Home · Personal Data Processing Policy

Personal Data Processing and Protection Policy

Last updated and effective: August 2026

In compliance with Law 1581 of 2012 (Colombia's statutory personal data protection law) and other applicable rules on the protection of personal data, this Personal Data Processing and Protection Policy is hereby established.

1. Data controller

Alexandra Mora Hernández
Bogotá, D.C., Colombia
Carrera 16 n.º 84A-09
Centro Médico Almirante Colón, Office 723
Email: amora@dralexandramora.com
Phone: +57 310 558 3932

2. Data subject to processing

Depending on the relationship with the data subject, the following may be processed: identification and contact data; information related to inquiries, appointments and communications; administrative information necessary to provide services; and, where a care relationship so requires, health-related information.

3. Purposes of the processing

Personal data may be processed in order to:

• respond to requests for information;
• manage requests for evaluation, consultation and appointments;
• maintain communications related to the services requested;
• establish and develop the physician–patient relationship where applicable;
• manage administrative processes arising from care;
• comply with legal, health, professional, accounting and regulatory obligations;
• address inquiries, requests and complaints related to personal data;
• maintain the security of the systems and channels used;
• carry out academic or scientific activities where there is a sufficient legal basis and the corresponding ethical, confidentiality and authorization obligations are met.

Personal data will not be sold or commercialized.

4. Authorization

Where applicable law requires authorization for the processing, it will be requested through mechanisms that allow its granting to be evidenced afterward.

Authorization must be prior, express and informed, except for the exceptions established by law.

5. Sensitive data

Data relating to health is sensitive in nature.

Where it is legally appropriate to request authorization to process sensitive data, the data subject will be informed of its nature and of the specific purposes of the processing, and the corresponding consent will be requested.

Where applicable, the data subject will likewise be informed that they are not obligated to authorize the processing of sensitive data, except for the exceptions provided by law.

Clinical information will be handled under the additional applicable obligations of reserve and confidentiality.

6. Rights of the data subject

The data subject may exercise the rights recognized under Colombian law, including to:

• know, update and rectify their personal data;
• request proof of the authorization where legally appropriate;
• request information on the use given to their data;
• submit inquiries and complaints;
• request the deletion of data or revoke the authorization where applicable;
• file complaints before the competent authority, subject to prior completion of the corresponding procedure.

7. Handling of requests, inquiries and complaints

The handling of matters related to the protection of personal data is the responsibility of Alexandra Mora Hernández, through:

Email: amora@dralexandramora.com

The request must make it possible to identify the data subject or the person entitled to act on their behalf and must clearly describe the subject of the request.

8. Procedure for inquiries

Inquiries related to personal data will be addressed within a maximum term of ten (10) business days counted from their receipt.

When it is not possible to respond within that term, the interested party will be informed of the reason for the delay and of the date on which the inquiry will be addressed, which may not exceed five business days following the expiry of the initial term.

9. Procedure for complaints

Data subjects or persons entitled may submit complaints related to the correction, updating or deletion of data, or to an alleged breach of the rules on data processing.

Complaints will be handled in accordance with the procedure established in Article 15 of Law 1581 of 2012.

The maximum term to address a complaint will be fifteen (15) business days counted from the day following its complete receipt. When it is not possible to address it within that term, the reasons and the new response date will be communicated in accordance with the limits established by law.

10. Security and confidentiality

Reasonable administrative, technical and organizational measures will be adopted to protect personal data against loss, unauthorized access, misuse, alteration or unauthorized disclosure.

The persons involved in the processing must respect the applicable confidentiality obligations.

11. Third parties, transmission and transfer

When technology providers, administrative providers or other third parties are involved in operations that entail the processing of personal data, the corresponding contractual and legal obligations must be observed.

National or international transfers or transmissions of information will be carried out in accordance with applicable Colombian law.

12. Term

This Policy takes effect in August 2026.

It will remain in force while the processing activities described are carried out and for the time necessary to fulfill the applicable legal, contractual, professional and regulatory obligations.

Any substantial modification will be communicated when so required by the regulations in force.