Full privacy notice

1. Identity and address of the data controller

Chenet Marcel Carreño, an individual engaged in business and professional activities, is responsible for processing personal data collected under the trade name Tlacati.

• Address: Calle Lotería Nacional 1, Interior 3, Colonia Tabacalera, Alcaldía Cuauhtémoc, C.P. 06030, Ciudad de México.
• Email for privacy and ARCO rights: gestantes@tlacatisurrogacy.mx.
• Website: tlacatisurrogacy.mx.

2. Personal data we may process

Depending on the channel you use and what you choose to share, Tlacati may process the following categories:

Identification and contact

• Name, age or date of birth.
• Phone number, email address, city and state of residence.
• Profile name, account identifier, profile photo and conversation content on WhatsApp, Facebook or Instagram.
• Mexican nationality, naturalization or self-declared permanent residency status, when necessary to explain a program's general requirements.

Follow-up information

• Availability, contact preferences and questions about the process.
• Permission to prepare or share a descriptive profile with a specific agency, clinic or program operator.
• Follow-up notes and conversation status.
• Height and weight and, if you decide to share one, a photograph of yourself, to prepare a profile.

Sensitive personal data

A conversation may include general information about previous pregnancies, reproductive experience or health. These data are sensitive. Tlacati limits processing to what is strictly necessary for the authorized purposes, with explicit written consent, including an electronic method that attributes it to the individual. Sharing the profile also requires permission for the specific delivery described in section 4. Section 3 explains how sensitive information sent spontaneously before consent is handled.

Complete profile. When an agency or program requires a more detailed profile and you authorize us to prepare it, we will send you, via WhatsApp, a personal link to a Tlacati form. In it you may declare, without attaching documents:

• Personal data: date of birth, marital status, education, religion and occupation.
• The details of each pregnancy: weeks, type of delivery, date and the baby's weight.
• Health history: surgeries, hospitalizations, mental health diagnoses, sexually transmitted infections, blood type, tobacco, alcohol, drugs and exposure to tobacco smoke.
• A text about yourself and a message for the intended parents.

Except for education and occupation, these data are sensitive. They are processed only with your express consent for the complete profile, which we request via WhatsApp before sending you the link and which you confirm again in the form.

Technical website data

To understand which parts of the site are useful, we count clicks on WhatsApp, email, calls and guide downloads in aggregate, together with the originating public page and day. We also count how often a page-not-found response is displayed, without storing the failed address. These first-party counters do not use cookies or identifiers, do not store IP addresses, message content or URL parameters, and are not sent to advertising platforms. Totals are retained for up to 90 days. We respect your browser's Do Not Track and Global Privacy Control signals by omitting this measurement.

When you visit the site, the infrastructure may generate minimal technical logs, such as IP address, date and time, requested path, browser type and security events. These are used to serve content, prevent abuse and diagnose faults. These logs cannot be disabled because they are necessary to deliver and protect the site. The site does not create user accounts or incorporate personalized advertising. Its only form is the complete profile form, which can only be accessed through a personal, single-use link that we send you via WhatsApp.

• That form does not use cookies or third-party tags, does not load external resources and does not record your IP address or the content of your answers in the technical logs.
• Your answers are encrypted on Tlacati's server when you submit them, and only the Tlacati team can decrypt them.
• The link expires after 7 days or once it is used.

3. Purposes of processing

Primary purposes

• Answer questions and provide general information about the usual stages and requirements of surrogacy.
• Continue the conversation through the chosen channel and record follow-up items.
• Consider, on a preliminary and non-clinical basis, whether exploring a program with an independent third party makes sense.
• Prepare a minimal descriptive profile when the data subject asks to proceed and, if an agency or program requires it and the data subject authorizes it, a complete profile with the information she declares in the form, including its English translation when the recipient needs it.
• Review the conversation and prepare replies and profiles with the support of artificial intelligence assistants. Replies follow rules and texts that the Tlacati team defines and approves; those that conform to them may be sent without individual review. A team member reviews and approves cases not covered by those rules and any delivery of a profile to an agency.
• Share that profile with the agency, clinic or program operator expressly authorized by the data subject.
• If the data subject tells us she is interested in donating eggs, guide her and, with her authorization, share her name, contact number, height, weight and, if she so decides, a photograph with the partner agency that handles egg donation in her area. Before sharing them, we will tell her which agency it is. Any other characteristics that agency needs will be requested by the agency directly, under its own privacy notice.
• Handle privacy requests, complaints, security incidents and legal obligations.
• Maintain the security, availability and technical operation of the site and contact channels.

Tlacati does not use this information to make diagnoses, medical assessments, clinical decisions or legal evaluations. Acceptance and each program's conditions are the responsibility of the third party operating it.

Secondary purposes

With permission, Tlacati may send educational information or request brief feedback to improve its guidance. You may decline from the outset or ask for this to stop at any time by writing to gestantes@tlacatisurrogacy.mx. Declining does not affect the handling of your main request.

Consent for sensitive data

Publishing this notice does not replace the express consent required to process sensitive data. If someone voluntarily sends sensitive information before giving consent, Tlacati will limit its handling to protecting the message, replying with instructions and, where appropriate, deleting or blocking it. It will not be used to prepare or share a profile until valid consent has been obtained.

4. Data transfers, processing by service providers and third-party services

Transfers requiring permission

Tlacati only transfers a profile or contact details to a specific agency, clinic or program operator when the data subject asks to proceed and expressly authorizes that disclosure. Before sharing, we explain who will receive the data and for what purpose. The data subject may refuse the transfer at no cost.

Transfers permitted by law

Information may be provided to a competent authority when there is a legal obligation or duly grounded order, or when necessary for the recognition, exercise or defense of a right.

Technology providers

To operate the site and contact channels, we use providers that may process information on behalf of the data controller, including:

• Meta Platforms: WhatsApp Business, Facebook and Instagram.
• Google Workspace and Google Cloud: email, storage, follow-up spreadsheets and infrastructure.
• Cloudflare: DNS, security, website delivery and email routing.
• Anthropic and OpenAI: artificial intelligence assistants (Claude and Codex) that the Tlacati team uses, under human supervision, to review conversations, prepare replies —which are sent according to rules approved by the team—, organize profiles and translate the complete profile texts into English. They may process the content of the conversation, including any health history you have already authorized. No profile is shared without review and approval by a member of the team. WhatsApp messages follow rules and texts approved by the team, and you may ask at any time to be attended by a person.

These providers operate under their own terms and may host or process data outside Mexico. Tlacati applies data minimization and restricted access measures. It does not sell personal data.

See Anthropic's and OpenAI's policies to learn about their uses, retention and rights mechanisms:

Anthropic privacy OpenAI privacy

External links open third-party services. Their privacy notices govern processing carried out directly on their platforms.

5. How to limit use or withdraw consent

You may request at any time:

• To stop receiving educational messages or non-essential follow-up messages.
• To withdraw permission to share your profile, provided the transfer has not yet occurred.
• To withdraw consent for future processing of sensitive data.
• To limit the contact channel or hours.

Send your request to gestantes@tlacatisurrogacy.mx. Withdrawal is not retroactive and may be subject to legal retention obligations.

6. ARCO rights

The data subject may exercise the rights of Access, Rectification, Cancellation and Opposition (ARCO), as well as withdraw consent.

How to submit a request

1. Write to gestantes@tlacatisurrogacy.mx with the subject line "Derechos ARCO".
2. Include your name, the right you wish to exercise, the data involved, a clear description of your request and how you would like to receive a response.
3. Do not attach official identification to your first email. Tlacati will reply with a secure and proportionate way to establish identity or representation.

The decision will be communicated within 20 business days after receipt of the complete request. If granted, it will be implemented within the following 15 business days. These periods may be extended once when circumstances justify it, in accordance with the law.

The procedure is free, except for justified reproduction or delivery costs in a non-digital format. If you disagree with the response, you may contact the competent personal data protection authority.

7. Retention, security and incidents

Data are retained only as long as needed to handle the conversation, provide authorized follow-up and meet obligations or defend rights. Once these purposes end, data are deleted, de-identified or blocked for the applicable legal period.

Tlacati uses reasonable administrative and technical controls, including restricted access, authentication, data minimization and storage in business services. No system is infallible. If a breach significantly affects a data subject's rights, they will be informed promptly about the nature of the incident, the data affected and recommended measures.

8. Minors

Tlacati's guidance is intended for adults. We do not intentionally collect data from minors. If we discover that a minor has shared information, follow-up will stop and the information will be deleted or blocked as appropriate.

9. Changes to this notice

The current version will always be available at tlacatisurrogacy.mx/en/privacy/. Minor changes take effect upon publication. If a change substantially modifies purposes, sensitive data processing or transfers requiring consent, a new notice will be made available before that processing begins, and the relevant consent will be requested.

10. Contact

For any questions about this notice or the processing of personal data, write to gestantes@tlacatisurrogacy.mx.