Data Processing Policy (Habeas Data)

1. Legal framework

This policy complies with Statutory Law 1581 of 2012, Decree 1377 of 2013 and other concordant rules that develop the fundamental right of Habeas Data in Colombia.

2. Controller

Data controller: INDESA — Institute of Advanced Densitometry, Medellín (El Poblado), Colombia. Rights channel: privacidad@indesa.health.

3. Principles

Data processing is governed by the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality.

4. Owner authorization

INDESA collects and processes personal data with the prior, free, express and informed authorization of the owner. For sensitive data (including health data), explicit consent is requested and the owner is informed that they are not obliged to authorize its processing.

5. Owner rights

• Know, update and rectify your personal data.
• Request proof of the authorization granted.
• Be informed about the use given to your data.
• File complaints with the Superintendence of Industry and Commerce for violations of the law.
• Revoke authorization and/or request deletion of data where appropriate.
• Access your personal data free of charge.

6. Procedure to exercise rights

Inquiries and claims may be directed to privacidad@indesa.health, indicating the owner name, a description of the facts and contact details.

Inquiries will be handled within a maximum of ten (10) business days and claims within a maximum of fifteen (15) business days, extendable in accordance with the law.

7. Security and confidentiality

INDESA implements appropriate security measures to protect information and requires its processors to comply with equivalent confidentiality and protection obligations.

8. Validity

This policy is effective upon publication. Databases will be retained while the processing purposes and applicable legal obligations subsist.