Personal Data Processing — Patients and Users
Important notice
This document was prepared as part of a consultation and has an informational and reference character. Its content reflects the current regulatory status at the time of delivery and does not constitute formal legal advice, nor the product of a comprehensive, fully remunerated legal consultation.
The consultants responsible for its preparation assume no responsibility, direct or indirect, for actions or omissions deriving from compliance or non-compliance with the content of this Notice by Dr. Tatiana Leal, her staff, contractors or any third party involved in its implementation.
This document is up to date as of the date and time of its formal delivery to the business owner. Regulations on personal data protection, healthcare and related sectors are subject to modifications by the legislature, the National Government, the Ministry of Health and Social Protection, the Superintendency of Industry and Commerce, and other competent authorities. Consequently, the consultants are not responsible for regulatory changes occurring after delivery of this document. It is expressly recommended to review and verify applicable regulations at the time of implementation of this Notice, and periodically during its application.
The consultants assume no responsibility for how Dr. Tatiana Leal implements this Notice, nor for the interpretation that the company, her staff or third parties make of the information contained herein. This document constitutes solely a suggestion prepared based on applicable regulations known at the time of delivery, and has no binding or imperative character for the recipient business owner.
Finally, it is noted that prior to the implementation of this Notice, the business owner must ensure training of all personnel involved in personal data processing, including staff, physicians and contractors, so that its application is conscious, informed and consistent with the principles and obligations described herein.
1. Data controller identification
| Field | Information |
|---|---|
| Independent Professional | Tatiana Elixandra Leal Sandoval |
| ID Number | 52.973.417 |
| Location | Bogotá D.C., Colombia |
| dratatianaleal@gmail.com | |
| Phone | - |
| Website | www.dratatianaleal.com |
2. Personal data categories processed
In the course of her activity as a provider of aesthetic medicine services, Dr. Tatiana Leal collects and processes the following categories of personal data:
| Category | Specific Data |
|---|---|
| Identification | Full name, ID number and type, date of birth, gender, civil status, photograph |
| Contact | Home address, home and mobile phone, email |
| Health (sensitive) | Medical record, medical history, diagnoses, treatments performed, clinical images (photographs before/after procedures), signed informed consent forms |
| Financial | Billing information, payment method, payment history and service packages purchased |
| Minors | In the case of patients under 18 years of age: data of the legal representative or guardian and their express authorization |
| Video surveillance | Images captured by the security cameras installed in the clinic’s facilities |
Health data is sensitive data in accordance with literal e) of Article 3 and Article 6 of Law 1581 of 2012. Its processing requires express, free and informed authorization from the data subject or their legal representative in the case of minors.
3. Processing purposes
Your personal data will be processed for the following purposes:
- Service delivery: appointment scheduling, medical care, post-treatment follow-up and medical record management.
- Patient communication: appointment reminders, results, post-procedure care instructions and information about services.
- Billing and financial management: issuing invoices, processing payments and managing service packages.
- Legal compliance: responding to requirements from health, tax or judicial authorities.
- Facility security: through the video surveillance system, to protect patients, staff and clinic assets.
- Commercial communications: information about new services, promotions or events, only when the data subject has granted express authorization.
- Quality improvement: internal analysis of patient satisfaction and clinical results.
4. Data transfer and transmission
Dr. Tatiana Leal may share your personal data with third parties under the terms authorized by Law 1581 of 2012. The medical records software provider acts as a data processor for the storage and management of clinical information on secure digital platforms. Health, tax and judicial authorities may receive information only when there is a legal obligation or duly notified requirement. Medical specialists or referral centers may access your data when necessary to ensure continuity of your treatment, with your prior consent.
Under no circumstances will Dr. Tatiana Leal sell, transfer or commercialize your personal data with third parties for purposes other than those indicated in this notice.
5. Data retention period
| Data Type | Retention Period |
|---|---|
| Medical records and health data | Minimum 5 years counted from the date of the last treatment, per Article 34 of Law 23 of 1981 and SGSSS regulations. For minors, the period is counted from the age of majority |
| Billing data | 10 years, per applicable tax regulations |
| Data processing authorizations | While the data subject maintains a relationship with the clinic and for any additional legally required period |
| Video surveillance images | Maximum 30 calendar days, unless legal or administrative proceedings are underway |
| Data for commercial communications | Until the data subject revokes their authorization |
6. Your rights as a data subject
In accordance with articles 8 and 14 of Law 1581 of 2012, you as the data subject have the following rights:
| Right | Description |
|---|---|
| Access (Know) | Know what data of yours is being processed, for what purpose, to which third parties it has been provided and its origin |
| Rectification | Request correction of your data when it is inaccurate, incomplete or outdated |
| Cancellation (Deletion) | Request deletion of your data when it is no longer necessary for the purpose for which it was collected, when the retention period has expired, or when the processing is contrary to law. This right is subject to legal exceptions, especially regarding medical records |
| Opposition | Oppose the processing of your data for specific purposes, especially the sending of commercial communications |
| Revoke authorization | Withdraw the consent granted for the processing of your data, without retroactive effect |
| File complaints | Submit complaints to the Superintendency of Industry and Commerce (SIC) for violations of Law 1581 of 2012, once the procedure before the responsible party has been exhausted |
How to exercise your rights
To exercise any of the above rights, send your written request to dratatianaleal@gmail.com, including your full name, ID number and type, a clear description of the right you wish to exercise and any supporting documents that may apply.
Dr. Tatiana Leal will respond within a maximum of ten (10) business days from receipt, per Article 14 of Law 1581 of 2012. If an additional period is required, you will be informed through the same channel.
7. Complete data processing policy
The complete Data Processing Policy is available at www.dratatianaleal.com, section Personal Data Protection. You may also request it physically at the clinic’s facilities or through the email address indicated in section 1 of this notice.
This privacy notice is issued in compliance with Article 15 of Law 1581 of 2012, Decree 1074 of 2015 (article 2.2.2.25.3.1.) and the guidelines of the Superintendency of Industry and Commerce. The provision of your personal data and the signing of the informed consent form confirm that you have been duly informed about the processing of your data.