Privacy Notice | Baja Body Mind

Effective 9 November 2026 (Mexico City time). Last updated: 9 November 2026. This is the comprehensive privacy notice of BENU Bespoke Therapies, S. de R.L. de C.V., which operates the Baja Body Mind clinic. The Spanish text is the controlling version for purposes of Mexican law; this English text is a translation for visitors.

1. Identity and address of the controller

The controller of your personal data is BENU Bespoke Therapies, S. de R.L. de C.V. (the “controller,” “the clinic,” “Baja Body Mind,” or “we”), which operates the wellness establishment Baja Body Mind in Rosarito, Baja California, Mexico.

The address for notices, and the clinic address published on this site, is: Carretera Libre Tijuana–Ensenada Km 29.5 #500, Popotla, Rosarito, Baja California, Mexico.

The controller’s RFC (Mexican tax ID) and tax domicile (domicilio fiscal) are not published on this site. They will be provided to you if you exercise ARCO rights or make another lawful request, or when a competent authority requires them.

To exercise your rights, revoke consent, limit the use or disclosure of your data, or ask a question about this notice, write to [email protected], or write or call us at the numbers published on this site: WhatsApp +52 664 437 4947 or US phone +1 619 467 1914, during clinic hours (10 am–4 pm PT (San Diego time), Monday to Saturday, by appointment). Requests are handled by the person or team the controller designates for that purpose. That person’s or team’s name will be stated in the reply to your request.

2. Personal data we process, including sensitive data

Depending on how you contact us and whether you visit, we may process:

Identity and contact data: name, phone number, WhatsApp account, language preference, therapy or dates of interest, and the content of administrative messages.
Health data (sensitive personal data): what you tell us in a health questionnaire, during the in-person visit, vital signs, medications, conditions, allergies, informed-consent records, and clinical notes related to your care at the clinic. These are treated as sensitive data under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, as in force, including the reform published in the Official Gazette on 14 November 2025).
Payment and billing data: deposit or payment confirmations, amounts, refunds, and receipts or invoices (CFDI) if you request one. When card payments are used, they are processed through a secure payment link of a payment provider; we do not ask for or publish full card numbers on this site and, to the extent the provider so operates, we receive payment confirmation rather than the full card number.
Technical site data: this is a static site. The hosting provider (Cloudflare Pages) may process technical data needed to deliver and protect the site, such as IP address, browser type, date and time, and pages requested. We have not installed advertising or third-party analytics tags on this site.

We do not knowingly collect data from children through this site. Services are offered to adults.

3. Primary purposes

We process your data, as needed, to:

handle requests for information, booking and visit logistics;
schedule, confirm, remind or reschedule appointments, and send arrival and preparation instructions;
provide in-person wellness IV care at the Rosarito clinic, including the in-person medical evaluation, informed consent, the infusion, monitoring, and written instructions when the visit ends;
process deposits, payments, refunds and receipts;
meet applicable Mexican legal, health, accounting and tax duties, and keep records for the periods the law requires;
respond to an emergency related to a visit at the clinic, if one occurs.

Health data are used for your care and related legal duties, not for marketing. These purposes are necessary for the relationship with the clinic or to comply with the law. If you do not want us to process the data that a visit or a payment requires, we may be unable to book or provide the service.

A questionnaire, a message or a pre-booking is not a remote medical approval. The clinical decision is made in person at the clinic in Mexico. WhatsApp and this site are used for booking, logistics and general information, not to assess or follow up clinically with someone who has already returned to the United States or another country.

4. Secondary purposes (you may opt out)

Unless you object, we may also use your name and contact details, without using your health data, to:

send general information about the clinic or services that is not required for an already booked visit;
invite you, after a visit, to leave a voluntary review, without requiring specific wording or making the service depend on that review.

To opt out of these secondary purposes, tell us by WhatsApp or phone at the published numbers. Opting out does not affect a booked visit or your ARCO rights.

5. Consent, especially for sensitive health data

Except where the LFPDPPP or health legislation allows or requires processing without consent (for example, a medical emergency or a legal duty), we will obtain your express written consent to process sensitive health data, by handwritten signature, electronic signature or another valid authentication method, on the questionnaire and/or the in-person consent forms. For payment and billing data, your express consent is given when you request and complete payment through the link or when you request a CFDI.

Your first WhatsApp message or a booking request should not include your medical records. We will ask for informed consent before we process your health data for care. You may revoke consent at any time, without retroactive effect, through the channels in section 1. Revocation may mean we cannot start or continue care that depends on those data. It does not remove the duty to keep the medical record or tax records for the legal retention periods.

6. Transfers

We do not sell your personal data. We may transfer them, only as needed, to:

the payment-link provider, solely to process a deposit or payment you requested (in the interest of the contractual relationship);
WhatsApp/Meta, if you choose to write to us on WhatsApp (your message is subject to WhatsApp’s terms and privacy policy; we do not control Meta’s processing);
the telecommunications provider, if you call or text the published numbers;
the site’s hosting provider (Cloudflare), as to technical connection data;
competent authorities, when the law requires it or for the prosecution or administration of justice;
professional advisers (legal, accounting or health) under confidentiality, when needed;
a hospital or emergency service, if a transfer is medically necessary during your visit.

Some of these transfers may be international (for example, if you use WhatsApp, a payment link, or if the site is served through Cloudflare). When a transfer requires your consent under the LFPDPPP and no legal exception applies — including those in article 36, such as transfers necessary for health care, for a contract in your interest, or to maintain the legal relationship — we will ask for it. The receiving third party must assume the obligations that correspond to the controller that transferred the data, as the law provides.

By using WhatsApp, a payment link or the site’s hosting services to communicate or book with us, you accept the transfers strictly necessary for that communication, that payment or the operation of the site. We do not transfer your health information for marketing.

For visitors in the United States: we do not sell personal information. This site does not use behavioral advertising or third-party analytics technologies. This notice is governed by Mexican law. If our practices change, we will update this notice.

7. ARCO rights, revocation, and limiting use or disclosure

You may access, rectify, cancel or object to the processing of your data (ARCO rights), revoke your consent, and limit the use or disclosure of your data, through the channels in section 1.

Your request must include, under article 28 of the LFPDPPP: your name and an address for notices; documents that prove your identity or, if applicable, your representative’s identity and authority; a clear description of the data involved, except for an access request; a description of the right you wish to exercise or what you are asking for; and any other element that helps locate the data. For rectification, also state the changes and provide supporting documentation.

The controller will notify you of its determination within a maximum of twenty business days from receipt of the request and, if the request is granted, will give effect to it within fifteen business days after that notice, periods that may be extended once for an equal period when the circumstances justify it, under article 31. Access will be provided through simple copies or electronic documents, by the means you indicate in your request. The exercise of these rights is free of charge; only reproduction or shipping costs, if any, may be charged, under article 34.

Cancellation, objection or revocation may not proceed when the law requires us to keep the clinical record or tax or accounting records, when we do not hold the data, when identity is not properly established, or in the other cases in articles 25 and 33 of the LFPDPPP, including when the data are needed to exercise or defend a right in a proceeding.

To limit use or disclosure for secondary purposes, a WhatsApp message or a phone call stating that you do not want promotional messages or review invitations is enough.

If you disagree with the response, or you do not receive one in time, you may file a data-protection request with Mexico’s Secretaría Anticorrupción y Buen Gobierno, within the periods and in the form set out in articles 40 and 41 of the LFPDPPP (generally, within fifteen business days after the controller’s response is communicated to you, or from the date the controller’s deadline expires if there is no response), in writing or through the means that Secretariat enables.

8. Retention

We keep data only for as long as they are needed for the purposes described and for the retention periods required by applicable Mexican health, tax and accounting rules. The clinical record is kept at least for the minimum period required by Mexican health rules, and tax and accounting records for the period required by tax law. They are then blocked and, in due course, deleted, as the law requires. For sensitive data, we aim to limit the processing period to what those purposes and duties require.

9. Security and limits

We maintain reasonable administrative, technical and physical security measures appropriate to the nature of the data, including limiting access to health information to staff who need it for your care or to comply with the law, and using a private questionnaire — not the public form on this site — for health data. No system is completely secure. If a security breach affecting your data occurs, we will inform you as the law requires.

This site, the on-site assistant and WhatsApp are not emergency channels and do not replace in-person care. The site assistant is a frequently-asked-questions router that runs in your browser; it does not assess your case, does not make clinical decisions, and does not send the conversation to a medical artificial-intelligence system or, in its current design, to an analytics server of ours. Do not use these channels to request a medical assessment once you have left Mexico; if you need care, seek local or emergency services.

10. Cookies and technologies on this site

We do not use advertising cookies or tracking cookies for marketing. Strictly technical cookies or browser or hosting-platform storage may exist as needed to display and protect the site. The frequently-asked-questions assistant does not use cookies or store the conversation, in its current programming (it runs only in your browser). If we later add analytics or advertising tools, we will update this notice and, where the law requires, offer choices.

If you write to us on WhatsApp or open a payment link, those third-party platforms may use their own cookies or technologies, under their own policies, which we do not control.

11. Changes to this notice

We may update this notice to reflect legal, operational or service changes. The current version is published on this page, with the date of the last update. Material changes will be announced on this same page and, when the law requires, also through the contact channel you have used with us.

12. Applicable law

This notice is issued under the Federal Law on the Protection of Personal Data Held by Private Parties, published in Mexico’s Official Gazette on 20 March 2025 and as amended on 14 November 2025, and other applicable Mexican rules. Clinical care is provided in Rosarito, Baja California, Mexico.