In compliance with Law 1581 of 2012, Articles 15 and 20 of the Colombian Constitution, and Decree 1377 of 2013, Dr. Felipe Estévez has created this document to outline the data processing policies designed to protect the rights of individuals regarding the use of their personal data, in accordance with the principles established by law.

This policy applies to all personal data provided directly by patients, employees, suppliers, contractors, and others who, for any reason, share their information with Dr. Felipe Estévez and his team.

Such information may be collected through physical, digital, or virtual means, including the website www.drfelipeestevez.com, social media platforms (Instagram, Facebook, WhatsApp, Messenger, etc.), applications (Skype, Gmail, email, etc.), and any other current or future digital tools used by the data owner for registration or communication purposes.

If deemed necessary, Dr. Felipe Estévez Trujillo may delegate the collection and/or processing of data to a third party—individual or legal entity—who must comply with all legal obligations regarding data protection, confidentiality, and proper handling. This delegation will be formally documented and signed between Dr. Estévez and the third party.

According to Article 3 of Law 1581 of 2012, the following definitions apply:

• Authorization: Prior, express, and informed consent of the data owner to process personal data.
• Database: An organized set of personal data subject to processing.
• Personal Data: Any information associated with one or more identifiable individuals.
• Data Processor: A person or entity that processes personal data on behalf of the data controller.
• Data Controller: A person or entity that decides how and why personal data are processed.
• Data Subject: The individual whose personal data are being processed.
• Processing: Any operation performed on personal data, such as collection, storage, use, circulation, or deletion.

Article 5 further defines:

• Sensitive Data: Refers to information that affects the privacy of the data subject or whose misuse could lead to discrimination. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in trade unions or social or human rights organizations, or information promoting political interests or parties. It also includes data related to health, sexual life, or biometric information.

According to Article 3 of Law 1266, the following additional definitions apply:

• Public Data: Data classified as public under the law or the Constitution, and any data not considered semi-private or private. Examples include data contained in public documents, legally finalized judicial rulings not subject to confidentiality, and information related to an individual’s civil status.
• Semi-private Data: Data that are not intimate, reserved, or public in nature, and whose disclosure may be of interest not only to the data subject but also to certain sectors or society in general, such as financial or commercial information.
• Private Data: Data of an intimate or confidential nature that are relevant only to the data subject.

This manual is governed by the following principles, as established in Article 4 of Law 1581 of 2012:

• Principle of Legality: Data processing must comply with the law and relevant regulations.
• Principle of Purpose: Processing must serve a legitimate purpose, as informed to the data subject.
• Principle of Freedom: Data may only be processed with the prior, express, and informed consent of the data subject, except where legally required.
• Principle of Accuracy: Data must be truthful, complete, up-to-date, verifiable, and understandable. Partial or misleading data are prohibited.
• Principle of Transparency: Data subjects have the right to access information about their personal data at any time.
• Principle of Restricted Access and Circulation: Personal data may only be processed by authorized individuals and may not be publicly available online unless access is technically restricted to authorized parties.
• Principle of Security: Appropriate technical, human, and administrative measures must be implemented to protect data from unauthorized access, loss, alteration, or fraud.
• Principle of Confidentiality: All individuals involved in data processing must maintain the confidentiality of personal information, even after their relationship with the organization ends.

The data provided and collected through any of the means previously mentioned will be used by Dr. Felipe Estévez and his team for the various purposes described below.

All data may be used in the following ways, except when the data subject or their legal representative voluntarily requests the revocation of authorization for data processing, or when the law restricts the use of sensitive or confidential data:

• General Use: To fulfill obligations undertaken with our clients, suppliers, and employees.
• Informative Use: To communicate, send, and/or receive—by any means, directly or through third parties—scientific and/or commercial information from Dr. Felipe Estévez, his team, or previously authorized third parties.
• Marketing: Dr. Felipe Estévez and his team, directly or through third parties, may design, implement, and develop marketing plans, promotions, offers, commercial policies, and service and/or product promotion projects previously authorized. Additionally, they may use data for the offering and recognition of benefits within our loyalty program.
• Advertising: Dr. Felipe Estévez and his team, directly or through third parties, may conduct marketing and advertising activities and send information regarding products and/or services offered by Dr. Felipe Estévez, his team, and/or authorized third parties.
• Brand Development: Dr. Felipe Estévez and his team, directly or through third parties, may distribute information aimed at strengthening the brand image of Dr. Felipe Estévez, his team, and/or authorized third parties.
• Data Sharing: Dr. Felipe Estévez and his team may share personal data or databases with third parties who assist, support, or carry out activities related to their own operations or commercial relationships with such third parties.
• Analysis: Dr. Felipe Estévez and his team may perform, directly or through third parties, statistical analyses, audits, market research, studies of consumer habits, surveys, and evaluations of products and/or services.
• Commercial Relations: Dr. Felipe Estévez and his team may, directly or through third parties, manage orders, payments, inventory control, product traceability, and the execution of agreements and contracts.
• Tax Purposes: Dr. Felipe Estévez and his team may, directly or through third parties, comply with tax obligations such as the preparation of receipts, invoices, tax returns, magnetic media, and any other legal fiscal requirements.

When information is provided by a patient to Dr. Felipe Estévez and his team, it will be considered sensitive data and will be governed by Law 1581 of 2012, respecting the principles of confidentiality and privacy as established in Law 23 of 1981, Decree 3380 of 1981, and Resolution 1995 of 1999.

General data such as name, identification, telephone, mobile number, email, age, gender, address, healthcare provider (EPS), emergency contact name and phone number, occupation, marital status, among others, may be processed in accordance with the provisions above, subject to the patient’s authorization, unless the data subject revokes such authorization.

The contents of the medical record will be safeguarded and maintained by Dr. Felipe Estévez and his team. However, it may be shared under the following circumstances:

1. When requested by a judicial authority, in which case no authorization from the data subject is required.
2. When necessary for the patient’s health, to share with the insurance company for the purpose of financial coverage, with prior authorization from the patient.
3. When necessary for the patient’s health, to share with the EPS, IPS, or clinic providing care, with prior authorization from the patient.
4. In all other cases provided for by law.

When information is provided by an employee to Dr. Felipe Estévez and his team as part of an employment relationship, it will also be considered sensitive data and governed by Law 1581 of 2012, respecting the principles of confidentiality and information privacy as established in Law 1755 of 2015.

General data such as name, identification, telephone, mobile number, email, age, gender, address, healthcare provider (EPS), emergency contact name and phone number, occupation, marital status, among others, may be processed as indicated above, with prior authorization from the employee, unless the data subject revokes such authorization.

The information provided by the employee through their résumé or employment application will be safeguarded and maintained by Dr. Felipe Estévez and his team. However, it may be shared under the following circumstances:

1. When requested by judicial, legislative, or administrative authorities acting within their legal powers, as stated in Article 27 of Law 1755 of 2015.
2. When there is express authorization from the employee who owns the information.
3. When the information is obtained through means unrelated to the existing employment relationship.
4. When shared with third parties for employment-related purposes, with prior authorization from the employee.

Cases Where Authorization Is Not Required

In accordance with Article 10 of Law 1581 of 2012, authorization is not required in the following cases:

1. When the information is required by a public or administrative entity in the exercise of its legal functions, or by judicial order.
2. For data of a public nature.
3. In cases of medical or health emergencies.
4. For processing authorized by law for historical, statistical, or scientific purposes.
5. For data related to the Civil Registry of Persons.

The owner of the personal data shall have the following rights regarding the personal data processed by Dr. Felipe Estévez and his team:

1. To know, update, and correct their personal data with Dr. Felipe Estévez Trujillo in his capacity as the data controller. This right may be exercised, among others, in relation to partial, inaccurate, incomplete, fragmented, or misleading data, as well as data whose processing is expressly prohibited or has not been authorized.
2. To request proof of the authorization granted to Dr. Felipe Estévez Trujillo, except in cases where such authorization is not required as a condition for data processing.
3. To be informed by Dr. Felipe Estévez Trujillo and/or his team, upon request, about the use that has been made of their personal data.
4. To file complaints with the Superintendence of Industry and Commerce for violations of the provisions set forth in Law 1581 of 2012 and other applicable regulations.
5. To revoke the authorization and/or request the deletion of their data.
6. To access their personal data free of charge that have been subject to processing.

Any information requested may be provided through physical mail, email, and/or any other means deemed appropriate, as long as the individual or legal entity has clearly demonstrated that they are the rightful owner of the data.

When processing data, the rights and best interests of children and adolescents shall be fully respected. The processing of personal data belonging to children and adolescents is strictly prohibited, except for data of a public nature and only when such processing meets the following parameters and requirements:

• It must respond to and respect the best interests of children and adolescents.
• It must ensure the protection of their fundamental rights.
• Once the above requirements have been met, the legal representative of the child or adolescent shall grant authorization, after the minor has exercised their right to be heard. The opinion of the minor shall be taken into consideration according to their maturity, autonomy, and ability to understand the matter.

All data controllers and processors involved in handling the personal data of children and adolescents must ensure that such data are used appropriately. For this purpose, the principles and obligations established in Law 1581 of 2012 and its regulatory decrees shall apply.

In accordance with this Personal Data Processing and Protection Policy, the following duties shall apply, without prejudice to any additional obligations established by law.

Therefore, the following responsibilities must be fulfilled:

Duties when acting as the Data Controller:

1. Request and retain, under the conditions set forth in this policy, a copy of the respective authorization granted by the data subject.
2. Clearly and sufficiently inform the data subject of the purpose of the data collection and of their rights arising from the authorization granted.
3. Provide information, upon the data subject’s request, regarding the use that has been made of their personal data.
4. Address inquiries and claims submitted within the timeframes and terms established in this policy.
5. Ensure compliance with the principles of truthfulness, quality, security, and confidentiality, as outlined in this policy.
6. Maintain information securely, under appropriate conditions to prevent its alteration, loss, unauthorized access, or fraudulent use.
7. Update information whenever necessary.
8. Correct personal data when appropriate.

Duties when processing personal data through a third-party data processor:

1. Provide the data processor only with personal data whose processing has been previously authorized.
2. Ensure that the information supplied to the data processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
3. Promptly communicate to the data processor any updates or changes regarding the data previously provided and adopt any necessary measures to ensure that the information remains current.
4. Inform the data processor in a timely manner of any corrections made to personal data so that the corresponding adjustments can be implemented.
5. Require the data processor at all times to uphold the same security and privacy standards applicable to the data subject’s information.
6. Notify the data processor when specific information is under dispute by the data subject, once a claim has been filed and until the respective process has been resolved.

Without prejudice to the exceptions established by law, the processing of the data subject’s personal information requires their prior and informed authorization, which must be obtained through any means that allows for subsequent verification or consultation. Likewise, the Data Processing Policy may be consulted at https://plasticsurgeonsincolombia.com/.

Since, prior to the implementation of this Data Protection Policy, certain personal data of patients, employees, suppliers, contractors, and/or other individuals already existed—data that, although not contained in a formal database, may be handled by Dr. Felipe Estévez Trujillo and his team—the corresponding authorization for the processing of such personal data shall be requested through any of the following means: email, text message, physical document, or website links.

An email will be sent to data subjects containing links that allow them to review the Data Processing Policy of Dr. Felipe Estévez Trujillo and his team, as well as the option to renew their authorization. It shall be understood that failure to respond will constitute acceptance of the processing of their personal data in accordance with this policy.

On social media platforms, a message will be sent to each person who makes contact, explaining that by initiating communication they accept the data processing policies, which can be reviewed at https://plasticsurgeonsincolombia.com/. This procedure is necessary since social media platforms do not allow publication of the policy in a format easily readable by users.

Dr. Felipe Estévez Trujillo and his team will use various mechanisms—such as digital or physical records, applications, or third-party platforms—to document and verify the authorization granted by the data subject.

The rights of data subjects established by law may be exercised by the following persons:

• By the data subject, who must sufficiently verify their identity through the means made available by Dr. Felipe Estévez Trujillo and/or his team.
• By the data subject’s successors or heirs, who must provide proof of such status.
• By the data subject’s legal representative and/or attorney, upon verification of their authority or power of attorney.
• The rights of children and adolescents shall be exercised by the persons legally authorized to represent them, in accordance with current law, and who can demonstrate such authority with the corresponding legal documents.

Inquiries: The data subjects or their successors may request access to the personal information of the data subject held in the databases or other records managed by Dr. Felipe Estévez Trujillo and/or his team, who will provide all the information contained in the individual record or any data linked to the identification of the data subject.

The inquiry may be submitted in writing or via email to cirugiaplastica@drfelipeestevez.com, including the following information: full name, valid identification number, contact address, email, telephone number, mobile number, and a copy of a valid identification document. The message must include a complete description of the inquiry, which will be answered within a maximum period of ten (10) business days from the date of receipt.

If it is not possible to respond within that period, the applicant will be informed of the reasons for the delay and the date on which the inquiry will be addressed. In any case, the additional response period may not exceed five (5) business days following the expiration of the initial period.

Claims: The data subject or their successors who consider that the information contained in a database should be corrected, updated, deleted, or that authorization for data processing should be revoked, may submit a claim to Dr. Felipe Estévez Trujillo and/or his team by email at cirugiaplastica@drfelipeestevez.com, following these rules:

• The claim must be submitted in writing, addressed to Dr. Felipe Estévez Trujillo, with the subject line “Database Claim”, and must include the following: full name, valid identification number, contact address, email, telephone number, mobile number, a copy of a valid identification document, and a detailed description of the claim.
• If the claim is incomplete, the claimant will be notified within five (5) business days of its receipt to correct the deficiencies. If two (2) months pass from the date of notification without the required information being provided, it shall be understood that the claimant has withdrawn the claim.
• If the person receiving the claim is not competent to resolve it, the claim will be forwarded to the appropriate party within a maximum of two (2) business days, and the claimant will be informed accordingly.
• Once the complete claim has been received, a note stating “Claim in Process” and indicating the reason for the claim will be included in the database within no more than two (2) business days. This note must remain in place until the claim is resolved.
• The maximum time frame to address a claim is fifteen (15) business days from the day following its receipt. If it is not possible to respond within that period, the claimant will be informed of the reasons for the delay and the date on which the claim will be resolved. In no case may this additional period exceed eight (8) business days following the expiration of the initial term.

Dr. Felipe Estévez Trujillo may transfer personal data to third parties, both national and international, for the purpose of processing such data, provided that a prior agreement has been established between the third party and Dr. Felipe Estévez Trujillo governing the handling of the personal information.

Dr. Felipe Estévez Trujillo has established a Personal Data Processing and Protection Policy, which is available on the website https://plasticsurgeonsincolombia.com/ and forms an integral part of this document.

Any questions or requests for additional information will be received and processed through the contact addresses provided in this Privacy Policy.

This Data Processing Policy has been in effect since September 26, 2022.

Dr. Felipe Estévez and his team may modify or update this policy whenever necessary to comply with new legal requirements or as deemed appropriate based on internal reviews or operational needs.

Consultation appointments can be scheduled in two ways: in-person or virtual.

If you choose an in-person consultation, please note that it will take place in the city of Bucaramanga.

If you choose a virtual consultation, you may attend from anywhere in the country or abroad, in case you are outside of Colombia.

For more information, you may contact us via WhatsApp at +57 310 2524820 or by email at citas@drfelipeestevez.com.