Data policy

POLICIES FOR THE TREATMENT AND PROTECTION OF PERSONAL DATA “COLOMBIAN CLINIC FOR OBESITY AND METABOLISM S.A.S”

1. Introduction

Pursuant to Law 1266 of 2008 and Law 1581 of 2012 (Art. 17 Lt. k and Art. 18 Lt. f) and Decree 1377 of 2013 (Art. 13.) by which provisions are dictated for the protection of personal data and in the development of the constitutional right of all persons to know, update and rectify the information that has been collected about them in databases or files, the "CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S" as responsible for the processing of personal data of its interest groups made up of users and their families, collaborators, contractors, entities responsible for payment and inspection, surveillance and control entities, information that has been obtained in the development of its mission activity of providing health services, for which it is committed to compliance with the aforementioned regulations and the protection of the rights of people and informs its interest group that it adopts the following policies on the collection, processing and use of personal data.

2. Data controller

The Health Services Provider Institution “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S”, identified with NIT. 830.029.172-6, with its main address in the city of Bogotá, Torre Zentai Building, Carrera 23 No 124 – 87, tower 1, office 805, Email: administrator@clinicaobesidad.com, Telephone 315 873 9927, is responsible for the processing of the data obtained from its different interest groups.

3. Definitions

Authorization: Prior, express, verbal and/or written and informed consent of the Owner to carry out the Processing of personal data.
Database: Organized set of personal data that is subject to processing.
Personal data: Any information linked to or that can be associated with one or more specific or identifiable natural persons.
Semi-private personal data: this is data that is not of an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to its owner, but also to a group of people or to society in general. In this case, the processing of such data requires the express authorisation of the owner of the information. For example: financial data, data relating to relations with social security entities (EPS, AFP, ARL, Compensation Funds).
Sensitive personal data: These are those that affect the privacy of the Owner or whose misuse may lead to discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life and biometric data.
Private personal data: is personal data that, due to its intimate or reserved nature, is of interest only to its Owner and requires express authorization for its processing. For example: Level of education, merchants' books, among others.
Public personal data: is that type of personal data that the regulations and the Constitution have expressly determined as public and, for whose collection and processing, the authorization of the Owner of the information is not necessary. For example: marital status of people, data contained in the RUNT, data contained in final court rulings, among others.
Data Processor: Natural or legal person, public or private, who by itself or in association with others, carries out the processing of personal data on behalf of the Data Controller.
Data Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the processing of the data.
Owner: Natural person whose personal data are subject to processing.
Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
Habeas data: is a jurisdictional action, normally constitutional, that can be exercised by any natural or legal person, who is included in a registry or data bank of any kind, whether in public or private institutions, in computerized registries or not, in order to be provided with the existing information about him/her, and to request its elimination or correction if it is false or out of date.

4. Data processing policy

The “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S”, by virtue of its corporate purpose, has obtained and kept since its creation, personal data of its interest groups, which we will hereinafter call owners, which are collected, stored, organized, used, transmitted, updated, rectified and generally managed, in accordance with the respective relationship and/or link (civil, labor or commercial) applying the following policies:

1. “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S” is committed to the correct use and treatment of personal data and sensitive personal data of its owners, avoiding unauthorized access to third parties that allows the information to be known, violated, modified, disclosed and/or destroyed, for which it has information security policies that include mandatory control measures.

2. “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S” requests from the owners of the information the data necessary to manage the health risk and to comply with the functions assigned by the current regulations that govern the General Social Security System in Health. The sensitive information required will be freely and voluntarily provided by the respective Owner.

3. Except for the exceptions provided for by law, the processing of personal data may only be carried out with the prior, express and informed consent of its owners, expressed in writing, orally or through unequivocal conduct of the Owner that allows a reasonable conclusion to be drawn that the authorization was granted.

4. “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S” will request from the entities responsible for payment, collaborators and contractors, the personal data necessary to establish the respective relationship and/or link (civil, labor or commercial). The sensitive information required will be freely and voluntarily provided by the respective Owner, who must give his/her consent and authorization for its respective treatment.

5. “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S” will ensure respect for and compliance with the fundamental rights of children and adolescents, observing the special requirements established for the processing of their personal data and sensitive personal data.

6. The processing of personal data provided by users and their families of “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S” will have the following purpose:

For the provision of care services to its users and families.
Update of data provided by the Owner.
Population characterization and monitoring for health risk management, using information derived from healthcare services.
Submission of mandatory Public Health reports.
Respond to requests from control entities.
Evaluation of indicators of opportunity and quality of services.
Evaluation of the quality of health products and services offered by the institution.
To take legal action and defend it.
Provision of information to the competent authorities if required.
In general, for any other purpose that arises from the legal nature of “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S”.

7. The processing of personal data provided by the collaborators of “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S” will have the following purpose:

Carrying out the personnel selection process according to their aptitude for a position or task.
Establish a contractual relationship.
Offer you training opportunities.
Performance evaluations, job satisfaction, personal growth, well-being, safety and health at work.
Complete the process of affiliation to the General Comprehensive Social Security System (Health Promotion Entities, Occupational Risk Administrators, Pension and Severance Funds, Compensation Fund).
Carry out the Remuneration process.
To take legal action and defend it.
Comply with court requirements.
To publicize the institution's progress in research, academic and clinical aspects.
Provision of information to the competent authorities if required.
In general, for any other purpose arising from the contractual relationship.

8. The processing of personal data provided by the entities responsible for payment and contractors of “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S”, whether natural or legal persons, will have the following purpose:

Carry out the contractual link.
Carry out the economic recognition for the provision of the service.
Provision of information to the competent authorities if required.
To take legal action and defend it.
Comply with court requirements.

5. Duties of the “COLOMBIAN CLINIC OF OBESITY AND METABOLISM S.A.S”

1. Guarantee the user’s full and effective constitutional right to habeas data.
2. Maintain the information in conditions of security and privacy.
3. Use the information for the mission-related purposes and those stipulated by law.
4. Process complaints from users regarding the information recorded in the database in a timely manner.
5. Not sell, circulate, or exchange the user database without legal or contractual cause to justify it.
6. Proof of compliance with the information provided to the Owner must be kept, and upon request, a copy must be given to them.
7. When requesting the Owner’s authorization, “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISMO S.A.S” must clearly and expressly inform the following:

The processing to which your personal data will be subjected and the purpose thereof.
The optional nature of the response to the questions asked, when these relate to sensitive data or the data of girls, boys and adolescents.
The rights that assist you as Owner.
The identification, physical or electronic address and telephone number of the Data Controller.

8. The use of personal data of children and adolescents must comply with the requirement of responding to and respecting the prevailing rights of this population group, and their fundamental rights.
9. The legal representative of the child or adolescent will grant authorization for the processing of the minor's personal data.

6. Rights of the Holders

The owner of personal data and sensitive personal data will have the following rights:
To know, update and rectify the data that appear therein. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented data that may lead to error, or data whose processing is expressly prohibited or has not been authorized.
Knowing why and for what purpose the “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S” collects information in a database.
Revoke at any time the authorization given to contain personal information in the databases of “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S”.
Revoke the authorization and/or request the deletion of the data when the processing is considered to not comply with the constitutional and legal principles, rights and guarantees. Revocation and/or deletion will proceed when the Superintendency of Industry and Commerce has determined that the controller or person in charge has engaged in conduct contrary to this law and the constitution during the processing.
File a complaint with the Superintendency of Industry and Commerce when you consider that your right to Habeas Data has been violated by “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S.”
Request proof of the authorization granted to the data controller, except when it is expressly excepted as a requirement for the treatment, in accordance with the provisions of article 10 of Law 1581 of 2012.
Access free of charge to your personal data that has been subject to processing.

7. Cases that do not require authorization for data processing

The authorization of the Owner will not be necessary when it comes to:

Information required by a public or administrative entity in the exercise of its legal functions or by court order.
Data of a public nature.
Cases of medical or health emergencies.
Processing of information authorized by law for historical, statistical or scientific purposes.
Data related to the Civil Registry of Persons.

8. Delivery of information

Information that meets the conditions established in Art. 13 of Law 1581 of 2012 may be provided to the following persons:

To the Holders, their successors in title or their legal representatives.
To public or administrative entities in the exercise of their legal functions or by court order.
To third parties authorized by the Owner or by law.

9. Area responsible for handling requests, queries and complaints.

The area responsible for handling requests, queries and complaints will be the customer service of “CLÍNICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S”, which once it receives the request in accordance with the following chapter will forward it to the area responsible for data processing.

10. Procedure for handling requests, queries and complaints

1. The owner of the information contained in the database of “CLÍNICA COLOMBIANA DE OBESIDAD Y METABOLIMO S.A.S” or his/her legal representative may exercise his/her right to know, update, rectify, delete and revoke the information contained therein by sending an email to the address: servicioalcliente@clinicaobesidad.com or by sending written communication to the following addresses: Bogotá: Administration Annex Zentai Tower Building Carrera 23 No 124 – 87, tower 1 office 805.

2. The request must be clear as to what is intended, whether it is to know, update, rectify, delete and/or revoke the information contained in a database. In addition, it must contain the contact information of the petitioner in order to be able to give a response.

3. Regardless of the mechanism used to file consultation requests, they will be attended to within a maximum period of ten (10) business days from the date of receipt. When it is not possible to attend to the consultation within said period, the interested party will be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended to, which in no case may exceed five (5) business days following the expiration of the first period.

4. Claims for correction, updating or deletion of data will be answered within fifteen (15) business days, counted from the day after the date of receipt. When it is not possible to attend to it within said term, the interested party will be informed before the expiration of the aforementioned term of the reasons for the delay and the date on which his claim will be attended to, which in no case may exceed eight (8) business days after the expiration of the first term.

5. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. Once the complete claim has been received, a legend stating “claim in process” and the reason for it will be included in the database within a period of no more than two (2) business days. This legend must be maintained until the claim is decided. Likewise, if two (2) months have passed since the date of the request, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

6. The first instance of the claim will be the “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S”, and once this has been exhausted without a satisfactory response, the Owner may appeal to the Superintendence of Industry and Commerce.

11. Validity

This policy is effective from the date of its publication and its validity will be subject to the purpose of processing personal data belonging to the legal nature of “CLINICA COLOMBIANA DE OBESIDAD Y METABOLISM S.A.S”.