Personal Data Processing Policy

1. Data controllers

The data controllers, acting as individuals and jointly for the channels they share (this website, WhatsApp, telephone and email), are the neurology specialists who make up Broca Unidad Neurológica:

• Dr. Karem Cárdenas Medina.
• Dr. Ana Carolina Miguez Pulido.
• Dr. Lina Marcela Osorio Coy.

Each neurologist is responsible for the medical records of the patients she treats. Hereinafter they are referred to as "Broca" or "the Controllers".

• Address: Carrera 12 No. 1 A norte 20, Edificio Centro Médico y Empresarial Uninorte, Office 309, Armenia, Quindío, Colombia.
• Email to exercise your rights: [email protected]
• Phone and WhatsApp: (+57) 315 345 7764
• Website: www.brocaunidadneurologica.com

2. Purpose and legal framework

This policy implements the right of habeas data set out in Article 15 of the Colombian Constitution: every person may access, update and correct the information collected about them. It is adopted pursuant to Statutory Law 1581 of 2012, Decree 1074 of 2015 (Chapters 25 and 26) and the instructions of the Superintendence of Industry and Commerce (SIC), the Colombian data protection authority. Medical records are also governed by Law 23 of 1981, Resolution 1995 of 1999 and Resolution 839 of 2017 of the Ministry of Health and Social Protection, and by any rules that amend or replace them.

The terms Authorization, Database, Personal data, Sensitive data, Processor, Controller, Data subject, Processing, Transfer and Transmission have the meaning given in Article 3 of Law 1581 of 2012 and Article 2.2.2.25.1.3 of Decree 1074 of 2015.

3. Principles

We apply the principles of legality, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality (Article 4 of Law 1581 of 2012). We only request the data needed for each purpose. We do not sell personal data or use it for advertising.

4. Who this policy applies to

We process data from three groups of people. Each group provides different data, for different reasons and under a different authorization:

1. People who only visit the website. They do not give us their name or contact details. Only technical browsing data is collected.
2. People who write to us or call us by WhatsApp, phone, email or Instagram, whether or not they book an appointment.
3. People seen in consultation (patients) and, where applicable, their designated representative.

It also applies to anyone who submits a habeas data request.

5. What data we process and why

Any other use will require a new authorization. If in the future we wished to send you information other than about your appointments, we would ask for a separate authorization, which you may refuse or revoke without any effect on your care.

6. Sensitive data: health data

Health data is sensitive data. Therefore:

• You are not required to authorize its processing or to answer questions about it. However, medical care is not possible without the necessary clinical information.
• We only process it with your prior, express and informed authorization, except in the cases of Article 6 of Law 1581 of 2012 (for example, a life-threatening emergency).
• By WhatsApp or phone we only ask for what is needed to book an appointment. You do not need to send test results or details of your medical history through those channels unless the neurologist asks you to.
• The medical record is confidential. Only the treating neurologist, authorized staff and the people the law or you authorize may access it.

7. Children and adolescents

Broca only sees patients aged 18 or over, and the site is not aimed at minors. We do not knowingly collect minors' data. If a minor contacts us, we will tell them that their legal representative must do so, and if we find that we received their data without valid authorization, we will delete it.

8. How we obtain your authorization and how we prove it

9. Your rights

As the data subject, you may at any time (Article 8 of Law 1581 of 2012):

1. Access the data we hold about you and how we use it, free of charge.
2. Update and correct partial, inaccurate or incomplete data.
3. Request proof of the authorization you gave us.
4. Revoke your authorization and request deletion of your data. Deletion does not apply where there is a legal duty to keep the data. This is the case of the medical record, which must be kept for the period stated in section 13.
5. File complaints with the Superintendence of Industry and Commerce once you have completed the inquiry or claim procedure with us.

These rights may be exercised by the data subject (proving their identity), their successors, their representative or attorney, and anyone acting under a stipulation in favor of another.

10. How to exercise your rights: inquiries and claims

Channels: the form on the Exercise my data rights page, the email [email protected] or a written request delivered at the office.

Inquiries (accessing your data or requesting proof of authorization): we answer within a maximum of ten (10) business days from the day after receipt. If that is not possible, we will tell you why and give you a new date, no later than five (5) business days after the first deadline (Article 14 of Law 1581 of 2012).

Claims (updating, correcting, deleting, revoking or reporting a breach): they must include your identification, a description of the facts and of what you request, the email or address for the reply and any documents you wish to provide. If the claim is incomplete, we will ask you to complete it within five (5) days. If two (2) months pass without a reply, the claim will be deemed withdrawn. We resolve claims within a maximum of fifteen (15) business days from the day after receipt, extendable by up to eight (8) business days with prior notice of the reasons (Article 15 of Law 1581 of 2012). While it is being resolved, the data will be marked "claim in progress".

To protect your information, we verify the identity of the applicant before disclosing or changing any data.

11. Providers that process data on our behalf and international transfers

To serve you we use providers (Processors) that process data on our behalf. Some of them have their servers outside Colombia:

By signing the authorization form at the office, confirming your authorization on WhatsApp or accepting analytics cookies, you expressly authorize the transmission of your data to these providers. We require them to apply security and confidentiality measures equivalent to those required in Colombia. Transfers to countries without an adequate level of protection according to the SIC are only made with your express authorization or in the other cases of Article 26 of Law 1581 of 2012.

12. Cookies

The site uses technical storage needed to work and, only if you accept it, Google analytics cookies. Details are in the Cookie Policy. You can change your choice at any time with the "Cookie settings" button in the footer.

13. How long we keep data

We keep data only for as long as reasonable and necessary for each purpose, or as required by law. After that we delete or anonymize it.

14. Requesting a copy of the medical record

The medical record is a private and confidential document. It is kept in the custody of the treating neurologist. To release it we follow these protocols:

Data subject (patient)

• In person: at the office, presenting your original ID document.
• By email: with a message sent exclusively from the email address you registered at the consultation. The copy is sent only to that address.

Third parties and representatives

• Previously authorized representative: if the patient registered the representative's name and ID in writing, the copy is released to that person after verifying their identity.
• Unregistered third parties: they must present a power of attorney authenticated by a Colombian notary, recently dated, together with a copy of the patient's ID document.
• Legal representatives: they must prove their status with the relevant legal documentation (a court ruling or a document certifying legal representation), which is verified and recorded.

15. Information security

We apply technical, human and administrative measures to protect data against loss, tampering and unauthorized access: encrypted connection (HTTPS with HSTS), security headers, access control to medical records and provider accounts, backups and staff confidentiality. If an incident affecting personal data occurs, we will manage it and report it to the SIC and to the people affected in accordance with applicable regulations.

16. Changes to this policy

We will publish any change on this site with a new version number and date. If the change affects the purposes or requires a new authorization, we will ask for it before applying the change. Previous versions remain published in the version archive as proof of what you accepted at each point in time.

17. Effective date

This version is effective from its publication date and replaces the previous policy. Databases will remain in force for as long as the purposes that justified the processing and the legal retention periods apply.