Personal Data Processing Policy

PERSONAL DATA PROCESSING POLICY – CLINICA LIV IN ACCORDANCE WITH LAW 1581 OF THE YEAR 2012
AND ITS REGULATORY DECREES

1. SCOPE.

The Personal Data Processing and Protection Policy presented below will apply to all databases and/or files containing personal data that are subject to processing by CLINICA LIV, considered as the controller and/or processor of the collected personal data.

DEFINITIONS.

• Database: Organized set of personal data that is subject to processing.

• Personal Data: Any information linked or that can be associated with one or more identified or identifiable natural persons.

• Sensitive Data: Information that affects the privacy of individuals or whose improper use may generate discrimination (racial or ethnic origin, political orientation, philosophical or religious beliefs, membership in unions or social or human rights organizations, health data).

• Data Processor: Natural or legal person, public or private, who by itself or in association with others, carries out the processing of personal data on behalf of the data controller. In cases where the controller does not act as the database processor, it will be expressly identified who will be the processor.

• Data Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the processing of the data.

• Data Subject: Natural person whose personal data is subject to processing.

• Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

• Transfer: Data transfer occurs when the data controller and/or processor located in Colombia sends the information or personal data to a recipient, who in turn is a data controller and is located داخل or outside the country.

• Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when its purpose is to carry out processing by the processor on behalf of the controller.

2. INFORMATION COLLECTION.

Employees, directors, or partners of CLINICA LIV who, in the development of legal, contractual, commercial, and/or any other activities that arise, require the collection of data, will limit themselves to requesting only those personal data that are strictly relevant and adequate for the provision of the offered service. Likewise, they will not use misleading or fraudulent means to collect and process personal data.

In order to guarantee the right to information and proper authorization from the data subjects, all data collection forms and support material of the different activities carried out by CLINICA LIV will contain statements regarding acceptance of personal data processing, which must be explained to the data subjects; and if necessary, depending on the activity to be carried out, a document of acceptance of data processing will be signed in accordance with current legislation.

3. DUTIES OF CLÍNICA LIV

According to the legal definitions and those established in this corporate data processing policy, CLÍNICA LIV, which will act as the DATA CONTROLLER OF PERSONAL DATA PROCESSING, will comply with the following duties:

1. Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.
2. Timely update, rectify, or delete data in accordance with the terms established by law.
3. Update the information reported by the controllers within five (5) business days from its receipt.
4. Process queries and claims submitted by data subjects within the terms established by law.
5. Adopt an internal manual of policies and procedures to ensure proper compliance with the law, especially for handling queries and claims from data subjects.
6. Record in the database the notes “claim in process” in the manner regulated by law.
7. Insert in the database the note “information under judicial dispute” once notified by the competent authority of legal proceedings related to the quality of the personal data.
8. Refrain from circulating information that is being disputed by the data subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.
9. Allow access to information only to persons authorized to have access to it.
10. Inform the Superintendence of Industry and Commerce when security breaches occur and there are risks in the administration of the data subjects’ information.
11. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
    
    
    4. DATA SUBJECT RIGHTS.The rights of the data subject are as follows:

1. Access, know, rectify, and update their personal data; this right is known as Habeas Data.
2. Request proof of the authorization granted for the processing of their data.
3. Receive information regarding the use given to their personal data.
4. Approach the authorities, especially the Superintendence of Industry and Commerce, and file complaints for violations of the provisions of current regulations and this document.
5. Modify and revoke authorization and/or request the deletion of personal data.
6. These rights may be exercised through the channels or means provided by CLINICA LIV for public service: Carrera 25A # 1A Sur -45. Parque Comercial El Tesoro, Local 4799- Medellin, Colombia, designated to respond to requests related to personal data processing and the exercise of the rights mentioned in this policy.

5. TERM

This personal data processing policy will be effective from January 1, 2024, and will remain in force as long as the purposes that justify its processing are maintained.

Substantial changes or modifications incorporated into this policy will be communicated to the data subject at least ten (10) days prior to their implementation. Notification of changes will be made through appropriate communication channels.