Comprehensive Privacy Notice

1. Identity and address of the data controller

Controller: AJOLOTE AZUL GENOMICS, S.A.P.I. de C.V. Mexican tax ID (RFC): AAG260603FJA.

Address: Calle Rómulo Ofarril 468, Colonia Olivar de los Padres, Álvaro Obregón, Mexico City, 01780, Mexico.

Privacy contact: privacidad@testgenetico-ajoloteazul.com. Telephone: +52 56 2445 1932.

2. Personal data we process

• Identification and contact data: name, date of birth, email address, and telephone number.
• Purchase and delivery data: address, service ordered, order status, communications, invoicing, and referral codes.
• Tax information you provide to request a Mexican electronic invoice (CFDI).
• Technical data: IP address, browser, device, security logs, and consent preferences.
• Payment data: Stripe processes card data; Ajolote Azul does not store the full card number or security code.

3. Sensitive and genetic data

To provide the services we may process health information, relevant history, biological samples, genetic data, and laboratory results. These are sensitive personal data.

We request express consent before purchase. When the patient is a minor or is not the buyer, we require authorization from their parent or legal guardian. Purchasing does not replace any informed consent or Agreement required before collecting or processing a sample.

4. Necessary primary purposes

• Identify the buyer, patient, and legal guardian where applicable.
• Manage the order, payment, shipment, receipt, and traceability of the sample.
• Coordinate analysis with the applicable laboratory.
• Deliver the laboratory's original report and contextual interpretation from Ajolote Azul.
• Provide support, replacements, invoicing, security, fraud prevention, and legal compliance.
• Retain evidence of consent, the contractual relationship, and services provided.

5. Optional secondary purposes

We will send newsletters, promotions, or wellness content only under a separate opt-in. You may refuse or withdraw this consent without affecting your purchase by emailing privacidad@testgenetico-ajoloteazul.com or using the unsubscribe link in each email.

Ajolote Azul does not currently use samples or genetic data for scientific research, GWAS studies, or database sales. Any change will require a new notice and separate consent where required.

6. Service providers and international disclosures

We share only the data required with providers acting on our behalf or delivering an essential part of the service. They may include Stripe (payments), hosting and database providers, Resend (email), logistics providers, and authorized professionals.

For NGx and PGx, required samples and data may be processed by Nutrigenomix and its laboratory network in Canada, the United States, and Ireland. For WGS and related services, they may be processed by Dante Labs S.r.l. in Italy and, depending on the service, Dante Labs Inc. in the United States.

These operations may involve processing outside Mexico. We require recipients to use information for the contracted service and under applicable contractual and legal duties. We may also disclose data to authorities when legally required. We do not sell personal or genetic data to insurers, employers, or advertisers.

7. Retention and deletion

The physical sample is retained for up to six months after processing and then destroyed, unless a legal obligation, technical incident, or valid instruction requires a different period.

Genetic results may remain available without a predetermined expiration date in the laboratory portal or system to provide a longitudinal service. You may request cancellation or deletion, subject to legal obligations, temporary backups, legal defense needs, and the capabilities and policies of the relevant laboratory.

Order, payment, invoicing, consent, and service records are kept for applicable tax, commercial, health, and limitation periods. They are then securely deleted or anonymized.

8. ARCO rights, withdrawal, and restrictions

Under Mexican law you may request access, rectification, cancellation, or objection (ARCO rights), withdraw consent, or restrict the use and disclosure of your data.

Email privacidad@testgenetico-ajoloteazul.com with: the data subject's name; a response channel; proof of identity and, where applicable, representation; a clear description of the right and data concerned; and information that helps us locate it. Do not send unnecessary genetic information.

We will communicate our decision within 20 business days after receiving a complete request and, if granted, implement it within the following 15 business days, subject to any extension allowed by law. You may also contact the competent Mexican data protection authority.

9. Security and incidents

We apply administrative, technical, and physical safeguards proportionate to the sensitivity of the data, including encrypted transmission, restricted access, traceability, and provider review. No system is infallible.

If a breach materially affects your property or moral rights, we will notify you as required by law and identify recommended actions.

10. Minors

A minor may take a test only when their parent or legal guardian completes the information, provides the required consents, and signs the applicable Agreement. We may request documents to verify identity, representation, and the best interests of the minor.

11. Cookies and measurement

Non-essential measurement tools, including Google Tag Manager, Google Analytics, Microsoft Clarity, and Vercel Speed Insights when enabled, activate only after consent. You may reject or change this choice through the site's cookie settings link.

12. Changes to this notice

We will publish changes on this page. If they substantially change the purposes or sensitive-data processing, we will request renewed consent where required.