California Privacy Policy
CCPA / CPRA
Clínica Dental Venegas — Effective June 2026
Your California Privacy Rights
As a California resident, you are entitled to the following rights under the CCPA/CPRA:
Categories of Personal Information Collected
In the past 12 months, we have collected the following categories of personal information from California residents, as defined by the CCPA:
| Category | Examples | Collected? | Sold/Shared? |
|---|---|---|---|
| Identifiers | Name, email, phone, IP address | Yes | No |
| Personal Records | Address, billing info | Yes | No |
| Health / Medical Info | Dental records, treatment history, medications | Yes (patients) | No |
| Internet / Network Activity | Browser data, cookies, pages visited | Yes | Limited* |
| Geolocation | City/region derived from IP | Yes | No |
| Inferences | Advertising audience segments | Yes | No |
| Sensitive: Health | Dental conditions, treatment info | Yes (patients) | No |
* Internet activity data (cookies) may be shared with advertising partners (Google, Meta) for ad measurement purposes only — not sold. See Section 4.
Sources of personal information
- Directly from you (contact forms, patient intake, phone calls)
- Automatically from your device (cookies, analytics tools)
- From advertising platforms when you interact with our ads
- From other healthcare providers who refer you to our clinic
Purposes for Collection and Use
We collect personal information for the following business and commercial purposes:
- Providing dental care, scheduling appointments, and managing patient records
- Communicating with you about your treatment, appointments, and account
- Processing payments and managing billing
- Displaying and measuring dental advertising campaigns directed at US residents
- Improving our website and digital marketing effectiveness
- Complying with legal obligations under HIPAA, Mexican law, and US state laws
- Detecting and preventing fraud or unauthorized access
Sale or Sharing of Personal Information
We do not sell your personal information as that term is traditionally understood. We do not receive money in exchange for your data.
However, under the CPRA's expanded definition, sharing cookie/pixel data with advertising partners like Google and Meta for cross-context behavioral advertising may constitute "sharing" under California law. We disclose this transparently:
- What is shared: Cookie identifiers and website activity data (not health information) with Google Ads and Meta for ad targeting and measurement
- Who it is shared with: Google LLC and Meta Platforms, Inc.
- Purpose: To show our dental ads to relevant audiences in the US; to measure how many ad viewers become patients
- We never share: Health information, PHI, dental records, or sensitive personal information with any advertising partner
You may also opt out by contacting us directly at the email or phone number in Section 10, or by using your browser's Global Privacy Control (GPC) signal, which we honor automatically.
Sensitive Personal Information
Under the CPRA, certain categories of information require heightened protection. We collect the following sensitive personal information from patients:
- Health and medical information (dental conditions, treatment history, medications, allergies)
- Government-issued ID numbers (for patient verification purposes)
- Financial account information (for payment processing)
We use sensitive personal information only for the purpose of providing dental care and as otherwise required by HIPAA and applicable law. We do not use sensitive personal information for advertising, profiling, or any purpose beyond what is necessary to deliver our services.
You have the right to limit our use of your sensitive personal information to these necessary purposes. To exercise this right, contact us using the information in Section 10.
How to Exercise Your Rights
To submit a verifiable consumer request under the CCPA/CPRA, you may:
- Email us at [EMAIL ADDRESS] with the subject line "CCPA Privacy Request"
- Call us at [PHONE NUMBER] and ask for our privacy officer
What to include in your request
- Your full name and contact information
- Description of the right you wish to exercise (access, deletion, correction, opt-out)
- Sufficient information to verify your identity (we may ask for additional verification for sensitive requests)
How we verify your identity
To protect your privacy, we will verify your identity before processing a request. We match the information you provide against the information we have on file. For health-related requests, we may require a signed authorization form.
Response timing
We will confirm receipt of your request within 10 business days and respond substantively within 45 calendar days. We may extend by an additional 45 days for complex requests, notifying you in advance.
You may submit up to two requests per 12-month period at no charge.
Authorized Agents
You may designate an authorized agent to submit a CCPA request on your behalf. To do so, the authorized agent must provide:
- Written authorization signed by you permitting the agent to act on your behalf
- Proof of the agent's own identity
- Sufficient information to verify your identity independently
We may deny a request from an agent who cannot meet these requirements.
Non-Discrimination
We will not discriminate against you for exercising any of your CCPA/CPRA rights. Specifically, we will not:
- Deny you dental services
- Charge you different prices or rates
- Provide you with a lower quality of service
- Suggest that you will receive a worse outcome as a result of exercising your rights
Data Retention
We retain personal information only as long as necessary for the purposes described in this policy or as required by law:
| Category | Retention Period | Legal Basis |
|---|---|---|
| Patient dental/medical records | Minimum 7 years from last treatment | HIPAA / Mexican NOM-004 |
| Contact & marketing data | Until opt-out or deletion request | Legitimate interest |
| Website analytics / cookies | Up to 26 months | Consent / analytics |
| Payment records | 5 years | Tax & accounting law |
| CCPA request records | 24 months | CPRA compliance |
Contact & Complaints
To exercise your California privacy rights or for any questions about this policy:
California Attorney General
If you believe your CCPA rights have been violated and we have failed to resolve your complaint, you may contact the California Attorney General's Office or the California Privacy Protection Agency (CPPA):
- California Privacy Protection Agency: cppa.ca.gov
- California AG: oag.ca.gov/privacy/ccpa