PRIVACY AND DATA PROCESSING POLICY
OFTALMOLOGIA AVANZADA SAS
Last Updated: March 12, 2026
This policy establishes the basis on which OFTALMOLOGIA AVANZADA SAS (“we,” “the Company”), domiciled in Bogotá, Colombia, processes personal data and Protected Health Information (PHI) of our patients and users globally.
1. INTERNATIONAL LEGAL FRAMEWORK
This policy is designed to simultaneously comply with:
United States: Health Insurance Portability and Accountability Act (HIPAA).
European Union: General Data Protection Regulation (GDPR) 2016/679.
Colombia: Law 1581 of 2012 and Decree 1377 of 2013.
Brazil/LATAM: LGPD and local data protection regulations.
2. DATA SUBJECT TO PROCESSING AND SENSITIVE DATA
We collect data necessary for the provision of health services and schedule optimization:
Biographic Data: Name, identification, date of birth, and contact information.
Sensitive Data (Health): Reason for consultation, clinical history, and symptoms. Under HIPAA and Law 1581, this data enjoys special protection; providing it is voluntary unless indispensable for medical treatment.
Profiling Data: Information from public social media profiles and digital behavior, collected only with your express consent for triage and service segmentation purposes.
3. PURPOSES OF PROCESSING
Your data will be processed for the following purposes:
Provision of Medical Services: Diagnosis, treatment, and follow-up.
Schedule Management and Triage: Profile analysis to prioritize appointments based on clinical urgency and case complexity.
Communications: Sending reminders and notifications via WhatsApp, SMS, or email.
Legal Compliance: Reports to health authorities and preservation of clinical records according to Colombian and international law.
4. GLOBAL DATA SUBJECT RIGHTS
Regardless of your location, we guarantee the following rights:
Access and Rectification: Consult and correct your information.
Erasure (Right to be Forgotten): Request the deletion of your data (subject to legal terms for medical record retention, which in Colombia is generally 15 years).
Portability: Receive your data in a structured, commonly used, and machine-readable format.
Withdrawal of Consent: Revoke your authorization for non-essential data processing (e.g., social media profiling).
5. INTERNATIONAL TRANSFERS AND SECURITY
Your data may be processed on servers located in the USA or Europe through technology providers (e.g., BotPenguin, Google Cloud). We implement:
End-to-End Encryption for all chat communications.
Standard Contractual Clauses (SCCs) with third parties to ensure that the level of protection is not diminished outside your country of origin.
6. CLAIMS PROCEDURE (HABEAS DATA)
To exercise your rights, you may contact our Data Protection Officer:
Email: [INSERT EMAIL]
Address: Bogotá, Colombia.
Response Time: 10 business days for inquiries and 15 business days for claims, in accordance with Colombian legislation.
NOTICE OF PRIVACY PRACTICES (HIPAA – USA)
This section is mandatory for patients within United States territory.
OFTALMOLOGIA AVANZADA SAS is required by law to maintain the privacy of your health information and to provide you with this notice of its legal duties. We may use your information for Treatment, Payment, and Health Care Operations. We will not use your data for marketing purposes without your specific authorization. If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services.