Privacy Policy & Personal Data Processing

DIAGNOSTICARTE S.A.S. (hereinafter "Almaluna"), with its principal place of business in Medellín, Colombia, email hola@alma-luna.co and phone +57 316 048 44 44, in compliance with Law 1581 of 2012, Decree 1377 of 2013 and other applicable Colombian regulations, adopts this Personal Data Processing Policy.

1. Purpose

To establish the guidelines for the collection, storage, use, circulation, deletion and other forms of processing of the personal data of the Data Subjects, guaranteeing their constitutional and legal rights.

2. Scope

This policy applies to all personal data registered in physical or digital databases administered by Almaluna, including patients, customers, website users, employees, suppliers and other natural persons with whom the company has a relationship.

3. Legal framework

• Constitution of Colombia, article 15.
• Law 1266 of 2008.
• Law 1581 of 2012.
• Decree 1377 of 2013.
• Sole Regulatory Decree 1074 of 2015.
• Resolution 1839 of 2019 of the Superintendence of Industry and Commerce (SIC).

4. Definitions

• Authorization: Prior, express and informed consent of the Data Subject for the processing of their personal data.
• Database: Organized set of personal data subject to processing.
• Personal data: Any information linked or that can be associated with one or several determined or determinable natural persons.
• Sensitive data: Data affecting the privacy of the Data Subject or whose misuse may generate discrimination, such as health, biometric, ideological or sexual orientation data.
• Data Controller: DIAGNOSTICARTE S.A.S. (Almaluna).
• Data Processor: Natural or legal person who processes data on behalf of the Controller.
• Data Subject: Natural person whose personal data is being processed.
• Transfer: Sending of personal data to a recipient inside or outside the country.
• Processing: Any operation on personal data (collection, storage, use, circulation, deletion).

5. Purposes of processing

Almaluna processes personal data of Data Subjects for the following purposes:

• Provision of aesthetic, medical and dermocosmetic services.
• Preparation and custody of the patient's medical record.
• Appointment management, scheduling, reminders and post-treatment follow-up.
• Billing, collections, refunds and tax compliance.
• Sending commercial information, promotions, news and newsletters (always with prior authorization).
• Compliance with legal, contractual and labor obligations.
• Management of relationships with suppliers and commercial partners.
• Handling of inquiries, complaints, claims and suggestions.
• Internal statistical analysis to improve service quality.

6. Sensitive health data

Due to the medical and aesthetic nature of the services, Almaluna collects and processes sensitive data related to the Data Subject's health (medical history, allergies, skin conditions, before/after photographic records, among others).

7. Rights of the Data Subjects

In accordance with article 8 of Law 1581 of 2012, the Data Subject has the right to:

• Know, update and rectify their personal data.
• Request proof of authorization granted.
• Be informed about the use given to their data.
• File complaints with the Superintendence of Industry and Commerce.
• Revoke authorization and/or request data deletion.
• Access their personal data free of charge.

8. Procedure to exercise rights

The Data Subject can exercise their rights through the following channels:

• Email: hola@alma-luna.co
• Phone: +57 316 048 44 44
• In person: At any of Almaluna's locations in Medellín.

The request must contain: full name, identification number, contact information, clear description of the right to be exercised and the facts that support it.

Response times:

• Inquiries: maximum 10 business days, extendable by 5 additional business days.
• Claims: maximum 15 business days, extendable by 8 additional business days.

9. Authorization

The processing of personal data requires the prior, express and informed consent of the Data Subject, except in cases excepted by law (public data, medical emergencies, requirements of competent authority, historical/statistical/scientific purposes).

10. Retention period

Personal data will be kept while the contractual or commercial relationship with the Data Subject subsists and, subsequently, for the periods required by tax, labor and archive regulations (minimum 10 years for medical records, in accordance with Resolution 839 of 2017 of the Ministry of Health). After this period, the data will be securely deleted.

11. Cookies and tracking technologies

Our website may use first-party and third-party cookies to improve the browsing experience, statistical analysis (Google Analytics) and shopping cart functionality. The user can configure their browser to accept, reject or delete cookies. Disabling them may affect the operation of some sections of the site.

12. Information security

Almaluna implements reasonable technical, human and administrative measures to protect personal data against alteration, loss, unauthorized or fraudulent consultation, use or access.

13. Transfer and transmission

Personal data may be shared with third-party data processors (technology providers, payment platforms, messaging services) under confidentiality agreements and exclusively for the authorized purposes.

14. Modifications

Almaluna reserves the right to modify this policy at any time. Modifications will be published on this website with their update date.

15. Effective date

This policy is effective from its publication date and will remain in force until modified or repealed by Almaluna.