Personal data processing policy

1. Data controller

David Ricardo Baquero Zamarra, colon and rectal surgeon, medical license 79939421.

• Address: Calle 78B # 69-240, Tower B, office 142, Medellín, Colombia.
• Email: coloproctobaquero@gmail.com
• WhatsApp: +57 304 601 5053
• Website: coloproctobaquero.com

2. Data we collect

We only ask for the data needed to handle each request:

• Appointment form: first and last name, mobile number, preferred location and type of visit (first visit, follow-up or second opinion).
• WhatsApp, email or phone: the data a person chooses to share when contacting us, which may include health information.
• Browsing: the site does not use its own advertising or tracking cookies. Some third-party services embedded in the page (the Google Maps map and Google Fonts typefaces) may record technical data such as IP address or browser, under their own policies.

3. Sensitive data and data of minors

Health information is sensitive data. No one is required to provide it in order to request an appointment: the form does not ask for it, and if a person chooses to share it via WhatsApp or email, we will use it only to guide and prepare their care.

Data of children and adolescents is processed only with the authorization of their legal representative and in their best interest.

Medical records are governed by their own specific regulations (including Resolution 1995 of 1999 and Resolution 839 of 2017) and are kept by the institution where care is provided.

4. How we use the data

• To receive, manage and confirm appointment requests.
• To communicate with patients via WhatsApp, phone or email about their visit: confirmations, schedule changes, reminders and preparation instructions.
• To answer questions and requests sent through our contact channels.
• To comply with legal obligations and respond to requests from competent authorities.
• To send information about the office's services or news, only when the person has expressly authorized it. They may ask us to stop at any time.

We do not sell, rent or transfer personal data to third parties.

5. Tools that help us process data

To run the website and our contact channels we use providers that act as data processors. Some store information on servers outside Colombia, so by accepting this policy you authorize that international transfer:

• WhatsApp (Meta Platforms): receives form requests and patient messages.
• Formspree (United States): sends a copy of each form request to the office email.
• Gmail (Google): the office email.
• Hostinger: website hosting.

Each provider applies its own security measures and privacy policies.

6. Data subjects' rights

As a data subject, every person has the right to:

• Know, update and correct their personal data.
• Request proof of the authorization they granted.
• Be informed about how their data has been used.
• Revoke their authorization or request deletion of their data, when there is no legal or contractual duty to keep it.
• Access their personal data free of charge.
• File complaints with Colombia's Superintendence of Industry and Commerce for violations of the law, after first submitting an inquiry or claim to the data controller.

7. How to exercise your rights

Inquiries and claims should be sent to coloproctobaquero@gmail.com with the subject line «Personal data», including full name, ID number, the specific request and a way to reply. If the sender is a representative or attorney, they must attach the document that proves it.

• Inquiries: answered within ten (10) business days. If that is not possible, we will explain why and reply within the following five (5) business days.
• Claims (correction, update, deletion or non-compliance): answered within fifteen (15) business days, which may be extended by up to eight (8) more business days, explaining the reason. If a claim is incomplete, we will ask for the missing information within five (5) days; if two (2) months pass without a response, the claim will be considered withdrawn.

8. Security and retention

We apply reasonable technical and administrative measures to protect data against loss, unauthorized access, consultation or use: encrypted connection (HTTPS) on the website, restricted access to contact channels and use of well-established providers.

Data is kept only for as long as needed to fulfill the purpose for which it was collected and to meet applicable legal obligations. Appointment requests that do not lead to a visit are deleted once they are no longer needed.

9. Authorization and effective date

By checking the authorization box on the form, or by contacting us through any channel, the person gives prior, express and informed authorization for the processing of their data under this policy.

This policy is effective as of October 15, 2026. Any significant change will be published on this page with its new update date.