Data Processing Notice

The personal-data controller for Weight Loss Surgery Guide is Cyntar S.C., represented by Lic. Jorge Arriaga and located at Paseo de los Héroes 9111-100, Zona Urbana Río Tijuana, C.P. 22010, Tijuana, Baja California, México. Cyntar S.C. owns and publishes the website, operates Hospital Cyntar, and supports the Obesity Control Center bariatric practice.

Obesity Control Center is the patient-facing bariatric medical practice. Authorized Hospital Cyntar personnel receive and manage all surgery inquiries submitted through Weight Loss Surgery Guide. Leads are not sold or routed to outside hospitals, brokers, manufacturers, financing companies, OCC-independent coordinators, or unrelated providers.

Weight Loss Surgery Guide provides general bariatric education, provider comparisons, and a pathway to request information about surgery. The website’s primary commercial purpose is to generate surgery inquiries for Cyntar S.C. and the Obesity Control Center practice. The site is not an emergency service and does not provide an individualized diagnosis or treatment recommendation through its public pages.

The website may collect name, email address, telephone or WhatsApp number, country or region, language, preferred contact channel, inquiry source, and the content of a general message. This information is used to respond, schedule follow-up, maintain communication preferences, and manage the inquiry in Bitrix24.

A surgery-inquiry form may request height, weight, calculated BMI, prior bariatric surgery, current medications, diabetes status, major medical conditions, and desired procedure. This information is sensitive health-related data. It is used only for preliminary inquiry routing, preparation for human follow-up, and determining what additional evaluation may be needed. Submission of a screening form does not establish candidacy, create a diagnosis, or guarantee that a procedure will be offered.

When sensitive health-screening information is requested, the form must present a separate, affirmative, unchecked acknowledgment authorizing Cyntar S.C. to process the information for the stated inquiry and preliminary-review purposes. Marketing consents must be separate and optional.

Weight Loss Surgery Guide does not accept medical-record uploads at launch. Visitors must not submit medical records, laboratory reports, diagnostic images, operative reports, identification documents, insurance records, or detailed medical histories through the website, AI chat, ordinary email, SMS, or WhatsApp.

Bitrix24 provides the CRM and AI-chat workflow. The Bitrix24 AI chat may answer general educational questions and collect contact details only. It may not request the screening fields, collect medical history, diagnose, calculate surgical candidacy, recommend a procedure, or represent itself as a licensed clinician.

A visitor may voluntarily include health information in a general message even when it was not requested. Cyntar S.C. will limit use to responding to the inquiry, will not intentionally use it for advertising, and may ask the visitor to continue through a more appropriate private process. Visitors should not transmit urgent medical information through the website.

The site may process IP address, browser and device information, operating system, referring page, pages viewed, approximate region, timestamps, consent choices, security events, and cookie or device identifiers. Necessary data supports security, page delivery, consent storage, and fraud prevention. Optional analytics and advertising data is processed according to consent and applicable law.

Cyntar S.C. may process email, SMS, WhatsApp, and telephone contact details; the permission wording shown; timestamps; source; message history; unsubscribe requests; suppression status; and evidence of consent. All promotional follow-up is manual through Bitrix24.

When a person submits a privacy, Canadian, international, GDPR, or ARCO request, Cyntar S.C. may process identity and contact information, request details, information needed to locate the record, verification information, correspondence, and the outcome.

Cyntar S.C. processes personal data to operate and secure the site; respond to inquiries; conduct limited preliminary screening; prepare human follow-up; provide requested educational, scheduling, travel, pricing, or consultation information; manage communication and cookie preferences; record consent and opt-outs; measure website performance when permitted; measure Cyntar’s own advertising campaigns when permitted; prevent abuse; comply with law; establish or defend legal claims; and improve content and operations using limited or aggregated information.

Depending on the activity and jurisdiction, processing may rely on consent; explicit consent for sensitive information where required; steps taken at the visitor’s request; performance of an agreement; compliance with a legal obligation; protection of legal rights; or legitimate interests such as securing the website, responding to inquiries, preventing abuse, and improving operations, provided those interests are not overridden by applicable rights.

Only authorized Cyntar S.C. and Hospital Cyntar personnel receive and manage surgery inquiries. Technical service providers may process limited information for the contracted purpose: GoDaddy for hosting; Bitrix24 for CRM, AI chat, and communications; Google for Google Analytics 4, Google Ads, and Google Tag Manager; Meta Platforms for Meta Pixel; Microsoft for Clarity; and the consent-management provider selected before launch. Professional advisers and public authorities may receive information when legally necessary.

When advertising consent or another valid permission applies, Google Ads and Meta Pixel may receive limited technical and generic conversion information. Cyntar S.C. does not intentionally send names, contact details, desired procedure, BMI, weight, diabetes status, medications, conditions, prior-surgery information, screening answers, message text, or chat text to advertising platforms. The site does not sell leads or display third-party advertising.

Cyntar S.C. is established in Mexico and serves prospective patients in the United States and Canada. GoDaddy, Bitrix24, Google, Meta, Microsoft, and approved subprocessors may process data in Mexico, the United States, Canada, the European Economic Area, or other countries where they operate. When applicable law requires a safeguard, Cyntar S.C. will use an available contractual or legal mechanism and review relevant provider terms.

Contact information and ordinary inquiry correspondence are normally retained for up to 24 months after the last meaningful interaction unless a longer period is reasonably necessary to complete an active request, comply with law, resolve a dispute, or protect legal rights.

Preliminary health-screening information for a person who does not become a patient is normally retained for up to 12 months after the last meaningful interaction. It should be deleted earlier when it is no longer needed. If the person proceeds to clinical evaluation or care, information needed for that process may become part of the applicable Cyntar clinical record and will follow separate healthcare-record retention requirements.

General AI-chat transcripts and contact details are normally retained for up to 12 months after the last interaction unless they become part of an active inquiry or another record with a different lawful retention period.

Necessary cookie data is retained for the browser session or up to 12 months depending on function. GA4 first-party cookies may last up to two years. Clarity playback data is generally retained for 30 days, while selected or aggregated interaction data may be retained for up to nine months. Google and Meta advertising-measurement cookies used on the site generally last up to 90 days. The production cookie inventory controls when a provider uses a shorter duration.

Consent and opt-out evidence may be retained for the life of the permission and for up to five years afterward when reasonably necessary to demonstrate compliance, resolve disputes, or meet legal obligations. Suppression records may be retained as long as needed to prevent unwanted marketing from restarting.

Privacy-rights requests, correspondence, and outcomes are normally retained for up to five years after closure. Identification documents, if exceptionally required, should be deleted earlier when no longer needed for verification.

Weight Loss Surgery Guide does not use solely automated decision-making that produces legal or similarly significant effects. The AI chat may provide general information or route an inquiry, but it does not determine candidacy, diagnose, recommend treatment, approve surgery, or deny access to care.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal data; withdraw consent; limit advertising disclosures; or complain to a regulator. International and Canadian requests may be submitted through GDPR and International Data Request. Requests under Mexico’s private-sector data-protection law may be submitted through ARCO Rights Request.

Cyntar S.C. uses administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, least-privilege access, role-based access, multifactor authentication where available, audit logging, vendor review, suppression controls, backups, and documented retention procedures. No system can guarantee absolute security.

Contact the privacy team at privacy@weightlosssurgeryguide.com, or write to: