In short
- This site does not use tracking or analytics cookies. It only remembers, in your browser, the language you chose.
- We do not sell data. We do not use patient data to train models or for our own purposes.
- For medical records, the data controller is the doctor or the clinic. We safeguard them on their behalf.
- You can request access, rectification, cancellation or objection at any time, free of charge.
1. Who is the data controller for your data
Novolution Labs, S.C. (hereinafter “Novolution Labs” or “we”) is the data controller for the personal data described in this notice. CorSapiens is the brand of our medical products.
- Legal name
- Novolution Labs, S.C.
- Address
- Calle Espíritu Santo 1294, col. La Lima, C.P. 80040, Culiacán, Sinaloa, Mexico
- novolutionlabs@gmail.com
- +52 55 6610 3613
For anything related to your personal data, contact our Personal Data Department, at the email address above.
2. What this notice covers
This notice covers the novolutionlabs.com website and our relationship with our clients: doctors, clinics, hospitals and companies that use our products and services.
Some products also have their own notice, detailing the data they process:
- CorSapiens Expediente: Expediente privacy notice.
- Código Infarto: app privacy policy.
- Doctors' websites: each site publishes the doctor's privacy notice; the doctor is the data controller for their patients' data.
If a product notice and this notice say different things about that product, the product notice prevails.
3. What this site collects
Almost nothing. You can read the entire site without giving us a single piece of data.
- Language preference. If you choose Spanish or English, your browser remembers it for your next visit. It is stored only on your device and never reaches us.
- No tracking or analytics cookies. We do not use visitor measurement tools, advertising pixels or browsing profiles.
- No forms. The site has no forms. If you write to us via WhatsApp or email, you start the conversation and decide what to tell us. We use that data (name, phone number or email, and whatever you write) only to reply to you and, if you ask, to prepare a proposal for you.
- Server logs. Like any website, the server records the IP address, date and requested page for security purposes. We do not use them to identify you or for advertising, and they are deleted periodically.
WhatsApp is a third-party service with its own privacy notice. When you write to us there, that third party processes your data according to its own rules.
4. Our clients' data
When you sign up for a product or service, or open an account, we process your data or that of your authorized staff:
- Identification and contact: name, email, phone number and position.
- Professional data: professional and specialty license numbers (cédulas), specialty, signature and letterhead (including the logo).
- Facility data: legal name, CLUES (Mexican health facility code) and address of the clinic or practice.
- Access and usage data: username, two-step verification if you enable it, IP address, access logs and usage of the artificial intelligence assistant.
- Billing and payment data: RFC (Mexican tax ID), tax regime, tax address and payment receipts.
We do not ask for your sensitive data to provide the service.
5. What we use your data for
Necessary purposes
Without them we cannot provide the service:
- Creating and managing your account and verifying your identity and your professional license.
- Providing the product or service you signed up for, giving you support and notifying you of changes or incidents.
- Keeping the log of access and changes that NOM-024 requires for the medical record.
- Protecting the security of the service, backing up information and handling incidents.
- Invoicing, collecting payment and meeting our legal obligations.
Additional purposes
We have none. We do not use your data for marketing or commercial profiling, we do not sell it, and we do not use patient data to train artificial intelligence models or for any purpose of our own. If we ever wanted to do so, we will ask for your permission first, and you can refuse without any change to your service.
6. Patient data: we safeguard it on the doctor's behalf
When a doctor or clinic registers their patients in our products, the data controller for that data is the doctor or the clinic, which compiles the medical record in accordance with NOM-004. Novolution Labs acts as data processor: we process that data only to provide the service and following their instructions.
This includes identification and contact data, and sensitive health data: medical history, notes, diagnoses, prescriptions, lab results, imaging studies, scanned documents and transcriptions of dictations or consultations.
As a data processor, we commit to:
- use it only to provide the contracted service;
- not transfer it, except upon a well-founded request from a competent authority, which we notify the doctor of when the law allows;
- maintain confidentiality, including on the part of our staff, even after the relationship ends;
- notify the doctor without delay of any security incident affecting their patients;
- help them handle their patients' requests and, when the service ends, hand over their medical records.
If you are a patient, exercise your rights with your doctor or clinic. We help them respond to you.
Artificial intelligence assistant
The Expediente assistant only suggests text, readings and drafts. The doctor reviews, corrects and signs. No decision about a patient is made without a doctor involved.
7. ECG interpretation service
When a clinic, hospital or company sends us electrocardiograms for interpretation, we receive patient data: name, age, sex, the tracing, the measurements and, afterwards, the electrocardiographic diagnosis issued by the cardiologist.
In this service the data controller is the clinic or company that hires us, which must inform its patients or employees and obtain their consent. Novolution Labs is the data processor: we process the data only to prepare and deliver the reports, with the same obligations as in section 6.
Each report is interpreted and signed by a cardiologist.
8. Who we share data with
Providers that help us (data processors)
Some providers process data on our behalf, only for what we ask of them and under a duty of confidentiality:
| Provider | Purpose |
|---|---|
| Email delivery | Verifying accounts, recovering passwords, appointment reminders and service notices. No clinical data. |
| Internet connectivity | Carrying encrypted information between your device and our servers. |
| Processing providers | While it exists, a backup so that the Expediente AI assistant keeps working if our infrastructure is unavailable. It may process the text of that request outside Mexico, without retaining it or using it for its own purposes. |
VPO Digital runs on a separate platform, which may be located outside Mexico, and will have its own privacy notice.
Transfers
We do not transfer personal data to third parties, except in the cases the law allows without your consent, such as a well-founded request from a competent authority.
9. How long we keep it
- Medical records: while the account is active. When it ends, the doctor can export them. We then keep them blocked for the period required by NOM-004 (at least 5 years from the last medical act) and afterwards securely delete them.
- Consultation recordings: audio is not stored. Transcriptions and the assistant's suggestions are deleted after 30 days.
- Client data: for the duration of the relationship and, afterwards, for the period required by tax and commercial laws.
- WhatsApp or email conversations: for as long as needed to assist you.
10. How we protect it
We apply administrative, technical and physical safeguards: encrypted connections, access isolated by clinic and by role, two-step verification, automatic logout after inactivity, encrypted daily backups, signed notes that cannot be altered, and a log of who viewed, printed or exported each medical record.
Records in Expediente are stored in Mexico. If an incident occurs that significantly affects your rights, we will notify you without delay so you can protect yourself.
11. Your ARCO rights
You have the right to access your data, rectify it if it is incorrect, cancel it and object to its use for specific purposes.
To exercise them, write to novolutionlabs@gmail.com with:
- your name and a way to reply to you;
- an official ID (and, if someone acts on your behalf, the document proving their authority to represent you);
- which right you want to exercise and regarding which data;
- any document that helps locate the data.
We will respond within a maximum of 20 business days. If your request is granted, we will carry it out within the following 15 business days thereafter. The process is free of charge.
The medical record is kept for the period required by NOM-004 while it serves your medical care, so some cancellations cannot be carried out before that period ends. We will explain this in our response.
If you are not satisfied with our response, you may turn to the Mexican personal data protection authority.
12. Revoking or limiting your consent
You can withdraw the consent you gave us or ask us to limit the use or disclosure of your data through the same channel as in section 11. If the revocation prevents us from providing the service, we will tell you beforehand.
You can also sign up for the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad) of Mexico's Federal Consumer Protection Agency (PROFECO).
13. Changes to this notice
We will publish any change on this page, with the date of the new version. If the data we process, the purposes or the providers change, we will notify you by email or when you log in to your account.
Current version: .