Privacy Policy and Personal Data Processing of INVERSIONES ALEXANDER LLANOS

​

INVERSIONES ALEXANDER LLANOS, a commercial entity identified with Tax ID No. 900466956, has as its main corporate purpose to provide comprehensive dental solutions based on the quality of service provision. Below, we will establish the privacy policy and personal data processing guidelines; therefore, hereinafter, the entity will be referred to as INVERSIONES ALEXANDER LLANOS.

REGULATORY SCOPE

Article 15 of the Constitution of the Republic of Colombia grants the right to any individual to know, update, and rectify personal data held about them in databases or files of public or private entities. It also places the obligation on those who have personal data of third parties to respect the rights and guarantees provided in the Constitution when collecting, processing, and sharing this information.

Likewise, Law 1266 of 2008, partially regulated by Decree 1081 of 2015, regulated the right to financial habeas data. Finally, in 2009, Law 1273 classified the "violation of personal data" as a crime.

Statutory Law 1581 of 2012 and all its regulations, Decree 1377 of 2013, and Decree 1074 of 2015, modified by Decree 253 of 2022, established the conditions and requirements for the legitimate and appropriate processing of personal data. It obligates those responsible for processing such data to adopt internal policies that ensure the proper fulfillment of these obligations and also guarantee the rights of data subjects.

​

OBJECTIVE AND SCOPE

The purpose of these policies is to guarantee the Right to Habeas Data that all individuals, including patients, providers, collaborators, clients, shareholders, or any other natural person, have concerning whom INVERSIONES ALEXANDER LLANOS, in the course of its corporate purpose, has collected, managed, or processed their personal data.

Given that one of the main activities carried out by INVERSIONES ALEXANDER LLANOS is to provide healthcare services, both the company and its employees have a duty to maintain confidentiality and discretion regarding patient data and any data related to their health. Therefore, we acknowledge the legal obligation to keep patient medical records confidential in accordance with the provisions of Law 23 of 1981, Resolution 1995 of 1999, and the databases of the general social security system regulated by Resolution 1344 of 2012, Regulatory Decree 3380 of 1981, and Decree 1570 of 1993.

In any case, if INVERSIONES ALEXANDER LLANOS were to process personal data, including sensitive data and data of children and adolescents, the company commits, in compliance with the current regulations adopted in these policies, to respect and guarantee the rights of the Data Subjects whose data it collects and processes as the Data Controller. The company understands that these provisions are of mandatory application in all activities that involve, wholly or partially, the collection, storage, use, and circulation of such information.

Therefore, INVERSIONES ALEXANDER LLANOS, like all third parties acting on behalf of the company, whether as collaborators or third parties involved in the processing of personal data, must observe and respect the rules on the protection of personal data, the confidentiality of the data processed, and this Policy in the performance of their duties and/or activities, even after the legal, commercial, labor, or any other type of relationships have ended.

​

DEFINITIONS

For the purpose of interpretation and application of these Policies, the following definitions or concepts are provided:

Authorization: Prior, express, and informed consent of the Data Subject to carry out the processing of their personal information.

Database: An organized set of personal data subject to processing, by both public and private entities. This includes data deposits found in documents that have the status of records.

Personal Data: Any information that directly or indirectly refers to a natural person or allows them to be associated with one or more individuals, enabling their identification. Some examples of personal data include: name, citizen identification number, physical address, email address, telephone number, marital status, health data, fingerprint, salary, assets, financial status, etc.

Sensitive Personal Data: Information that affects an individual's privacy or whose improper use could lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or that promotes the interests of any political party, as well as data related to health, sexual life, and biometric data (health data, fingerprints, photos, videos).

Public Personal Data: Data classified as such by law or the Political Constitution or data that is not private, semi-private, or sensitive. Public data include, among others, information regarding individuals' marital status, profession or occupation, and their status as a trader or public servant, data contained in the National Road Safety Register (RUNT), or data contained in the public business registry of Chambers of Commerce. By their nature, public data may be found in public records, public documents, gazettes and official bulletins, and duly enforceable court judgments that are not subject to confidentiality.

Private Personal Data: Data that, due to its intimate or confidential nature, is relevant only to the data subject. Examples include merchants' books (accounting), information gathered from home inspections, telephone numbers as long as they are not in public databases, or salary information.

Semi-Private Personal Data: Data that is neither intimate, confidential, nor public, and whose knowledge or disclosure may be of interest not only to the data subject but also to a certain sector or group of people or to society in general. Examples include data related to compliance or non-compliance with financial obligations or data related to relationships with social security entities, among others.

Data Processor: A natural or legal person, whether public or private, who, on their own or in association with others, processes personal data on behalf of the Data Controller.

Data Controller: A natural or legal person, whether public or private, who, on their own or in association with others, decides on the collection of personal data and/or the processing of data.

Data Subject: The natural person whose personal data is subject to processing.

Processing: Any operation or set of operations on personal data, including collection, storage, use, circulation, or deletion of such information.

Transfer: The sending of personal data by the Data Controller or the Data Processor from Colombia to a controller located within the country (national transfer) or outside the country (international transfer).

Transmission: The processing of personal data that involves the communication of such data within Colombia (national transmission) or outside Colombia (international transmission) and aims to carry out processing by the Data Processor on behalf of the Data Controller.

Query: A request by the Data Subject or their successors to access the information about the Data Subject held in the databases managed by INVERSIONES ALEXANDER LLANOS.

Claim: A request by the Data Subject or their successors to correct, update, or delete the information contained in a database managed by INVERSIONES ALEXANDER LLANOS or in the event of non-compliance by INVERSIONES ALEXANDER LLANOS or one of its Data Processors.

Minors: Refers to individuals under the age of eighteen (18), corresponding to Children, Boys, and Adolescents.

Shareholders: Any person who has had or has an investment in shares of the companies that are part of INVERSIONES ALEXANDER LLANOS.

Collaborator: This term includes all individuals within the stakeholder group of INVERSIONES ALEXANDER LLANOS, such as administrators of the entity, employees, contractors, suppliers, apprentices, etc.

​

PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

The principles contained in current regulations, which by default govern this policy, and which will be applicable for the purpose of processing personal data, are:

Principle of Legality in Data Processing: The processing referred to in Law 1581 of 2012 is a regulated activity that must comply with what is established in it and in other provisions that are part of it, complement it, and/or modify it.

Principle of Purpose: The processing of personal data must serve a legitimate purpose in accordance with the Constitution and the Law, and this purpose must always be informed to the Data Subject.

Principle of Freedom: Prior, express, and informed consent of the Data Subject is essential for processing any of their data. Personal data may not be obtained or disclosed without prior authorization, except in the absence of a legal or judicial mandate that releases the consent.

Principle of Restricted Access and Circulation: The processing is subject to limits derived from the nature of personal data, legal provisions, and the Constitution. In this sense, processing may only be carried out by individuals authorized by the Data Subject and/or those provided for by law.

Principle of Truthfulness or Quality: Information subject to processing must be truthful, complete, accurate, current, verifiable, and understandable. The processing of partial, incomplete, fragmented data, or data that may lead to error is prohibited.

Principle of Transparency: Data Subjects have the right to obtain, at any time and without restrictions, information about the existence of data concerning them from the Data Controller or Data Processor.

Principle of Security: Information subject to processing by the Data Controller or Data Processor must be handled with the technical, human, and administrative measures necessary to provide security to the records, preventing their alteration, loss, consultation, unauthorized or fraudulent use or access.

Principle of Confidentiality: All individuals involved in the processing of personal data that do not have the nature of public data are obliged to ensure the confidentiality of the information, even after their relationship with any of the tasks that involve processing has ended. They may only provide or communicate personal data when it is in accordance with the activities authorized by law and within its terms.

Necessity and Proportionality: Personal data recorded in a database must be strictly necessary to fulfill the purposes of the processing, as informed to the Data Subject. Therefore, they must be adequate, relevant, and in line with the purposes for which they were collected.

Temporality or Expiry: The retention period for personal data will be necessary to achieve the purpose for which they were collected; therefore, INVERSIONES ALEXANDER LLANOS, in accordance with the principle of legality, will ensure that data are collected, processed, and managed lawfully. This means that, in the course of its activities, it will collect the necessary data for its business operations. When INVERSIONES ALEXANDER LLANOS acts as the Data Controller, meaning when it deals with a Data Subject who will become a beneficiary, volunteer, employee, supplier, or, in general, any Collaborator, it will inform them clearly, sufficiently, and in advance about the purpose(s) of the processing that will be applied to their personal data

​

In accordance with the principles of reasonableness and proportionality, INVERSIONES ALEXANDER LLANOS will collect personal data that are strictly necessary to carry out its corporate purpose and will only retain this information for the time required to fulfill such purposes, while always adhering to the special terms established by the law for sensitive data.

Likewise, INVERSIONES ALEXANDER LLANOS will respect the Data Subject's freedom to authorize the use of their data. However, it should be noted that, as provided by governing laws, under no circumstances can the Data Subject revoke the authorization and request the deletion of the data when there is a legal or contractual obligation that requires them to remain in the database or archive.

​

RIGHTS OF DATA SUBJECTS

Rights of the data subjects:

INVERSIONES ALEXANDER LLANOS respects and guarantees the rights of data subjects, which are outlined below:

1. Know, update, and rectify their personal data.

2. Request proof of the authorization granted to INVERSIONES ALEXANDER LLANOS, except when the processing being carried out does not require it.

3. Be informed by INVERSIONES ALEXANDER LLANOS about the use of their personal data, upon request made through the channels provided for this purpose.

4. Submit queries and claims to INVERSIONES ALEXANDER LLANOS in order to safeguard their right to Habeas Data.

5. Lodge complaints with the Superintendency of Industry and Commerce for violations of current regulations and request the deletion of personal data when it has been determined that INVERSIONES ALEXANDER LLANOS has engaged in conduct contrary to the law or the Constitution.

6. Access their personal data that have been subject to processing free of charge. The information requested by the data subject may be provided by any means, including electronic means, as required by the data subject. The information must be easy to read and must correspond in every way to the information held in the databases or files administered by INVERSIONES ALEXANDER LLANOS.

PURPOSES OF PROCESSING OF ADMINISTERED PERSONAL DATA

INVERSIONES ALEXANDER LLANOS may collect and process personal data of its patients, clients, suppliers, employees, apprentices, and other collaborators, as well as sensitive data, whether related to the health status of patients, their background, or medical history, which are required in order to carry out activities that enable INVERSIONES ALEXANDER LLANOS to fulfill its corporate purpose.

The database of clients, patients, and users will contain the information required to provide healthcare services by INVERSIONES ALEXANDER LLANOS as part of its corporate activities.

The database of employees, apprentices, and other collaborators is intended to keep INVERSIONES ALEXANDER LLANOS' information up to date regarding these individuals, in order to ensure the proper development of the established employment or contractual relationship.

The database of suppliers aims to have updated and sufficient information about natural persons who already hold this status or wish to have it in the future, in order to properly contract their services and make the corresponding payments.

The data administered by INVERSIONES ALEXANDER LLANOS are kept in accordance with the principles of necessity and reasonableness; expiration and temporality; and in accordance with the provisions of special regulations governing document retention.

INVERSIONES ALEXANDER LLANOS may collect and process personal data of patients, clients, suppliers, apprentices, and other collaborators for financial reasons, including but not limited to records for collection management or credit and financial information, through insurance intermediaries when necessary, as well as for contact purposes to offer new commercial products and services, satisfaction and service quality surveys, sharing information with strategic allies, reinsurers, and insurance intermediaries for the contracting of products and services, handling of claims, and general commercial management as authorized by the data subject.

​

RESPONSIBILITIES AS DATA CONTROLLER AND DATA PROCESSOR

Responsibilities as the data controller:

Considering that the data controller is the one who manages databases and processes the data incorporated into them, INVERSIONES ALEXANDER LLANOS will act as the data controller and, therefore, must comply with the following responsibilities:

1. Request and retain, under the conditions provided in this Policy, a copy or recording of the respective authorization granted by the Data Subject.

2. Clearly and sufficiently inform users about the purpose of data collection and the rights they have by virtue of the granted authorization.

3. Ensure that the user, through the channels of attention established in this Policy, can fully and effectively exercise the right to Habeas Data at all times.

4. Provide information, at the request of the user, about the use of their personal data.

5. Process queries and claims in accordance with the terms set out in this Policy.

6. Observe the principles of truthfulness, quality, security, and confidentiality as established in this Policy.

7. Keep the information under the necessary security conditions to prevent its alteration, loss, consultation, unauthorized or fraudulent use or access.

8. Update the information when necessary.

9. Rectify personal data when appropriate.

10. Provide the Data Processor with only the personal data that it is authorized to provide to third parties.

11. Ensure that the information provided to the Data Processor is truthful, complete, accurate, current, verifiable, and understandable.

12. Promptly communicate to the Data Processor any updates regarding the data previously provided.

13. Demand from the Data Processor, at all times, compliance with the conditions of security and privacy of the Data Subject's information.

14. Inform the Data Processor when certain information is under discussion by the Data Subject.

15. Inform that the use of data corresponds to the development of its activities.

16. Appoint qualified personnel for the handling of personal information, using security measures implemented to prevent alteration, loss, consultation, or unauthorized use.

17. Address the instructions and requirements issued by the Superintendency of Industry and Commerce.

18. Comply with any other responsibilities provided for in current general regulations governing the matter.

​

PROCEDURE FOR REQUESTS AND COMPLAINTS (PQR's)

INVERSIONES ALEXANDER LLANOS has human and administrative mechanisms in place to adequately address requests, inquiries, complaints, and claims related to the processing of personal data, in order to guarantee the exercise of the rights contained in the Constitution and the law, especially the right to know, update, rectify, and delete personal information, as well as the right to revoke the consent granted for the processing of personal data, when there is no legal or contractual duty for the Data Subject to remain in the databases.

Channels

The channels established by INVERSIONES ALEXANDER LLANOS for the submission of requests and complaints are as follows:

a) Technological channels

• Telephone service by calling PBX (1) 637 8266 Ext. 4 - Service Coordination - or Mobile (57) 300 510 9844

• Sending an email to info@alexllanos.com / comercial-servicio@alexllanos.com

• Submitting through the website www.alexllanos.com/

• Social media: Instagram dr_alexllanos, Facebook Dr. A Odontología by Alex Llanos

b) Headquarters: Personalized attention upon presentation of identification at our headquarters located at: Carrera 13 # 119 - 54

The channels provided by INVERSIONES ALEXANDER LLANOS have trained personnel for the performance of their functions and also have the necessary information systems so that updates related to the personal data that Data Subjects request can be documented and traced.

In case new channels are created, such as new phone numbers, email addresses, service branches or offices, they will be inserted into this policy, and the policy will be updated and published, and information will be disseminated to interested parties through the most expeditious means.

It should be noted that in order to process any request or complaint made by Data Subjects, the identity of the requester must be validated and authenticated. Therefore, when submitting the request or complaint, the person must prove that:

• They are the Data Subject or one of their successors or legal representatives.

• They are a person authorized by the Data Subject.

• They are a judicial or administrative authority with the legal powers to request the information.

In the latter case, in accordance with the pronouncement of the Constitutional Court, the public or administrative entity must justify its request by indicating the connection between the need to obtain the data and the fulfillment of its constitutional or legal functions. Upon delivering the information, the public or administrative entity will be informed that it must comply with the duties and obligations imposed by Law 1581 of 2012 regarding the protection and guarantee of personal data, as well as the observance of the principles of purpose, legitimate use, restricted circulation, confidentiality, and security.

Content of the inquiry or complaint:

The request must be addressed to INVERSIONES ALEXANDER LLANOS or the respective company that is part of the business group and must contain at least the following information:

• Full name of the Data Subject.

• Identification number of the Data Subject.

• Contact information for the Data Subject.

• Description of the facts that give rise to the inquiry or complaint.

• Documents that support the inquiry or complaint.

• Preferred method of receiving a response.

• Name of the petitioner, which, if different from the Data Subject, must attach the documents that allow them to act on behalf of the Data Subject.

• Signature of the petitioner.

Data Subjects must prove their identity as follows:

• For requests submitted in writing or by email, a copy of the ID card must be attached.

• Successors must prove their relationship by attaching a copy of the deed that opens the succession and a copy of their identification.

• Representatives must submit an authenticated copy of the power of attorney and their identification.

Processing times for an inquiry or complaint

Inquiry

Once INVERSIONES ALEXANDER LLANOS receives the request for information through any of the channels mentioned above, it will review the individual record corresponding to the Data Subject's name and ID number provided. If any discrepancy is found between these two pieces of information, the Data Subject will be informed within five (5) business days of receipt of the request in order for the requester to clarify it.

If, upon reviewing the provided document and the Data Subject's name, it is found that they match, a response will be provided within a maximum of ten (10) business days.

If INVERSIONES ALEXANDER LLANOS believes that more time is needed to respond to the inquiry, it will inform the Data Subject of this situation and will provide a response within a period not exceeding five (5) business days after the expiration of the initial term.

Complaint

When the Data Subject believes that the information contained in a database managed by INVERSIONES ALEXANDER LLANOS should be corrected, updated, or deleted, or if a breach of legal duties is detected, they may submit a complaint through the means described in this document.

Once INVERSIONES ALEXANDER LLANOS receives the complaint through any of the channels mentioned above, it will review whether it is complete as stipulated in Article 15 of Law 1581 of 2012. If the complaint is found to be incomplete, the interested party will be informed within five (5) business days of receipt of the complaint in order for the requester to complete it.

Once the complete complaint is received, a response will be provided within a maximum of fifteen (15) business days.

If INVERSIONES ALEXANDER LLANOS believes that more time is needed to respond to the complaint, it will inform the Data Subject of this situation and will provide a response within a period not exceeding eight (8) business days after the expiration of the initial term.

If INVERSIONES ALEXANDER LLANOS is not competent to resolve a complaint, it will forward it to the appropriate entity within a maximum of two (2) business days and inform the interested party of the situation so that they can follow up or clearly identify the entity to which they should address their complaint.

Complaints to the Superintendency of Industry and Commerce

The Data Subject, Successor, or representative must first complete the consultation or complaint process as provided in this Policy before contacting the Superintendency of Industry and Commerce to file a complaint.

Disagreement with the response to the inquiry or complaint:

If there is no agreement with the response issued, the Data Subject can request reconsideration directly from INVERSIONES ALEXANDER LLANOS, following the steps defined in this procedure.

Costs of the process:

The Data Subject may consult their personal data free of charge at least once every calendar month or whenever there are substantial modifications to the information processing policies that warrant new inquiries.

For consultations with a frequency greater than once per calendar month, INVERSIONES ALEXANDER LLANOS may charge the Data Subject for shipping, reproduction, or certification expenses.

​

INFORMATION SECURITY

INVERSIONES ALEXANDER LLANOS has information security policies and standards that allow information to maintain its availability, integrity, and confidentiality, aiming to protect it from tampering, loss, or unauthorized or fraudulent access. It may also retain the personal data of data subjects in databases located in Colombia or abroad, complying with the purpose authorized by the data subject and using appropriate security measures to safeguard its integrity and confidentiality.

The personal data processed by INVERSIONES ALEXANDER LLANOS, including sensitive personal data, will be managed and treated with appropriate security and confidentiality measures, in accordance with applicable laws and regulations. In the case of personal data contained in Clinical Histories, it will comply with the provisions of Law 23 of 1981, Resolution 1995 of 1999 of the Ministry of Health, and other regulations that modify, complement, or add to them. With regard to other data, including sensitive data other than Clinical Histories, they will be protected through the use of suitable technological and physical mechanisms.

TRANSMISSION OF PERSONAL DATA

INVERSIONES ALEXANDER LLANOS may transmit all or part of the personal data of data subjects to any authorized entities in accordance with Colombian legislation for the performance of medical activities and services, as well as to its employees, contractors, service providers, suppliers, distributors, advisors, and other collaborators for the purpose of providing health services, offering new products or services, and/or sharing data with third parties with whom it has lawful alliances or relationships related to its commercial activities or for the execution of the respective company's corporate purpose. They will be obliged to process this personal data in accordance with the purposes and uses provided for in the authorizations granted by the data subjects and these Policies. INVERSIONES ALEXANDER LLANOS may also transfer and/or transmit personal data to any acquirer of the company, as well as to any subsidiary and/or division or business.

INTERNATIONAL TRANSFER OF PERSONAL DATA

When transferring personal data to another country, it will be essential to have the authorization of the data subject whose information is being transferred, unless the law provides otherwise. In this regard, before sending personal data to another country, INVERSIONES ALEXANDER LLANOS will verify that it has the prior, express, and unequivocal authorization of the data subject to transfer their personal data. It should be noted that in cases of medical or health emergencies, authorization is not required in accordance with the provisions of Article 10 of Law 1581 of 2012.

The transfer of personal data may only be made to third parties with whom INVERSIONES ALEXANDER LLANOS has a contractual, commercial, and/or legal relationship, and in cases where users request services in countries where INVERSIONES ALEXANDER LLANOS has a presence, and in accordance with the clauses and/or benefit plans.

MODIFICATION AND/OR UPDATE OF THE DATA PROTECTION AND INFORMATION MANAGEMENT POLICY

Any substantial changes to the policies presented here will be communicated through the most expeditious channel possible. In any case, as new communication channels are created, this policy will be included in them, and notification will be given for any substantial changes.

Validity

The validity of these Policies began on August 16, 2022, and will remain in effect as long as there are no substantial modifications to the underlying legislation.

rtir del 16 de agosto de 2022 y se mantendrá en tanto se modificación sustancialmente a la legislación que le sirve de sustento.