Information processing and/or data privacy policy

CONTEXT

The company CLÍNICA DE ESPECIALIDADES OFTALMOLÓGICAS S.A.S. hereinafter CLÍNICA DE ESPECIALIDADES OFTALMOLÓGICAS, in compliance with the regulations in force regarding the protection of personal data in Colombia, especially Law 1581 of 2012; establishes through this document the policies of treatment and protection of personal data, which will be applied to any act of collection, treatment, transfer, transmission, updating, rectification or any other action, whatever it may be, of processing the data of CUSTOMERS, SUPPLIERS, HUMAN RESOURCES and any other person who has a relationship with the OPHTHALMOLOGICAL SPECIALTIES CLINIC.

The CLINIC OF OPHTHALMOLOGICAL SPECIALTIES S.A.S. company identified with NIT No. 900138758-2 in the Chamber of Commerce of Aburra Sur located in the department of Antioquia.

Address: CL 25 SUR 46 220 Envigado, Antioquia

Telephones: 4480408

Email: notificacionesjuridicas@ceomedellin.com

PRESENTATION

The personal data in the custody of the Clínica de Especialidades Oftalmológicas S.A.S., in its capacity as responsible and/or in charge, will be processed in compliance with the principles of legality, purpose, freedom, veracity or quality, transparency, access and restricted circulation, security and confidentiality; thus guaranteeing the right to privacy, intimacy, honor and good name of the owners of the personal data collected.

PURPOSE OF THE TREATMENT POLICY

The OPHTHALMOLOGICAL SPECIALTIES CLINIC, in order to guarantee its CUSTOMERS, SUPPLIERS, HUMAN RESOURCES and any other person who has a relationship with the company the proper use and processing of their personal data and in compliance with current regulations on the protection of Personal Data (Law 1266 of 2008, Law 1581 of 2012 and Decree 1377 of 2013) is allowed to present the Treatment Policies on the protection of Personal Data ( hereinafter the «Policy») of the company in relation to the collection, use, transfer and processing of the same, by virtue of the authorization that has been granted by the Owners of the information.

Through this policy, the OPHTHALMOLOGICAL SPECIALTIES CLINIC indicates the general guidelines adopted for the proper use and protection of the personal data of the holders, as well as the purpose of the collection of information, the rights of the Holders, the area responsible for dealing with complaints and claims, as well as the procedures that must be exhausted to know, Update, rectify and delete information.

In compliance with the constitutional right to Habeas Data, CLÍNICA DE ESPECIALIDADES OFTALMOLÓGICAS S.A.S. only collects Personal Data and sensitive data when previously authorized by its Owner, implementing for this purpose, clear measures on confidentiality and privacy of Personal Data.

DEFINITIONS

In accordance with Article 15 of the National Constitution, Law 1581 of 2012 and Decree 1377 of 2013, the following definitions will be taken into account:

Owner: natural or legal person whose Personal Data is subject to Processing.

Data Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the Processing of the data.

Data processor: Natural or legal person, public or private, who, by itself or in association with others, processes personal data on behalf of the data controller

Authorization: Prior, express and informed consent of the owner to carry out the processing of personal data.

Personal data: Any information linked to or that can be associated with one or more specific or determinable natural persons.

Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Sensitive Data: Those that may affect the privacy of the Owner or whose improper use may generate discrimination, such as those concerning health, sex, political affiliation, among others.

Semi-private data: that which is not intimate, reserved, or public in nature and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector of people or society in general.

Public data: it is the data qualified as such according to the mandates of the law or the Political Constitution of Colombia and that data that is not semi-private, private or sensitive.

Database: An organized set of personal data that is subject to processing.

Transmission: Processing of personal data that involves the communication of the same within or outside the territory of Colombia when it is intended to carry out a processing by the processor on behalf of the responsible party.

Privacy Notice: Verbal or written communication generated by the responsible party, addressed to the owner for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable to them, the way to access them and the purposes of the treatment that is intended to be given to the personal data.

Data transfer: Processing of data that involves its disclosure, free of charge or for a fee, to a person other than the owner of the data or other than the person in charge authorised by the owner.

Habeas Data: Fundamental right of every person to know, update, rectify and/or cancel the information and personal data that have been collected from him or her and/or are processed in public or private databases, in accordance with the provisions of the law and other applicable regulations.

Dissociation procedure: Refers to any processing of personal data in such a way that the information obtained cannot be associated with an identified or identifiable person.

Principles for data processing: These are the fundamental rules, of a legal and/or jurisprudential order, that inspire and guide the processing of personal data, from which actions and criteria are determined to solve the possible collision between the right to privacy, habeas data and protection of personal data with the right to information.

PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

In accordance with Article 4 of Law 1581 of 2013, Law 1266 of 2008 and the Jurisprudence of the Constitutional Court, the principles that govern the Processing of Personal Data are:

Principle of legality in terms of Data Processing: The Processing referred to in Law 1581 is a regulated activity that must be subject to the provisions of Law 1581 and the other provisions that develop it.
Principle of purpose: The Data Processing adopted by the OPHTHALMOLOGICAL SPECIALTIES CLINIC is implemented in the light of a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the Owner prior to the collection of personal or sensitive data.
Principle of freedom or informed consent: The Processing may only be exercised with the prior, express and informed consent of the Data Controller. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate that relieves consent.
Principle of veracity or quality: The data subject to Processing must correspond to real, truthful situations, must be understandable, accurate and complete, as provided by the owner of the same.
Principle of incorporation: when the collection of personal information in databases means advantageous situations for its owner, the database operator must incorporate them.
Principle of restricted access and circulation: The processing of personal and/or sensitive data is subject to the specific limits determined by the purpose of each database, by the authorisation of the owner and the principle of purpose.
Security principle: The information subject to processing by the Data Controller or Data Processor referred to in this law must be handled with the technical, human and administrative measures that are necessary to provide security to the records, preventing their adulteration, loss, consultation, unauthorized or fraudulent use or access.
Principle of expiration or temporality: the unfavorable information of the owner must be removed from the databases, definitively, based on criteria of reasonableness and timeliness; likewise, once the causes that justified the collection and administration of the owner’s information disappear, its use must cease.
Principle of utility: the collection, collection, processing and information of personal data must fulfill a certain function, in accordance with the legitimate exercise of the administration of the same.
Principle of necessity: the personal information concerned must be that which is strictly necessary for the fulfilment of the purposes of the database
Principle of Individuality: independently collected databases should be preserved in this way.
Principle of Transparency: the right of the owner to obtain and know from the controller and/or data processor, at any time and without restrictions, information about the existence of data concerning him/her will be guaranteed.
Confidentiality: the OPHTHALMOLOGICAL SPECIALITY CLINIC and all the persons involved in the processing of personal and/or sensitive data, have the professional obligation to keep and maintain the confidentiality of these, in accordance with the Confidentiality Policy and the Information Security Policy that subsists even after the contractual relationship or the commercial relationship or any other type of relationship has ended.
Special protection of sensitive data: personal data of a sensitive nature will only be collected by the OPHTHALMOLOGICAL SPECIALTIES CLINIC When they are necessary for the development of its corporate purpose.

SCOPE OF APPLICATION

The policies set forth in this document will apply to the processing of personal data, carried out within the Colombian territory or outside it, by virtue of international treaties, contractual relationships, alliances, or any other form of linkage.

RECIPIENTS AND/OR RESPONSIBLE PARTIES

The policies contemplated will apply to and bind the following persons:

Legal representative
Tax Auditor and/or Accountant
Internal staff of the OPHTHALMOLOGICAL SPECIALITY CLINIC, managers or not, who custody, process, have access or any other form of relationship with the company’s databases.
Contractors, natural persons, legal entities, consortiums, temporary unions or any other, who provide their services to the OPHTHALMOLOGICAL SPECIALTIES CLINIC under any type of relationship or commercial relationship, by virtue of which any processing of personal or sensitive data is carried out.
Any person with whom there is a legal relationship of a statutory, contractual, service or any other nature.
Third parties from whom the OPHTHALMIC SPECIALTIES CLINIC has legally obtained information
Entity Users
The other persons established by law.

6.1. AUTHORIZATION FOR USE OF INFORMATION
The authorization described in the previous paragraph will not be necessary in the following cases:

In order to carry out the proper processing of the data of the RECIPIENTS described in the previous paragraph, the OPHTHALMOLOGICAL SPECIALTIES CLINIC requires free, express authorization from the owner or his/her representative, to make use of the owner’s data.

The authorisation may be recorded in any medium, such as a physical or electronic document or in any format that allows subsequent consultation.

The authorization will be understood as the informed consent freely and consciously issued by the holder or his representative, in which the OPHTHALMOLOGICAL SPECIALTIES CLINIC informs the following information:

The processing to which your personal data will be subjected and the specific purpose of the same.
The time for which your personal data will be processed.
The rights that assist him as a holder.
The different communication channels in which you can make queries and/or complaints to the Data Controller or Data Processor.

The OPHTHALMOLOGICAL SPECIALTIES CLINIC or the person responsible for the data collected and processed by the OPHTHALMOLOGICAL SPECIALTIES CLINIC, must keep proof of the authorization issued by the OWNER and/or his/her representative, which must be available at all times for consultation.

6.1. SITUATIONS IN WHICH AUTHORIZATION IS NOT NECESSARY
The authorization described in the previous paragraph will not be necessary in the following cases:

Information required by a public or administrative entity in the exercise of its legal functions or by court order.
Data of a public nature.
Cases of medical or health emergency.
Processing of information authorized by law for historical, statistical or scientific purposes.
Data related to the civil registry of people.

6.2. PROVISION OF INFORMATION

Personal data may only be provided to the following persons:

The HOLDERS, their successors or their legal representatives.
public or administrative entities in the exercise of their legal functions or by court order.
third parties authorized by the owner in writing, and/or third parties authorized by Law.

7. PROCESSING OF PERSONAL DATA WHEN THERE ARE NO PRIVACY NOTICES

The operations that constitute the processing of personal data by the OPHTHALMOLOGICAL SPECIALTIES CLINIC, in its capacity as responsible or in charge of the same, will be governed by the following parameters.

PERSONAL DATA RELATED TO HUMAN RESOURCE MANAGEMENT

The OPHTHALMOLOGICAL SPECIALTIES CLINIC will process the personal data of its employees, contractors, suppliers, interns, trainees, people who apply for vacancies as follows:

Treatment before employment

The OPHTHALMOLOGICAL SPECIALTIES CLINIC will inform, in advance, the persons interested in participating in a selection process, of the rules applicable to the processing of the personal data provided by the interested party, as well as those obtained during the selection process; and obtain the required authorization to deliver such information to third parties and for any purpose other than to participate in this process.

Once the selection process has been exhausted, the OPHTHALMOLOGICAL SPECIALITY CLINIC will report the negative result and return the personal data provided to the non-selected persons; when this is not possible, it will be destroyed for which the owner will have been previously informed.

The information obtained by the CLINIC OF OPHTHALMOLOGICAL SPECIALTIES regarding those who were not selected, specifically the results of the psychotechnical tests and interviews, if applicable, will be eliminated from its information systems, thus complying with the principle of purpose.

Data processing during employment relationships, provision of services or commissioned works

The OPHTHALMOLOGICAL SPECIALTIES CLINIC will store the personal data and information obtained from the selection process of employees, contractors, managers or any other form of relationship with the company, in a virtual and/or physical folder identified with the name of each of them, where the respective documentation will be deposited to each person.

Data processing after termination of the contractual relationship

Once the employment relationship has been terminated, whatever the cause, the OPHTHALMOLOGICAL SPECIALITIES CLINIC will proceed to store the personal data obtained from the selection process of documentation generated in the development of the employment relationship in a secure physical or virtual file.

7.1 PROCESSING OF PERSONAL DATA OF SUPPLIERS

The OPHTHALMOLOGICAL SPECIALITIES CLINIC will protect and guarantee an adequate processing of the data obtained from its suppliers, so it will only use them for the necessary purposes established for each specific case.

7.2 PROCESSING OF PERSONAL DATA IN PROCUREMENT PROCESSES

Third parties who, in contracting processes, alliances and cooperation agreements or any other form of relationship with the OPHTHALMIC SPECIALTIES CLINIC, access, use, process and/or store personal data of employees, users, customers, potential clients or any other third party related to the OPHTHALMIC SPECIALTIES CLINIC must adopt the guidelines set forth in this Policy. as well as the appropriate security measures to guarantee the security of the data.

7.3 PROCESSING OF USERS’ PERSONAL DATA

The personal data of the users and potential users of the OPHTHALMOLOGICAL SPECIALTIES CLINIC will be collected and processed for the purposes established in this document.

PURPOSES OF PROCESSING WHEN THERE ARE NO PRIVACY NOTICES

The Personal Data of the Owners are collected by the OPHTHALMOLOGICAL SPECIALTIES CLINIC in the development of its corporate purpose, for the purposes described below, but not limited to:

Carry out advertising and marketing campaigns to offer its services, seminars, products or any other, its own or those of third parties.
Implement loyalty programs.
Conduct market research.
To carry out commercial agreements, events or institutional programs directly or in association with third parties.
Data verification through consultation of public databases or risk centers.
Georeferencing activities and statistical studies.
Send information on activities and/or consultancies developed by the Company or send information that is considered of interest through different means.
Comply with the legal obligations of information to the administrative entities, as well as to the competent authorities that require it.
Share with third parties that collaborate with the Company and that for the fulfillment of their functions, must access the information to some extent, such as – but not limited to – courier service providers, advertising agencies, collection houses, pension and severance funds, banking entities, among others.
To ensure the safety and adequate provision of the services and products of the OPHTHALMOLOGICAL SPECIALTIES CLINIC or any other third party directly or indirectly linked to the OPHTHALMOLOGICAL SPECIALTIES CLINIC.
Execute the contracts that the company has signed.
Follow-up, approach and/or creation of future business relationships.
Support and carry out the Company’s audit and monitoring processes.
Any other purpose that may result in the development of the contract or the commercial relationship or of any other nature between the OPHTHALMOLOGICAL SPECIALTIES CLINIC and the Owner.
Issue certifications, diplomas or similar or related documents.
Issue invoices, bonds, credit notes or any other equivalent, similar or related document.
Verify the legal situation of SUPPLIERS, CONTRACTORS and HUMAN RESOURCES.

FIRST PARAGRAPH: The information provided by the Owner will be used without limitation for the purposes indicated herein and once the need for the Processing of Personal Data ceases, they may be deleted or archived by the OPHTHALMOLOGICAL SPECIALTIES CLINIC according to its possibilities.

RIGHTS OF DATA SUBJECTS

The owners of the personal data found in the databases that are stored in the information systems of the OPHTHALMOLOGICAL SPECIALTIES CLINIC, have the rights described in this section in compliance with the fundamental guarantees enshrined in the Political Constitution and the law.

The exercise of these rights will be free and unlimited by the owner of the personal data, without prejudice to legal provisions that regulate the exercise of the same.

The exercise of Habeas Data, expressed in the following rights, constitutes a very personal power and will correspond to the owner of the data in an original way, except for the exceptions of law. In accordance with the above; The owners of the information shall have the right to:

The right to obtain all the information, update, rectify, modify, consult at any time in front of the OPHTHALMOLOGICAL SPECIALITIES CLINIC your own personal data at any time, which you consider partial, inaccurate, incomplete, fractional or that you consider misleading.
The right to obtain information regarding the processing applied to your personal data, the purpose of the processing, the location of the databases, the transfers and uses in general given to them.
The right to cancel your personal data or delete them when you consider that they are excessive, irrelevant or the processing is contrary to the rules, except in those cases contemplated as exceptions by law or contractually agreed otherwise.
The right to request at any time proof of the authorisation granted to the OPHTHALMOLOGICAL SPECIALITIES CLINIC
The right to revoke the consent or authorisation that enables the processing of your data, except in those cases contemplated as exceptions by law or contractually agreed otherwise.
To access, free of charge, your personal data that has been subject to Processing,
The right to file complaints and claims with the Superintendence of Industry and Commerce, or with the competent entity, prior to the exhaustion of the exercise of their right before the OPHTHALMOLOGICAL SPECIALTIES CLINIC.
The right to be represented by any person with absolute capacity to do so, which must be accredited in writing.

DUTIES OF THOSE RESPONSIBLE FOR AND IN CHARGE OF THE DATABASES

The OPHTHALMOLOGICAL SPECIALITY CLINIC or any of the recipients of these policies, when they assume the status of data controller and/or data processor, must comply with the following duties:

To guarantee to the Owner, at all times, the full and effective exercise of the right of habeas data.
Request and keep, under the conditions provided for in this law, a copy of the respective authorization granted by the Owner.
Duly inform the Owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
Guarantee that the information provided to the Data Processor is truthful, complete, accurate, updated, verifiable and understandable, in accordance with the data provided by the OWNER.
Update the information, communicating in a timely manner to the Data Processor, all the news regarding the data previously provided and adopt the other measures necessary to ensure that the information provided by the OWNER is kept up to date.
Rectify the information when it is incorrect and communicate the pertinent information to the Data Processor.
Provide the Data Processor, as the case may be, only data whose Processing is previously authorised in accordance with the provisions of this law.
Require the Data Processor at all times to respect the security and privacy conditions of the Data Controller’s information.
To process the queries and claims formulated in the terms indicated in this law.
Adopt an internal manual of policies and procedures to ensure adequate compliance with this law and, in particular, for the attention of queries and complaints.
Inform the Data Processor when certain information is under discussion by the Data Controller, once the claim has been filed and the respective procedure has not been completed.
Inform, at the request of the Owner, about the use given to their data.
Inform the data protection authority when there are violations of security codes and there are risks in the management of the Data Subjects’ information.
Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
To keep a record of the data that have been modified and the respective modifications, the transfers of data and their transmission.
Refrain from using any data that is being disputed by the OWNER or his/her representative or that the competent judicial or administrative entity has ordered not to use.
Allow access to information only to persons designated for this purpose.
To keep a central register of databases containing personal data, including the history since their creation, processing of information and cancellation of the database.
Make a history where inactive data is recorded, which must also be safeguarded.
To keep an organized record of the requests made by the HOLDERS or their representatives and the responses offered to them.

PROCEDURES CONSULTATIONS, UPDATING, RECTIFICATIONS AND DELETIONS

The Owners of the Personal Data or their representatives may, at any time, consult, update, rectify or request the deletion of the data kept by the OPHTHALMOLOGICAL SPECIALTIES CLINIC, for which the following procedure is established:

The owner of the data and/or his/her representative interested in the exercise of his/her rights, must prove such condition, by means of a copy of the pertinent document. In the case of holders, the above must be accredited by means of a citizenship card, passport, alien card, civil registry. The representatives must prove this situation through a special power of attorney and/or general power of attorney duly recognized before a notary, certificate of existence and representation -partners-, civil registry or court ruling that determines it.
The above documents may be supplied to the OPHTHALMOLOGICAL SPECIALTIES CLINIC, by physical or digital means.
The owner or his representative must submit a request for consultation, updating, rectification or deletion of his data, through a physical or digital document to the email notificacionesjuridicas@ceomedellin.com
COMPLAINTS PROCEDURE: The application to exercise any of the aforementioned rights must contain at least the following:

Name and identification of the owner of the personal data and their representatives, if applicable, supported through the documents indicated in paragraph a hereof.

Specific and precise request, specifying the reason and content of the request, i.e. whether the aim is to consult, update information, rectify or request for the deletion of personal data; as well as the reasoning or justifications of the request.

Physical and/or electronic address at which the respective notifications are authorized.

Documents that support the application.

Once the request has been received by the OPHTHALMOLOGICAL SPECIALTIES CLINIC and it is confirmed that it constitutes a claim, the legend «claim in process» will be placed on it or on it, which will be maintained until it is decided.
In the event that any of the requirements mentioned above in paragraph c or any other information necessary to respond to the request is missing, the OPHTHALMOLOGICAL SPECIALTIES CLINIC will notify the interested party within ten (10) business days following receipt of their request, so that they can be corrected by the OWNER or his representative.
If after a period of two (02) months from the date of the request made by the OPHTHALMOLOGICAL SPECIALTIES CLINIC, the OWNER or his representative does not provide the required information or correct the requirements, it will be understood that he or she has withdrawn the initial request.
The OPHTHALMOLOGICAL SPECIALTIES CLINIC will have a term of ten (10) business days to respond to the request made by the OWNER or his/her representatives, if it is a consultation, or fifteen (15) business days if it is a claim. Terms that will be counted from the request made by the OPHTHALMOLOGICAL SPECIALTIES CLINIC for the OWNER or his/her representative to correct the requirements or provide the information required by the OPHTHALMOLOGICAL SPECIALTIES CLINIC.
Whenever the terms indicated above cannot be met, this situation will be informed to the applicant before the expiration of the term.

FIRST PARAGRAPH: the OPHTHALMOLOGICAL SPECIALTIES CLINIC informs the OWNERS of the information that the request for the deletion of the information and the revocation of the authorization will not proceed when the OWNER has a contractual or non-contractual duty with the OPHTHALMOLOGICAL SPECIALTIES CLINIC and when there is a judicial or administrative requirement regarding the personal data of the OWNER.

SECOND PARAGRAPH: It is pertinent to clarify that the owners of the information, their representatives or successors may only file a complaint with the Superintendence of Industry and Commerce once they have submitted the consultation or claim procedure indicated in these policies to the OPHTHALMOLOGICAL SPECIALTIES CLINIC and whose response has not been satisfactory.

INTERNATIONAL TRANSFER OF PERSONAL DATA

For the transmission and transfer of personal data, the following guidelines will be followed:

International transfers of personal data must comply with the provisions of Colombian Law 1581 of 2012, specifically Article 26. This includes a prohibition on transferring personal data to countries that do not offer adequate levels of protection, with some exceptions where this prohibition does not apply.
The transfer of personal data to countries that do not have adequate protection will not be permitted. A country is considered to have an adequate level of data protection if it meets the standards set by the Superintendence of Industry and Commerce of Colombia.
In exceptional situations, the Ophthalmological Specialties Clinic may transfer personal data in the following circumstances:

When the owner has given clear and explicit consent for the transfer.
In cases of exchange of medical information, when it is necessary for the treatment of the owner for reasons of public health or hygiene.
For bank or financial transfers, in accordance with applicable regulations.
In the case of transfers agreed upon in international treaties to which Colombia is a party, based on the principle of reciprocity.
For the execution of a contract between the owner and the Clinic, or for the implementation of pre-contractual measures, provided that the consent of the owner is obtained.
When it is legally necessary to protect the public interest, or for the recognition, exercise or defence of rights in a judicial process.

This approach seeks to ensure that personal data is handled securely and in accordance with current regulations, thus protecting the rights of data subjects.

PERIOD OF VALIDITY OF THE DATABASES

The databases listed in this document will have a duration of twenty (20) years from the date of obtaining the respective personal data. Except in the case that the owner has a legal or contractual duty that merits its permanence in the database for a later term.

EFFECTIVE DATE

These personal data processing policies are in force as of November 15, 2016.

ANNEX 1

– Format for handling personal and commercial data – Patients

Information processing and/or data privacy policy

Contact us today

PBX Phone

WhatsApp

Main office

Links of interest