HORARIOS DE ATENCIÓN : Monday to Sunday - 6:00am to 8:00pm  
  CITAS EN EL : +57 604 444 - 2006            

Data treatment policy

INFORMATION PROCESSING POLICIES

CLÍNICA DEL CAMPESTRE S.A. CLINICAL DATABASE

PRELIMINARY ASPECTS

CLÍNICA DEL CAMPESTRE S.A. – CLÍNICA DEL CAMPESTRE, aware of the importance of personal data for the owners and the responsibility it has acquired regarding them as a result of the information processing activities carried out in the execution of its corporate purpose, it makes its policies for the processing of personal information available to all interested parties, in compliance with the provisions of Article 2.2.2.25.3.1 of the Single Decree of the Commerce, Industry, and Tourism sector, DU 1074 of 2015 (Decree 1377 of 2013, Art. 13).

CONTACT INFORMATION

Depending on the nature of each database, section 8, CLÍNICA DEL CAMPESTRE may act as the DATA CONTROLLER or DATA PROCESSOR of personal information that makes up the respective DATABASE. CLÍNICA DEL CAMPESTRE is located in the city of Medellín (COL.), with its main office at Calle 17 Sur No. 44-06, telephone (+574) 444 20 06.

OBJECT

The purpose of this document is to regulate the activities related to the processing of personal data that make up the DATABASES of CLÍNICA DEL CAMPESTRE, mainly regarding the processing purposes, rights of the DATA SUBJECTS, the commitments undertaken by CLÍNICA DEL CAMPESTRE as the processing CONTROLLER or PROCESSOR, and the tools adopted to allow DATA SUBJECTS to exercise their rights properly.

LEGAL FRAMEWORK

For situations that are not regulated by the INFORMATION PROCESSING POLICIES of CLÍNICA DEL CAMPESTRE, the provisions of Laws 1581 of 2012 and 1266 of 2008 and regulatory decrees 1377 of 2013 and 1727 of 2009, compiled in DU 1074 of 2015, shall apply.

DEFINITIONS

For interpretative purposes and to provide a better understanding of the INFORMATION PROCESSING POLICIES of CLÍNICA DEL CAMPESTRE, the following definitions are adopted:

4.1. Authorization

Prior, express, and informed consent given by the data subject for the purpose of processing their data.

4.2. Database

The organized set of personal data subject to processing.

4.3. Personal data

Any information related to one or more identified or identifiable natural persons, which constitutes the DATABASES of CLÍNICA DEL CAMPESTRE.

4.4. Private data

Data that, due to its intimate or reserved nature, is only relevant to the data subject.

4.5. Public data

Data that is not semi-private, private, or sensitive. Public data includes, among others, data related to the individuals’ marital status, profession or occupation, and their status as a trader or public servant.

4.6. Semi-private data

Data that is not of an intimate, reserved, or public nature, and whose knowledge or disclosure may be of interest not only to the data subject but also to a certain sector or group of people.

4.7. Sensitive data

Data that affects the data subject’s privacy or whose misuse could lead to discrimination.

4.8. Biometric data

All data related to the physical, physiological, or behavioral characteristics of a person that facilitates their identification.

4.9. Data processor

The natural or legal person who, on their own or in association with others, processes personal data on behalf of the data controller.

4.10. Data controller

The natural or legal person, public or private, who, on their own or in association with others, makes decisions on the databases and/or data processing.

4.11. Data subject

The natural or legal person whose data, as the processing object, is part of the DATABASES of CLÍNICA DEL CAMPESTRE.

4.12. Processing

Any operation or set of operations that CLÍNICA DEL CAMPESTRE performs on the personal data that make up the DATABASES of CLÍNICA DEL CAMPESTRE, including collection, storage, use, circulation, or deletion.

4.13. Strategic allies

Natural or legal persons, public or private, who, on their own or in association with others, carry out commercial activities aimed at developing, promoting, or supporting the corporate purpose of CLÍNICA DEL CAMPESTRE.

INFORMATION PROCESSING PRINCIPLES

In order to ensure the proper processing of personal data in all actions carried out by CLÍNICA DEL CAMPESTRE regarding the information that makes up the DATABASES of CLÍNICA DEL CAMPESTRE, as well as in the interpretation and execution of these policies, the following principles will be followed:

5.1. Legality principle

Throughout all stages and activities of information processing by CLÍNICA DEL CAMPESTRE or any entity designated as the PROCESSOR for the processing, the provisions described in section 3 and any other regulations that govern, supplement, modify, or repeal them, in addition to the provisions of this policy, shall be applied.

5.2. Purpose principle

Processing personal information from the DATABASES of CLÍNICA DEL CAMPESTRE will only involve activities related to the purpose established in section 9.

5.3. Freedom principle

The processing activities to which personal data are subject, governed by this policy, will only be carried out when the data subject has given prior or express authorization, unless they fall within the scope of those that, in accordance with the provisions of Article 10 of Law 1581 of 2012, do not require the data subject’s authorization.

This does not prevent the data subject from requesting the deletion of their personal data at any time, as stated in section 15.

5.4. Accuracy or quality principle

CLÍNICA DEL CAMPESTRE is committed to ensuring that the information that makes up its databases is truthful, complete, accurate, up-to-date, verifiable, and understandable. Therefore, it will refrain from processing partial, incomplete, fragmented, or misleading data. To this end, CLÍNICA DEL CAMPESTRE provides data subjects with the mechanisms established in sections 16, 17, and 18, aimed at ensuring that data subjects can request the correction, updating, or deletion of information at any time.

5.5. Transparency principle

CLÍNICA DEL CAMPESTRE has adopted appropriate mechanisms to ensure that the DATA SUBJECT can obtain information about the existence of data concerning them  at any time and without restrictions.

5.6. Access and restricted circulation principle

Access to the information that makes up the DATABASE of CLÍNICA DEL CAMPESTRE is restricted to specialized personnel who have received prior training for handling this type of information. CLÍNICA DEL CAMPESTRE does not publish personal information that can be processed on the Internet or other means of mass dissemination or communication.

5.7. Security principle

CLÍNICA DEL CAMPESTRE has implemented a series of technical, human, and administrative measures, congruent to the nature of the data subject to processing, to prevent their alteration, loss, consultation, use, or access by unauthorized personnel.

5.8. Confidentiality principle

CLÍNICA DEL CAMPESTRE has established a protocol that guarantees data subjects whose information makes up the DATABASES of CLÍNICA DEL CAMPESTRE that the individuals involved in the processing of their personal data will maintain this information confidential, even after the processing work or contractual relationship with the company has ended.

PERSONAL DATA PROCESSING

  1. AUTHORIZATION

The processing activities regulated by this policy will be performed exclusively on personal data for which the data subjects have given their prior, express, and informed consent.

Notwithstanding the above, CLÍNICA DEL CAMPESTRE reserves the right to process information for which authorization is not required under the legal provisions governing the matter, in which case the commitments of CLÍNICA DEL CAMPESTRE towards data subjects as established in this policy shall remain in effect.

For these purposes, it is important to note that CLÍNICA DEL CAMPESTRE may use any of the following methods to obtain the data subject to processing:

  • Data collected directly by CLÍNICA DEL CAMPESTRE

CLÍNICA DEL CAMPESTRE keeps a copy of the authorizations issued by each of the data subjects that make up the databases of CLÍNICA DEL CAMPESTRE.

  • Data provided by third parties

In addition to the personal data collected by CLÍNICA DEL CAMPESTRE directly from the DATA SUBJECT, CLÍNICA DEL CAMPESTRE may obtain personal data from databases provided by third parties who have previously obtained authorization from the DATA SUBJECTS.

LEVEL OF INVOLVEMENT

Depending on the nature of the respective database (Section 8) and the purposes pursued with the processing (Section 9), CLÍNICA DEL CAMPESTRE may act as the DATA CONTROLLER or DATA PROCESSOR of personal information that makes up the respective DATABASE.

CLÍNICA DEL CAMPESTRE reserves the right to delegate certain processing activities to a third party to be carried out on its behalf, in which case the third party shall comply with the commitments established in Section 14 of this policy.

CLÍNICA DEL CAMPESTRE DATABASES

The CLÍNICA DEL CAMPESTRE DATABASES refer to the set of personal data systematically stored for the purposes described in Section 9 and the processing activities carried out on them.

The CLÍNICA DEL CAMPESTRE DATABASE is mainly composed of:

  • DATABASES IN WHICH CLÍNICA DEL CAMPESTRE ACTS AS THE DATA CONTROLLER:
  • CLÍNICA DEL CAMPESTRE EMPLOYEE DATABASE
  • CLÍNICA DEL CAMPESTRE SUPPLIER DATABASE
  • CLÍNICA DEL CAMPESTRE PATIENT DATABASE
  • CLÍNICA DEL CAMPESTRE VIDEO DATABASE
  • CLÍNICA DEL CAMPESTRE CLIENT DATABASE
  • CLÍNICA DEL CAMPESTRE NON-MEDICAL CONTRACTORS DATABASE
  • CLÍNICA DEL CAMPESTRE MEDICAL CONTRACTORS DATABASE
  • CLÍNICA DEL CAMPESTRE SPACE CONCESSION DATABASE
  • CLÍNICA DEL CAMPESTRE SATISFACTION SURVEY DATABASE
  • CLÍNICA DEL CAMPESTRE SHAREHOLDERS DATABASE

PURPOSE AND PROCESSING ACTIVITIES

CLÍNICA DEL CAMPESTRE is a company professionally dedicated to the provision of services related to human health and the medical profession. To carry out its social purpose, it requires executing certain processing activities whose nature and purpose vary depending on the characteristics of each of the databases subject to processing, as described below:

DATABASES IN WHICH CLÍNICA DEL CAMPESTRE ACTS AS THE DATA CONTROLLER:

  • CLÍNICA DEL CAMPESTRE EMPLOYEE DATABASE:

Purpose and processing activities:

For the development of its social purpose, it is essential to hire highly qualified personnel with demonstrated experience in specific areas. Therefore, CLÍNICA DEL CAMPESTRE collects certain personal data from potential candidates to be employed by the company and existing employees, which facilitate, among others, the selection, hiring, and promotion processes within CLÍNICA DEL CAMPESTRE, as well as the execution of certain contractual obligations with its employees, certain clients, service providers, and contractors.

For the effective development of such activities, CLÍNICA DEL CAMPESTRE needs to collect, store, use, and in general, carry out activities related to the processing of personal data that allow active interaction with the data subjects, compliance with obligations as an employer, and proper and uninterrupted execution of activities related to its social purpose, Consequently, the purpose of processing personal information contained in the CLÍNICA DEL CAMPESTRE EMPLOYEE DATABASE is:

  • Establishment of communication channels with the data subjects associated with the activities mentioned in the previous paragraphs.
  • Conducting selection processes, promotion, employee welfare, payroll, performance and competencies, induction, training, education, workplace safety and health.
  • Fulfillment of obligations derived from current employment contracts, directly or through third parties.
  • Compliance with obligations related to the execution of CLÍNICA DEL CAMPESTRE’s corporate purpose, within and outside the national territory.
  • Execution of employee training and development programs and other events organized by CLÍNICA DEL CAMPESTRE, or in which CLÍNICA DEL CAMPESTRE has any interest in participating.
  • Execution of employee performance evaluations.
  • Adoption of control and security measures over different CLÍNICA DEL CAMPESTRE facilities.
  • CLÍNICA DEL CAMPESTRE SUPPLIER DATABASE:

Purpose and processing activities:

For the development of its corporate purpose, CLÍNICA DEL CAMPESTRE collects certain personal data from (i) suppliers, (ii) potential suppliers, (iii) employees or contact persons of its suppliers, (iv) employees or contact persons of its potential suppliers, which facilitate, among others, the contracting processes and the execution and compliance verification with various contractual obligations.

For the effective development of such activities, CLÍNICA DEL CAMPESTRE needs to collect, store, use, and in general, carry out activities related to the processing of personal data that allow active interaction with the data subjects, fulfill its contractual obligations, verify the fulfillment of contractual benefits in its favor, and execute activities related to its corporate purpose adequately and without interruptions. Consequently, the purpose of processing personal information contained in the CLÍNICA DEL CAMPESTRE SUPPLIER DATABASE is:

  • Establishment of communication channels with the data subjects related to the activities established in the previous paragraphs.
  • Sending requests and requirements for services and/or supply of materials, according to the Company’s needs.
  • Fulfillment of obligations related to the execution of CLÍNICA DEL CAMPESTRE’s corporate purpose within the national territory.
  • Monitoring compliance with obligations by the SUPPLIERS.
  • Adoption of control and security measures over different facilities of CLÍNICA DEL CAMPESTRE.
  • As an element of analysis for the establishment and/or maintenance of contractual relationships.
  • CLÍNICA DEL CAMPESTRE PATIENT DATABASE:

Purpose and processing activities:

CLÍNICA DEL CAMPESTRE, in compliance with its corporate purpose, needs to collect certain personal data from its patients to provide the offered services in an adequate and timely manner, as well as to comply with the different legal provisions that regulate it.

For the effective development of such activities, CLÍNICA DEL CAMPESTRE requires collecting, storing, using, and generally carrying out activities related to the processing of personal data that allow it to actively interact with the data subjects, fulfill its obligations as the Data Controller, and properly and uninterrupted execute the activities related to the health services offered. Consequently, the purpose of processing personal information contained in the CLÍNICA DEL CAMPESTRE PATIENT DATABASE consists of:

Establishing communication channels with the data subjects related to the activities mentioned in the previous paragraphs.

Evaluating the quality of services provided by CLÍNICA DEL CAMPESTRE.

Fulfilling obligations related to the execution of CLÍNICA DEL CAMPESTRE’s corporate purpose within the national territory.

Adopting control and security measures over the different installations of CLÍNICA DEL CAMPESTRE.

Complying with the legal and contractual obligations of CLÍNICA DEL CAMPESTRE towards the data subjects.

Complying with different legal and regulatory provisions that bind CLÍNICA DEL CAMPESTRE.

Analyzing medical records.

CLÍNICA DEL CAMPESTRE VIDEO DATABASE

Purpose and processing activities:

In compliance with its corporate purpose, CLÍNICA DEL CAMPESTRE needs to collect certain data and videos that allow it to provide the offered services adequately and timely and adopt relevant security measures. Consequently, the purpose of processing personal information contained in the CLÍNICA DEL CAMPESTRE VIDEO DATABASE consists of:

Adopting control and security measures over the different installations of CLÍNICA DEL CAMPESTRE.

CLÍNICA DEL CAMPESTRE CLIENT DATABASE

Purpose and processing activities:

In compliance with its corporate purpose, CLÍNICA DEL CAMPESTRE needs to collect certain personal data from its clients to provide the offered services adequately and timely, as well as to comply with the different legal provisions that regulate it. For the effective development of such activities, CLÍNICA DEL CAMPESTRE requires collecting, storing, using, and generally carrying out activities related to the processing of personal data that allow it to actively interact with the data subjects, fulfill its obligations as the Data Controller, and properly and uninterruptedly execute the activities related to the health services offered. Consequently, the purpose of processing personal information contained in the CLÍNICA DEL CAMPESTRE CLIENT DATABASE consists of:

Establishing communication channels with the data subjects associated with the activities mentioned in the previous paragraphs.

As an element of analysis for establishing and/or maintaining contractual relationships.

Evaluating the quality of services provided by CLÍNICA DEL CAMPESTRE.

CLÍNICA DEL CAMPESTRE NON-ASSISTANT CONTRACTORS DATABASE

Purpose and processing activities:

For the development of its corporate purpose, CLÍNICA DEL CAMPESTRE needs to hire highly qualified personnel with demonstrated experience in specific areas. In this regard, CLÍNICA DEL CAMPESTRE collects certain personal data from potential non-assistant contractors of the company and existing contractors, which facilitate, among others, the selection processes within CLÍNICA DEL CAMPESTRE and the execution of certain contractual obligations with its contractors, clients, and service providers.

For the effective development of such activities, CLÍNICA DEL CAMPESTRE requires collecting, storing, using, and generally carrying out activities related to the processing of personal data that allow it to actively interact with the data subjects, fulfill its obligations as a contractor, and properly and uninterrupted execute the activities related to its corporate purpose. Consequently, the purpose of processing personal information contained in the CLÍNICA DEL CAMPESTRE NON-ASSISTANT CONTRACTORS DATABASE consists of:

Establishing communication channels with the data subjects associated with the activities mentioned in the previous paragraphs.

As an element of analysis for establishing and/or maintaining contractual relationships.

Sending requests and service requirements and/or material supply according to the Company’s needs.

Conducting contractor selection processes.

CLÍNICA DEL CAMPESTRE ASSISTANT CONTRACTORS DATABASE

Purpose and processing activities:

For the development of its corporate purpose, CLÍNICA DEL CAMPESTRE needs to hire highly qualified personnel with demonstrated experience in specific areas. In this regard, CLÍNICA DEL CAMPESTRE collects certain personal data from potential assistant contractors of the company and existing contractors, which facilitate, among others, the selection processes within CLÍNICA DEL CAMPESTRE and the execution of certain contractual obligations with its contractors, clients, and service providers. For the effective development of such activities, CLÍNICA DEL CAMPESTRE requires collecting, storing, using, and generally carrying out activities related to the processing of personal data that allow it to actively interact with the data subjects, fulfill its obligations as a contractor, and properly and uninterrupted execute the activities related to its corporate purpose. Consequently, the purpose of processing personal information contained in the CLÍNICA DEL CAMPESTRE ASSISTANT CONTRACTORS DATABASE consists of:

Establishing communication channels with the data subjects associated with the activities mentioned in the previous paragraphs.

As an element of analysis for establishing and/or maintaining contractual relationships.

Sending requests and service requirements and/or material supply according to the Company’s needs.

Conducting contractor selection processes.

CLÍNICA DEL CAMPESTRE SPACE CONCESSION DATABASE

Purpose and processing activities:

For the development of its corporate purpose, CLÍNICA DEL CAMPESTRE collects certain personal data from (i) concessionaires, (ii) potential concessionaires, (iii) contact persons of the concessionaires, which facilitate, among others, the processes of administration, monitoring the reimbursement of consideration for space concession, contracting services and/or supplies, as well as the execution and verification of compliance with various contractual obligations. For the effective development of such activities, CLÍNICA DEL CAMPESTRE requires collecting, storing, using, and generally carrying out activities related to the processing of personal data that allow it to actively interact with the data subjects, fulfill its obligations, and properly and uninterrupted execute the activities related to its corporate purpose. Consequently, the purpose of processing personal information contained in the CLÍNICA DEL CAMPESTRE SPACE CONCESSION DATABASE consists of:

  • Establishment of communication channels with the data subjects, associated with the activities mentioned in the previous paragraphs.
  • Evaluation of the quality of services provided and received.
  • CLÍNICA DEL CAMPESTRE CLINICAL SATISFACTION SURVEY DATABASE

Purpose and treatment activities

CLÍNICA DEL CAMPESTRE, in compliance with its social purpose, requires collecting certain personal data with surveys that allow it to provide the offered services adequately and promptly, as well as to comply with the different legal provisions that regulate it.

For the effective development of such activities, CLÍNICA DEL CAMPESTRE needs to collect, store, use, and generally carry out activities related to the processing of personal data that enable it to actively interact with the holders of such information, fulfill its obligations as the RESPONSIBLE party, and properly and uninterruptedly carry out activities related to the offered health services. Consequently, the purpose of processing the personal information contained in the CLÍNICA DEL CAMPESTRE CLINICAL SATISFACTION SURVEY DATABASE is:

  • Evaluation of the quality of services provided by CLÍNICA DEL CAMPESTRE.
  • CLÍNICA DEL CAMPESTRE SHAREHOLDER DATABASE

Purpose and treatment activities

Considering the corporate structure of CLÍNICA DEL CAMPESTRE, it is mandatory to have the personal information of the shareholders who make up the company. For this reason, CLÍNICA DEL CAMPESTRE collects certain personal data from current and former shareholders, which facilitate, among others, compliance with social statutes, tax and accounting obligations, commercial and financial obligations of CLÍNICA DEL CAMPESTRE, and the execution of certain contractual obligations with clients and suppliers.

For the effective development of such activities, CLÍNICA DEL CAMPESTRE needs to collect, store, use, and generally carry out activities related to the processing of personal data that enable it to actively interact with the holders of such information, fulfill its obligations as the RESPONSIBLE party, and properly and uninterruptedly carry out activities related to the social statutes. Consequently, the purpose of processing the personal information contained in the CLÍNICA DEL CAMPESTRE SHAREHOLDER DATABASE is:

  • Establishment of communication channels with the data subjects, associated with the activities mentioned in the previous paragraphs.
  • Compliance with obligations derived from the company towards the Shareholder, the Data Subject.
  • Information about dividend or profit payments.
  • Compliance with obligations related to the execution of the social purpose of CLÍNICA DEL CAMPESTRE, within and outside the national territory.
  • As an element for the administration of life insurance policies for members.

10.-PROCESSING OF SENSITIVE PERSONAL DATA

CLÍNICA DEL CAMPESTRE recognizes that certain data subject to processing are or may be considered sensitive data. In this regard, CLÍNICA DEL CAMPESTRE has adopted measures to ensure that when the data subject to processing falls within the legally defined sensitive data:

  • Compliance with the principles that regulate the processing of personal information, as established in section 5, is reinforced.
  • No activity is conditioned upon the provision of sensitive personal data.
  • Express, informed, and voluntary authorization must be obtained from the holders of such data before carrying out processing activities.

11.-PROCESSING OF MINOR’S DATA

As a general rule, in the execution of any activity involving the processing of personal data, CLÍNICA DEL CAMPESTRE will refrain from handling data whose subject is a minor, per the provisions of Article 7 of Law 1581 of 2012.

Exceptionally, CLÍNICA DEL CAMPESTRE will have to process the personal data of minors. When this occurs, CLÍNICA DEL CAMPESTRE will subject the processing of such data to the following rules:

  • Respect for the best interests of the minor data subject.
  • Respect for the fundamental rights of the minor data subject.
  • Authorization issued by the legal representative of the minor data subject.

COMMITMENTS MADE TO DATA SUBJECTS

12.-COMMITMENTS

In compliance with the provisions of section 7 of this policy and articles 17 and 18 of Law 1581 of 2012, and in its capacity as the DATA CONTROLLER of personal information, CLÍNICA DEL CAMPESTRE adopts the following commitments with the data subjects:

  • Ensure that the DATA SUBJECT can fully and effectively exercise the right to habeas data at all times.
  • Request authorization from the DATA SUBJECT when, according to a legal provision, such authorization is necessary.
  • Keep a copy of the authorization issued by the DATA SUBJECT when necessary.
  • Properly inform the DATA SUBJECT about the purpose of collecting the data.
  • Properly inform the DATA SUBJECT of their rights as such.
  • Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use, or access.
  • Ensure that the information subject to processing is truthful, complete, accurate, updated, verifiable, and understandable.
  • Rectify the information when it is incorrect or biased.
  • Process the inquiries and claims made by the data subjects following the terms established by the law.
  • Allow access to personal information only to individuals who, according to legal provisions, are authorized to access it.
  • Adopt an internal procedures manual to ensure the proper processing of personal data.
  • Provide information, at the request of the DATA SUBJECT, regarding the use given to their data.
  • Inform the delegated superintendent for the Protection of Personal Data, or the appropriate authority, of security breaches and risks in the management of the data subjects’ information.

13.-SPECIAL COMMITMENTS

Regarding information subject to controversy before an administrative or judicial authority, or that is being claimed by the DATA SUBJECT, or whose blocking has been ordered by the competent authority, CLÍNICA DEL CAMPESTRE undertakes to take all necessary measures to prevent such information from being further processed, except for its storage, until a final decision is made.

14.-COMMITMENTS OF CLÍNICA DEL CAMPESTRE AND THIRD PARTIES AS DATA PROCESSORS

The obligations described below will apply when (i) for convenience, CLÍNICA DEL CAMPESTRE delegates the performance of certain activities related to data processing to a third party, or when (ii) CLÍNICA DEL CAMPESTRE performs data processing activities as a DATA PROCESSOR, as defined in section 4 of this document:

  • Ensure the full and effective exercise of the right to habeas data for the DATA SUBJECT.
  • Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use, or access.
  • Promptly carry out the update, rectification, or deletion of data when required by CLÍNICA DEL CAMPESTRE or directly by the DATA SUBJECT.
  • Process requests made by DATA SUBJECTS to ensure the proper treatment of their personal data.
  • Take all necessary measures to prevent the further processing of information subject to controversy before an administrative or judicial authority, or information that is being claimed by the data subject, or whose blocking has been ordered by the competent authority, except for its storage, until a final decision is made.
  • Allow access to information only to individuals who are authorized to access it.
  • Inform the delegated superintendent for the Protection of Personal Data or the appropriate authority of security breaches and risks in the management of the data subjects’ information.
  • Adopt data processing policies that ensure the proper handling of personal data.
  • Provide the data processing policies described in the previous section to the DATA CONTROLLER.

DATA SUBJECT RIGHTS

15.- DATA SUBJECT RIGHTS

CLÍNICA DEL CAMPESTRE, committed to respecting the interests of data subjects whose personal data is processed and aware of the importance of proper data handling, recognizes the following rights of the data subjects in CLÍNICA DEL CAMPESTRE’s databases:

  • Knowledge

Under this right, the data subject is empowered to request, at any time and free of charge, information about the data being processed by CLÍNICA DEL CAMPESTRE and the use made of such data.

  • Rectification

The data subject has the power to request the correction of inaccurate information in CLÍNICA DEL CAMPESTRE’s databases at any time.

  • Update

The data subject can request that the information in CLÍNICA DEL CAMPESTRE’s databases be complete and up-to-date for reasons other than data correction. In this regard, they may request the inclusion or removal of any relevant information.

  • Request a copy of the authorization

When, in accordance with the provisions of section 6 of this policy and article 10 of Law 1581 of 2012, it is necessary to obtain the data subject’s authorization for their data to be subjected to processing activities, they are entitled to request, at any time and free of charge, a copy of the authorization issued.

  • Revoke the authorization

When, in accordance with the provisions of section 6 and article 10 of Law 1581, it is necessary to obtain the data subject’s authorization for their data to be subjected to processing activities, they are entitled to revoke the authorization issued at any time.

  • Deletion

Under this right, the data subject may request the deletion of data in CLÍNICA DEL CAMPESTRE’s databases at any time, provided that there is no legal or contractual obligation to retain it.

PROCEDURES FOR THE EFFECTIVE EXERCISE OF RIGHTS

16.- GENERAL ASPECTS

CLÍNICA DEL CAMPESTRE has implemented a series of procedures within the company for the proper handling of personal information and the exercise of the rights of data subjects recognized in section 15. These procedures may vary depending on the right exercised by the data subject, as outlined in the following sections 17 and 18.

17.- INQUIRIES

For the exercise of the rights of knowledge, access to information, and request for a copy of the authorization, as stated in section 15, paragraphs 15.1 and 15.4, respectively, the data subjects or authorized persons, following the provisions of section 19, may submit inquiries to the relevant department, section 20, following the following rules:

  • Mechanisms

Inquiries shall be submitted by written request addressed to the Customer Service Area of CLÍNICA DEL CAMPESTRE, at Calle 17 Sur No. 44 – 06, Medellín (Colombia), by individuals who, according to section 19, are authorized to do so. The request should briefly describe the information for which access is desired, provide a mailing address, identification details, and documents that prove the legitimacy to act, if the requester is not the data subject.

  • Processing

Upon receipt of the inquiry, the relevant department will endeavor to resolve it, to the extent possible, within ten (10) business days from the date of receipt.

If it is not possible to address the inquiry within the timeframe indicated in the previous paragraph, the requester will be informed of the situation, the reasons for the delay, and the date by which the request will be resolved. In no case shall this date exceed five (5) business days from the expiration of the initial term.

  • Response

The competent department responsible for the proper handling of personal data will provide a written response to the data subjects’ requests within the terms established in the previous section, sent to the physical or electronic address provided by the requester for this purpose.

If the requester provides both a physical and an electronic address or multiple addresses of either type, it will be at the sole discretion of CLÍNICA DEL CAMPESTRE to decide which address to send the response to.

18.- PETITIONS

For the exercise of the rights of rectification, updating, revoking authorization, and deletion of information, as established in sections 15.2, 15.3, 15.5, and 15.6, respectively, data subjects or authorized persons, following the provisions of section 19, may submit petitions to the competent department, section 20, following the following rules:

  • Mechanisms

Petitions shall be submitted by written request addressed to the Customer Service Area of CLÍNICA DEL CAMPESTRE, at Calle 17 Sur No. 44 – 06, Medellín (Colombia), by individuals who, according to section 19, are authorized to do so. The request should briefly describe the facts that motivate the petition, provide a mailing address, identification details, and attach the documents that support the request and prove the legitimacy to act if the requester is not the data subject.

  • Processing

Incomplete Petition

Disposition

If CLÍNICA DEL CAMPESTRE deems that the petition submitted by the data subject or the authorized person, per the provisions of section 19, is incomplete due to the lack of requirements established in the previous section, the interested party will be required to remedy the deficiencies within five (5) days following the receipt of the request.

If two (2) months have elapsed since the date of CLÍNICA DEL CAMPESTRE’s requirement to the interested party without the latter submitting the requested information, it shall be understood that they have withdrawn the claim, without prejudice to the ability to submit a new petition in the same regard. In such a case, the terms for resolution will begin to run from the date of new petition.

Complete Petition

Once the complete petition is received or the deficiencies have been remedied within the term established in the previous paragraph, a note stating “claim in progress” and the reason for it will be included in the respective database of CLÍNICA DEL CAMPESTRE within two (2) business days. This note will remain until the claim is resolved.

Notwithstanding the above, the competent department will endeavor to resolve the petition, to the extent possible, within fifteen (15) business days from the date of receipt.

If it is not possible to address the petition within the timeframe indicated in the previous paragraph, the data subject will be informed of the situation, the reasons for the delay, and the date by which the request will be resolved. In no case shall this date exceed eight (8) business days from the expiration of the initial term.

  • Decision

The Customer Service Area of CLÍNICA DEL CAMPESTRE will provide a written response to the data subjects’ requests within the terms established in the previous section, sent to the physical or electronic address provided by the requester for this purpose.

19.- LEGITIMACY

The data subject, their successors in interest, and individuals authorized by the data subject or their successors in interest are legitimized to exercise the rights established in section 15 and other rights recognized by law. In the latter two cases, the authorized person must provide suitable mechanisms to prove their authorized status.

20.- COMPETENCE

For all matters related to the processing of personal information, addressing inquiries and requests, CLÍNICA DEL CAMPESTRE has designated the Customer Service Area as the competent authority. To this end, technical, human, and administrative measures have been implemented to ensure the confidentiality and security of the information.

FINAL PROVISIONS

21.- EFFECTIVENESS

This policy comes into effect on the date of its publication, August 26, 2016, and will remain in effect as long as CLÍNICA DEL CAMPESTRE carries out the activities described in section 9, which correspond to the purposes of processing outlined in this policy.

Substantial changes to the processing policies that may affect the content of the authorization, particularly those related to the identification of CLÍNICA DEL CAMPESTRE and/or the purpose of processing personal data, will be promptly communicated to the data subjects efficiently and before implementing the new policies.

22.- NATIONAL DATA PROTECTION AUTHORITY

CLÍNICA DEL CAMPESTRE, in ensuring the effective protection of the personal data of the data subjects whose information is part of CLÍNICA DEL CAMPESTRE’s databases, makes available to the general public information related to the Delegation for Personal Data Protection, the competent authority at the national level responsible for overseeing processing activities conducted within the national territory. This information can be accessed through the following link: http://www.sic.gov.co/sobre-la-proteccion-de-datos-personales