Privacy Policy
What this website records
This site uses the following, and nothing else:
- Analytics — to count visits and see which pages are read. Aggregate, and not used to identify you.
The rule we hold ourselves to: no advertising or analytics tag is permitted on any page where you tell us about your health — intake, booking, payment or consultation. Those pages carry no third-party tracking at all. This is the practice that regulators elsewhere have pursued hospitals over, and we treat the line as absolute.
No third party is contacted either. Our typefaces are served from this website rather than from Google Fonts, which is the usual arrangement and which would send your IP address to Google on every page you open. Loading this site contacts nobody but us.
Our web host keeps server logs in the ordinary way, which is a technical necessity rather than a choice of ours. We do not use them for profiling.
If you contact us by WhatsApp, email or telephone, you are of course sending us information, and from that point the rest of this policy applies.
What we collect when you become a patient
Identification. Your name, identity document or passport number, date of birth, email address, telephone number and address. Used to identify you and to maintain your clinical file.
Health data. Your medical history, current conditions, medicines, allergies, laboratory results, and the clinical notes your physician writes. Under Law No. 8968 this is sensitive personal data and carries the highest level of protection.
Where a prescription follows, we additionally record what Decree No. 44363‑S requires on a prescription: your name, identification, age, the date, and your weight and height.
How our database is classified
We maintain our patient database for exclusively internal use, within the meaning of Article 2(a) of Law No. 8968. We do not sell, rent, trade or share your data with marketing companies, data brokers or external databases.
That internal-use classification is what exempts the database from mandatory registration with PRODHAB, the Agency for the Protection of Inhabitants' Data. The exemption holds only for as long as the non-disclosure practice holds, and we treat it as a binding commitment rather than a convenience.
What we use it for
- Clinical assessment — deciding, with you, what your results mean and what if anything should be done.
- Prescribing, where a physician judges it appropriate after that assessment.
- Continuity of care — so that any authorised physician in this clinic can treat you without your history being lost between appointments.
- Legal obligations — the record-keeping required of us by the Colegio de Médicos y Cirujanos and the Ministry of Health, including the clinical record contents that Article 9 of Decree No. 44363‑S requires for every teleconsultation.
We do not use your data to build advertising audiences, and we do not upload patient information to any advertising platform.
Who else sees it
The laboratory you use. When tests are ordered, the laboratory receives what it needs to perform them and returns the results. Laboratories are independent providers with their own privacy obligations; you pay them directly.
The pharmacy that dispenses a prescription. Only what is needed to fill it.
Receta Digital, the Ministry of Health's national prescribing system, where a controlled medicine is prescribed. Decree No. 44363‑S requires that route in the private sector for psychotropics and narcotics. Most medicines used in metabolic care are not controlled and do not pass through it.
A court. We disclose data when a Costa Rican judge issues a valid order. We do not hand patient information to any authority voluntarily, in any country, without a legal order compelling it.
What we will never do
- Sell your data, in any form, to anyone.
- Share it with a pharmaceutical company, a supplier or a compounding pharmacy for any purpose beyond dispensing your own prescription.
- Use it for research or publication without your separate, explicit, written consent.
- Use your results, your photograph or your story in marketing without your separate written permission.
For patients from the United States and Canada
This section exists because most of the people who read it will assume otherwise.
HIPAA does not apply to this clinic. HIPAA is United States law, binding on covered entities in the United States. We are a Costa Rican medical provider and we are not one. Any clinic outside the United States telling you it is "HIPAA compliant" is describing a standard it has adopted voluntarily, not a law it answers to.
What we are bound by is Costa Rican law — Law No. 8968, the General Health Law, and the ethical obligations of the Colegio de Médicos. Those are real obligations with a real regulator behind them. They are simply not the ones you are used to.
In practical terms this means: your remedy if we mishandle your data is through PRODHAB and the Costa Rican courts, not through a US regulator. We would rather you knew that before you became a patient than after.
How it is protected
- Encryption of sensitive data in transit and at rest.
- Access control — records are reachable only by authorised clinical and administrative staff, with individual credentials and two-factor authentication.
- Audit logging of record access, reviewed for unauthorised activity.
- A private setting for every consultation, which Article 10 of Decree No. 44363‑S requires of the clinician as well as of you.
No system is perfect, and a policy claiming otherwise is not worth reading. If a breach affecting your data occurs, we will tell you.
Data held outside Costa Rica
Some of the systems a modern clinic depends on — records, scheduling, email — are operated by providers whose servers sit abroad. Where that applies to your data, we require contractual protections equivalent to those Costa Rican law demands, restrict access to a need-to-know basis, and log that access.
You may withdraw consent for processing outside Costa Rica at any time. Doing so may limit services that depend on those systems, and we will tell you which.
How long we keep it
Clinical records are retained for the minimum period Costa Rican law requires, which for medical records is ten years. This is an obligation on us rather than a choice, and it limits what deletion can mean while the period runs.
Your rights, and how to use them
Law No. 8968 gives you four rights, known together as ARCO:
- Access — to see your complete file and everything we hold about you.
- Rectification — to correct anything inaccurate.
- Cancellation — to have data deleted, subject to the ten-year retention above, which applies to clinical records but not to non-essential administrative data.
- Revocation — to withdraw consent, after which your file is archived according to those same obligations.
Consent to a teleconsultation is separately revocable at any moment under Article 9 of Decree No. 44363‑S, including during the consultation itself.
To exercise any of these, or to complain, write to our data officer at robert@curavidacannabisclinics.com. If you are not satisfied with our answer, you may take the matter to PRODHAB.
Contact and marketing
If you become a patient, you agree that we may contact you by telephone, email, SMS and WhatsApp about your own care. That is clinical contact and it is not optional while you are under our care.
Marketing contact is separate and requires your agreement. You can withdraw it at any time without affecting your treatment.
Changes
If this policy changes materially, the date below changes and we will tell existing patients. We do not make quiet amendments.
Last updated 19 October 2026. Cura Vida Clinics Costa Rica LLC Sociedad de Responsabilidad Limitada.