Comprehensive Privacy Notice

QuHealthy Inc. ('QuHealthy', 'we'), with headquarters in Sinaloa, Mexico, is the data controller responsible for the processing and protection of your personal data. This notice applies to all platform user categories: patients, independent healthcare professionals, foundation directors and social workers, and enterprise medical supplier representatives.

We collect only data necessary for platform functionalities: • Identity and Contact Data: Full name, 18-digit CURP, official ID, RFC tax ID, email, telephone, and address. • Sensitive Personal Health Data: Clinical history, evolution notes, prescriptions, laboratory results, and vital signs stored in the Health Vault. • Social Assistance & Vulnerability Data: Socioeconomic status (NSE) and social evaluations recorded by foundations with beneficiary consent. • Commercial & Regulatory Data: COFEPRIS operating notices, sanitary licenses, lot/batch numbers, serial numbers, and medical device registrations.

• Identity Data: Name, email, CURP, RFC, and professional/institutional verification documents. Nombre completo, correo electrónico, teléfono y dirección.
• Sensitive Health Data: Electronic health records, diagnoses, prescriptions, and test results under strict medical confidentiality (NOM-004-SSA3). Cédula profesional, especialidad y comprobante de ejercicio clínico.
• Technical & Telemetry Data: IoT thermal telemetry logs for cold chain shipments, IP addresses, and auditable security metrics. Historial clínico, notas de evolución, diagnósticos, recetas y antecedentes biomédicos.

Your data is used strictly to: (a) Provide digital clinical records and consultation infrastructure; (b) Manage FoundationVouchers issuance and redemption for humanitarian assistance programs; (c) Coordinate inventory orders, warehouse transfers, B2B quotes, and cold chain shipments; (d) Process payment and service settlements; and (e) Comply with sanitary and tax regulations before SAT and COFEPRIS. QuHealthy NEVER sells, rents, or monetizes medical health data to third parties.

Clinical records are shared solely with healthcare professionals with whom the patient has an active appointment or has granted temporary access through Clinical Sovereignty (Health Data Sharing). Foundations only access folios and records strictly necessary to substantiate social subsidies. Quotation and purchase order data is exchanged exclusively between the supplier and the purchasing institution.

All sensitive data is encrypted using AES-256 at rest and TLS 1.3 in transit. The platform features Role-Based Access Control (RBAC), multi-factor authentication (MFA), immutable audit logging, and logical database partitioning.

Our cloud infrastructure operates in high-availability data centers adhering to international security benchmarks. Data is retained strictly for the duration required by applicable sanitary regulations for clinical records (minimum 5 years under NOM-004-SSA3) and fiscal statutory retention periods.

You or your legally authorized representative may at any time exercise your rights of Access, Rectification, Cancellation, or Opposition (ARCO), or revoke consent for processing sensitive personal data by submitting a formal request to our Data Protection Officer.

• Access: Inquire what personal data we hold and the terms of its processing.
• Rectification: Request correction of outdated, inaccurate, or incomplete information.
• Cancellation: Request deletion of your data when you consider it is not being processed lawfully.
• Opposition: Object to specific data processing or revoke shared access previously granted to doctors or foundations.

To file an ARCO request, email privacy@quhealthy.org. Requests will be processed within statutory timelines set forth by the LFPDPPP.

Registration and medical care for minors or individuals under legal guardianship must be executed through the account of an accredited parent or legal guardian who provides express legal consent.