Privacy policy

1. Who is responsible for your data

This website, ibogainetreatmentmx.com, is operated by Ibogaine Treatment MX (“we”, “us”), a physician-led medical facility in Mexico City, Mexico. We are the data controller (in Mexican law, the responsable) for the personal data described in this policy.

This policy is written to meet the requirements of Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, in force since 21 March 2025) and its regulations, and it also describes the rights that visitors from the United States, Canada, the European Union and the United Kingdom have under their own laws. Where those laws give you more protection than this policy, the law applies.

This policy covers the website and the enquiry and screening process. Once you are admitted for treatment, the clinical record and the informed-consent documents you sign govern how your medical information is handled, alongside this policy.

2. What we collect

2.1 Information you give us by email

• Your email address, and anything else you choose to put in the message
• Who the enquiry is for (yourself, a family member, or someone else)
• What you are looking to treat (opioid, alcohol or stimulant dependence, or another category)
• How and when a clinician should reach you: a phone, WhatsApp number or email address, and the best time for a call

Email also carries technical data we do not ask for, such as the date and time, the sending address and mail-server routing information. We keep it with the message and use it for nothing else.

2.2 Information you give us during screening

If a clinician calls you back and you decide to be screened, we ask for and receive medical information. This can include your name and date of birth, medical history, current medications and prescriber details, substance-use history, an electrocardiogram (EKG), blood-test results, cardiac history, psychiatric history, and the name and contact details of a family member you nominate. Under Mexican law this is sensitive personal data, and section 4 explains how consent works for it.

2.3 Information collected automatically

Our web server and hosting provider keep standard logs: IP address, browser type, device type, the pages you visit, the site that referred you, and timestamps. If analytics cookies are enabled on the site, they collect similar information in aggregate; section 9 explains what runs and how to turn it off.

2.4 Information we do not collect

We do not collect payment card numbers through this website. We do not buy data about you from data brokers. We do not receive your details from other clinics or referral services, and we do not pay anyone for them.

3. Why we use it

We do not use your data for purposes that need a separate decision from you, such as marketing emails, without asking first. If we ever want to use your data for a new purpose, we will tell you and, where the law requires it, ask for your consent again.

4. Sensitive health data and consent

Medical information is sensitive personal data under Mexican law and special-category data under EU and UK law. We only collect it after you have been told what we will use it for and have agreed in writing, which happens at the start of screening, before any medical questions are asked. You can withdraw that consent at any time by contacting us (section 14). Withdrawing consent stops future use, but it does not undo processing that has already happened, and it does not let us delete a clinical record that Mexican law requires us to keep.

Screening decisions are made by physicians. No decision about whether to treat you is made by an automated system.

5. Who we share it with

We share personal data only with the people and organisations below, and only as much as each one needs.

• The clinicians on your case. The cardiologist, emergency physician, psychiatrist, nurse and coordinator assigned to you. Each is bound by professional confidentiality.
• The receiving hospital, if a transfer happens during treatment, so it can treat you.
• Your own doctor or prescriber at home, when you ask us to share a washout plan or the written clinical summary. We do not contact them without your permission.
• The family contact you nominate, for the updates you have agreed to. We do not share medical detail with family members you have not authorised.
• Service providers that process data on our behalf and under our instructions: web hosting, email delivery, the customer-relationship and scheduling tools we use to manage enquiries and calls, and IT support. They may not use your data for their own purposes.
• Authorities, where a law, court order or health regulator requires it, or where we need to protect someone’s life or safety.

We do not sell personal data. We do not share it with other clinics, referral networks, patient brokers or advertisers. We do not use health information to build advertising audiences, on this site or on any platform.

6. International transfers

We are based in Mexico. Some of the service providers in section 5, including hosting, email and customer-relationship tools, store data in the United States. Your data may therefore be processed in Mexico and the United States, and, if you contact us from elsewhere, in your own country. Where we transfer data out of the country it was collected in, we do so under contracts that require the recipient to protect it to the standard this policy describes, and, for EU and UK data, under standard contractual clauses or another mechanism recognised by those laws.

7. How long we keep it

When a retention period ends we delete the data or anonymise it so it can no longer identify you.

8. Your rights

8.1 Everyone

Whatever country you are in, you can ask us to tell you what personal data we hold about you, correct it, delete it where we are not legally required to keep it, stop using it for a particular purpose, or withdraw a consent you have given. In Mexican law these are the ARCO rights: access, rectification, cancellation and opposition.

To exercise them, contact us as set out in section 14, say which right you are using, and give us enough information to identify you and find your data. We will confirm we have received your request and respond within 20 business days, and act on it within 15 business days after that, which are the periods Mexican law sets. We may ask you to prove your identity first, because we will not release medical information to someone we cannot verify.

If you think we have handled your data unlawfully, you can complain to Mexico’s data-protection authority for the private sector, the Secretaría Anticorrupción y Buen Gobierno (which took over that role from INAI in 2025), or to the authority in your own country.

8.2 Residents of the European Union and the United Kingdom

You also have the rights to restrict processing, to data portability, and to object to processing based on legitimate interests. You can complain to your national supervisory authority, or in the UK to the Information Commissioner’s Office.

8.3 Residents of California and other US states

You have the right to know what personal information we collect and how we use and share it, to request deletion or correction, and to be free from discrimination for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of; if that ever changes, this policy will say so and we will provide an opt-out. You can appoint an authorised agent to make a request on your behalf.

9. Cookies and analytics

The site sets cookies that are needed for it to work, such as the security cookies WordPress uses. These cannot be switched off without breaking the site.

If we use an analytics service, it sets cookies that measure how the site is used: pages viewed, time on page, the site that referred you, approximate location from your IP address, and your device type. The data is aggregated and is not linked to your enquiry or medical record. You can refuse analytics cookies in your browser settings, and most browsers let you delete cookies that have already been set. The current list of cookies in use, with their names and lifetimes, is available on request by email.

We do not use advertising cookies or pixels on pages where you provide health information.

10. Security

The site is served over HTTPS. Email enquiries arrive in a mailbox that only authorised staff can access, and are encrypted in transit wherever your mail provider and ours support it, which the major providers do. Medical records are held separately from the website, with access limited to the clinicians on your case. Staff and providers who handle your data are bound by confidentiality obligations. No system is perfectly secure; if a breach ever affects your data in a way that could harm you, we will tell you and the relevant authority as the law requires.

11. Children

We do not treat anyone under 18 and the site is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us information, contact us and we will delete it.

12. Other websites

This site links to a small number of outside sites, such as published research and the Mexican professional-licence registry. Their privacy practices are their own, and this policy does not cover them.

13. Changes to this policy

When we change this policy we will update the date and version number at the top of the page. If a change affects how we use data we already hold, or would need your consent, we will tell the people affected directly before it takes effect.

14. How to contact us

Privacy questions and requests: email info@eclmedia.agency with “Privacy request” in the subject line. A member of the team, not a clinician, will respond and, where needed, give you a direct channel for sending documents securely. Requests are handled by the person responsible for personal data at the clinic.