Privacy Notice

1. Identity of the controller

Controller: Mayel, a software platform for aesthetic clinics operated from Mexico.

Personal data department: privacidad@mayel.app.

2. Personal data we process

We process the following categories of personal data, depending on your relationship with us:

• From the subscriber: name or company name, contact person, email address, telephone, state within Mexico, and the tax details needed to invoice.
• From each platform user: name, email address, role within their clinic, profile photograph if they choose to upload one, and activity records inside the system.
• From anyone contacting us through the site: business name, state, email address and the message they send.
• Technical usage data: IP address, device type and session origin (web or mobile app), associated with the audit records.
• From anyone who signs in with Google (and, once available, Apple): name, email address, whether the provider verified that email, and the account identifier at the provider, which we store to link your Mayel account. Apple supplies the name only the first time and may supply a private relay email address instead of yours. We do not receive passwords, contacts, calendar or any other data from your Google or Apple account.
• From a clinic’s customer who adds her loyalty card to Google Wallet (and, once available, Apple Wallet): name, card number or QR serial, points and visits, and the clinic details shown on the card (name, logo, colours, contact details and programme terms). For Apple Wallet, also a device identifier so updates can be sent to it.
• We do not collect financial data directly: payments are processed by a specialist provider that receives your card details under its own privacy notice.

3. Sensitive and health data

The clinical records, assessments, consents and photographs a clinic enters into the platform contain its patients’ sensitive personal data.

In respect of that data the clinic is the controller and Mayel is the processor: we process it on the clinic’s behalf, on its instructions and solely to provide the service. We do not use it for our own purposes, we do not share it with other clinics, and we do not commercialise it.

Obtaining the patient’s express consent to process her sensitive data is the responsibility of the clinic treating her.

When a user uploads a profile photograph, that image is ordinary personal data processed only to identify them within their clinic.

4. Purposes of processing

Primary purposes, necessary for our relationship with you:

• Creating, administering and supporting the account and the clinic’s organisations.
• Providing the subscribed service, including hosting and backing up the information the clinic enters.
• Authenticating each user and recording in the ledger who performed each action, including sign-in with Google or Apple if you choose it.
• Creating, and keeping up to date at the customer’s request, the clinic’s loyalty card in Google Wallet or Apple Wallet.
• Invoicing, collecting the subscription and meeting tax and accounting obligations.
• Handling support requests, security incidents and requests from competent authorities.
• Sending operational notices: service changes, maintenance, amendments to these documents.

5. Secondary purposes

Additionally, and only if you do not object, we use your contact details to send you information about new functionality, content useful to your clinic and invitations to demonstration sessions.

You may object to these purposes at any time, without affecting the subscribed service, by writing to privacidad@mayel.app or using the unsubscribe link in each email.

6. Legal basis and consent

Processing your data for the primary purposes rests on the contractual relationship between us and on articles 8, 9, 15, 16 and 17 of the Federal Law on the Protection of Personal Data Held by Private Parties.

By providing us with your data and using the platform you consent to the processing described in this notice.

7. Transfers and disclosures to processors

We do not sell, rent or assign your personal data to third parties for commercial or advertising purposes.

To run the service we pass data to processors acting on our behalf under contract: infrastructure and hosting (Amazon Web Services: application and files in its Mexico region, database currently in its United States region), transactional email delivery and payment processing. Under Mexican law a disclosure to a processor does not require your consent.

If you choose to sign in with Google or Apple, that company (Google LLC; Apple Inc.) authenticates you under its own privacy notice and tells us the data described in clause 2; we do not send it your Mayel data. If a customer adds her loyalty card to Google Wallet or Apple Wallet, we pass Google LLC or Apple Inc. the card content (name, card number, points and visits, and the clinic details shown on it) and, for Apple Wallet, the device identifier used to send updates; each company processes it under its own privacy notice. For the customer’s card the clinic is the controller and Mayel the processor; the terms of its loyalty programme are the clinic’s responsibility.

We may transfer personal data without your consent in the cases the law provides, in particular where required by a competent authority through a duly founded and reasoned request, or where necessary to perform obligations arising from the legal relationship between the parties.

The current list of processors is available on written request at privacidad@mayel.app.

8. Access, rectification, cancellation and objection rights

You have the right to access your personal data, to have it rectified when inaccurate, to have it cancelled when you consider it unnecessary, and to object to its processing for specific purposes. To exercise them, send your request to privacidad@mayel.app including:

• Your full name and a means of replying to you.
• A copy of official identification proving your identity, or the document proving legal representation.
• A clear description of the data concerned and of what you are asking for.
• For rectification, the documentation supporting the requested change.

9. Response times

We will answer your request within twenty (20) business days of receiving it. Where the request is well founded, we will give effect to it within the following fifteen (15) business days.

Exercising these rights is free of charge; only justified postage or reproduction costs may be charged.

If your request concerns a patient’s clinical record, we will refer it to the clinic responsible and tell you we have done so, since in that case Mayel acts as processor.

10. Withdrawing consent

You may withdraw the consent you gave us by writing to privacidad@mayel.app. Note that withdrawal may make it impossible to continue providing the subscribed service, and that in certain cases we must retain information to meet a legal obligation.

To stop using Google sign-in, remove Mayel’s access on your Google Account permissions page (myaccount.google.com/permissions); for Apple, in your Apple ID settings. To remove a loyalty card, delete it from Google Wallet or Apple Wallet on your device; the card stops updating and, for Apple Wallet, we stop sending updates to that device.

11. Limiting use and disclosure

You may ask us at privacidad@mayel.app to limit the use or disclosure of your data, for example to stop receiving promotional communications. We will confirm your entry on our exclusion list.

12. Cookies and local storage

Mayel uses no advertising cookies and no third-party tracking, and does not sell browsing information.

The platform stores information in your browser’s or device’s local storage in order to work: your session identifier, the clinic you have active, your language, your appearance preference and the last schedule view you used. You can clear it from your browser; doing so signs you out.

13. Security measures

We apply administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction or unauthorised use: encrypted traffic, role-based authorisation checked on the server for every request, isolation of each clinic’s information, and an immutable ledger recording who accessed or changed what.

Mayel personnel access a clinic’s information only as needed to provide support, resolve an incident or meet a legal obligation.

No system is infallible. Should a breach occur that significantly affects your rights, we will tell you without delay, along with the measures taken.

14. Retention and deletion

We retain your data for the duration of the contractual relationship. When the clinic’s account loses access, we keep its information for twelve (12) months so that it can be exported or the clinic can return, notify before that period ends, and then delete it.

We retain for longer only what the law obliges us to keep — tax and accounting documentation — and the ledger entries evidencing operation of the service.

15. Minors

The platform is intended for professionals; we do not create accounts for minors.

Where a clinic treats a minor, it is the clinic that must obtain the consent of the person holding parental authority or guardianship. The platform allows that responsible adult to be recorded in the file.

16. Changes to this notice

We may update this notice because of legal changes, changes to the platform or changes in our practices. We will publish the current version at mayel.app with the date of its last update and, where the change is substantial, tell you by email.

17. Supervisory authority

If you believe your right to the protection of personal data has been infringed, you may approach the competent data protection authority in Mexico.

18. Contact

Personal data department: privacidad@mayel.app. Anything else: support@mayel.app.