Privacy Policy &
Aviso de Privacidad

Identity of the Responsible Party

The party responsible for the collection, use, and protection of your personal data (Responsable) is:

By downloading, accessing, or using the HouseCall application, you acknowledge that you have read this Privacy Policy and consent to the collection and use of your personal data as described herein.

Personal Data We Collect

HouseCall collects the following categories of personal data (datos personales) in order to provide on-demand home physician visit services:

2.1 Identity & Contact Data

2.2 Medical & Health Data (Sensitive Personal Data)

2.3 Location Data

Location data is only collected when you have an active visit request or ongoing visit. We do not track your location in the background when the app is not in use for a visit.

2.4 Technical & Device Data

2.5 Payment Data

Purposes of Data Processing

3.1 Primary Purposes (Finalidades Primarias)

These are essential to providing the service. You cannot opt out of these while using HouseCall:

• Creating and managing your user account (patient or physician)
• Matching patients with available physicians in their area
• Dispatching physicians to the patient's home address
• Enabling real-time location tracking during an active visit
• Processing payment for completed visits via Stripe
• Generating visit receipts and sending them via email (SendGrid)
• Maintaining a medical record of visits, diagnoses, and prescriptions
• Sending push notifications for visit status updates
• Enabling in-app chat between patient and physician during a visit
• Complying with legal and regulatory obligations applicable in Mexico

3.2 Secondary Purposes (Finalidades Secundarias)

These are not essential to the service. You may opt out at any time without affecting your access to HouseCall:

• Sending promotional communications about new features or services
• Conducting satisfaction surveys and service quality assessments
• Aggregated and anonymized analytics to improve the platform

To opt out of secondary purposes, email privacy.housecall@aviantacapital.com or adjust your notification preferences in the app's Settings screen.

Data Storage & Infrastructure

Your personal data is stored using the following third-party infrastructure:

All Firebase data is stored on servers operated by Google LLC. While Google's infrastructure is global, your data may reside on servers located in the United States or other countries. By using HouseCall, you consent to this international transfer.

4.1 Data Retention

We retain your personal data for the following periods:

• Account data: For as long as your account is active, plus 12 months after account deletion.
• Medical records (visit history, prescriptions, diagnoses): 5 years from the date of the visit, as required by Mexican health regulations.
• Payment transaction records: 5 years, as required by Mexican fiscal law.
• Location data: GPS data is used in real time and is not retained after a visit is completed.
• Push notification tokens: Retained while you have an active account; deleted upon account deletion.

Data Transfers & Sharing

HouseCall does not sell your personal data to third parties. We share your data only in the following circumstances:

• With your attending physician: Your name, address, symptoms, medical history, and GPS location are shared with the physician who accepts your visit request. This sharing is essential to the service.
• With service providers: As listed in Section 4, we share data with infrastructure providers (Firebase, Stripe, SendGrid, etc.) under data processing agreements that prohibit them from using your data for their own purposes.
• Legal obligations: We may disclose your data to government authorities, courts, or law enforcement agencies if required by applicable Mexican law, a court order, or a legitimate legal process.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the acquiring party, who will be bound by this Privacy Policy.
• With your express consent: For any other purpose not listed here, we will obtain your prior consent.

Your Rights (Derechos ARCO)

Under the LFPDPPP, you have the following rights over your personal data:

How to Exercise Your Rights

To exercise any of the above rights, send a written request to privacy.housecall@aviantacapital.com including:

1. Your full name and registered email address
2. A clear description of the right you wish to exercise
3. A copy of a valid government-issued ID (for identity verification)
4. Any additional information relevant to your request

We will respond within 20 business days as required by Article 32 of the LFPDPPP. Where technically feasible, you may also manage some data directly in the app through your profile settings.

Right to Revoke Consent

You may revoke your consent to the processing of your personal data at any time. Note that revocation of consent for primary purposes will result in the inability to use the HouseCall service. To revoke consent, contact us at privacy.housecall@aviantacapital.com.

Data Security

We implement reasonable technical and organizational security measures to protect your personal data, including:

• Data in transit is encrypted using TLS/HTTPS for all API communications
• Firebase Security Rules restrict access to your data to your authenticated session only
• Payment data is never stored on our servers — all card handling is delegated to Stripe's PCI DSS Level 1 certified infrastructure
• Medical data access is restricted to your attending physician on a per-visit basis
• Firebase Authentication is used for all user sessions; passwords are never stored in plaintext
• Firestore access rules prevent cross-user data access

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data breach affecting your rights, we will notify you in accordance with applicable law.

Minors

HouseCall is intended for users who are 18 years of age or older. We do not knowingly collect personal data from minors under the age of 18. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at privacy.housecall@aviantacapital.com so we can delete the information.

Medical visits for minors may only be requested by a parent or legal guardian who accepts our Terms of Service on the minor's behalf.

Cookies & Tracking Technologies

The HouseCall iOS application does not use browser cookies. However, we use the following tracking technologies:

• AsyncStorage (local device storage): Used to persist your login state, app preferences (language, theme), and notification settings locally on your device. This data never leaves your device.
• Firebase Analytics: Used for aggregated, anonymized usage analytics to improve the app. No personally identifiable information is linked to analytics events.
• Expo device identifiers: Used solely for push notification token management.

Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document
• Send you a push notification and/or email alerting you to the changes
• Require re-acceptance within the app before continued use

Continued use of HouseCall after notification of changes constitutes acceptance of the updated Privacy Policy.

Supervisory Authority & Complaints

If you believe that your rights under the LFPDPPP have not been respected after contacting us, you have the right to file a complaint with Mexico's supervisory authority: