Privacy Notice

1. Data controller and address

Alba Digital Software y Soluciones en Salud Mental S.A. de C.V. ("Alba Digital," "we," "us"), with address at Río Suchiate 722 Int. 205, Col. Lomas del Valle, San Pedro Garza García, Nuevo León, C.P. 66240, Mexico, is responsible for processing the personal data we collect through this website (albaclinica.com.mx), in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations. Alba Clínica is Alba Digital's clinical product family.

2. Personal data we collect

When you browse this site and use its contact form, we may collect:

• Data you provide directly: your name, email address, type of practice, the product you're interested in (Alba Clinical Dashboard, Alba Patient Companion, both, or just keeping an eye on it), and the content of your message.
• Technical data generated when you submit the form: your IP address and the date and time of submission, which we log alongside your message solely to prevent spam and keep a minimal record of the contact.
• Your newsletter choice and the notice version: together with your message we record whether you ticked the optional box to receive news, and the version of this notice in force when you submitted the form, so that your choice can be demonstrated.
• "Honeypot" field: the form includes a hidden field, invisible to people, whose only purpose is to detect automated bot submissions; it is not designed to capture data from visitors.

Sensitive personal data, including patients' health data, is not requested through this site and must not be sent, including in the form's message field. If it arrives, it is deleted.

3. Purposes of processing

Primary purposes

• Responding to your request for a demonstration or information, and following up on it.
• Identifying you as the sender and replying to the email address you provided.
• Arranging a demonstration with fictitious data and adding you to the interest list about Alba Clínica's future availability, when you request it.
• Keeping a minimal record of the communication and preventing misuse of the form.

Secondary purposes

Additionally, and only with your consent, we would like to use your data to:

• Send you Alba Clínica news, including new features and future availability, if you tick the optional box on the form.
• Produce aggregated, non-identifiable statistics about interest in our products.

You can opt out of these secondary purposes without affecting our response to your request by writing to info@albadigital.com.mx with the subject line "Secondary purposes."

4. Data transfers

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes. The only third parties involved are technical service providers acting on our instructions (for example, the hosting provider that technically transmits emails generated by the form), and competent authorities when there is a well-founded legal requirement. Outside of these cases, we do not transfer your personal data to third parties. Transfers specific to the optional Google Calendar integration are described in section 5.

5. Google Calendar integration (use of Google user data)

Alba Clinical Dashboard, Alba Digital's clinical records software, offers each practitioner an optional integration with Google Calendar. It is only activated if the practitioner chooses to connect their own Google account, and it works as follows:

• Google data accessed: the app requests only the calendar.events scope, which it uses to create, update, and delete events in the practitioner's primary calendar for the appointments scheduled in Alba Clinical Dashboard. It does not read or list any other events, and it does not access other calendars, contacts, email, or the Google account profile.
• What is sent to Google Calendar: for each appointment, only the patient's first name and first surname, and the date, time, and duration of the appointment. This data is patients' personal data and, because these are appointments with a mental health professional, it may reveal health context. The reason for consultation, notes, modality, appointment status, and any other information from the clinical record are not sent. Synchronization is one-way: from Alba Clinical Dashboard to Google Calendar.
• Where credentials are stored: the access tokens issued by Google are stored on the Alba Clinical Dashboard server installed at the clinic itself, together with a reference to each event created; Alba Digital does not keep them on its own servers. To complete authorization and refresh tokens, the clinic's installation communicates with an Alba Digital intermediary service (oauth.alba-auth.com, hosted on Cloudflare), which keeps Google's authorization code for no more than five minutes and does not store tokens.
• Sharing: information received from Google APIs is not sold, not used for advertising or user profiling, not transferred to third parties —except to the technical providers needed to deliver the integration or when required by law— and not used to develop, improve, or train generalized artificial intelligence or machine learning models. No one at Alba Digital reads it, except with the practitioner's express consent, when necessary for security purposes, or to comply with the law.
• Disconnecting and deletion: the practitioner can disconnect the integration at any time from My profile → Integrations in Alba Clinical Dashboard; doing so deletes the tokens and event references from the installation. Access can also be revoked from the Google account settings (myaccount.google.com/permissions). Events already created remain in the practitioner's Google Calendar until they delete them. For any related request, write to info@albadigital.com.mx.

The decision to use this integration with patient data rests with the clinic and each practitioner, under the clinic's own privacy notice.

Alba Clinical Dashboard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data protection and security

We treat both Google user data and the patient data involved in the Google Calendar integration as sensitive information, and we protect them with the following administrative and technical safeguards:

• Encryption in transit: all of the integration's communications are encrypted with HTTPS (TLS): between the practitioner's browser and Alba Clinical Dashboard, between the clinic's installation and the oauth.alba-auth.com intermediary service, and between these and Google's APIs.
• Data minimization: the integration requests a single scope (calendar.events) and sends Google only what is strictly needed to schedule —first name, first surname, and time—, without the reason for consultation, notes, or any other information from the clinical record (see section 5). A patient's name and appointment time are patients' personal data.
• Credential protection: authorization uses the OAuth 2.0 flow with PKCE, so an authorization code cannot be exchanged without a verification key known only to the clinic's installation. The Google client secret is stored as an encrypted secret in Cloudflare, only in the intermediary service, and is never distributed to clinic installations. The authorization code is deleted as soon as the installation retrieves it, and in any case after five minutes.
• Storage and access control: tokens are stored in the database of the clinic's own server, inside its local network; they are never displayed in the interface or sent to Alba Digital. Using Alba Clinical Dashboard requires signing in with individual credentials, with role-based permissions and, when the clinic enables it, two-step verification. Each practitioner can only connect and disconnect their own Google account.
• Personnel access and logging: access to the Google Cloud and Cloudflare consoles that manage the integration is restricted to authorized Alba Digital personnel. Connecting and disconnecting each Google account is recorded in the installation's audit log.
• Incidents: if we detect a security breach that significantly affects this data, we will notify the clinic and the affected practitioners without undue delay, as required by the LFPDPPP, so they can take action (for example, revoking access from their Google account).

Retention and deletion. We keep Google user data only for as long as needed to provide the integration:

• Access tokens and event references are kept in the clinic's installation while the integration remains connected, and are deleted as soon as the practitioner disconnects it. If the practitioner revokes access from their Google account, the tokens stop being valid.
• The authorization code is kept in the intermediary service for no more than five minutes.
• Backups that the clinic makes of its own database remain on its server, under its custody.
• To request deletion of data related to the integration, write to info@albadigital.com.mx; we will respond within a maximum of 20 business days.

7. Cookies, analytics, and other technologies

This site does not use tracking or advertising cookies, nor third-party analytics services, and we do not set our own cookies to profile your browsing.

To display the site's typography, we load web fonts from Google Fonts, which involves a technical request to Google's servers (fonts.googleapis.com and fonts.gstatic.com) that may transmit your IP address to Google under its own privacy policy. We do not use this service to identify you or for marketing purposes.

This is separate from the Alba Clinical Dashboard software itself, which runs inside each clinic's own network; the processing of patient data within it is described in each clinic's own privacy notice.

8. ARCO rights and how to exercise them

You have the right to access, rectify, and cancel your personal data, and to object to its processing or withdraw your consent (ARCO rights), under the LFPDPPP.

To exercise these rights, write to info@albadigital.com.mx with the subject line "ARCO rights," including your full name, the right you wish to exercise, a clear description of the personal data involved, and any information that helps us locate it. We will respond within a maximum of 20 business days; exercising these rights is free of charge.

If you believe your right to personal data protection has been violated, you may file a complaint with the competent authority.

9. Changes to this notice

We may update this notice to reflect changes in our practices, in applicable law, or on this website. The current version will always be available on this same page, with its update date.