Data Processing Policy

1 · Data controller

Name

Daniel Ramos Hernández

Capacity

Individual practitioner — plastic surgeon

Address

Bogotá D.C., Colombia

Email

hello@drdanielramos.co

Phone / WhatsApp

+57 310 811 4609

Digital channels

bodybogota.com · bodybogota.co

2 · Definitions

The definitions in Article 3 of Law 1581 of 2012 apply:

Authorisation

The data subject's prior, express and informed consent to the processing.

Database

An organised set of personal data subject to processing.

Personal data

Any information linked to, or which can be associated with, one or more identified or identifiable natural persons.

Sensitive data

Data affecting the data subject's privacy, or whose misuse could lead to discrimination — including data concerning health.

Processor

Whoever processes the data on the controller's behalf.

Controller

Whoever decides on the database and its processing.

Data subject

The natural person whose data is processed.

Processing

Any operation on personal data: collection, storage, use, circulation or deletion.

3 · Data processed

• Identification and contact. Full name, email address, telephone number with country code, and country of residence.
• Enquiry data. The procedure of interest selected, and any free-text message the data subject chooses to write.
• Browsing data. Approximate IP address, browser and device type, pages visited, and referral source.

4 · Sensitive data — express notice

5 · Purposes of processing

• Receiving, handling and answering the consultation request or enquiry submitted.
• Contacting the data subject by email, telephone call or WhatsApp regarding that enquiry.
• Sending information about the procedure enquired about and about the consultation process.
• Scheduling, confirming and following up consultation appointments.
• Producing aggregated, anonymous statistics on site usage for improvement purposes.
• Complying with any legal obligations applicable to the controller.

Data is not used for third-party marketing, and is never sold, rented or transferred for commercial purposes.

6 · Rights of the data subject

Under Article 8 of Law 1581 of 2012, the data subject has the right to:

1. Access, update and correct their personal data held by the controller. This right may be exercised in respect of, among others, partial, inaccurate, incomplete or fragmented data, data that is misleading, or data whose processing is expressly prohibited or has not been authorised.
2. Request proof of the authorisation granted to the controller, except where the law provides otherwise.
3. Be informed, upon request, of the use made of their personal data.
4. File complaints with the Superintendency of Industry and Commerce for breaches of the law, once the enquiry or complaint procedure before the controller has been exhausted.
5. Withdraw the authorisation and request deletion of the data where the processing does not respect constitutional and statutory principles, rights and guarantees.
6. Access their processed personal data free of charge.

7 · Duties of the controller

The controller undertakes, among the duties listed in Article 17 of Law 1581 of 2012, to: guarantee the data subject's full exercise of their rights; request and keep a copy of the authorisation; properly disclose the purposes of processing; keep the information under security conditions preventing tampering, loss, unauthorised consultation or access; update and correct data where appropriate; handle enquiries and complaints within the statutory deadlines; and report security breaches to the authority.

8 · Who handles requests

Enquiries, complaints and requests to update, correct or delete data, or to withdraw authorisation, are handled directly by the controller:

hello@drdanielramos.co
Suggested subject line: "Data protection"

9 · Enquiry procedure

Data subjects or their successors may enquire about the personal information held in the controller's databases, and will be provided with all information contained in the individual record or linked to the data subject's identification.

The enquiry will be answered within a maximum of ten (10) business days from the date of receipt. Where it is not possible to answer within that period, the interested party will be informed of the reasons for the delay and the date on which the enquiry will be answered, which in no case may exceed five (5) business days after the expiry of the first period.

10 · Complaint procedure

A data subject who considers that information held in a database should be corrected, updated or deleted, or who becomes aware of an alleged breach of the controller's statutory duties, may file a complaint, handled as follows:

1. The complaint is made by a request addressed to the controller, identifying the data subject, describing the facts giving rise to the complaint, giving a notification address and attaching any supporting documents.
2. If the complaint is incomplete, the interested party will be asked within five (5) days of receipt to remedy the deficiencies. If two (2) months pass from that request without the required information being provided, the complaint will be deemed withdrawn.
3. If the recipient of the complaint is not competent to resolve it, it will be forwarded to whoever is, within a maximum of two (2) business days, and the interested party will be informed.
4. Once a complete complaint is received, a note reading "complaint in progress" and its reason will be added to the database within no more than two (2) business days. That note remains until the complaint is decided.
5. The maximum period to resolve the complaint is fifteen (15) business days from the day after receipt. Where that is not possible, the interested party will be informed of the reasons for the delay and the date of resolution, which in no case may exceed eight (8) business days after the expiry of the first period.

11 · Prior-exhaustion requirement

Under Article 16 of Law 1581 of 2012, a data subject or successor may only file a complaint with the Superintendency of Industry and Commerce once the enquiry or complaint procedure before the controller has been exhausted.

12 · Authorisation: obtaining, proof and withdrawal

Authorisation is obtained in advance, expressly and on an informed basis, through a non-pre-ticked consent checkbox on the contact form linking to this policy and to the Privacy Policy. When the form is submitted, the exact date and time at which authorisation was granted are recorded, constituting proof that it exists.

The data subject may withdraw authorisation or request deletion of their data at any time by writing to hello@drdanielramos.co, following the complaint procedure in section 10. Withdrawal does not apply where a legal or contractual duty requires the data subject to remain in the database.

13 · International transfer

To operate the site and receive enquiries, the controller relies on the following processors, whose servers are located outside Colombia, principally in the United States:

Formspree

Receives and forwards contact form submissions.

Hostinger

Website hosting and server technical logs.

Google

Search Console and aggregate usage analytics.

The transfer is based on the data subject's express authorisation, under Article 26(a) of Law 1581 of 2012.

14 · Security measures

The controller adopts reasonable technical, human and administrative measures to protect the information: HTTPS encryption on both domains, two-step verification on the receiving mailbox, restricted access to enquiries, and periodic review of processors. In the event of a security incident compromising personal data, the data subject and the Superintendency of Industry and Commerce will be informed.

15 · National Database Registry

Registration of databases with the Superintendency of Industry and Commerce is mandatory for companies and non-profit entities with total assets exceeding 100,000 UVT, and for public legal entities, under Decree 1074 of 2015. The controller under this policy is an individual and therefore does not fall within the entities required to register.

16 · Term

This policy is in effect from 3 September 2026. Databases will be retained for as long as the purpose that justified their collection subsists and the applicable statutory periods run, and in any event for a maximum of five (5) years from the last contact with the data subject, unless a legal obligation imposes a different period — as is the case for medical records, which are governed by Colombian health regulations.

Any substantial amendment will be published at this same address, stating its effective date.