How we look after your information

Who is responsible

Tu Cauce, based in Todos Santos, Baja California Sur, Mexico, is the data controller for your personal information.

For anything to do with this notice, including the requests described below, write to privacidad@tucauce.com.

What we collect

If you are looking for care: your name, email, and your phone number if you give it. Once you book, we keep your appointments and the messages between you and your practitioner.

If you are a practitioner: the above, plus your location, languages, biography, photograph, the practices you offer, your prices and hours, and the documents evidencing your training or professional licence.

From everyone who visits: if you agree to it, usage data — which pages are visited and what is searched — to improve the site. You can decline and everything still works.

Sensitive personal data

We handle sensitive personal data about your health: what you record in your journey, the notes your practitioner writes about your visits, the forms you complete, and the measures tracked over time.

The law requires your express consent for this. We ask for it clearly and separately before any record is created, and you can withdraw it.

What you type into the symptom search never leaves your device. If you write \u201cmy back hurts\u201d to find someone, that text stays in your browser \u2014 we record only which concern it matched, never your words.

What we use it for — necessary purposes

These are what make the service possible. Without them we could not serve you.

Creating and maintaining your account · connecting you with practitioners and letting them see what they need in order to care for you · handling appointments, reminders and messages · keeping the record you and your practitioner build together · verifying the credentials of everyone listed · acting on reports and keeping the platform safe · meeting legal obligations.

What we use it for — optional purposes

These are not essential, and you can decline without any effect on the service.

Measuring how the site is used so we can improve it. This is switched off until you accept it: you will see a notice where you can accept or decline, and you can change your mind at any time.

We do not use your information for advertising, we do not sell it, and we do not trade it with anyone.

Who can see your record

A practitioner can see your journey in two cases only: when they have marked a visit with you as held, or when you explicitly grant it.

Your revocation always wins, even over a completed visit. One appointment years ago does not mean permanent access to your health record, and you can close it from your own portal at any time.

Someone referring you to a colleague grants them nothing. Only you decide.

Who we share it with

The practitioners you choose, to the extent described above.

Providers who operate the platform on our behalf under contract: website and database hosting in the United States, sending the emails that let you into your account, and usage measurement if you accepted it. They may not use your information for their own purposes.

Authorities, where a legal obligation requires it.

We do not sell personal information to anyone, under any circumstances.

We never put clinical information in an email. The emails we send are for getting into your account or resetting your password; nothing from your record travels that way.

Your ARCO rights

You may ask to access your data, rectify it if it is wrong, cancel it when you believe it is no longer needed, and object to its use for particular purposes. You may also withdraw your consent at any time.

Write to privacidad@tucauce.com with your name, a way to reply to you, what you are asking for and which data it concerns. We will respond within the periods the law sets.

Some information must be kept even after you close your account, where a legal obligation or the defence of a claim requires it. We will tell you if that applies.

How we protect it

Information is encrypted in transit and encrypted at rest. Access is decided by the database itself rather than by the website: even if the site had a bug, the database will not hand one person's record to another.

Backups are taken daily. We limit who inside Tu Cauce can see what, and access is logged.

No system is perfect. If a breach occurred that materially affected your rights, we would tell you.

Changes to this notice

If we change this notice we will publish it here with a new date, and if the change is substantial we will tell you directly before it takes effect.

If we ever wanted to use your information for a purpose other than those described, we would ask your consent again.

If something is wrong

Write to us first — most things are resolved that way, and we want to know.

You may also go to the competent data protection authority, which since 2025 is the Secretaría Anticorrupción y Buen Gobierno, following the dissolution of INAI.