PRIVACY AND PERSONAL DATA PROCESSING POLICY
At HERO, we are committed to protecting the privacy, security, and confidentiality of the personal information of our patients, users, suppliers, employees, contractors, and all other individuals who interact with us.
This Policy sets forth the guidelines governing the collection, use, storage, disclosure, transmission, transfer, and other processing of personal data by HERO, in accordance with Colombian Law 1581 of 2012, Decree 1074 of 2015, and all other applicable Colombian personal data protection regulations.
1. DATA CONTROLLERS
For the purposes of this Policy, the HERO Institute brand operates in Colombia through:
HERO INSTITUTE MEDELLÍN S.A.S.
Tax ID (NIT): 901163623-6
Carrera 25A # 1A Sur 45, Office 730
Medellín, Colombia
HERO INSTITUTE BOGOTÁ S.A.S.
Tax ID (NIT): 901231596-7
Calle 117 # 6 A 60, Office 509, Bogotá D.C., Colombia
Both companies may hereinafter be referred to collectively as “HERO.” Each company is responsible for the processing of personal data collected or managed in connection with its activities, without prejudice to the sharing, transmission, or transfer of information between them when necessary for authorized purposes and in accordance with applicable law.
For questions, requests, or complaints regarding privacy and personal data protection, please contact:
Email: info@heroinstitute.co
2. PERSONAL DATA WE PROCESS
Depending on the Data Subject’s relationship with HERO, we may collect and process identification and contact information, as well as administrative, financial, contractual, and commercial information.
When necessary for the provision of healthcare services, we may also process sensitive personal data, including health information, medical history, medical records, photographs, images, videos, and other clinical information.
HERO may also process images captured through video surveillance systems and, where applicable, biometric data used for identification, access control, or security purposes.
Health and biometric data are considered sensitive personal data and are subject to special protection under Colombian law.
3. PURPOSES OF DATA PROCESSING
HERO may process personal data, as applicable, to provide, manage, and follow up on medical and healthcare services; create, maintain, and manage medical records and other legally required records; manage appointments, consultations, procedures, treatments, follow-up visits, billing, and payments; and communicate with patients and users by telephone, email, WhatsApp, SMS, or other channels regarding their care.
Personal data may also be processed to handle requests, inquiries, complaints, and claims; comply with administrative, accounting, contractual, healthcare, regulatory, and legal obligations; and manage relationships with suppliers, contractors, employees, and other third parties associated with HERO.
HERO may also use personal data to provide information about its services, treatments, activities, educational content, news, and commercial or promotional communications, when the Data Subject has provided the required authorization.
Where legally applicable, Data Subjects may request at any time that their information no longer be used for commercial or promotional purposes, without affecting the provision of medical or healthcare services.
4. SENSITIVE DATA AND CLINICAL INFORMATION
HERO will process sensitive personal data only when necessary and when there is a lawful basis for doing so.
Whenever the Data Subject’s authorization is required for the processing of sensitive data, HERO will inform the Data Subject of the sensitive nature of such information and will obtain the appropriate explicit authorization in accordance with applicable law.
Information contained in medical records will be treated as confidential and handled in accordance with the specific regulations governing its custody, access, and confidentiality.
5. PHOTOGRAPHS, IMAGES, AND AUDIOVISUAL MATERIAL
Photographs, images, and videos obtained for clinical purposes may be used for medical documentation, evaluation, follow-up, and support of the patient’s care, subject to the applicable security and confidentiality requirements.
The use of photographs, images, videos, testimonials, or clinical cases for advertising, promotional, commercial, educational, scientific, institutional, social media, or public presentation purposes will be subject to the Data Subject’s appropriate authorization whenever required by law.
Authorization for advertising or promotional purposes may be obtained separately from the authorization required for medical care.
6. VIDEO SURVEILLANCE
HERO facilities are equipped with video surveillance systems for the purpose of protecting the safety and security of patients, visitors, employees, facilities, equipment, and other property, as well as preventing and investigating security incidents.
Images captured through these systems constitute personal data and will be processed solely for legitimate purposes related to the safety, security, and protection of individuals and property, unless they must be retained or disclosed in response to a request from a competent authority or for the establishment, exercise, or defense of legal rights.
HERO will display appropriate notices in areas subject to video surveillance informing individuals of the presence of cameras and the processing of their images.
7. DATA SHARING, TRANSMISSION, TRANSFER, AND THIRD-PARTY ACCESS
HERO may provide access to, transmit, or transfer personal data to service providers or other third parties when necessary for its operations and the provision of its services. These may include technology providers, information systems and data storage providers, laboratories, healthcare providers, financial institutions, payment processors, professional advisors, administrative service providers, and other third parties that legitimately participate in the authorized purposes described in this Policy.
Where appropriate, information may also be shared between HERO Institute Medellín S.A.S. and HERO Institute Bogotá S.A.S. for continuity of care, patient management, administrative processes, and other authorized purposes.
Third parties acting as data processors must use the information solely for the applicable purposes and comply with the corresponding security and confidentiality requirements.
HERO may also disclose information when required by law or by a competent authority.
8. DATA SUBJECT RIGHTS
In accordance with applicable Colombian law, Data Subjects have the right to:
- Access, update, and correct their personal data.
- Request proof of the authorization granted, where applicable.
- Obtain information about how their personal data has been used.
- Submit inquiries, requests, and complaints.
- Request deletion of their personal data or withdraw their authorization when legally permitted.
- File a complaint with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio – SIC) after completing the applicable complaint process with HERO.
Requests may be submitted to info@heroinstitute.co and should include sufficient information to identify the Data Subject and clearly describe the request or right being exercised.
9. SECURITY AND CONFIDENTIALITY
HERO implements reasonable administrative, technical, and organizational measures designed to protect personal data against loss, alteration, misuse, unauthorized access, disclosure, or circulation.
All individuals involved in the processing of personal information are subject to confidentiality obligations, including after their relationship with HERO has ended.
10. AUTHORIZATION, DATA RETENTION, AND EFFECTIVE DATE
Whenever required by law, HERO will obtain the Data Subject’s prior, express, and informed authorization for the processing of personal data and will retain evidence of such authorization.
Personal data will be retained for as long as necessary to fulfill the purposes for which it was collected and for any additional periods required under applicable medical, healthcare, contractual, accounting, regulatory, or legal requirements.
HERO may update this Policy as necessary to reflect legal, regulatory, technological, or operational changes. Material changes will be communicated through the appropriate channels.
