Personal data processing policy
In force since 24 September 2026.
This is a courtesy translation. The Spanish version is the official text and prevails in case of any difference.
1. Data controller
Paul Alejandro Méndez Patarroyo, internist and rheumatologist, Colombian Medical Licence 79554568. Calle 126 # 7-26, Office 903 (Torre 126), Usaquén, Bogotá, Colombia. Email: doctor.paul.mendez.reumatologo@gmail.com. Phone and WhatsApp: +57 311 687 6727.
2. Data we collect
- Identification and contact data: name, identity document number, date of birth, mobile phone and email.
- Health data, which the law classifies as sensitive: diagnosis, answers to follow-up questionnaires, scores of disease activity, function and quality of life, and information recorded in the medical record.
3. Purposes
- To provide medical care and clinical follow-up of the disease.
- To record the information in the medical record, in accordance with Resolution 1995 of 1999 and other applicable regulations.
- To report the information required by the health authorities, such as the Cuenta de Alto Costo, where applicable.
- To contact the patient with appointment reminders, results and follow-up.
Data are not sold or used for commercial or advertising purposes.
4. Sensitive data
The data subject is not obliged to authorise the processing of sensitive data or to answer questions about them. Authorisation is explicit and is given by accepting the consent in the patient portal or at the office.
5. Rights of the data subject
- To access, update and correct their data.
- To request proof of the authorisation given.
- To be informed of the use made of their data.
- To withdraw authorisation or request deletion of their data, except where there is a legal duty to keep them, as is the case with the medical record.
- To file complaints with the Superintendencia de Industria y Comercio (the Colombian data protection authority).
- To access their data free of charge.
6. How to exercise your rights
Write to doctor.paul.mendez.reumatologo@gmail.com stating your name, identity document and request.
- Enquiries: answered within a maximum of 10 business days, extendable by 5 further business days.
- Claims: answered within a maximum of 15 business days, extendable by 8 further business days.
7. Security and processors
Information is kept with reasonable security measures and with access restricted to the treating physician. To run the portal, technology providers are used that act as data processors and may store information on servers outside Colombia: the website hosting (Netlify) and the storage of answers in a Google spreadsheet used exclusively by the office. These providers process the data only to deliver the service.
8. Term
This policy applies from its publication. Data will be kept for as long as the doctor–patient relationship exists and for the time the law requires for the medical record. Any significant change will be announced on this site.