Personal Data Processing Policy

This is an English translation of our Personal Data Processing Policy. If there is any difference between versions, the Spanish version prevails.

INMUNOMEDICA LAB S.A.S. · NIT 901451024-1
Version 1.0 · Effective as of November 1, 2026

At a glance

• We use your data to provide your care, schedule your appointments and sample collections, process authorizations with your EPS (health insurance company), insurance policy or prepaid health plan (medicina prepagada), and issue invoices.
• Your health data is sensitive. We only process it with your explicit authorization or when the law allows it. Answering questions about your health is optional.
• On WhatsApp, you are first answered by a virtual assistant powered by artificial intelligence. You can ask to talk to a person at any time.
• We never send you results by WhatsApp. We only let you know that they are available.
• What you write on WhatsApp is not part of your medical record. We keep the conversation for 6 months and then delete it.
• Marketing messages are optional. Write «BAJA» (Spanish for “unsubscribe”) and we will stop sending them.
• Some of our technology providers are located outside Colombia.
• You can access, update and correct your data, and ask us to delete it, except for the data the law requires us to keep, such as your medical record.

1. Who is responsible for your data

We are a healthcare provider institution (IPS, institución prestadora de servicios de salud). We provide clinical laboratory services, non-ionizing diagnostic imaging, and outpatient consultations in cardiology, pain management and palliative care, endocrinology, internal medicine, neurology and rheumatology.

Who handles your personal data requests: the General Management, under the responsibility of the legal representative.
Email for personal data matters: contacto@inmunomedica.co

2. Who this policy applies to

It applies to the personal data we process about:

• Patients, however they come to us: through an EPS, as private patients, through a health insurance policy or through a prepaid health plan.
• Guardians, family members and legal representatives of patients.
• Interested people who write to us or leave us their details and are not yet patients (we call them “prospects”).

Our employees and the providers that process data on our behalf (processors) must comply with it.

3. Key terms

Taken from Law 1581 of 2012 (Ley 1581 de 2012), art. 3, and Decree 1074 of 2015 (Decreto 1074 de 2015), art. 2.2.2.25.1.3:

• Data subject (Titular): the person the data refers to. For example, you.
• Processing (Tratamiento): any use of the data: collecting, storing, using, sharing or deleting it.
• Controller (Responsable): whoever makes decisions about the processing. Here, it is INMUNOMEDICA LAB S.A.S.
• Processor (Encargado): whoever processes data on behalf of the controller. For example, a technology provider.
• Authorization (Autorización): your prior, express and informed consent.
• Sensitive data (Dato sensible): data that affects your privacy or whose misuse may lead to discrimination. Health data is sensitive (Law 1581, art. 5).
• Transmission (Transmisión): when we send data to a processor, inside or outside Colombia, so that it processes the data on our behalf.
• Transfer (Transferencia): when we send data to another controller, inside or outside Colombia.
• Privacy notice (Aviso de privacidad): the short message we show you before asking for your data, with the essentials of this policy.

4. Principles we follow

We apply the principles of Law 1581 of 2012 (art. 4): legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality.

In practice: we only ask for what is necessary, we tell you what we use it for, we protect it, and we do not use it for anything else without your authorization.

5. What data we process

• Identification and contact: name, type and number of identity document, phone number, WhatsApp number, email and address (for example, for home sample collection).
• Health coverage: EPS, health insurance policy or prepaid health plan, service orders and authorizations.
• Health (sensitive data): services or tests you need, medical orders, information from your consultations, laboratory results, diagnostic images and medical record.
• Conversation: the messages you send us and that we send you by WhatsApp, their date and time, the files you attach and the delivery status of the messages.
• Authorizations and preferences: what you accepted, when and through which channel, and whether you asked for «BAJA».
• Billing and payments: data for the electronic invoice and to charge you or your insurer.
• Prospects: name, WhatsApp number, service you are interested in and status of your request.

6. What we use your data for

We ask for your authorization separately for care and for marketing messages. Accepting one does not oblige you to accept the other.

6.1 Care and scheduling

This purpose is necessary to provide your care. We use your data to:

1. Answer your questions about the prices and requirements of our services.
2. Record and manage your requests for appointments and sample collections, including at home.
3. Verify your coverage and process authorizations with your EPS, health insurance policy or prepaid health plan.
4. Provide you with health services and keep your medical record, as required by law.
5. Send you confirmations, appointment reminders and “results available” notices. The notice does not include the result.
6. Invoice and collect payment for the services from you or from whoever pays on your behalf.
7. Handle your requests, complaints, claims and suggestions.
8. Comply with the legal duties of the health sector and respond to the authorities.
9. Verify your identity and protect the security of our channels.

6.2 Interested people (prospects)

If you write to us and are not yet a patient, we record your data in Gestionarte to reply to you and follow up on your request. If you do not become a patient, we keep it for 6 months from your last contact and then delete it.

6.3 Marketing messages (optional)

Only if you accept separately, we send you information about our services, promotions and health campaigns.

• Not accepting does not change your care in any way.
• We only send these messages Monday to Friday from 7:00 a.m. to 7:00 p.m. and on Saturdays from 8:00 a.m. to 3:00 p.m. Never on Sundays or public holidays (Law 2300 of 2023 [Ley 2300 de 2023], arts. 3 and 5).
• We do not use your health data to choose which marketing messages to send you.
• Write «BAJA» and we will stop sending them (see section 19).

7. Your health data (sensitive data)

• We process it because it is necessary to provide your care and because the law requires us to keep your medical record.
• Before processing it, we ask for your explicit authorization. We tell you which data is sensitive and what we use it for.
• You are not required to authorize the processing of your sensitive data. Answering questions about your health is optional. No activity depends on you giving us sensitive data (Decree 1074 of 2015, art. 2.2.2.25.2.3). If you prefer not to answer in the chat, you can do so at your appointment.
• In the chat we only ask for what is necessary for your request, such as the service or test you need. We do not ask for your identity document number in the chat: we ask for it in a secure form bearing the Inmunomédica brand.
• If you choose to send us photos (for example, of orders or results) or other health data, we store them encrypted, we do not forward them and we do not add them to your medical record. They are deleted with the conversation, after 6 months.
• In a medical or public health emergency, we may process your data without authorization, as permitted by law (Law 1581, art. 10). The chat does not handle emergencies: if you have one, call 123.

8. Children and adolescents

• We only process their data in a way that respects their best interests and their fundamental rights.
• Authorization is given by their legal representative. Beforehand, we listen to the minor’s opinion and give it weight according to their maturity, autonomy and ability to understand the matter (Decree 1074 of 2015, art. 2.2.2.25.2.9).
• If you write on behalf of a minor, you must be their legal representative or be authorized by them. To verify this, we will ask you, through the secure form, for the minor’s civil registration (registro civil) or identity document.
• If you are under 18, ask your legal representative to write to us or to come with you to your appointment.
• We do not send marketing messages directed at minors.

9. If you give us another person’s data

If you write on behalf of a family member or give us another person’s data (for example, the guardian’s), you must have their authorization or be their legal representative. We may ask you to prove it.

10. How we ask for your authorization

• On WhatsApp: before asking for your data, we show you the privacy notice, with the link to this policy. You accept with a button. There is one button for care and scheduling and another, optional one for marketing messages.
• In the secure form: we send you the link by WhatsApp from our official number. It always starts with https://crm.gestionclinica.app. There you enter your identity document number.
• At our facility: you sign the authorization in writing before your care.
• We keep proof of your authorization: what you accepted, when and through which channel (Decree 1074 of 2015, art. 2.2.2.25.2.5).
• Your silence never counts as authorization (Decree 1074 of 2015, art. 2.2.2.25.2.4).

When we do not need your authorization (Law 1581, art. 10): when a public entity requests it in the exercise of its functions or a judge orders it; when the data is of a public nature; in cases of medical or public health emergency; for historical, statistical or scientific purposes authorized by law; and for civil registry data.

11. How our WhatsApp channel works

• We serve you on WhatsApp at +57 305 479 3737 through our own system, Gestionarte.
• In Gestionarte we record your conversation, your requests and your authorizations.
• On WhatsApp we give you prices and requirements, receive requests for appointments and sample collections (including at home), and send you reminders and “results available” notices.
• The virtual assistant answers 24 hours a day. Our team is available Monday to Friday from 7:00 a.m. to 7:00 p.m. and on Saturdays from 7:00 a.m. to 11:00 a.m. It is not available on Sundays or public holidays.
• We never send results by WhatsApp. We let you know that they are ready and you view them on our results portal, available 24 hours a day. You access it from “Check your results” («Consulta de resultados» in Spanish) on inmunomedica.co.
• What you write in the chat is not part of your medical record. We keep the conversation for 6 months from the last message and then delete it.
• WhatsApp is a Meta service. When you use it, WhatsApp’s terms and privacy policy also apply.

12. Virtual assistant powered by artificial intelligence

We use artificial intelligence transparently, as required by the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio, SIC) in External Circular 002 of 2024 (Circular Externa 002 de 2024).

• What it is: a virtual assistant that runs on Claude, an artificial intelligence model from the company Anthropic. The first message in the chat tells you that you are talking to a virtual assistant.
• What it does: it answers questions about prices and requirements, and receives your requests.
• What it does not do: it does not give clinical guidance, does not give diagnoses and does not interpret results. It does not make decisions about your healthcare. In an emergency, it tells you to call 123.
• You can always talk to a person. The assistant offers you this option, and you can ask for it at any time.
• What data it processes: the text of your messages, so that it can reply to you. Anthropic processes them in the United States as our processor.
• No training: Anthropic’s commercial terms do not allow it to use your data to train its models. We also ask it not to keep the data after replying.
• It can make mistakes. If something is unclear or you think there is an error, ask to talk to a person.
• Before launching the assistant, we assessed its risks to your data (privacy impact assessment), and we repeat the assessment whenever we change it significantly.

13. Who we share your data with

• Your EPS, insurer, health insurance policy or prepaid health plan: to verify your coverage, process authorizations and invoice.
• The IPS’s professionals and staff involved in your care.
• Reference laboratories and other providers, when your test or your care is referred to them.
• The authorities, when the law or a judge requires it (for example, the health authorities).
• Our technology providers (processors), which are explained in section 14.

We do not sell your data.

14. Providers outside Colombia (international transmission)

To operate our channels, we use providers that process data outside Colombia. As a result, your data leaves the country.

• These providers process your data only on our behalf, for the purposes of this policy.
• We have a contract with each of them (their terms of service and data processing terms) that requires them to process the data according to our instructions, protect its security and keep it confidential.
• Because they are our processors and we have that contract, the law does not require us to ask for a separate authorization for this transmission (Decree 1074 of 2015, arts. 2.2.2.25.5.1 and 2.2.2.25.5.2). We still inform you about it here and in the chat notice.

15. How we protect your data

• Each member of our team signs in with their own user account and a second factor, and only sees what their role requires.
• We log who views or changes your data.
• Data is encrypted in transit. We store the photos and health data you send us in the chat encrypted.
• We only ask for your identity document number in the secure form, never in the chat.
• We do not send results by WhatsApp.
• We make backups, which are renewed within 30 days at most.
• If a security incident occurs that puts your data at risk, we report it to the Superintendence of Industry and Commerce, as required by law (Law 1581, art. 17, lit. n).

16. How long we keep your data

We keep your data only for as long as necessary for the purpose and to comply with the law. When it is no longer needed, we delete it (Decree 1074 of 2015, art. 2.2.2.25.2.8).

17. Your rights

Under Law 1581 of 2012 (art. 8), you have the right to:

1. Access, update and correct your data.
2. Request proof of the authorization you gave us, except when the law does not require it.
3. Be informed, upon request, of how we have used your data.
4. Revoke your authorization or ask us to delete your data, when there is no legal or contractual duty to keep it (Decree 1074 of 2015, art. 2.2.2.25.2.6).
5. Consult your data free of charge, at least once every calendar month and every time we make substantial changes to this policy (Decree 1074 of 2015, art. 2.2.2.25.4.2).
6. File a complaint with the Superintendence of Industry and Commerce, after submitting your inquiry or claim to us (Law 1581, art. 16).

Who can exercise these rights (Decree 1074 of 2015, art. 2.2.2.25.4.1): you, by proving your identity; your successors in title (causahabientes), by proving that status; your representative or attorney-in-fact, by proving the representation; or whoever holds a stipulation in favor of another person (estipulación a favor de otro). The rights of children and adolescents are exercised by their representatives.

18. How to submit an inquiry or a claim

Channels:

• Email: contacto@inmunomedica.co
• WhatsApp: +57 305 479 3737
• In writing at our facility: Carrera 43 # 29-35, piso 3, Medellín.

What to include: your name, what you want (to consult, correct, update, delete or revoke), how we should reply to you and any documents you wish to provide. To verify your identity, we will ask for your identity document through the secure form, not in the chat.

Inquiries (to access your data)

• We will reply within 10 business days at most from the date we receive your inquiry.
• If we cannot do so within that period, we will tell you why and when we will reply. That new date cannot be more than 5 business days later (Law 1581, art. 14).

Claims (to correct, update, delete, revoke or report a breach)

1. If your claim is incomplete, we will ask you to complete it within 5 days of receiving it. If 2 months pass without you completing it, we will consider that you have withdrawn it.
2. If we are not the competent party to resolve it, we will forward it to the appropriate party within 2 business days at most and let you know.
3. Within 2 business days at most, we will mark your data with the legend «reclamo en trámite» (“claim in process”) until we resolve it.
4. We will reply within 15 business days at most, counted from the day after we receive it. If we cannot, we will tell you why and when. That new date cannot be more than 8 business days later (Law 1581, art. 15).

We cannot delete data or accept a revocation when you have a legal or contractual duty to remain in the database. For example, we cannot delete your medical record. See what can be deleted at inmunomedica.co/eliminacion-de-datos.

19. Marketing messages and how to unsubscribe

• They are optional and you accept them with a separate button.
• We only send them Monday to Friday from 7:00 a.m. to 7:00 p.m. and on Saturdays from 8:00 a.m. to 3:00 p.m. Never on Sundays or public holidays.
• Write «BAJA» and we will stop sending you marketing messages. If you write it when you receive a reminder, we will ask you what you want to stop receiving: marketing messages, reminders or everything.
• You can also revoke your authorization through any of the channels in section 18.

20. Changes to this policy

• We publish the current version at inmunomedica.co/politica-de-datos.
• If something substantial changes, such as who the controller is or what we use your data for, we will notify you before applying the change or, at the latest, when we apply it. If the purpose changes, we will ask you for a new authorization (Decree 1074 of 2015, art. 2.2.2.25.2.2).

21. Effective date

• This policy is effective as of November 1, 2026.
• Our databases will remain in force for as long as the purposes of this policy and the legal retention periods in section 16 apply.

22. Laws and regulations we apply

• Political Constitution of Colombia (Constitución Política de Colombia), article 15 (habeas data).
• Statutory Law 1581 of 2012 (Ley Estatutaria 1581 de 2012), on personal data protection.
• Decree 1377 of 2013 (Decreto 1377 de 2013), compiled in Decree 1074 of 2015 (Book 2, Part 2, Title 2, Chapter 25).
• Sole Circular (Circular Única) of the Superintendence of Industry and Commerce, Title V, and External Circular 002 of 2024 (personal data in artificial intelligence systems).
• Law 2300 of 2023 (channels, schedules and marketing messages).
• Resolution 1995 of 1999 of the Ministry of Health (Ministerio de Salud), amended by Resolution 839 of 2017 (medical records).
• Law 962 of 2005, article 28 (retention of merchants’ books and papers).