Data Privacy Policy and Terms and Conditions

The website www.columnavertebralmedellin.com (hereinafter, "the Site"), where physiotherapist Juliana Lopera Isaza offers virtual consultation services, therapeutic tools and informational content on the health of the musculoskeletal system —especially the spine— and on difficult-to-manage pain, respects your privacy and undertakes to protect your Personal Data through this Privacy Policy and these Terms and Conditions.

In the course of its activity, the Site processes information linked or that may be associated with natural persons ("Personal Data") through different means, including:

• Website www.columnavertebralmedellin.com
• Email
• SMS, MMS text messages and other electronic messages
• Social media

The purpose of this Privacy Policy is to inform the practices and procedures for the processing of the Personal Data of the Site's users, when the Site acts as the data controller of Personal Data.

• Controller: Physiotherapist Juliana Lopera Isaza
• Address: Medellín, Colombia
• Phone: +57 316 523 6696
• Email: info@columnavertebralmedellin.com

The Site will process Personal Data (collection, storage, use, consultation, processing, circulation, reporting, updating, compilation, modification, correction, management and deletion) in accordance with the Privacy Notice (which governs the particular terms of the data subject's consent), this Privacy Policy and Colombian legislation.

Personal Data subject to processing

• Information that personally identifies the data subject: full name.
• Information related to health: given the meaning and content of the Site, it is necessary to have some health information in order to help all those people who, of their own free will, provide such information.
• Contact information: email address, phone number.
• Interactions with data subjects: correspondence (emails, surveys), complaints and claims (PQR) (petitions, complaints, claims).
• Information about shared content and services: user interaction with the use of the different services offered.
• Online browsing information: device, IP address, operating system, geolocation, browsing details, login dates and times, time spent, user activities.

The Site will NOT process sensitive Personal Data, understood as data that may affect the privacy of the data subject or whose improper use may result in discriminatory processing, such as: biometric data, data on racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social or human rights organizations, or any political party.

The Site's services are NOT directed to persons under 18 years of age, and therefore such Personal Data will not be processed. If the involuntary collection of sensitive Personal Data or of data of persons under 18 years of age is discovered, it will be deleted immediately.

(i) Directly: through contact channels, applications and electronic forms, as well as through the website.

(ii) Through our social media:

• Facebook: https://www.facebook.com/columnavertebralmedellin/
• Instagram: https://www.instagram.com/columnavertebralmedellinfisio
• YouTube: https://www.youtube.com/@columnavertebralmedellin

(iii) Automatically: through cookies, web beacons and other technologies that allow monitoring traffic on our website. At the end of this Policy you will find information about how these types of technologies work and their use.

(iv) Automatically through third-party services: the automatic collection of Personal Data may originate through third-party websites, including: Google Analytics UA, Google Analytics 4, Facebook Business Manager, HubSpot, Hotmart, YouTube (when videos are viewed) and social media such as Facebook and Instagram (through plug-ins, if the data subject chooses to "share", "like", access or share content). For these services to operate correctly, data such as the IP address and browsing history may be collected.

For more information on the processing of Personal Data by these third parties, you can click on their name to consult their privacy policy. The Site does not control the Personal Data processing operations carried out by these third parties.

If you prefer to avoid the automatic processing of Personal Data through third-party services, you may log out of your social media account before using the website or change the privacy settings of the application.

The Site may process Personal Data through business partners, in accordance with the Privacy Notice or transfer agreements (with independent third-party controllers, authorized to transfer Personal Data) or transmission agreements (with processors acting on behalf of the Site).

Among the interactions that could result in the processing of Personal Data through third parties are:

(i) Service providers: Personal Data may be shared with third-party processors that provide services for the fulfillment of the purposes, such as user registration service providers, data analysis systems, messaging companies, payment gateways, organizations for fraud protection and credit risk reduction, advertising and marketing companies, among others.

To acquire the different services offered by the Site, user registration on third-party websites or platforms may be required. In this scenario, the Site does not control or administer these websites, and therefore the user must accept their terms and conditions, privacy policy and other terms. The Site is not responsible for the processing of Personal Data by such third parties.

Below are some of the third parties that may require authorization for the processing of Personal Data, together with their Privacy Policies:

• Hotmart: https://hotmart.com/es/legal/privacidad-de-datos
• Bukz: https://bukz.co/policies/privacy-policy
• HubSpot: https://legal.hubspot.com/privacy-policy

(ii) Independent third parties: we may transfer Personal Data to third parties, which will process the Personal Data in accordance with the Privacy Notice, this Policy and Colombian legislation. The transfer may occur with respect to third parties that provide payment processing services and make available the content indicated on the website.

(iii) Business transfers: the Site may consider selling or buying other entities, expanding and/or growing its business or services, or being acquired by third parties. In these scenarios, the Personal Data of users could be transferred, subject to the provisions and purposes set forth in the Privacy Notice and this Policy.

Personal Data will be processed for the following purposes:

General purposes

• Verify the identity of the data subject.
• Resolve inquiries, petitions, complaints or claims.
• Notify changes to our Terms and Conditions and Policies.
• Make possible the fulfillment of contractual obligations and legal duties.

Marketing and promotion

• Explain our products and services.
• Carry out marketing, advertising, loyalty, market segmentation and other similar activities.
• Recommend features and services, and identify preferences.
• Send information about our services by email, social media, website, mobile application, among others.
• Handle inquiries about our services.
• Send invitations to events and training sessions.
• Record comments and feedback about our products and/or services, which may be published on our website with the user's authorization.

Contractual management

• Provide access to the content, tools and services on our own websites.
• Process payments (through the payment gateway provided by a third-party processor, which will store the financial information, including the payment method, such as debit or credit card information).
• Send account statements or invoices arising from the contract.
• Handle support and customer service requests.
• Handle and resolve requests for warranty enforcement, payment reversal, exercise of the right of withdrawal and complaints and claims (PQR).
• Monitor compliance with contractual obligations, including restrictions on the use of the products or services.
• Send information relevant to the performance of the contract.

In relation to registration accounts created with partner third parties

• Give instructions to partner third parties regarding the blocking of, restriction of access to the products and services, or closure of the profile.
• Send general communications related to the contractual relationship, content or advertising.

Purchase of products and/or services

• Order processing, sending information about the order status, delivery of products and issuing of invoices.
• Collect information about purchase history and determine preferences in order to provide better information.
• Provision of after-sales services.

Internal management

• Collect information for commercial and marketing research purposes (consumption habits, preferences, purchase interest, product testing, concept, service evaluation, satisfaction).
• Develop new services.
• Carry out audits.
• Administer the security of systems and databases.
• Carry out financial and accounting management.
• Risk, statistical, commercial, control, oversight and marketing analysis.

Data subjects have the following rights with respect to the processing of their Personal Data:

a) Consultation

• Access free of charge their Personal Data that has been subject to processing, at least once every calendar month and each time there are substantial modifications to this Policy.
• Be informed regarding the processing of their Personal Data.
• Request proof of the authorization granted for the processing, except where it is exempt as a requirement.

b) Claims

• Update and/or rectify their Personal Data when it is partial, inaccurate, incomplete, fragmented or misleading.
• Revoke the authorization and/or request the deletion of their Personal Data, provided there is no legal or contractual obligation requiring its retention.
• Report the breach of any of the obligations of the Site or of third parties in relation to the processing of their Personal Data.
• File complaints with the Superintendencia de Industria y Comercio (Colombian Superintendence of Industry and Commerce) for infringements of the regulations in force on the protection of Personal Data.

9.1 Filing information

By electronic communication to the email info@columnavertebralmedellin.com, the data subject may contact the customer service area and make consultations or claims, providing the following information:

• Full name and identification.
• Proof of the capacity in which they act (as the data subject of personal data or on behalf of a third party).
• Contact details (email address and phone numbers).
• Reason(s) or fact(s) giving rise to the consultation or claim, with a brief description of the right to be exercised (access, know, update, rectify, request proof of authorization, revoke, delete, report non-compliance).
• The documents to be asserted.

9.2 Procedure for making consultations

Once the request is submitted, it will be analyzed to verify the identity of the data subject. If it is made by a person other than the data subject and representation is not proven, the request will be rejected.

All consultations will be handled within a maximum term of 10 business days from the day following the date of receipt. Where it is not possible to handle it within that term, the data subject will be informed, stating the reasons for the delay and indicating the date on which it will be handled, which may not exceed the 5 business days following the expiry of the first term.

9.3 Procedure for submitting claims

The data subject, their successors, representatives or attorneys-in-fact may make claims (correction, updating, deletion or breach of duties) according to the following procedure:

• Identity verification. If representation is not proven, the claim will be rejected.
• If the claim is incomplete, the Site will request the data subject to remedy the omissions within the following 5 days. After 2 months without remedy, the claim will be deemed abandoned.
• If the area receiving the claim is not competent, it will refer it within a maximum of 2 business days and inform the data subject.
• The maximum term to handle the claim will be 15 business days counted from the day following receipt. If it is not possible to handle it within that period, the data subject will be informed of the reasons and a new date will be indicated, which may not exceed the 8 business days following the expiry of the first term.

9.4 Exhaustion of the procedural requirement

Once the terms indicated have been met, the data subject whose rights are denied, in whole or in part, may bring the facts to the attention of the Superintendencia de Industria y Comercio (Colombian Superintendence of Industry and Commerce).

Personal Data will remain in the databases only for the time that is reasonable and necessary in accordance with the purposes that justify the processing, in the absence of a legal mandate, order of a competent authority or contractual obligation requiring its continuity. Likewise, deletion will be carried out once the data subject so requests, in the terms of this Policy: within the 15 business days following the request, extendable once for a maximum term of 8 business days.

For the automatic collection of Personal Data we use:

• Cookies (or browser cookies): a small file stored on the hard drive of the computer or mobile device. Unless the data subject has adjusted their browser or device settings to reject cookies, cookies will be stored when you use our website.
• Web beacons: our website and our emails may contain small electronic files (transparent GIFs, pixel tags) that allow counting users, verifying email openings, recording content popularity and verifying the integrity of the system and the server.
• Third-party cookies: our page may have links to third-party pages that use cookies (such as social media plug-ins: Facebook, Instagram, YouTube) or that collect Personal Data (such as Google Analytics).

Cookies can be blocked through the settings of the browser or mobile device ("help" option). However, if all cookies are blocked (including essential ones), it may not be possible to access all or part of our website.

To disable the use of third-party cookies, you can visit their websites to manage the use of these types of cookies or log out of social media. Regarding Google Analytics, preferences can be managed by clicking on the name. To prevent the use of cookies by the mobile application, you can uninstall it.

Upon entering the platform, the Site will provide the necessary information to allow accepting or rejecting the necessary, preference, statistical and marketing cookies, jointly or independently, so that they can be duly individualized by the data subject.

Purposes of the use of cookies and monitoring technologies

• Proper functioning of the website.
• Improve the content of the website.
• Collect information for commercial research and marketing.
• Establish and store usage preferences.
• Show advertisements on the website and on partner third-party sites.
• Recognize the data subject when they return to our website.
• Improve understanding of the website's activity.
• Speed up searches.
• Know consumption preferences regarding the products offered.
• Analyze the pages browsed and the searches performed, improve commercial and promotional initiatives, show advertising or promotions, banners of interest.
• Perfect the offering of content and articles, personalize such content, presentation and services, as well as promote and enforce the rules and security of the site.

The Site will have technical, physical and organizational security measures proportionate to the sensitivity and volume of the Personal Data processed, in order to maintain the security and confidentiality of the information.

The processing of Personal Data will be carried out in accordance with the principles of the Personal Data protection regime, including the restricted circulation of information: only Site personnel with functions related to the processing will have access to it.

This Privacy Policy is in effect as of November 3, 2024.

This Policy may be modified by the Site when required, provided that it does not involve modifications to the identity of the Site or the purposes of the processing. Modifications regarding the purposes of the processing must have the prior authorization of the data subject.

Schedule your virtual appointment via WhatsApp or email:

• Phone / WhatsApp: +57 316 523 6696
• Email: info@columnavertebralmedellin.com