CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., has the infrastructure and organization, technological and physical platform necessary to guarantee the correct and suitable treatment of the information and personal data and sensitive data, as well as the confidentiality necessary for the exercise of the rights of the holders contained in the Constitution and the Law, and to a greater extent to allow the knowledge, updating, rectification and suppression of personal information, and to achieve excellence in the provision of health services and in general in the development of the corporate purpose of the CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S.. For such purpose and treatment of personal data of the different owners, CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. has established the following policies:

CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. has the necessary means to provide a correct treatment of personal data and sensitive data, guaranteeing the confidentiality of the same except in the cases exempted by the Law, avoiding the access to the information by unauthorized third parties.

2. The information requested by CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. to its owners will be the necessary to guarantee the provision of the health service, manage the health risk and in general to comply with its corporate purpose and the rules that regulate the General System of Social Security in Health. The required sensitive data will be freely and voluntarily provided by the owners of the information, and its treatment may only be carried out with the authorization of the owner, except in the cases provided by law.

3. CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. will ensure strict compliance with the fundamental rights of minors, and the processing of their data will require prior authorization from their representatives; in no case will CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. disregard the best interests of the minor.

1 PRINCIPLES APPLICABLE TO THE PROCESSING OF YOUR PERSONAL DATA
During the time we process your personal data, we will ensure the application of the general principles set forth in the PERSONAL DATA PROTECTION LAW:

Legality Principle: The processing of personal data is a regulated activity and must obey a legitimate purpose, therefore, we will comply with the provisions of the PERSONAL DATA PROTECTION LAW and other provisions that develop it.

Principle of Purpose: We will apply treatment to your personal data always obeying a legitimate purpose which will be previously informed to the holder.

Principle of Freedom: We will treat your personal data when we have the prior, express and informed consent of the owner. The holder may, in any case, refuse the processing of sensitive data.

Truthfulness or Quality Principle: The personal data we will process must be truthful, complete, accurate, updated, verifiable and understandable.

Principle of Transparency: we guarantee that at any time and without restriction, you can obtain information about the existence of the data concerning you.

Principle of Access and Restricted Circulation: we commit that the processing of your personal data will be carried out by entities or third parties that you have authorized and/or by the persons provided for in the PERSONAL DATA PROTECTION LAW. Personal data may not be available on the Internet or other means of mass dissemination or communication, except that access is technically controllable to provide restricted knowledge only to owners or authorized third parties.

Security Principle: The information subject to treatment by us will be handled with the technical, human and administrative measures necessary to provide security to the records, avoiding its adulteration, loss, consultation, use or unauthorized or fraudulent access.

Confidentiality Principle: We are committed that the persons involved in the processing of your personal data that are not public, will be obliged to ensure the confidentiality of the information, even after the end of their relationship with any of the tasks that comprise the treatment, and may only make provision or communication of personal data when it corresponds to the development of authorized activities.

Principle of Accountability: This principle is based on the approach of recognition and commitment of organizations to increase the standards of protection in order to ensure and guarantee individuals an adequate treatment of their personal data. This principle entails an obligation for us to be accountable for our personal data protection activities, to accept responsibility for them and to disclose the results in a transparent manner.
2 PURPOSE OF INFORMATION PROCESSING
The purposes of the treatment of information of its Users will be the following:
2.1 For the provision of health care services to its users, family members and guardians.
For the Registration of Images and Diagnostic Tests.
Identification and updating of user data.
To process authorizations for health services required by users.
Manage users' medical orders and medications.
Characterization, monitoring, population identification and risk management.
The assignment and/or reassignment of appointments, collection and recovery of accounts receivable, information and other operations related to the General Social Security Health System.
Compliance with the obligations of the General Social Security Health System.
Evaluation of early warning indicators, timeliness and quality of products and services provided.
Exercise legal actions and in the defense of the same.
Reporting of information to the different stakeholders of the General Social Security Health System, in compliance with legal requirements and/or current regulations.
Provision of information to the competent authorities when required.
Personal Data Update Campaigns, and Information on Changes in the policies for the Treatment of Personal Data.
To make known the different services and products offered by the IPS, to advertise them, and in general to maintain contact with users through any means of communication (written and/or electronic), in order to advance any necessary procedure for the development of the corporate purpose of CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S.
Any other operation necessary for the development of the corporate purpose of CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. according to its nature.
2.2 The purposes of the processing of information from its Suppliers and Providers shall be the following:
Identification of them, as well as measurement of need, timeliness and quality of the products and services provided by them.
To carry out the contractual linkage.
To carry out the economic recognition for the provision of the service.
Provision of information to the competent authorities when required.
Exercise legal actions and in the defense of the same.
Comply with legal requirements

The purposes of the processing of information of its Shareholders shall be the following:
To carry out any notation or operation related to the quality of shareholder.
Attending to service and shareholder service tasks.
To comply with any of the obligations contracted with our shareholders. To inform our shareholders about any relevant situation regarding the products or services offered by our Clínica.
Prevent, detect and control any activity or information that could be interpreted as fraud, unfair treatment or breach of confidentiality.
Any other operation necessary for the development of the corporate purpose of CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. according to its nature.
2.3 The purposes of the processing of information of its Employees shall be the following:
Carrying out the selection process of personnel according to their suitability for a position or task.
Establish a contractual relationship.
Biometric data will be used for authentication and attendance control purposes.
Provide you with training opportunities.
Performance evaluations, job satisfaction, personal growth, well-being, safety and health at work.
Comply with the process of affiliation to the General System of Integral Social Security (Health Promoting Entities, Labor Risk Administrators, Pension and Severance Funds, Family Compensation Fund).
To carry out the Remuneration process.
Exercise legal actions and in the defense of the same.
Comply with judicial requirements.
To inform about the institution's progress in research, academic and clinical aspects.
Provision of information to the competent authorities when required.
In general, for any other purpose arising from the contractual relationship.
The images and sounds captured by the security cameras are exclusively for the security of users, collaborators and visitors in general.
Any person involved in the processing of personal data and sensitive data, and whose responsibility lies with CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., have the obligation to ensure the confidentiality of the information, even if they no longer have any kind of relationship with this IPS.
3 TREATMENT OF SENSITIVE DATA
We will only process sensitive personal data for what is strictly necessary, requesting prior and explicit consent from the owners (legal representatives, proxies, assignees) and informing them about the exclusive purpose for its processing. We will process sensitive data in the following circumstances:

The processing has been expressly authorized by the owner of the sensitive data, except in cases where, by law, the granting of such authorization is not required.
The treatment is necessary to safeguard the vital interest of the holder and he/she is physically or legally incapacitated. In these events, the legal representatives must grant authorization.
The processing relates to data that are necessary for the recognition, exercise or defense of a right in legal proceedings;
The treatment that has a historical, statistical or scientific purpose or, within the framework of improvement processes; the latter, as long as the measures leading to the suppression of the identity of the owners are adopted or the data is dissociated, that is, the sensitive data is separated from the identity of the owner and is not identifiable or it is not possible to identify the owner of the data or sensitive data.

In addition to the foregoing, we comply with the following obligations:

To inform that since it is sensitive data, you are not obliged to authorize its treatment.
Inform explicitly and in advance, in addition to the general requirements of authorization for the collection of any type of personal data, which data subject to processing are of a sensitive nature, the purpose applied, and obtain their explicit consent.
Do not make any activity conditional on you providing us with sensitive personal data (unless there is a legal or contractual reason to do so).
4 DUTIES WITH THE HOLDERS
The holder of the personal data and sensitive data will have the following rights, which will be respected and guaranteed by CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. in its capacity as Responsible for the treatment of this information:

To know, update and rectify their personal data before CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose processing is expressly prohibited or has not been authorized.
Request proof of the authorization granted to CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. except when expressly exempted as a requirement for the Processing.
Be informed by CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., upon request, regarding the use that has been made of your personal data.
File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it;
To revoke the authorization and/or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that, in the treatment CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. has incurred in conduct contrary to this law and the Constitution;
Access free of charge to your personal data that have been subject to Processing.
4.1 DUTIES OF CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S.
CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., in its capacity as responsible for the processing of personal data and sensitive data, shall have the following duties:

Guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data.
Request and keep, under the conditions set forth in the Law, a copy of the respective authorization granted by the Holder.
Duly inform the Data Subject about the purpose of the collection and the rights he/she has by virtue of the authorization granted.
Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access, and to guarantee its confidentiality and integrity.
Keep the information updated, requiring the holder if necessary. And rectify the information when it is incorrect.
To process queries and claims made by the owners or their representatives under the terms set forth in this Processing Policy.
Inform upon request of the Data Subject about the use given to their data.
Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the Data Holders.
Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.
5 DO NOT REQUIRE AUTHORIZATION
The authorization of the owners of the information will not be necessary in the following cases:

Information required by a public or administrative entity in the exercise of its legal functions or by court order.
Data of a public nature.
Cases of medical or sanitary emergency.
Processing of information authorized by law for historical, statistical or scientific purposes.
Data related to the Civil Registry of Persons.
6 CLAIMS AND PETITIONS
The owners of the information or their representatives may request and consult the personal data and sensitive data that CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. has in its databases and files. The Information Security area, headed by the Personal Data Protection Officer, as responsible for the development and processing of the exercise of the rights of the owners, will attend and manage any request through the e-mail [email protected] or through the customer service line: Ibagué: (8) 2772055 EXT. 1052. They may also do so at the Information Security Office.

The collaborators and employees of CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. may manage requests and claims related to personal data and sensitive data through the personal data protection officer.
6.1 Content of the petition or claim:
The request of petition or claim of the holder about personal data and sensitive data shall contain the following information:

Identification of the Holder (Names, surnames and identification number).
Location data of the owner (address and telephone number).
Description of the facts giving rise to the request or claim and supporting documents and/or evidence.
Signature of the holder or his/her representative (if acting through a representative, attach power of attorney or special authorization).
6.2 CONSULTATION
The Data Controllers or their successors in title may consult the personal information of the Data Controller contained in any database or files of CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., who will provide them with all the information contained in the individual record or that is linked to the identification of the Data Controller.

The consultation will be answered within a maximum term of ten (10) working days from the date of filing the same, once compliance with the above requirements has been verified. When it is not possible to attend the consultation within such term, the holder will be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term.
In case of disagreement with the answer provided by CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., the holder or his representative may make a new request for consultation, indicating the reasons for disagreement.
6.3 CLAIMS
The Data Subject or his or her assignees who consider that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012 or any concordant regulation, may file a complaint with

CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., which will be processed under the following rules:

The claim shall be formulated by means of a request addressed to CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., meeting the minimum requirements established in this policy. If the claim is incomplete, the interested party will be required within five (5) days following the receipt of the claim to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been abandoned.
In the event that CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S. is not competent to resolve it, it will transfer it to the corresponding person, provided that he/she is identifiable, within a maximum term of two (2) business days and will inform the interested party of the situation.
Once the complete claim has been received, a legend will be included in the database stating "Under Management" and the reason for the claim, within a term no longer than two (2) business days. Said legend shall be maintained until the claim is decided.
The maximum term to address the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within such term, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
In accordance with the provisions of Article 16 of Law 1581 of 2012, the holder or his representative may only go before the Superintendence of Industry and Commerce once he has exhausted the present complaint process before CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S.
7 VALIDITY
This Information Processing Policy of CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S., is in force as of December 26, 2019 and will be subject to the purposes of the processing of personal data and sensitive data proper to the corporate purpose and the nature of CLÍNICA INTERNACIONAL DE ALTA TECNOLOGÍA CLINALTEC S.A.S.