Data controller

Erick Adrian Zamora Tehozol, an individual (persona física), is the responsable (data controller) for the processing of the personal data collected through RHEUMAI Professional, available at rheumai.xyz.

Address for hearing and receiving notifications: Calle 34, número 250, local 210, colonia Pensiones, C.P. 97219, Mérida, Yucatán, México.

Email for privacy matters, derechos ARCO (rights of Access, Rectification, Cancellation, and Opposition), limitation of use, and revocation of consent: privacidad@rheumai.xyz.

Scope of the service

RHEUMAI Professional is an artificial-intelligence-based information and workflow platform for qualified professionals in rheumatology. It helps retrieve and synthesize scientific information, organize clinical information, and generate professional documentation. It does not autonomously establish diagnoses, does not prescribe treatments, and does not replace the independent clinical judgement of a licensed professional.

Data we may process

Account and contact data, when used to access the service or to communicate with RHEUMAI.
Questions, instructions, messages, responses, and files that the user chooses to submit.
Session, conversation, and device identifiers.
IP address, user agent, date, time, and technical data necessary for security, abuse prevention, and operation.
Authentication data provided by the access service used.
Transaction and billing data when payments are enabled. RHEUMAI must not retain private keys or full card data.
Error logs, tool usage, and service performance records.

Health data

Health data are sensitive personal data. The public version of RHEUMAI is not authorized to receive identifiable clinical records, medical notes containing personal data, or information that would allow a patient to be recognized.

Before using the service, the user must remove names, medical record numbers, CURP (Mexican population registry code), NSS (Mexican social security number), addresses, telephone numbers, email addresses, faces, and any other direct or indirect identifier. An institutional workflow that processes identifiable information will require separate controls, contracts, legal basis, and authorization.

Primary purposes

Process requests and generate responses.
Retrieve and synthesize scientific literature.
Maintain sessions and conversations.
Process the permitted files that the user submits.
Authenticate users and manage access.
Prevent abuse, fraud, attacks, and failures.
Operate, maintain, and protect the service.
Manage payments and billing when enabled.
Address the rights of data subjects, incidents, and legal obligations.

Secondary purposes

With separate consent where necessary, RHEUMAI may use minimized or aggregated data to evaluate quality, measure usage, and improve features. RHEUMAI does not sell personal data or use it for behavioral advertising. The data subject may refuse or withdraw their consent for these purposes without losing the essential features.

Providers and transfers

RHEUMAI may use providers of hosting, databases, storage, authentication, security, payments, and artificial intelligence models. Content sent to an AI provider must be processed in a form readable by that provider in order to generate a response. Encryption in transit or at rest does not mean that the content remains encrypted during inference.

Some providers may process data outside Mexico. RHEUMAI limits processing to what is necessary to provide the service and applies the corresponding contracts and legal mechanisms. No additional transfers will be made without consent where the law requires it, except for the applicable legal exceptions.

Cookies and similar technologies

RHEUMAI may use functional cookies, browser storage, and session identifiers to maintain access, remember preferences, and protect the service. Non-essential technologies will be disclosed and will be subject to the applicable consent.

Retention and deletion

RHEUMAI retains data for as long as necessary to provide the service, protect the platform, address requests, resolve disputes, and comply with legal obligations. Thereafter it deletes the data securely or anonymizes it irreversibly. A deletion request may take time to propagate to backups. Data subject to a legal obligation will be blocked until the applicable period ends.

Security

RHEUMAI applies administrative, technical, and physical measures proportional to the risk. These measures may include encryption in transit, access controls, minimization, separation of environments, secrets management, audit logs, and incident response. No system is completely secure. RHEUMAI does not claim to have end-to-end encryption or general homomorphic processing of queries.

ARCO rights and revocation

The data subject may request access to, rectification, cancellation of, or opposition to the processing of their data. They may also limit its use or disclosure and revoke their consent by sending an email to privacidad@rheumai.xyz.

The request must include the name of the data subject, a means of receiving the response, documents evidencing identity or representation, a clear description of the right they wish to exercise, and the information necessary to locate the data. For rectification, the request must indicate the correction sought and provide supporting evidence.

The controller will communicate its determination within 20 days following receipt of a complete request. If the request is granted, the controller will give effect to it within the following 15 days, unless an extension permitted by law applies. Revocation has no retroactive effect and may be limited by legal obligations.

Minors

RHEUMAI Professional is intended for adults and healthcare professionals. It is not designed for minors to provide personal data or request medical guidance.

Automated decisions

RHEUMAI generates content through automated systems. Responses may contain errors, omissions, or biases. They do not by themselves produce legal effects and must not autonomously determine clinical decisions.

Changes to this notice

Changes will be communicated at rheumai.xyz/privacy or through a visible notice on the platform. If a change requires new consent, RHEUMAI will request it before carrying out the corresponding processing.

Contact

Email: privacidad@rheumai.xyz

Address: Calle 34, número 250, local 210, colonia Pensiones, C.P. 97219, Mérida, Yucatán, México.

Comprehensive Privacy Notice