Privacy Notice

The party responsible for the processing of your personal data is:

• Legal name: [TO COMPLETE: Legal name of the clinic]
• Federal Taxpayer Registry (RFC): [TO COMPLETE: RFC]
• Address: Av. Paseo Triunfo de la República 4450, Ciudad Juárez, Chihuahua, Mexico [TO COMPLETE: ZIP code and neighborhood if applicable]
• Contact email: info@vistar.com.mx
• Phone: +52 656 629 1601

For the purposes described in this notice, we may collect the following personal data:

Identification and contact data

• Full name
• Age, date of birth and gender
• Landline or mobile phone
• Email address
• Home address
• Official identification (when required by the service)

Sensitive medical data

As Vistar is a healthcare provider, during the course of care we may collect sensitive personal data under article 3, section VI, of the LFPDPPP, including:

• Ophthalmic and general clinical history
• Results of previous or ongoing studies, diagnoses and treatments
• Information about conditions, surgeries and medications
• Biometric data related to visual health (corneal topography, retinal imaging, ocular biometry, among others)

These data receive reinforced treatment and are collected only when necessary for medical care or when your express and written consent exists.

Website usage data

• IP address and approximate location
• Device type, browser and operating system
• Pages visited and time spent
• Information captured through cookies and similar technologies (see section 8)

The personal data we collect are processed for the following purposes:

Primary purposes (necessary for the relationship)

• Scheduling, confirming, rescheduling or canceling medical appointments
• Providing ophthalmologic care, diagnoses and treatments
• Creating, maintaining and updating the clinical record
• Issuing prescriptions, study orders and tax invoices
• Processing payments and managing billing
• Responding to and following up on inquiries, requests, complaints or comments made through our channels
• Complying with applicable legal, tax and health-related obligations

Secondary purposes (optional)

If you agree, we will additionally use your data to:

• Send you reminders of periodic check-ups and service promotions
• Share educational content about visual health
• Conduct satisfaction surveys
• Invite you to events, talks or screening campaigns
• Conduct internal statistics and service improvement, handling data in a dissociated form whenever possible

You may object to any of the secondary purposes by writing to info@vistar.com.mx. Your objection will not affect your ability to receive medical care.

In order to fulfill the primary purposes, your personal data may be transferred to the following third parties, which are required to observe this Privacy Notice:

• Clinical and imaging laboratories: for complementary diagnostic studies.
• Other physicians and health institutions: when necessary for continuity of care or for consultations.
• Insurers and medical-expense administrators: when treatment is financed in whole or in part through a policy.
• Technology providers: cloud hosting, electronic health record systems, scheduling platforms, email and web analytics, contracted under confidentiality and data-protection agreements.
• Competent authorities: in legally provided cases (Ministry of Health, COFEPRIS, tax, judicial or administrative authorities).

Except in the cases above, we do not carry out transfers that require your consent. If in the future we plan to do so, we will inform you and request your express authorization.

Pursuant to articles 22 to 35 of the LFPDPPP, you have the right to:

• Access the personal data we hold about you and learn the details of their processing.
• Rectify them when they are inaccurate or incomplete.
• Cancel them when you believe they are not necessary for the stated purposes or are being used for purposes not consented to.
• Object to the use of your data for specific purposes.

To exercise any of these rights, send a request to info@vistar.com.mx with the subject "ARCO Rights". Your request must contain:

1. Full name and means to receive the response.
2. A simple copy of a valid official ID (voter card, passport or professional license).
3. A clear and precise description of the data and the right to be exercised.
4. Any document that helps locate the personal data.

We will respond within a maximum of 20 business days from the receipt of your request, and if appropriate, we will act on it within 15 business days following the notification. These periods may be extended once for an equal period when circumstances justify it.

Exercising ARCO rights is free of charge. If you repeat the request within less than twelve months without justified cause, we may charge only reproduction and shipping costs.

You may revoke at any time the consent you have granted us for the processing of your personal data. To do so, send a request with the subject "Revocation of consent" to info@vistar.com.mx, following the procedure in the previous section.

Please note that, by legal mandate, in some cases we may not be able to address your request immediately or it may be necessary to retain certain data to comply with health, tax or legal obligations (for example, the minimum retention of clinical records under NOM-004-SSA3-2012).

You may request that your personal data not be processed for marketing, advertising or commercial prospecting purposes. To do so, register in our internal record by sending an email to info@vistar.com.mx with the subject "Use limitation". You may also register free of charge in the Public Registry of Users (REUS) of the Federal Consumer Prosecutor's Office (PROFECO).

Our website uses cookies and similar technologies (pixels, local storage) in order to:

• Remember your preferences (language, consent, dark mode).
• Analyze traffic and site performance.
• Personalize content and improve your experience.

You can configure your browser to accept, reject or delete cookies. Please note that disabling them may affect the operation of some sections of the site.

The analytics services we use may include, among others: Google Analytics, Meta Pixel and Google Tag Manager. [TO COMPLETE: Adjust the list according to the tools actually used.]

Vistar has implemented administrative, technical and physical security measures to protect your personal data against damage, loss, alteration, destruction, unauthorized use, access or processing. Among others, we use encrypted connections (HTTPS), access controls, locked record storage, and confidentiality agreements with personnel and providers.

No system is absolutely impenetrable; however, we make our best efforts to maintain the confidentiality and integrity of the information you entrust to us.

Vistar reserves the right to make modifications or updates to this Privacy Notice at any time, to address legislative changes, internal policies or new requirements for the provision of our services.

Any modification will be published on this page indicating the date of the last update. We recommend that you review it periodically.

If you have questions about this Privacy Notice or about the processing of your personal data, you may contact us:

• Email: info@vistar.com.mx
• Phone: +52 656 629 1601
• Address: Av. Paseo Triunfo de la República 4450, Ciudad Juárez, Chihuahua, Mexico

If you consider that your right to the protection of personal data has been violated, you may also contact the National Institute for Transparency, Access to Information and Personal Data Protection (INAI): home.inai.org.mx.