How we protect your data

Who is responsible for your data?

The controller of your data is Nunciatura Medical, the company that operates Clínica Thuel.

• Address: Centro Médico Nunciatura, Calle 76A, San José, 10108, Costa Rica.
• Phone: +(506) 4070-2045 · WhatsApp: +(506) 6053-5355.
• Email for privacy matters: consultas@clinicathuel.com.

The treating physicians also take part in the clinical record, and they safeguard it under professional confidentiality (Code of Medical Ethics, arts. 70 and 131).

In which database is it stored?

Your data is stored in a patient and contact database of Clínica Thuel (Law 8968, art. 5.1.a). It is a database for internal use: we do not sell it, rent it or transfer it so that others can do business with it.

What data do we collect?

Contact data

Your name, phone or WhatsApp number, email, preferred time and the service you are interested in. We receive it when you use the consultation form, write to us by WhatsApp or email, or call us.

Health data

This is sensitive data (Law 8968, arts. 3.e and 9). It includes the reason for your visit, medical history, medications, allergies, clinical photographs and everything recorded in your clinical record. Simply telling us which treatment interests you may already reveal something about your health, so we protect it with the same confidentiality.

We collect it during the consultation and medical care. It may also reach us if you write it to us on WhatsApp. That is why we ask for a separate authorization to process it (see below).

Browsing data

Pages visited, type of device and browser, where you came from (for example, from an ad) and actions such as tapping the WhatsApp button. Visit measurement and advertising cookies are active by default, and you can disable them. You will find the details in the cookie policy.

Which data is required, and what happens if you do not provide it?

• Required to book: your name, a phone or WhatsApp number and the service you are interested in. Without them we cannot schedule your appointment.
• Required to provide care: the health data the doctor needs to evaluate your case safely. No one is obligated to provide sensitive data (Law 8968, art. 9.1). However, if you do not provide it, the doctor may not be in a position to recommend or perform a procedure safely.
• Optional: email, preferred time, comments and the authorization to receive information from the clinic. If you do not provide them, we will gladly assist you all the same.
• Analytics and advertising cookies: active by default and optional. If you disable them, the site works the same.

What do we use your data for?

With your authorization for care

• Booking, confirming, rescheduling and reminding you of your appointments and follow-up visits.
• Answering your inquiries by WhatsApp, phone or email.
• Providing you with medical care and keeping your clinical record.
• Handling complaints, claims and requests about your rights.

Only if you accept it separately

• Sending you information and news from the clinic by WhatsApp or email. This is a separate, optional authorization with no pre-checked box (Regulation 37554-JP, arts. 2.f and 4.b; Law 8642, art. 44). You can withdraw it whenever you wish by writing “I do not wish to receive information.” We apply it immediately and at no charge.

Active by default, and you can disable it

• Measuring site usage and showing the clinic's ads through analytics and advertising cookies. We notify you when you arrive, and you can disable them whenever you want in Cookie Preferences.

We do not use your data for purposes other than these (Law 8968, art. 6.4).

Your authorization for health data

To process health data, we ask for your express consent, in writing or by electronic means (Law 8968, art. 5.2). We consider it received when you:

• check the authorization box on the consultation form, which leaves a record in the WhatsApp message; or
• reply affirmatively to the authorization message we send you by WhatsApp before asking you for health information; or
• sign the authorization form at the clinic.

Until you give us that authorization, we ask that you do not send photographs, diagnoses or health details by WhatsApp or email. We keep a record of your authorization, because it is our responsibility to prove that we obtained it (Regulation 37554-JP, art. 6).

Who receives your data?

We do not sell your data. To operate, we use providers that process it on our behalf and following our instructions (processors or technology intermediaries, Regulation 37554-JP, arts. 2.k, 2.n and 29–31). Even if they host it, we remain responsible for your data.

What we do not share with advertising platforms: your clinical record, your messages, your photographs or the data you type into the form. We do not send those platforms your name, your phone number or your messages; they do receive, as happens on any site that uses these tools, the address of the page you visit. Even so, you should know this: while these cookies are active, the analytics and advertising platforms receive browsing data from the site and may also use it under their own policies. That is why we notify you when you arrive, and you can disable them whenever you want.

Within the clinic's staff, only the people who need your data to care for you can access it. Your clinical record is accessed only by authorized healthcare personnel, who are bound by professional confidentiality.

Does your data leave Costa Rica?

Yes. The technology providers in the table above may store data on servers outside Costa Rica, mainly in the United States. Transferring data to other countries requires your consent (Law 8968, arts. 14 and 31.f). By using the site with cookies active, or by accepting this policy, you authorize us to make that transfer; you can withdraw that authorization by disabling cookies at any time. We require those providers, by contract or through their terms of service, to apply security and confidentiality measures (Regulation 37554-JP, arts. 29 and 43).

What rights do you have?

Law 8968 (art. 7) and its Regulation (arts. 7–26) grant you these rights. Exercising them is completely free of charge:

• Access: to know what data of yours we hold, what we use it for and who we share it with.
• Rectification: to correct inaccurate or incomplete data.
• Deletion: to ask us to delete your data.
• Revocation: to withdraw, at any time, any authorization you have given us, without retroactive effect.
• To know how it is processed: to learn about the system, program or method we use with your data, including the virtual assistant (Law 8968, art. 7.1.d).
• To consent or not to your data being transferred to third parties.

How to exercise them and how quickly we respond

• Write to us at consultas@clinicathuel.com or by WhatsApp with your name, the right you wish to exercise and a way for us to reply to you.
• We send you an acknowledgment with the date of receipt.
• We may ask you to confirm your identity. If information is missing, we will ask you for it only once within the following 5 business days, and you have 5 business days to send it (Regulation, art. 19).
• We respond within 5 business days, counted from the day after receipt (Law 8968, art. 7; Regulation, art. 18).
• If you revoke your authorization, we apply it within 5 business days and, within that same period, we notify the providers that hold your data (Regulation, art. 8). If you ask us to confirm that we have stopped processing your data, we respond within 3 business days (Regulation, art. 9).
• If we cannot grant what you request, we will explain why in writing (Regulation, art. 22).

Some data must be kept by law, such as the clinical record. If you ask for deletion, we will explain what we can delete and what we must keep (Regulation, art. 26.b).

If you believe we did not handle your request properly, you can file a complaint with the Agencia de Protección de Datos de los Habitantes (PRODHAB), at www.prodhab.go.cr (Law 8968, art. 24).

How long do we keep your data?

• Clinical record: at least 10 years from your last visit.
• Contact data without medical care: for as long as we remain in conversation with you and up to 2 years after the last contact, unless you ask us to delete it sooner.
• Authorization to receive information: until you withdraw it.
• Browsing data: according to the duration of each cookie, stated in the cookie policy.

Under no circumstances do we keep data that could affect you for more than 10 years after its purpose has ended, unless a special regulation or an ongoing care relationship justifies it (Law 8968, art. 6.1; Regulation, art. 11).

How do we protect your data?

We use administrative, physical and technical measures: access limited by person, passwords, protected equipment and providers that meet security standards (Law 8968, art. 10). We review the measures for health data at least once a year (Regulation, art. 37).

If a security incident affecting your data were to occur, we will notify you within 5 business days. We will tell you what happened, what data was compromised, what we did and where you can get more information (Regulation, arts. 38 and 39).

Minors

This site is intended for people over 18 years of age. If a minor needs care, the data and authorizations are provided by their mother, father or legal representative (Law 8968, art. 5.1).

Analytics and advertising cookies

Visit measurement and advertising cookies are active by default, and you can disable them. You can change your choice whenever you wish in Cookie Preferences. You will find more detail in the cookie policy.

Can this policy change?

Yes, when our services, our providers or the law change. We will publish the current version here with its date. If the change affects how we use your data, we will ask for your authorization again.

Last updated: October 13, 2026.