Privacy Policy

1. Introduction

At IVLU S.A.S. ("IVLU"), we prioritize and respect your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information obtained through our website, medical consultations, and service delivery.

IVLU complies with Colombia's Data Protection Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015), and relevant international standards including GDPR principles. By providing personal data, you agree to the practices described herein.

2. Information We Collect

2.1. Personal Identifiers:

• Full name
• Government-issued ID number
• Date of birth
• Physical address
• Phone number
• Email address
• Payment information

2.2. Medical Information:

• Medical history and clinical records
• Allergies and medications
• Clinical photographs for diagnosis
• Previous test results
• Treatment notes

2.3. Website Usage Data:

• IP address
• Browser type
• Visited pages
• Session duration
• Referral source
• General geographic location

3. Data Collection Methods

We collect information through:

• Direct input: Website forms, medical consultations, appointment scheduling
• Automated means: Cookies and tracking technologies
• Authorized third parties: Insurance providers, medical referrals (with consent)

4. Purpose of Data Processing

We process personal information to:

• Deliver aesthetic medicine and hair restoration services
• Maintain medical records and treatment tracking
• Coordinate appointments and send care instructions
• Process payments and billing
• Respond to inquiries
• Send service updates (with consent)
• Improve services and website experience
• Comply with legal obligations
• Protect legitimate business interests

5. Legal Basis for Processing

Data processing is conducted under:

• Explicit consent: Through forms and policy acceptance
• Contractual necessity: Service delivery
• Legal compliance: Health and tax regulations
• Legitimate interests: Service improvements respecting user rights

6. Third-Party Data Sharing

IVLU does not sell personal information. Limited sharing occurs with:

• Service providers: Payment processors, IT support
• Medical professionals: With patient consent
• Government authorities: When legally required
• Insurance companies: For claims processing (with consent)

All third parties must maintain confidentiality and security standards.

7. International Data Transfers

Data may be stored on servers outside Colombia. We ensure:

• Adequate protection measures per Colombian regulations
• GDPR-compliant transfers when applicable
• Standard contractual clauses for non-adequate jurisdictions

8. Information Security

We implement robust security measures including:

• Data encryption
• Strict access controls
• Intrusion detection systems
• Regular backups
• Staff training
• Security audits

While we employ industry-standard protections, absolute security cannot be guaranteed.

9. Data Retention

We retain information:

• As necessary for stated purposes
• Per legal requirements (minimum 15 years for medical records)
• Until consent withdrawal (where applicable)

Obsolete data is securely deleted or anonymized.

10. Your Rights

Under Colombian law and international standards, you may:

• Access your personal data
• Request corrections
• Withdraw consent
• Request deletion (subject to legal exceptions)
• Object to processing
• File complaints with supervisory authorities

GDPR-specific rights apply to EU residents. CCPA provisions apply to California residents.

Queries answered in 10 business days, claims in 15

Send your request to centromedicoivlu@gmail.com or in writing to Calle 127 A #7-19 Consultorio 306, Usaquén, Bogotá, with your name, ID number, a description of the request, a reply address and any supporting documents.

• Queries (what data we hold and how we use it): answered within 10 business days of receipt, extendable by up to 5 business days with notice.
• Claims (update, correct or delete data, or withdraw consent): answered within 15 business days from the day after receipt, extendable by up to 8 business days with notice. If a claim is incomplete, we will ask you to complete it within 5 days; after 2 months without a reply, the claim is considered withdrawn.

Withdrawal of consent and deletion do not apply where the law or a contract requires us to keep the data, as with medical records. Once this process is complete, you may file a complaint with Colombia's data protection authority, the Superintendencia de Industria y Comercio (SIC).

11. Cookies & Tracking Technologies

Our website uses:

• Essential cookies: Basic functionality
• Analytical cookies: Usage analysis
• Functional cookies: Preference storage
• Marketing cookies: Ad personalization (opt-in required)

Manage preferences through browser settings. Note: Disabling cookies may affect site functionality.

Each service that sets cookies is listed in our cookie policy.

12. Minors' Privacy

We do not knowingly collect data from individuals under 18 without parental consent. Treatments for minors require legal guardian authorization and medical supervision.

COPPA-compliant procedures are followed for any minor-related data.

13. External Links

Our website may contain third-party links. We are not responsible for external content or privacy practices. Review third-party policies before engaging.

14. Policy Updates

We may periodically update this policy. Significant changes will be:

• Posted prominently on our website
• Communicated via email when appropriate

Always check the "Last Updated" date for current version.

15. Contact Us

For privacy inquiries or data requests:

• Email: centromedicoivlu@gmail.com
• Phone: +57 322 835 1465
• Mailing Address: Calle 127 A #7-19 Consultorio 306, Usaquén, Bogotá

Data Controller:
IVLU S.A.S.
NIT (Tax ID): 901681646
Address: Calle 127 A #7-19 Consultorio 306, Usaquén, Bogotá

16. Visitors from the United States: care is provided in Bogotá, Colombia

IVLU is a medical practice in Bogotá, Colombia. All consultations and treatments take place at our clinic in Colombia, and Colombian law governs the processing of your data. This section explains what happens to the data you send us from the United States.

Data we collect: your form, your messages and website usage

• Contact form: the name, email, phone number and message you type, including the treatment you are interested in.
• Email, phone or WhatsApp: the content of the messages you choose to send us and your contact details.
• Usage data: pages visited, device and browser type, approximate location derived from your IP address, and the contact links you click.

We use it to answer you and book your consultation in Bogotá

To answer your inquiry, schedule your consultation in Bogotá, send you preparation instructions and measure which pages and contact channels work, so we can improve the website.

Kommo, Google and Cloudflare process your data; we do not sell it

• Kommo: receives the data from the contact form on our pages.
• Google Analytics, through Google Tag Manager: measures website usage.
• Google Maps: displays the embedded map of our location.
• Google Sheets / Apps Script and Cloudflare Turnstile: only once our own appointment form is enabled; they store the request and block spam.
• Your messaging provider (for example, WhatsApp or your email service) when you choose to contact us through it.

We do not sell your personal data.

Inquiry data is kept only while we handle your appointment

Inquiry data is kept as long as needed to answer you and manage your appointment. If you become a patient, your medical record is kept for the period required by Colombian law (section 9).

Access, correct or delete your data by email or phone

You can ask to access, correct or delete your data and withdraw your consent by writing to centromedicoivlu@gmail.com or calling +57 322 835 1465. We follow the deadlines in section 10. Health-related data from U.S. residents is covered in our Consumer Health Data Privacy Notice.