Personal data processing policy

1. Data controller

Dr. Santiago Delgado — Medellín Hair Transplant, Medical License RM 1017247216.

• Address: Torre Médica Clínica Buonavitta, Suite 602, Avenida San Juan at Calle 80, Medellín, Colombia.
• Email: info@medellinhairtransplant.com
• Phone and WhatsApp: +57 310 373 8733

2. Data we collect

Through the contact form, WhatsApp, medical consultation and the clinical record we may collect: full name, country of residence, phone or WhatsApp number, email address, and data related to the holder's hair health, including medical history and clinical photographs.

3. Sensitive data

Health data is sensitive data under Law 1581 of 2012. Providing it is optional and it is only processed with the holder's express authorization, for the purposes of medical assessment, diagnosis, treatment planning and follow-up. Clinical photographs are only published with the patient's additional, express, written authorization.

4. Purposes of processing

• Scheduling and managing assessments, consultations and medical procedures.
• Creating and safekeeping the clinical record as required by Colombian regulations.
• Responding to information requests and maintaining communication with the patient.
• Coordinating care for international patients (virtual assessment and scheduling).
• Complying with legal, accounting and health obligations.

5. Rights of the data holder

As data holder you have the right to: know, update and rectify your data; request proof of the authorization granted; be informed about how your data is used; file complaints with the Colombian Superintendence of Industry and Commerce (SIC); revoke authorization and request deletion of your data where no legal or contractual duty prevents it; and access your data free of charge.

6. How to exercise your rights

You may exercise your rights by writing to info@medellinhairtransplant.com or via WhatsApp at +57 310 373 8733, stating your name, the right you wish to exercise and the facts supporting your request. Queries are answered within 10 business days and claims within 15 business days, as required by law.

7. Security and retention

We adopt reasonable technical, human and administrative measures to protect information and prevent its alteration, loss, or unauthorized access. Clinical records are retained for the periods required by Colombian health regulations; other data, for as long as necessary for the purposes described.

8. Validity and changes

This policy is effective as of its publication and may be updated. Any substantial change will be published on this same page.