1 · Who is responsible for your data
The data controller is AX Scientific Lab (Aesthetic Xpert), the official academy of the technique, at Av. Circunvalación del Golf Los Incas, Lima, Peru.
For anything concerning your data, including exercising your rights, write to directorio@ribxcar.org. That mailbox is handled by the academy and is the formal channel for this policy.
2 · One standard for everyone
Surgeons in the directory live in more than ten countries, each with its own data protection law. Rather than treat people differently according to their passport, we apply the strictest of those standards to everyone.
In practice, processing is governed by Peru's Personal Data Protection Law No. 29733 and its regulations — the controller's home law — and, in addition, we grant every surgeon the rights that the European General Data Protection Regulation (GDPR) gives to EU residents, together with the equivalent principles of Japan's APPI, Canada's PIPEDA, Mexico's LFPDPPP and Morocco's Law 09-08.
Where these laws differ, we follow the more protective one. You do not need to work out which applies to you.
3 · Exactly what data we hold
This is the complete list. There are no other fields, and we obtain nothing about you from any other source: everything we hold you gave us on the form or it comes from the record of the training you completed.
| Data | Published? | Why |
|---|---|---|
| Name and professional title | Yes | To identify you in the directory |
| Country and city | Yes | So a patient can find a surgeon near them |
| Clinic or centre | Yes | To place you professionally |
| Certification type and year | Yes | To attest the training and whether it is current |
| Professional website or Instagram | Yes, if you provide it | To link to your site. Optional |
| Email address | No | To send your badge and write to you about your listing |
| Date and time of consent | No | Evidence that you authorised it |
| IP address and browser | No | Evidence that you authorised it |
We do not ask for or store your phone number, home address, identity document, health data, any data about your patients, or financial information. We process no special categories of data.
Your IP address and browser are stored for one reason only: they are the evidence that consent was given and when. They are never published, never used for analytics, never combined with anything else, and cannot be used to profile you. We spell this out because it is the field almost no privacy policy mentions.
4 · On what legal basis
On your consent, and on nothing else. We do not rely on legitimate interest or on any basis that would require you to object in order to get out: if you do not agree, we publish nothing.
Consent is obtained before publication, it is express (two checkboxes you tick, none pre-ticked), it is informed — this page forms part of that information — and it is revocable at any time. Withdrawing it does not undo processing that was already lawful, but it stops all processing from that point on.
5 · Who can see what is published
It is worth being blunt here, because this is the most significant consequence of agreeing. The directory is a public web page. What is published is visible to anyone and, moreover, can be read, indexed and quoted by search engines such as Google and by artificial intelligence systems such as ChatGPT, Perplexity, Claude or Gemini.
That is not a side effect — it is the point of the directory. It exists so that when a patient asks where to have the technique done, you come up rather than someone with no training. But it does mean your professional data may end up cached or quoted by services we do not control, and that removing it from our site does not automatically erase it from those third parties.
If you would rather not appear, simply do not give consent. Your certification is exactly the same either way.
6 · Where the data lives and who processes it
We do not sell, rent or share data with anyone for commercial purposes. The only third parties involved are the infrastructure providers that make the service run, and they act on our behalf:
| Provider | What it does | Where |
|---|---|---|
| Contabo GmbH | Server the directory runs on | Lauterbourg, France (EU) |
| Supabase Inc. | Database where consents are stored | Ohio, United States |
| ImprovMX | Forwarding for directorio@ribxcar.org | United States |
International transfer: because the database sits in the United States, your data leaves your country. We say so plainly. The transfer relies on the consent you give — informed of this specific point — and on the standard contractual clauses included in the provider's data processing agreement.
We may also disclose data if a competent authority compels us to through a valid legal request. This has not happened to date.
7 · How long we keep it
- Data published in the directory: for as long as your consent stands. If you withdraw it, the data is removed from the site within 10 business days at most.
- The consent record (date, time, IP, browser and what you agreed to) is kept for five years from the date you withdraw. This is not so we can keep using it — quite the opposite: it is the evidence that we published with permission at the time. If we deleted this too, we could not demonstrate that we acted properly.
- Email address: deleted along with everything else when you withdraw, except where it forms part of the consent record above.
8 · Your rights, and how to exercise them
By writing to directorio@ribxcar.org from the address you registered, you can:
- Access everything we hold about you, and receive a copy.
- Rectify or update anything inaccurate or out of date.
- Erase your data and leave the directory.
- Object to the processing, or restrict it.
- Withdraw consent at any time, without giving a reason.
- Port your data in a machine-readable format.
- Complain to the supervisory authority that covers you.
We respond within 10 business days at most, which is shorter than either Peruvian law or the GDPR requires. There is no charge and we will not ask you to justify the request.
None of this affects your certification. Leaving the directory does not revoke your training or your accreditation: they are separate things and will stay that way.
If you believe we handled your request poorly, you may go to Peru's National Authority for the Protection of Personal Data (Ministry of Justice and Human Rights) or, if you live in the European Union, to your country's supervisory authority. In Japan, the Personal Information Protection Commission; in Canada, the Office of the Privacy Commissioner; in Morocco, the CNDP; in Mexico, the competent guarantor body.
9 · Cookies and tracking
This site sets no cookies. It uses no Google Analytics or any other analytics tool, carries no social media pixels, and loads no third-party scripts. That is why you will not see a cookie banner: there is nothing to consent to.
The server keeps technical access logs — as any web server does — for operation and security. They are not used to identify visitors or for advertising.
10 · The badge you install on your website
If you agree to be listed, you will receive a badge for your own site. You should know what that code does, since it will live on your page and under your responsibility:
- It sets no cookies on your visitors.
- It runs no JavaScript. It includes a structured-data block in JSON-LD format, which search engines read but which does not execute or perform any action.
- The seal artwork is served from our server, and you should know precisely what that means: the browser of anyone visiting your site requests that image from us. We do it this way for one concrete reason — it lets us withdraw the seal instantly if a certification stops being current, rather than depending on you to update your page.
- From that request we store only the domain where the seal is installed and the date, so we know it is still live. We do not store your visitors' IP addresses: our server is configured not to log them on that path. We do not identify them, do not profile them, and do not combine that with anything.
- It also contains a verification link back to this site, which only fires if someone clicks it, exactly as with any other link.
Put plainly: the badge does not turn us into a third party watching your patients. We know which site it sits on; we do not know who visits it.
If you would still rather no request left your site towards us at all, ask us for the embedded-artwork version and we will send it: it makes no external call. In that case revocation stops being automatic and is reflected on the verification page instead.
11 · Security
The site runs entirely over HTTPS. Access to consent records is restricted to the academy staff who manage the directory. Each personal consent link is cryptographically signed and works only for its owner's record, so nobody can consent on someone else's behalf.
No system is infallible. Should a breach affecting your data ever occur, we will notify you and the competent authority within the deadlines set by the applicable rules.
12 · Minors
The directory is strictly professional and addressed to qualified surgeons. We do not knowingly process data relating to minors.
13 · Changes to this policy
If we change this policy in a way that affects your rights or broadens the purposes, we will tell you by email before it takes effect and, where the law requires it, we will ask for fresh consent. We will not quietly widen the use of your data.
Last updated: 1 September 2026.
Can I leave the directory after agreeing to appear?
Yes, at any time, without giving a reason and with no consequence for your certification. Write to directorio@ribxcar.org and we will remove you within 10 business days at most.
Is my email address or phone number published?
Your email is never published: it is used only to send you your badge and to write to you about your listing. Your phone number is not even requested.
Why do you store my IP address?
Solely as evidence that consent was given and when. It is never published, never used for analytics and never combined with any other data.
Can search engines and AI systems read my listing?
Yes, and that is the purpose of the directory: that you come up when someone asks about the technique. It does mean your professional data may be quoted by services we do not control.
If I leave the directory, do I lose my certification?
No. They are separate things. Certification rests on the training you completed; the directory rests on your permission to publish it.