purposes.

What Is the Purpose?

We use the data to identify you; schedule and perform occupational medical assessments; create, update, and safeguard your records; interpret tests; issue fitness conclusions and medical recommendations; provide your results; follow up on the assessment; manage the service and billing; address your requests; and comply with health and legal obligations.

Processing sensitive data requires your express written consent, unless an applicable legal exception applies. Medical tests or procedures also require the corresponding authorizations. Communication of results to the employer is governed by the transfers section and the decisions recorded at the end.

Other Purposes and Transfers

We will not use your health data for advertising, the sale of databases, or public disclosure. Any additional purpose requiring consent will be disclosed and requested separately; refusing it will not affect the medical service.

With your authorization, we may communicate to the employer identified on the consent form the fitness conclusion and occupational restrictions necessary to manage compatibility between your job and your health. Communication of drug screening results and specific clinical documents is authorized separately, specifying the content, purpose, and recipient.

The employer's commissioning of the examination does not imply unrestricted access to your records. Authorization does not permit uses incompatible with the stated purpose. We will limit disclosure to relevant information; recipients must respect this notice and their applicable confidentiality and data protection obligations.

We may communicate information to competent authorities or other recipients when a legal provision or a statutory exception permits doing so without consent. The legal basis and scope will be documented. The consent form does not expand those exceptions or constitute a waiver of your rights.

Providers and Safeguards

We use personal Microsoft OneDrive for digital storage and our own Synology DS725+ server for backups with previous versions. Providers processing data on behalf of SESAMET must do so under the applicable instructions and contractual obligations. If a provider determines its own purposes, its status as a third party and the legal basis for communication will be assessed.

Technology services may involve processing outside Mexico under the provider's terms. SESAMET must maintain the required protection and corresponding instruments. Using these services does not authorize providers to use clinical information for incompatible purposes of their own.

We apply administrative, physical, and technical measures proportionate to the sensitivity of the information and restrict access according to roles. People involved are subject to confidentiality obligations. No system eliminates all risk; in the event of a breach significantly affecting your property or non-material rights, we will inform you immediately under the applicable legal terms.

Retention

Medical records are retained for a minimum of five years from the last medical act, in accordance with NOM 004 SSA3 2012. Once the purposes and applicable periods have ended, the corresponding blocking and deletion will take place. Backups will remain restricted during their retention and deletion cycle.

Rights and Request Procedure

You may access your data and learn how it is processed; request correction of inaccurate or incomplete data; request cancellation where appropriate; and object on legitimate grounds to certain processing. You may also withdraw your consent or request limits on use or disclosure.

Submit a written request to the address or email in section 1. Include your name and a means of receiving a response; documents proving your identity and, where applicable, representation; the right you wish to exercise; a description of the related data, except for access requests; and information that helps locate it. For corrections, specify the correction and provide supporting documents. We will provide an acknowledgment or reference number.

We will communicate the determination regarding ARCO rights within a maximum of twenty business days of receiving the request and, where appropriate, implement it within fifteen business days after communication. These periods may be extended once for an equal period when circumstances justify it, informing you of the reason.

After identity verification, access will be provided through consultation or an electronic copy by secure means; you may request a plain copy. Exercising these rights is free, except for permitted reproduction or shipping costs and cases provided for by law. Any full or partial refusal will be communicated with its legal basis.

Withdrawal and Restrictions

To withdraw consent or request restrictions, use the same channels and identify the consent or use you wish to withdraw or restrict. SESAMET applies the same response and implementation periods stated above to these requests, without prejudice to legal obligations requiring other action.

Withdrawal will not have retroactive effect. Cancellation or withdrawal does not require destruction of information that must be retained by law or prevent processing covered by a legal exception. We will explain the limitations and, where applicable, the inability to complete a service requiring that data. Refusing a voluntary transfer does not authorize disclosure or imply waiving access to your own results.

Publication and Changes to the Notice

This notice governs data processed for occupational medical services. Its publication online allows you to consult it; merely browsing or reading it does not constitute express consent to process sensitive data or transfer medical results.

Changes will be made available at https://sesamet.com/aviso and at reception, indicating the version and date. If a change requires new consent, we will request it before applying the corresponding processing. You may request an updated copy free of charge.

If you believe your right to data protection has not been addressed, you may contact the Secretaría Anticorrupción y Buen Gobierno under applicable legislation.

Legal basis: Federal Law on Protection of Personal Data Held by Private Parties, particularly Articles 7, 8, 15, 18–20, and 27–36; NOM 004 SSA3 2012 on medical records. Notice version: 1.