Your safety and your health, before any procedure.
Albya exists because trust shouldn't depend on luck. These are the guarantees, processes and safeguards we apply so every decision you make with us is informed and safe.
Nobody appears on Albya without going through verification.
Our medical direction, led by Dr. Ariel, defines the standards each professional and clinic must meet before being published. This is what we verify — and how we verify it:
| What we verify | How we verify it | Validity |
|---|---|---|
| Professional license | Against each country's official registry of professions (SEP in MX, Ministry in CO) | Permanent · annual review |
| Specialty license | Against the same official registry | Permanent · annual review |
| Declared certifications | Direct confirmation with the issuing body (Allergan, fellowships, diplomas) | Per certification expiry |
| Operating notice | Against the official government portal (COFEPRIS or equivalent) | Until its expiry date |
| Sanitary lead | Verified license + confirmation from the clinic | Permanent · annual review |
| Awards and rankings | Against the original source (link to the article or the body's site) | At profile onboarding |
| Academic publications | Against DOI, Scholar or ResearchGate | At profile onboarding |
If something can't be verified, we don't publish it. And if we find an inconsistency —an expired license, a fake award— we pause the profile until it's resolved.
Verification levels
Each profile moves up as it proves more.
Not visible yet
Registered but didn't complete verification. Doesn't appear in the directory.
Verified by Albya
License and essential data verified. Visible in the directory with a verification badge.
Complete profile
Basic verification + validated certifications + complete profile. Standard ranking.
Featured position
Advanced + verified awards + 5+ reviews + profile 90 %+ complete.
Only those who were actually seen can write. Period.
Only patients who booked, paid and were seen on Albya can leave reviews. Each one goes through two filters before being published.
Automatic filter against spam, offensive language and unrelated content.
Manual review in flagged cases or when the review reports a clinical or legal risk.
Once published, it carries the "Verified by Albya" seal signed with your name and city.
What we don't do
- We don't publish reviews paid by the clinic.
- We don't publish anonymous reviews.
- We don't allow clinics to edit or delete reviews (only reply).
- We don't have a "paid featured reviews" category.
What you can do
- Edit your own review within 30 days of publishing.
- Report a review you think is fake with one click — we investigate.
- Report an abusive clinic reply — we review it.
And new clinics? Newly verified ones appear with a "New on Albya" badge until their first 5 reviews. You know they're verified but still without a track record — and you decide with full information.
Money is only released when everything went well.
When you book, your payment is processed by the gateway and held in Albya's escrow. It's only released to the clinic when the appointment happened and 48 hours passed without a problem report.
Your card info is never shared with the clinic.
Payments processed by PCI DSS Level 1 certified gateways.
Financial data encrypted in transit (TLS 1.3) and at rest.
We use payment tokens — we don't store full card numbers.
Appointment happens and all goes well: payment released to the clinic on day 3.
Clinic cancels: 100% automatic refund in 5–7 business days.
You cancel within the free window: 100% automatic refund.
You cancel outside the window: the policy visible at booking applies.
You report a problem within 48h: the payment is held while we investigate.
Only you decide when and with whom to share.
Your health data —allergies, conditions, medications, record documents— is the most sensitive category we handle. That's why we apply extra protections.
End-to-end encryption, in transit and at rest.
Role-based access — the team only accesses in legal or support cases you authorize.
Re-authentication to open sensitive documents (fingerprint on mobile, password on desktop).
Full audit of who accessed what data, when and why.
Compliance with LFPDPPP (Mexico) and Law 1581 of 2012 (Colombia).
Specific health-data privacy notice, separate from the generic one.
Explicit consent when sharing with each professional — not implicit.
ARCO right exercisable from your account.
Your control
- You decide what data to complete and what to leave empty.
- You decide which professional to share each document with.
- You decide to share your record with an external party via a temporary, revocable link.
- You decide when to download all your data or delete your account.
What we never do
- We never sell your data to third parties.
- We never share identifiable info with pharma, insurers or brands.
- We never use your record to personalize ads.
The rule is simple: if the data is yours, the decisions are yours.
You have 48 hours. We have a process.
From your appointment detail you can report a problem within the next 48 hours. From there, here's what happens:
A support team member contacts you in under 24 business hours.
We investigate: we talk to you, we talk to the clinic, we review the evidence.
We make a documented decision and communicate it to you.
If the clinic didn't deliver what was booked: didn't open, didn't see you, or the service was clearly different.
When there are partial breaches or the service was provided under conditions different from those agreed.
When there's disagreement between patient and clinic, we facilitate the resolution.
If there are systematic breaches, we suspend its profile while investigating — and permanently if misconduct is confirmed.
What's not covered
- Subjective dissatisfaction with the natural results of the procedure (each body responds differently).
- Changes of mind after the service was performed.
- Incidents occurring outside the process booked on Albya.
Real people, not bots.
Behind every verification, every approved review and every investigated report there's a human team. Our Trust & Safety team is distributed between Mexico City and Bogotá, with business hours Monday to Saturday.
We comply with the regulations that protect those who use us.
| Country | Main regulation | What applies |
|---|---|---|
| Mexico | LFPDPPP | Processing of personal and sensitive data |
| Mexico | COFEPRIS rules | Verification of sanitary notices for medical and aesthetic services |
| Mexico | CFDI 4.0 (SAT) | Mandatory electronic invoicing |
| Colombia | Law 1581 of 2012 + Decree 1377 | Habeas data and information protection |
| Colombia | DIAN Resolution | Electronic invoicing |
| International | PCI DSS Level 1 | Payment data protection |
| International | GDPR principles | Best practices applied for European users |
If something shouldn't be on Albya, tell us.
Albya only works if the community helps us keep it clean. Report any of these situations:
What to report
- Professional or clinic with credentials that don't seem real.
- A review you think is fake or paid.
- Inappropriate treatment during or after an appointment.
- Problem with a charge, invoice or refund.
- Suspected misuse of personal or health data.
- Any practice that puts a patient at risk.
What people ask us most about safety.
Albya is the platform that connects. The medical service is the responsibility of the clinic and the professional that sees you. That's why we verify their credentials and back you when there's a breach of the booked process — but we don't replace the direct medical relationship.
Don't do it. Let us know. Paying inside Albya is the condition for backing to apply. A clinic asking you to pay outside is violating our terms and we will suspend it.
If the cancellation falls within the free window, it's processed automatically and arrives at your original payment method in 5 to 7 business days. If it's due to a clinic breach, the same. Final times depend on your issuing bank.
No. Our ranking is based on objective signals: rating, number of verified reviews, distance, availability, profile completeness and verified tenure. We don't sell positions.
Because each review must be associated with an appointment that was actually paid and attended on Albya. It's traceable end to end.
Only you, the professional you explicitly choose to share it with, and the support team in legal cases or those you authorize yourself. Each access is logged.
Yes. From Settings → Account data you can download your complete info (compliant with LFPDPPP and GDPR) or delete your account. Deletion has a 30-day grace period in case you change your mind.
If that happened, you have the right to download all your data at any time. Data is not transferred to a third party without your explicit consent in accordance with applicable law.
Yes. You can report without your identity being revealed to the reported clinic. Only our Trust & Safety team knows the origin of the report.
We verify at onboarding and review validity at least every 12 months. If a license or certification expires, we flag the profile with a notice. If it's not renewed in time, we pause it.
If you have a doubt, don't wait.
Our team is available to answer any question about safety, data or processes. Your trust is the most important asset we have.