Personal Data Processing and Protection Policy

 I.  OBJECTIVE

In compliance with the provisions of Statutory Law 1581 of 2012 and Regulatory Decree 1377 of 2013, GSMED S.A.S. adopts this Personal Data Processing and Protection Policy, the contents of which will be made known to all Data Subjects whose data has been collected or may be obtained in the future in the course of business or employment activities. 

In this way, GSMED S.A.S. states that it guarantees the rights to privacy, confidentiality, and reputation in the processing of personal data, and consequently, all its actions will be governed by the principles of legality, purpose, freedom, accuracy or quality, transparency, access and restricted circulation, security and confidentiality.

II.  IDENTIFICATION OF THE DATA CONTROLLER

 

III.  SCOPE

The purpose of this Policy is to be implemented and applied by GSMED S.A.S. in all its processes, subprocesses and/or lines of business. Its scope includes workers, third parties, contractors and persons linked through agreements, provided that information related to personal data is handled.

This Policy will be applicable in internal procedures of a contractual, commercial, financial, corporate, administrative, accounting, tax, labor nature, as well as in the security systems and control of entry and exit of personnel.

All persons who, in the course of carrying out different contractual, commercial, labor, among others, permanent or occasional activities, come to provide GSMED S.A.S. with any type of information or personal data, may know, update, rectify and delete such information, under the terms provided in this Policy.

IV.  DEFINITIONS

V.  PRINCIPLES OF PERSONAL DATA PROCESSING

For the Processing of Personal Data, GSMED will apply the following principles:

5.1. Principle of legality: The Processing of Personal Data shall be subject to the provisions of the applicable laws in Colombia and other regulations that develop them.

5.2. Principle of purpose: Processing shall serve a legitimate purpose in accordance with the Colombian Constitution and Law, which shall be disclosed to the Data Subject.

5.3. Principle of freedom: Processing may only be carried out with the prior, express, and informed consent of the Data Subject. Data shall not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate.

5.4. Principle of truthfulness or quality: The information subject to Processing shall be truthful, complete, accurate, up-to-date, verifiable, and understandable. The Processing of partial, incomplete, fragmented, or misleading data is prohibited.

5.5. Principle of transparency: The Data Subject's right to obtain information from GSMED at any time and without restrictions regarding the existence of data concerning them shall be guaranteed.

5.6. Principle of restricted access and circulation: Personal data, except public information, shall not be available on the Internet or other mass disclosure media unless access is technically controllable and restricted to authorized persons.

5.7. Principle of security: The information subject to Processing shall be handled with the technical, human, and administrative measures necessary to prevent its adulteration, loss, unauthorized or fraudulent consultation, use, or access.

5.8. Principle of confidentiality: All GSMED personnel involved in the Processing of Personal Data shall be obliged to ensure their confidentiality, even after the termination of their relationship with the activities covered by the Processing.

VI.  DATA SUBJECT AUTHORIZATION

GSMED guarantees that it will only process the Personal Data of individuals who have previously, expressly, and with full knowledge authorized such processing. GSMED will retain a faithful copy of the authorization so that, at any time and whenever appropriate, the Data Subject may request its revocation and the immediate deletion of their information.

In the authorization request, GSMED will provide all information related to the Processing to which the Personal Data will be subject, including its purpose, the optional nature of the response regarding sensitive data or data of children and adolescents, the rights available to the Data Subject, and the identification and contact details of the Data Controller.

When the collection of Personal Data arises from the conclusion of a contract, the terms and conditions of the Processing will be documented in the contracts signed with the Data Subjects.

GSMED will not be required to request the Data Subject's authorization in the following cases:

·  For information required by a public or administrative entity in the exercise of its legal duties or by court order.

·  When the data is public in nature.

·  In cases of medical or health emergencies.

·  When Processing is authorized by law for historical, statistical, or scientific purposes.

·  When the data relates to the Civil Registry of Persons.

VII.  PURPOSE OF PROCESSING                                                       

Notwithstanding the provisions of the corresponding authorization request or contract, the Processing of Personal Data carried out by GSMED generally has one of the following purposes:

 

7.1. Suppliers and Contractors:

·  Carry out the existing commercial or contractual relationship.

·  Purchase products or request services, and report the tax information related to them.

·  Maintain efficient communication regarding contractual relationships.

·  Support internal or external audit processes.

·  Perform statistical studies or accounting processes.

·  Comply with tax, accounting, and regulatory obligations.

7.2. Clients and Users:

·  Identify and verify the account holder within the framework of the business relationship.

·  Manage orders, contracts, electronic invoicing, and payments.

·  Deliver and maintain medical equipment.

·  Provide customer service and manage warranties.

·  Contact customers in the event of complaints, claims, or suggestions.

·  Send commercial, promotional, or advertising information through any medium, including physical mail, email, or mobile device.

·  Conduct satisfaction surveys and statistical studies.

·  Consult and report information to financial risk bureaus (Datacrédito, TransUnion), in accordance with Law 1266 of 2008 on Financial Habeas Data, which establishes: (i) prior notification to the account holder at least twenty (20) calendar days before the negative report, and (ii) a maximum retention period for negative data according to current legal terms.

7.3. Physicians and Healthcare Professionals:

·  Contact for medical education and support in the use of equipment.

·  Compliance with the Value Transfer Registry (legal obligation).

·  Invitation to academic and commercial events.

·  Sending scientific, clinical, or regulatory information related to the equipment.

·  Use of image in training material and corporate image, with express authorization.

7.4. Employees and Job Applicants:

·  Execute the existing labor contractual relationship.

·  Develop selection, evaluation, hiring, and background check processes.

·  Fulfill labor obligations: payroll payment, social benefits, social security contributions (EPS, ARL, pension).

·  Compliance with the Occupational Health and Safety Management System (SG-SST).

·  Perform occupational medical exams, manage medical leave, and monitor occupational health.

·  Use of image in training material and corporate image, with express authorization.

7.5. Partners and Shareholders:

·  Compliance with corporate, company, and tax obligations.

·  Preparation of minutes, corporate books, and accounting records.

·  Convening meetings, distributing profits, and making corporate decisions.

7.6. Facility visitors:

·  Access control and private security.

·  Video surveillance and closed-circuit security in facilities.

7.7. Website users, social media, and digital channels (including WhatsApp):

·  Providing the services offered on the GSMED website and digital channels.

·  Responding to inquiries, complaints, requests, and technical support.

·  Sending informative, commercial, or promotional communications about products and services, with authorization.

·  Analyzing browsing patterns and improving the website using cookies.

·  Inviting users to commercial and academic events organized by GSMED.

VIII.  PROCESSING OF CHILDREN'S AND ADOLESCENTS' DATA

GSMED understands that the Processing of children's and adolescents' Personal Data is prohibited, except when it involves data of a public nature. Therefore, it undertakes not to collect Personal Data from minors under 18 years of age without the authorization of their legal representative, always ensuring: (i) respect for the fundamental rights of minors, (ii) respect for their best interests, and (iii) the minor's right to be heard.

IX.  PROCESSING OF SENSITIVE DATA

GSMED undertakes to avoid, as far as possible, the Processing of Sensitive Data. However, when necessary, GSMED will take into account:

·  The need to inform the Data Subject that, as it involves Sensitive Data, they are not obliged to authorize its Processing.

·  The need to explicitly and priorly inform the Data Subject of the specific purpose of the Processing of sensitive data.

·  That the Data Subject may not be conditioned to provide sensitive data as a requirement for the provision of a service, except for a legal or contractual reason.

X.  REVOCATION OF AUTHORIZATION

The Data Subject may, at any time, revoke the authorization granted to GSMED S.A.S. for the Processing of their personal data and/or request the deletion of the same, by submitting a request to the email address habeasdata@gsmedimaging.com.

The revocation will proceed when there is no longer a legal or contractual obligation requiring GSMED to retain the information. The request must clearly indicate the identification of the Data Subject, the description of the facts giving rise to the request, and the contact address to receive the response.

The revocation of authorization may entail the impossibility of continuing the provision of services or the execution of the contractual relationship when the personal data are necessary for such purposes.

XI.  RIGHTS OF THE DATA SUBJECTS

Personal Data Subjects whose data is held in GSMED's Databases shall enjoy the following rights:

11.1. To know, update, and rectify their Personal Data: in the case of partial, inaccurate, incomplete, fragmented data, data that may mislead, or data whose Processing is expressly prohibited or has not been authorized.

11.2. To request proof of the authorization: granted for the Processing of their personal data, except when exempted by law.

11.3. Be informed: about the use that has been made of your Personal Data, upon prior request to GSMED or its Processor.

11.4. Revoke authorization and/or request deletion: when you consider that constitutional and legal principles, rights, and guarantees have not been respected.

11.5. Free access to your Personal Data: at least once every calendar month.

11.6. File complaints with the Superintendency of Industry and Commerce (SIC): for violations of the provisions of personal data protection regulations, after prior processing by GSMED.

XII.  PROCEDURES FOR HANDLING INQUIRIES AND REQUESTS

The person responsible for handling requests, inquiries, or complaints within GSMED is:

Data Protection Officer: Tatiana Yepes
Email: habeasdata@gsmedimaging.com
Landline: (601) 805-0449
Mobile: +57 310 5438709
Website: https://gsmedimaging.com/es/nosotros/contactanos/
Address: Cra. 69 #25B-44, Office 614, Bogotá D.C.

12.1. Requests or Inquiries

·  The inquiry or request must be sent to habeasdata@gsmedimaging.com, fully identifying yourself and clearly describing your request.

·  GSMED will respond to the request or inquiry within a maximum period of ten (10) business days from the date of receipt.

·  If it is not possible to respond to the inquiry within the stated period, GSMED will inform the interested party of the reasons for the delay and the new deadline, which in no case may exceed five (5) additional business days.

12.2. Complaints

·  The complaint must be sent to habeasdata@gsmedimaging.com, fully identifying yourself and describing the request for correction, update, deletion, or the alleged non-compliance.

·  If the complaint is incomplete, GSMED will request the interested party to remedy it within the following five (5) business days. If two (2) months pass from the date of the request without the interested party submitting the requested information, it will be understood that they have withdrawn the complaint.

·  Once the complete complaint has been received, GSMED will include the phrase "complaint pending" in the database within a period not exceeding two (2) business days.

·  GSMED will respond to the complaint within a maximum period of fifteen (15) business days from the day following the date of its receipt.

·  If it is not possible to respond to the complaint within the stated period, GSMED will inform the interested party of the reasons for the delay and the date of response, which in no case may exceed eight (8) business days after the expiration of the first period.

XIII.  TRANSFER AND TRANSMISSION OF PERSONAL DATA

With the express and informed prior authorization of the Data Subject, and in fulfillment of the purposes described in this Policy, GSMED S.A.S. may transfer and/or transmit your personal data to third parties, inside or outside the territory of the Republic of Colombia, under the terms of Article 26 of Law 1581 of 2012.

13.1. Transfer of personal data:

The transfer will take place when GSMED, as the Data Controller, sends personal data to a third party that will act as the Data Controller. In these cases, GSMED will verify that the receiving third party has adequate levels of personal data protection.

13.2. Transmission of personal data:

Transmission will take place when GSMED shares information with third parties that act as Data Processors, so that they may carry out processing on behalf of GSMED. In these cases, the corresponding transmission contracts will be signed, establishing the obligations of the Processor, confidentiality, and appropriate security measures.

Among the external data processors that GSMED currently uses is DocuSign Inc. (San Francisco, USA), a contract electronic signature platform located in the United States of America, a country declared to have an adequate level of personal data protection by External Circular 005 of 2017 of the Superintendency of Industry and Commerce, which legitimizes the transfer under the terms of Article 26 of Law 1581 of 2012. Additionally, DocuSign Inc. has SOC 2 Type II security certification. The updated list of data processors can be requested at habeasdata@gsmedimaging.com.

XIV.  SECURITY MEASURES

GSMED S.A.S. adopts reasonable technical, human, physical, and administrative measures to protect personal data against unauthorized or fraudulent alteration, loss, consultation, use, or access, including: encrypted storage and backups, profile-based access control, password policies, confidentiality clauses in employment and commercial contracts, restricted custody of physical files, and periodic employee training.

In the event of a security incident that compromises personal data and poses a risk to Data Subjects, GSMED S.A.S. will report it to the Superintendency of Industry and Commerce and notify the affected Data Subjects within fifteen (15) business days of its detection, in accordance with subparagraph n) of Article 17 of Law 1581 of 2012.

XV.  COMMERCIAL COMMUNICATIONS AND LAW 2300 OF 2023.

Commercial, advertising, or promotional communications sent by GSMED S.A.S. to Data Subjects will be made only with prior express authorization and in compliance with Law 2300 of 2023. Consequently, calls and messages for commercial purposes will be sent Monday through Friday between 7:00 a.m. and 7:00 p.m., and on Saturdays between 8:00 a.m. and 3:00 p.m., without contacting the Data Subject on Sundays or holidays, unless they have expressly authorized other times. The Data Subject will not be contacted through the same channel more than once a day within the same week.

All commercial communications will include a prompt, simple, and free mechanism to opt out. The Data Subject may also request exclusion at any time by writing to habeasdata@gsmedimaging.com, and the request will be addressed within three (3) business days. Before each campaign, GSMED S.A.S. will consult the National Registry of Excluded Numbers (RNE).

XVI.  USE OF COOKIES.

The GSMED S.A.S. website uses first-party and third-party cookies to enable navigation, analyze usage patterns, and offer personalized content. Upon entering the site, users may accept, reject, or configure the use of non-essential cookies through the banner provided for this purpose. Data Subjects may also configure their browser to block or delete cookies at any time without affecting general access to the site. Technical cookies necessary for the operation of the site do not require consent.

XVII.  DIGITAL CHANNELS, WHATSAPP, AND VIRTUAL ASSISTANTS.

GSMED S.A.S. may collect and process personal data through WhatsApp, chatbots, virtual assistants, or other messaging applications. At the beginning of the interaction, the Data Subject will be informed through an automatic welcome message that their data will be processed in accordance with this Policy, and their express authorization will be requested. Data obtained through these channels will be used solely for the authorized purposes and stored in secure technological environments. GSMED S.A.S. does not make decisions that produce legal effects on Data Subjects based exclusively on automated processing without human intervention.

XVIII.  SUPERVISORY AUTHORITY.

The Superintendency of Industry and Commerce, through the Directorate for Personal Data Protection, is the competent authority for monitoring compliance with Colombian personal data protection regulations. Data Subjects may file complaints at www.sic.gov.co after completing the inquiry or claim process with GSMED S.A.S., in accordance with the paragraph of Article 16 of Law 1581 of 2012.

XIX.  EFFECTIVE DATE

This policy takes effect on August 21, 2026, and may be modified at any time, with timely notice to Data Subjects through the website https://gsmedimaging.com/es/politica-privacidad/ at least 10 days in advance.

Database retention period: GSMED S.A.S. databases will remain valid while the contractual, commercial, employment, or corporate relationship with the Data Subject continues and, upon its termination, for the additional period required by the legal retention obligations applicable to each type of data. For example: data of unsuccessful applicants, one (1) year; employment data, twenty (20) years after termination of the relationship; occupational medical records and disability certificates, twenty (20) years; customer and supplier data, ten (10) years after termination of the relationship; partner and shareholder data, ten (10) years; video surveillance footage, thirty (30) days; and web user and marketing contact data, two (2) years from the last interaction or until the authorization is revoked. Once these periods expire, the data will be securely deleted or irreversibly anonymized.