Personal Data Protection Policy

1. SCOPE

This Personal Data Protection Policy shall apply to all Databases and/or Files that contain Data Personal Data that are subject to processing by DR. JULIAN ZULUAGA, considered as responsible and/or in charge of the processing of Personal Data. processing of Personal Data.

2. IDENTIFICATION OF THE PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

DR. JULIAN ZULUAGA 26 Of. 727 of the city of Medellín, Colombia identified with Tax Identification Number Tax Identification Number NIT 901.137.860-5 E-mail: pacientes@drjulianzuluaga.com , telephone (+571) 300-3140575

3. DEFINITIONS

- Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of Personal Data. Personal Data.
- Privacy Notice: Verbal or written communication generated by the responsible party, addressed to the Data Subject for the processing of Personal Data, by means of which the Data Subject is informed about the existence of the applicable data processing policies, the way to access them and the purposes of the processing. the existence of the Information Processing Policies that will be applicable, the way to access them and the purposes of the Processing. Treatment intended to be given to the personal data.
- Data Base: Organized set of Personal Data that is subject to Processing.
- Personal Data: Any information linked or that can be associated to one or several natural persons, determined or determined or determinable.
- Sensitive Data: Information that affects the privacy of individuals or whose improper use can generate discrimination discrimination (Racial or ethnic origin, political orientation, philosophical or religious convictions, relevance to unions or social or human rights organizations, health social organizations or human rights, health, sex life and biometric data).
- Data Processor: Natural or legal person, public or private, who by itself or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller. In the events in which the Data Controller does not act as Data Processor, the Data Processor shall be expressly identified.
- Data Controller: Natural or legal person, public or private, who by himself or in association with others, is the person who others, decides on the Database and/or the Processing of the data.
- Terms and Conditions: general framework in which the conditions for the participants of activities are established. activities commercial or related activities.
- Data Subject: Natural person whose Personal Data is the object of Processing.
- Processing: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.
- Transfer: The transfer of data takes place when the Controller and/or Processor of personal data, located in Colombia, sends information or personal data to a recipient, which in turn is the recipient of the information or personal data. located in Colombia, sends the information or personal data to a recipient, which in turn is the Responsible and is located inside or outside the country.
- Transmission: Processing of Personal Data that involves the communication of such data within or outside the territory of the territory of the Republic of Colombia when its purpose is the performance of a Processing by the Processor on behalf of the Controller. Controller.

4. TREATMENT

DR. JULIAN ZULUAGA, acting in his capacity as Responsible for the Processing of Personal Data, for the adequate development of its commercial activities, as well as for the strengthening of its relationships with third parties, collects, stores, stores, stores and stores, uses, circulates and suppresses Personal Data corresponding to natural persons with whom it has or has had a relationship relationship, such as, but not limited to, employees and their relatives, shareholders, consumers, customers, clients, distributors, suppliers, creditors and debtors.

5. PURPOSE

Personal Data are processed by DR. JULIAN ZULUAGA for the following purposes:
5.1 Participation in different types of surveys through online registration or forms.
5.2 Completion of subscription applications, software orders and online services, or to facilitate the request for information that may be requested from us.
5.3 Make it easier for you to use our website.
5.4 Adapt the most relevant content to their interests.
5.5 Inform you of important news concerning DR. JULIAN ZULUAGA.
5.6 Inform you about our new products or services, product upgrades, technical support issues, and other support issues, events and special offers.
5.7 Promote products and services on our website and the websites of our business partners. partners.
5.8 Prevent and detect fraud or other illegal or prohibited activities.
5.9 To ensure the security and integrity of our Web Site.
5.10 As part of an ongoing sales process.
5.11 While providing technical support or consulting regarding any product.
5. 12 To be part of the maintenance and modernization process of our products.
5. 13 To be part of automated media such as communication protocols.

6. RIGHTS OF THE HOLDERS OF PERSONAL DATA

The natural persons whose Personal Data are processed by DR. JULIAN ZULUAGA, have the following rights, which may be exercised at any time:: The natural persons whose Personal Data are processed by DR. following rights, which may be exercised at any time:
6.1. To know the Personal Data on which DR. JULIAN ZULUAGA is processing. Likewise, DR. Likewise, the Data Subject may request at any time that his or her data be updated or rectified, for example, if he or she finds that his or her data is If you find that your data are partial, inaccurate, incomplete, fractioned, misleading, or those whose Processing is expressly Processing is expressly prohibited or has not been authorized.
6.2. Request proof of the authorization granted to DR. JULIAN ZULUAGA for the processing of your Personal Data.
6.3. Be informed by DR. JULIAN ZULUAGA, upon request, regarding the use that it has given to your Personal Data. Personal Data.
6.4. File before the Superintendence of Industry and Commerce complaints for infringements to the provisions of the Law of Personal Data Protection. Protection of Personal Data.

6. 5. Request DR. JULIAN ZULUAGA the suppression of your Personal Data and/or revoke the authorization granted for the treatment of the same, by submitting a claim, in accordance with the procedures established in the paragraph 11 of this Policy. However, the request for deletion of the information and the revocation of the authorization shall not authorization shall not proceed when the Data Subject has a legal or contractual obligation to remain in the the Database and/or Files, nor while the relationship between the Holder and DR. JULIAN ZULUAGA, by virtue of which the information was collected, is still in force. by virtue of which the data were collected.

6. 6. Access free of charge to your Personal Data subject to Processing.

7. AREA RESPONSIBLE FOR THE IMPLEMENTATION AND ENFORCEMENT OF THIS POLICY

Asuntos Legales SAS is responsible for the development, implementation, training and enforcement of this Policy. Policy. For this purpose, all employees who process Personal Data in the different areas of the company are responsible for the areas SAS, are obliged to report these databases to Legal Affairs and to inform the latter immediately, in accordance with the immediately, of all requests, complaints or claims received from Personal Data Holders. Legal Affairs has also been designated as the area responsible for the attention of petitions, queries, complaints and claims before which the Data Subject may claims before which the Owner of the information may exercise his/her rights to know, update, rectify, rectify and delete the data and revoke the suppress the data and revoke the authorization.

8. AUTHORIZATION

DR. JULIAN ZULUAGA must request prior, express and informed authorization from the Personal Data on which the processing is required to be carried out.
8.1. Prior authorization means, that the consent must be given by the Data Subject, at the latest, at the at the latest at of the collection of the Personal Data.
Express authorization means that the consent of the Data Subject must be explicit and concrete; the consent of the Data Subject is not valid. not valid open and non-specific authorizations are not valid. It is required that the Data Subject expresses his/her willingness to authorize DR. JULIAN ZULUAGA to process his/her Personal Data. This manifestation of the Holder's will may be given through different mechanisms made available by DR. JULIAN ZULUAGA, such as:
- In writing, for example, by filling out an authorization form as shown in Annex 1.
- Orally, for example, in a telephone conversation or videoconference.
- By unequivocal conduct that leads to the conclusion that you have given your authorization, for example, through your express acceptance of the Terms and Conditions of an activity that requires your authorization. express acceptance to the Terms and Conditions of an activity in which the authorization of the the authorization is required for the processing of their Personal Data. IMPORTANT: In no case shall DR. JULIAN ZULUAGA assimilate the silence of the Data Subject to an unequivocal conduct. Whatever the mechanism used by SAS, it is necessary that the authorization be kept in order to be consulted at a later date. consulted at a later date.
8.3. Informed Authorization means that at the moment of requesting the consent of the Data Subject, he/she should be clearly informed of the following clearly:
- The Personal Data that will be collected.
- The identification and contact details of the Data Controller and the Data Processor.
- The specific purposes of the intended Processing, i.e.: how and for what purpose the collection, use, circulation of Personal Data will be carried out. the collection, use and circulation of Personal Data, and
- Which are the rights that you have as a Personal Data Subject; for this purpose, please refer to section 6 of this Policy. Policy.
- The optional nature of the answer to the questions asked, when they deal with sensitive data. sensitive data or on the data of children and adolescents.

9. SPECIAL PROVISIONS FOR THE PROCESSING OF SENSITIVE PERSONAL DATA.

In accordance with the Personal Data Protection Law, sensitive data are considered to be data of a sensitive nature that are that affect privacy or whose improper use may generate discrimination, such as those related to:
- Racial or ethnic origin.
- Political orientation.
- Religious / philosophical convictions.
- Membership in trade unions, social organizations, human rights organizations or political parties.
- Health.
- Sex life.
- Biometric data (such as fingerprint, signature and photo).
- The Processing of Personal Data of a sensitive nature is prohibited by law, except with the express, prior and informed authorization of the prior, express and informed authorization of the Data Subject, among other exceptions set forth in Article 6 of the Law. Law 1581 of 2012. In this case, in addition to complying with the requirements established for authorization, DR. JULIAN ZULUAGA shall:
- To inform the Data Subject that since it is sensitive data, he/she is not obliged to authorize its processing.
- Inform the Data Subject which of the data to be processed are sensitive and the purpose of the processing. Processing. IMPORTANT: No activity may be conditioned to the provision of sensitive Personal Data by the Data Subject.

10. SPECIAL PROVISIONS FOR THE PROCESSING OF PERSONAL DATA OF CHILDREN AND ADOLESCENTS ADOLESCENTS

According to the provisions of Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013, SAS shall only will only carry out the Processing, that is, the collection, storage, use, circulation and/or deletion of Personal Data. Personal Data of children and adolescents, as long as this treatment responds to and respects the best interest of children and adolescents, as long as this treatment responds to and respects the best interest of children and adolescents. best interest of children and adolescents and ensures respect for their fundamental rights. Once the above requirements have been met, DR. JULIAN ZULUAGA shall obtain the Authorization of the legal representative of the child or adolescent. child, the child or adolescent, after the minor has exercised his or her right to be heard, an opinion that will be assessed taking into account the maturity, autonomy and maturity, autonomy and capacity to understand the matter.

11. PROCEDURE FOR ATTENTION AND RESPONSE TO REQUESTS, INQUIRIES, COMPLAINTS AND CLAIMS OF THE HOLDERS OF PERSONAL DATA

Data subjects of Personal Data that is being collected, stored, used, circulated, used, circulated by by DR. JULIAN ZULUAGA, may at any time exercise their rights to know, update, rectify and suppress their information and revoke the authorization. For this purpose, the following procedure shall be followed, in accordance with the Personal Data Protection Law:
11.1. ATTENTION AND RESPONSE TO PETITIONS AND INQUIRIES: What does the procedure consist of? The Holder or his/her assignees may request DR. JULIAN ZULUAGA, through the means indicated below: 11.2. below:
- Information about the Personal Data of the Data Subject that are subject to Processing.
- Request proof of the authorization granted to DR. JULIAN ZULUAGA for the processing of your Personal Data.
- Information regarding the use given by DR. JULIAN ZULUAGA to your personal data. Means available for the submission of requests and inquiries: DR. JULIAN ZULUAGA has provided the following means for the reception and attention of requests and queries, all the which allow us to keep proof of the same:
- Communication addressed to DR. JULIAN ZULUAGA, Carrera 38 # 26 - 17 Bio 26 Of. 727 in the city of Medellín.
- Request submitted to e-mail: pacientes@drjulianzuluaga.com Attention and response by DR. JULIAN ZULUAGA: Requests and inquiries will be answered within a maximum term of ten (10) working days from the date of receipt of the same. If it is not possible to respond to the request or consultation within such term, the will inform the the interested party, stating the reasons for the delay and indicating when the request or consultation will be attended to, which in no case shall be no This may in no case exceed five (5) working days following the expiration of the first term. 11.2. ATTENTION AND RESPONSE TO COMPLAINTS AND CLAIMS: What does the process consist of? The Holder or his/her assignees may request DR. JULIAN ZULUAGA, by means of a complaint or claim submitted through the channels indicated below:
- The correction or updating of the information.
- The deletion of your Personal Data or the revocation of the authorization granted for the processing of the same. them.
- That the alleged failure to comply with any of the duties contained in the Law for the Protection of the Rights of of Personal Data Protection Law. The request must contain a description of the facts that give rise to the complaint or claim, the address and contact information of of The request must contain a description of the facts giving rise to the complaint or claim, the address and contact details of the applicant, and must be accompanied by the documents to be asserted. Means authorized for the presentation of complaints and claims: DR. JULIAN ZULUAGA has arranged the following means for the reception and attention of complaints and claims, all of which which allow to keep proof of their presentation:
- Communication addressed to DR. JULIAN ZULUAGA, Carrera 38 # 26 - 17 Bio 26 Of 727 in the city of Medellín.
- Request submitted to e-mail: pacientes@drjulianzuluaga.com Attention and response by DR. JULIAN ZULUAGA: If the complaint or claim is submitted incomplete, DR. JULIAN ZULUAGA shall require the interested party within five (5) business days to submit the complaint or claim. (5) days following the receipt of the complaint or claim to correct the faults. After two (2) months from the date of the request, if the applicant does not submit the required information, DR. required information, it will be understood that the complaint or claim has been withdrawn. The maximum term to address the complaint or claim shall be fifteen (15) business days from the day following the date of its receipt. following the date of receipt. When it is not possible to attend to the complaint or claim within such term, the interested party will be the interested party will be informed of the reasons for the delay and the date on which the complaint or grievance will be addressed, which in no case shall no (8) working days following the expiration of the first term.

12. INFORMATION OBTAINED PASSIVELY

When accessing or using the services contained within DR. JULIAN ZULUAGA's websites, DR. JULIAN ZULUAGA may collect information passively through technologies for information management, such as "cookies", to "cookies", through through which information is collected about the hardware and software of the equipment, IP address, type of browser, operating system, name of the browser, operating system, domain name, access time and the addresses of the web sites from which they originate. addresses of the originating websites; through the use of these tools, Personal Data of the users is not collected directly. We will also information will also be collected about the pages that the individual visits most frequently on these websites for the purposes of in order to to know their browsing habits. Nevertheless, the user of DR. JULIAN ZULUAGA's web sites has the possibility to configure the functioning of the "cookies", according to the options of his or her Internet browser.

13. SECURITY OF PERSONAL DATA

DR. JULIAN ZULUAGA, in strict application of the Principle of Security in the Processing of Personal Data, will provide the technical, human and administrative measures that are necessary to provide security to the personal records avoid adulteration, loss, consultation, use or unauthorized or fraudulent access. The obligation and responsibility of SAS is limited to having the appropriate means for this purpose. DR. JULIAN ZULUAGA does not guarantee the security total security of information nor is it responsible for any consequence derived from technical failures or improper access by the user. by by third parties to the Database or File in which the Personal Data subject to Processing by DR. by DR. JULIAN ZULUAGA and its Agents. DR. JULIAN ZULUAGA shall require the service providers it hires, to adopt and comply with the technical adoption and compliance with the appropriate technical, human and administrative measures for the protection of the Personal Data in relation to which such Personal Data in relation to which such suppliers act as Agents.

14. TRANSFER, TRANSMISSION AND DISCLOSURE OF PERSONAL DATA

DR. JULIAN ZULUAGA may disclose to its related companies worldwide, the Personal Data on which it carries out the processing, for its use and treatment in accordance with this Policy for the Protection of Personal Data. Data Protection Policy. Likewise, DR. JULIAN ZULUAGA may disclose Personal Data to third parties not related to DR. JULIAN ZULUAGA when: 1. they are contractors in execution of contracts for the development of DR. JULIAN ZULUAGA's activities;
2. By transfer to any title of any line of business to which the information relates. In any case, in the contracts for the transfer of Personal Data signed between DR. JULIAN ZULUAGA and the Data Processors, it shall be required that the information be treated in accordance with the present terms and conditions. Responsible for the Processing of Personal Data, it shall be required that the information be processed in accordance with this Policy. Policy Personal Data Protection Policy and shall include the following obligations on the head of the respective processor:
- To treat, on behalf of DR. JULIAN ZULUAGA, the Personal Data in accordance with the principles that protect them.
- Safeguard the security of databases containing Personal Data.
- Keep confidentiality with respect to the processing of Personal Data.

1 5. APPLICABLE LAW

This Personal Data Protection Policy, the Privacy Notice and the Authorization Form that is part of this Privacy Policy, the Privacy Notice and the Authorization Form that is part of this of this Policy, are governed by the provisions of the current legislation on the protection of Personal Data to which this Policy referred to referred to in Article 15 of the Political Constitution of Colombia, Law 1266 of 2008, Law 1581 of 2012, Decree 1266 of 2008, Law 1581 of 2012, the Decree 1377 of 2013, Decree 1727 of 2009 and other regulations that modify, repeal or replace them.

1 6. VALIDITY

This Personal Data Protection Policy is effective as of April 20, 2021.