DentalX Back to home

Mexico Annex: Processing Contract (Remisión)

ANX-MX · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

Convenience translation: the Español text controls.

Read in: English · Español

SHA-256 of this text: ef6997d564e4def67cedb89ffd6cddb05723120be77555af855bd13847a120df

Mexico — ANX-MX: Processing Contract (Remisión)

Document ID: ANX-MX · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]] Language: Spanish controls (es/annex-mx.md: "Contrato de Encargo (Remisión)"). This English text is a convenience translation. Applies to: Clinics established in the United Mexican States. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.

1. Legal framework and nature of the relationship

1.1 The legal framework. This Annex is the legal instrument that evidences the existence, scope and content of the relationship between:

  • the Clinic, as responsable (controller); and
  • VstreamX, as encargado (processor).

It is made under the Federal Law on the Protection of Personal Data Held by Private Parties published in the Diario Oficial de la Federación on 20 March 2025 ("LFPDPPP"), and under its Regulation published on 21 December 2011, in so far as the Regulation remains applicable (the "Regulation"). [[TO CONFIRM: article numbers of the 2025 LFPDPPP on the encargado, the remisión and express written consent for sensitive data, inserted in clauses 1.2, 2 and 10; the transitory provision under which the 2011 Regulation applies only where it does not contradict the new law; whether a new Regulation has been published; and any amendment published since (a reform dated 14 November 2025 is reported and must be checked)]]

1.2 A remisión. The communication of Clinic Data to VstreamX, inside or outside Mexico, is a remisión to an encargado. It is not a transferencia. Under the LFPDPPP it therefore requires neither the data subjects' consent nor that they be informed of it as a transfer.

1.3 Own-purpose use would change that. That characterisation holds only while VstreamX and its Sub-processors process Clinic Data solely on the Clinic's behalf. Clause 3 secures it.

2. Obligations of the encargado

In accordance with Article 50 of the Regulation, VstreamX:

  • (I) processes the Clinic Data only according to the Clinic's instructions (MDPA clause 3);
  • (II) does not process the Clinic Data for purposes other than those the Clinic instructs (MDPA clause 4);
  • (III) implements the security measures in MDPA Schedule 2, in accordance with the LFPDPPP, the Regulation and other applicable provisions;
  • (IV) keeps confidentiality over the Clinic Data (MDPA clause 5);
  • (V) deletes the Clinic Data once the legal relationship with the Clinic has ended, or by the Clinic's instruction, provided no legal provision requires its retention (MDPA clause 14 and clause 6 of this Annex); and
  • (VI) does not transfer the Clinic Data, except:
    • where the Clinic so determines;
    • where the communication results from a subcontracting under clause 4; or
    • where a competent authority requires it, in which case MDPA clause 16 applies.

3. No use for own purposes by VstreamX or its Sub-processors

VstreamX ensures, through its contracts with its Sub-processors, that neither it nor they process Clinic Data for their own purposes. This covers Google LLC (including Vertex AI) and Meta Platforms, Inc. / WhatsApp LLC. In particular, Clinic Data is not used:

  • for advertising;
  • for profiling; or
  • to train artificial-intelligence models.

If a Sub-processor were to use Clinic Data for its own purposes, it would cease to be a sub-encargado and would require the data subjects' consent as a transfer. VstreamX would then:

  • notify the Clinic without delay; and
  • cease sending Clinic Data to that Sub-processor.

4. Subcontracting

4.1 Authorisation. In accordance with Articles 54 and 55 of the Regulation, the Clinic authorises VstreamX to subcontract the services to the Sub-processors listed in MDPA Schedule 3.

4.2 Obligations of the sub-encargado. Each Sub-processor assumes the same obligations as VstreamX under this Annex, through its contract with VstreamX.

4.3 Changes. A new or replacement Sub-processor requires the Clinic's prior approval, given in the Service as MDPA clause 7.5 provides, before the Clinic's data is routed to it (Regulation, Arts. 54 and 55). [[TO CONFIRM: Mexican counsel's view on whether, under the 2025 LFPDPPP, the general authorisation in clause 4.1 with 30 days' notice and a right to object under MDPA clause 7 suffices; if it does, a new version may return to that model]]

5. Cloud computing services

In accordance with Article 52 of the Regulation, VstreamX, as a provider of cloud computing services:

  • (a) has and applies personal-data protection policies consistent with the principles and duties of the LFPDPPP;
  • (b) discloses its subcontracting relationships involving the Clinic Data (MDPA Schedule 3);
  • (c) does not take on ownership of, or rights over, the Clinic Data;
  • (d) keeps confidentiality over the Clinic Data;
  • (e) is transparent about changes to its privacy policies and service conditions (MDPA clause 18);
  • (f) allows the Clinic to limit the types of processing through the configuration of the Service;
  • (g) implements the security measures in MDPA Schedule 2;
  • (h) guarantees the deletion of the Clinic Data at the end of the service, and allows the Clinic to verify it by the certificate in MDPA clause 14.7;
  • (i) prevents access to the Clinic Data by persons without access privileges; and
  • (j) informs the Clinic of any request by an authority (MDPA clause 16).

6. Retention and clinical records

6.1 The Clinic's duty. Under NOM-004-SSA3-2012, the clinical record must be kept for at least 5 years from the last medical act. DentalX does not auto-delete clinical records.

6.2 At the end of the service. The complete export under MDPA clause 14 is the return of the Clinic Data. It allows the Clinic to meet that duty after the deletion.

7. Security breaches

7.1 Notice to the Clinic. VstreamX notifies the Clinic of any security breach affecting Clinic Data within 24 hours of establishing it (MDPA clause 9).

7.2 What the notice contains. The notice contains the information the Clinic needs to inform the affected data subjects immediately where the breach significantly affects their patrimonial or moral rights:

  • the nature of the incident;
  • the personal data compromised;
  • recommendations to the data subjects;
  • the corrective actions taken; and
  • the means for obtaining more information.

8. ARCO rights

8.1 Assistance. VstreamX assists the Clinic within 5 business days, as MDPA clause 8 provides. This allows the Clinic to answer requests to exercise the rights of access, rectification, cancellation and opposition (ARCO), and to revoke consent, within 20 days, and to implement them within 15 days after its answer.

8.2 Through the Clinic only. VstreamX does not answer data subjects' requests directly. It forwards them to the Clinic.

9. Electronic clinical record systems (NOM-024)

9.1 Not certified. DentalX is not certified under NOM-024-SSA3-2012 on health-information-registration systems. Whether that standard applies to a foreign software service used by a private dental clinic is being reviewed by Mexican counsel. [[TO CONFIRM: Mexican counsel's opinion on NOM-024 scope, and VstreamX's decision to certify or to keep this disclosure]]

9.2 The Clinic's acknowledgement. The Clinic acknowledges this status. It remains responsible for the legal validity of its clinical record.

10. The Clinic's obligations

The Clinic is responsible, as responsable, for:

  • its privacy notice (comprehensive and simplified);
  • obtaining the express and written consent of each patient to the processing of their sensitive health data, with a handwritten or electronic signature or another authentication mechanism (DentalX provides a template the patient signs in the Service);
  • appointing the person or department in charge of personal data, and recording it in the Service; and
  • handling ARCO rights.

The Clinic's acceptance of this Annex does not replace the consent of its patients.

11. Authority

References to the data protection authority are to the authority competent under the LFPDPPP. Since the extinction of INAI, that authority is the Secretaría Anticorrupción y Buen Gobierno. [[TO CONFIRM: competent authority and its current name]]

12. Applicable law

The LFPDPPP and the Regulation apply to the processing of Clinic Data whatever law governs the commercial relationship under MDPA clause 23. Nothing in this Annex or the MDPA limits the rights of data subjects under them.

13. Change in law

When a new Regulation of the LFPDPPP is published, VstreamX will adapt this Annex as MDPA clause 18.4 provides.

Items to confirm before publication (Mexico)

  1. Publication date.
  2. The article numbers of the 2025 LFPDPPP for the encargado and the remisión, and whether a new Regulation has been published (§1.1).
  3. Mexican counsel's opinion on the scope of NOM-024, and VstreamX's decision to certify or to disclose (§9).
  4. The competent data protection authority and its current name (§11).