Privacy notice

Data controller

Patricio Ruiz Abrín, individual practitioner.
Colonia Nápoles, Mexico City.
Contact: patricio@inessentia.mx

Personal data collected

To provide the service, I collect the following data:

• Contact data: name, email, and phone number.
• Scheduling data: appointment date and time, session format (in-person or online).
• Billing data (when applicable): tax ID, legal name, the postal code of your registered tax address, and your tax regime — the four details Mexican tax authorities require to issue an invoice.
• Patient portal access data: to identify you when you book or follow up on appointments, an access identifier tied to your record is generated. It is not a password and is not stored in readable form.
• Conversations with the scheduling assistant: if you use the portal's automated assistant to arrange an appointment, the text you write is stored temporarily so I can follow up on your request.
• Patient portal usage: if you accept the notice on entering, I record which screen of the portal you were on and what actions you took — booking, cancelling or rescheduling an appointment, starting a payment — to understand how it is used and improve it. What you write is not stored, nor the content of anything: only the step, the date, and a visit identifier. If you do not accept, nothing is recorded.
• Sensitive data: in the therapeutic context, information related to your physical and mental health is collected. This data receives special protection under the LFPDPPP and is used solely for therapeutic purposes, with your express consent.

Purposes of processing

Primary purposes (necessary for the service):

• Coordinating and following up on appointments, including through the patient portal and its scheduling assistant.
• Providing therapeutic care.
• Issuing invoices upon request.

Secondary purposes (optional):

• Sending you information about workshops, therapeutic groups, or content related to mental wellbeing.

You can opt out of the secondary purposes at any time by writing to patricio@inessentia.mx. Declining does not affect the provision of therapeutic services.

Contact form

If you write to me through the contact form on this site, I receive your name, the email or phone number you leave and, if you write one, your message, along with the page you sent it from. I use them only to reply to you and arrange a first appointment; I don't add them to any list or write to you about anything else.

They are stored in a Google Sheets spreadsheet in my Google account (Google LLC, in the United States), under its privacy policy. The email notification I receive doesn't include your message: it only tells me there is a new one. If we start working together, your details become part of your record like any patient's; if not, I delete the row no later than six months after receiving it. And since the form isn't a clinical channel, please don't write details about your health there.

Data transfers

I do not sell or share your personal data with third parties for commercial purposes, and I do not hand it to anyone except where a legal obligation requires it.

To provide the service I do rely on third-party platforms, which necessarily process some of your data: Zoom (online sessions), Google Calendar (scheduling), Anthropic (the patient portal's automated scheduling assistant), Stripe (card and bank-transfer payments), FacturaGorila, operated by Bisimplex (invoicing), and Resend (delivery of the emails I send you: confirmations, reminders, and invoices). Each operates under its own privacy policy, which I recommend reviewing directly.

About Google Calendar: every booked appointment creates a Google Calendar invitation with you as a guest. That invitation reaches you directly from Google by email and is recorded in your own Google account. Once sent, that copy is in your hands and Google's, not mine: if you later ask me to delete your data, I can remove the event from my calendar, but not the copy already sitting in yours.

About payments: if you pay by card, neither your name nor your email leaves my system. The payment is completed on Stripe’s page, not mine: your card details go to Stripe directly and I never see them — I keep no card number and no charged amount. If you pay by bank transfer (SPEI), Stripe requires a customer record created beforehand with your name and email, so those two details are stored with Stripe, Inc., in the United States, under their privacy policy. In both cases the charge description reads only “Session”, and Stripe sends you the receipt directly. If you ask me to delete your data, I also delete that customer record. What I cannot delete is the data from payments already made — the address a receipt was sent to, for instance: that stays on Stripe’s side.

About invoicing: if you ask me for an invoice, the tax details needed to issue it are sent to FacturaGorila — the platform I issue receipts through, operated by the company Bisimplex — and are stored there under their terms and Bisimplex’s privacy notice. If I also end up keeping them on my side, they are deleted when I anonymize your record, like the rest of your data. If you ask me to send it to you, I email it to you —the XML file and its PDF—: that is not done by FacturaGorila but by my own system, like the rest of the emails I send you (just below).

About the emails I send you: when an appointment confirmation, a reminder, or your invoice reaches you from me, that email goes out from my system through Resend (Resend, Inc., in the United States), the service I use to deliver email, under their privacy policy. To deliver them, Resend processes your name and your email address, and in the case of an invoice the two attachments as well, which carry your tax ID and legal name inside. The content of these emails is administrative —times, confirmations, and amounts—, never anything we discuss in session. And as with any email, once delivered it also sits in your inbox: if you ask me to delete your data, I can remove what is on my side, but not the emails you already received.

About the scheduling assistant: the text you write in that conversation is sent to Anthropic in order to generate a reply, under their privacy policy. Your name, email, and payment details are not sent. It is an administrative tool, meant for coordinating times — it is not a clinical channel and it does not carry health-data certifications such as HIPAA. For that reason I ask you not to share clinical or sensitive information there: that is what I am for, through the channels we already use.

How long I keep your data

I don't keep everything for the same length of time:

• Conversations with the scheduling assistant: automatically deleted after 30 days. If you want one deleted sooner, write to me and I'll do it.
• Appointment requests: kept for at least 14 days after the appointment date, and deleted afterwards in the normal course of operation.
• Portal usage records: deleted after 30 days.
• Contact data and your practice history: kept while you are an active client. If you stop coming and ask me to, I anonymize your record: I keep only the dates my internal scheduling rules need, and delete your name, your email, and any associated notes.

Backups of all of the above expire after 30 days. Payment data is the exception: data from a completed charge stays with my payment processor, and its removal is not up to me.

Your rights (ARCO)

You have the right to:

• Access: know what data I hold about you and how it's used.
• Rectification: correct inaccurate or incomplete data.
• Cancellation: request that I delete your data when it's no longer needed.
• Objection: object to the processing of your data for specific purposes.

To exercise any of these rights, write to me at patricio@inessentia.mx stating your full name and the right you wish to exercise. I'll respond within a maximum of 20 business days, as established by the LFPDPPP.

An honest note about the limits: there are three things I cannot undo, even if you ask. The copy of a calendar invitation Google has already delivered to your account, text that has already travelled to the assistant in a past conversation, and the data from a payment that has already gone through my payment processor. In all three cases I can delete what sits on my side, and I'll confirm that to you in writing.

Cookies and tracking technologies

This site uses Google Analytics cookies, which load automatically when you visit, to understand general visit behavior in an aggregated, anonymous way. No personally identifiable data is collected through these cookies.

In the patient portal I also use a first-party cookie, not third-party analytics: it stores a visit identifier to group the steps of a single session of use, and another that remembers you have already accepted this notice so it is not shown again. Neither is shared with anyone, and they do not identify you outside the portal.

If you would rather not be measured, you can turn them off here. You can also block or delete them through your browser settings at any time.

Analytics cookies are now turned off in this browser.

Changes to this notice

Any modification to this privacy notice will be published on this same page along with the corresponding update date. I recommend reviewing it occasionally.