Legal
Privacy Policy
Last updated: 27 August 2026
On Dr. John Malpartida's website we treat your privacy as an extension of medical confidentiality. This document explains what information you give us, how that information travels, and what rights you have over it.
1. Data controller and applicable legal framework
The controller of the personal data collected through this site is JM PLASTIC SURGERY S.A.C., tax ID (RUC) 20612023019, with premises at C. Las Caobas 152, La Molina, Lima, Peru.
Processing is carried out in accordance with Law No. 29733, the Peruvian Personal Data Protection Law, its Regulations approved by Supreme Decree No. 003-2013-JUS, and the directives of the National Authority for the Protection of Personal Data.
2. What information we collect
We only collect the information you choose to give us when completing the assessment form or writing to us through our contact channels. We do not obtain your data by any other means.
- Contact details: full name, age, district and WhatsApp number.
- Consultation details: the procedure you are interested in and, if you choose to provide them, your decision stage and preferred contact time.
Only five fields are required: name, age, district, WhatsApp and the procedure you are interested in. The rest of the form is optional.
This site does not ask for medical history: we do not ask about previous surgeries, illnesses, medication or allergies. That background is gathered during the in-person consultation, as part of the medical act.
Even so, the procedure you are interested in reveals an intention to undergo surgery, so it is treated with the same confidentiality as health data: they are not sold, not rented, not used for marketing and not shared with anyone beyond what is set out in section 4.
3. What happens when you submit the form
While you are filling in the form, your answers stay in your browser: if you close the page before submitting, they are discarded and never reach us.
When you press the submit button, two things happen at once. First, your answers are transmitted to our server, which records them in the coordination sheet used by the team that manages appointments. Second, WhatsApp opens with a pre-written message containing those same details.
You should know this precisely: the recording described in the first step happens the moment you press the button, even if you then decide not to send the WhatsApp message. If you do send it, the conversation is additionally hosted on WhatsApp, a service of Meta Platforms, Inc., and is also governed by that platform's privacy policies.
4. Who we share it with and where it is stored
To run the site and coordinate appointments we rely on providers acting as data processors. None of them is authorised to use your information for their own purposes.
- Vercel Inc. — hosting of the site and of the server that receives the form.
- Google LLC — the spreadsheet (Google Sheets) where your appointment request is recorded.
- Meta Platforms, Inc. — WhatsApp, only if you choose to send the message.
- Supabase Inc. — storage of the photographs and videos published on the site. It receives no form data.
These providers operate servers outside Peru, so processing involves a cross-border flow of personal data under article 15 of Law No. 29733. By ticking the consent box and submitting the form, you authorise that transfer.
Beyond these processors, we do not disclose your information to third parties, except where required by a competent authority under the law.
5. Cookies, analytics and third-party content
This site sets no cookies, uses no analytics or advertising tools and stores no information on your device. We do not track your visits or build browsing profiles.
Our server temporarily records the IP address from which the form is submitted, for the sole purpose of limiting automated submissions and protecting the service from abuse. That address is not added to the coordination sheet and is not linked to your request.
There is third-party hosted content: photographs and videos are served from Supabase Storage, and the map in the location section is displayed inside a Google Maps frame. When those elements load, their providers may record your connection's IP address, as happens with any embedded content on any website.
6. Data retention
The request recorded in the coordination sheet is kept for as long as your enquiry is being handled and, if you do not end up being treated, until you ask us to delete it.
The WhatsApp conversation remains hosted on that platform. If you do become a patient, your medical record is retained in accordance with the rules on the retention of medical documentation, which are independent of this policy.
You may ask us at any time to delete the contact records arising from your enquiry.
7. Information security
We apply reasonable technical and organisational measures to protect your information: the site is served entirely over an encrypted connection, access to the coordination sheet is restricted to the staff who manage appointments, and the credentials for that integration never travel to your browser.
No system is entirely infallible. Should an incident compromise your personal data, we will act in accordance with the applicable regulations.
8. Your rights: access, rectification, cancellation and objection
As the owner of your data, you may access the information we hold about you, update it, correct it or object to its processing, as well as request its deletion and withdraw the consent you gave when submitting the form.
To exercise any of these rights, write to the email address at the foot of this page with the subject «Solicitud de Derechos ARCO». We will respond within the periods set out in Law No. 29733 and its Regulations.
If you believe your request was not properly handled, you may lodge a complaint with the National Authority for the Protection of Personal Data of the Ministry of Justice and Human Rights.
9. Minors
The procedures presented on this site are intended for adults. The form requires a declared minimum age of eighteen (18) and rejects submissions that do not meet it.
We do not knowingly request or collect data from minors. If we become aware that a form was completed by a minor without the authorisation of a parent or guardian, we will delete the information.
10. Changes to this policy
We may update this document when our processes or the applicable regulations change. The date of the last modification appears at the top of the page.
Contact
For any question about this policy, or to exercise your rights:
- Email: drjohnmalpartida001@gmail.com
- Suggested subject: ARCO Rights Request — Personal Data
- Address: C. Las Caobas 152, La Molina 15024, Lima, Perú.