The Article 15 of the Colombian Constitution states that “All people have the right to their personal and family privacy and to their good name, and the State must respect them and ensure that they are respected. Likewise, they have the right to know, update and rectify the information that has been collected about them in data banks and files of public and private entities (…)”. This constitutional precept enshrines three autonomous fundamental rights, namely, privacy, good name and habeas data. The constitutional precept that is developed in this document is that of “habeas data”, which is the right that guarantees and protects everything related to the knowledge, updating and rectification of personal information contained in databases and files, which has been developed and protected by the Statutory Law 1581 of 2012.
The right of habeas data must then be understood as an autonomous fundamental right that is composed of the following two elements,
1.1 Information self-determination.
1.2 Freedom.

This policy complies with each and every one of the guiding principles set forth in Law 1581 of 2012, which are as follows:
4.1. Principle of legality in matters of data treatment: It is a regulated activity that must be subject to the provisions of the law and other provisions that develop it.
4.2. Principle of purpose: The treatment must obey a legitimate purpose in accordance with the Constitution and the Law, which must be informed to the holder.
4.3. Principle of freedom: The treatment can only be exercised with the prior, express and informed consent of the holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves the consent.
4.4. Principle of truthfulness or quality: The information subject to treatment must be truthful, complete, accurate, updated, verifiable and understandable. The treatment of partial, incomplete, fractioned or misleading data is prohibited.
4.5. Principle of transparency: In the treatment, the holder’s right to obtain from the Data Controller or Data Processor, at any time and without restrictions, information about the existence of data concerning him/her, must be guaranteed.
4.6. Principle of restricted access and circulation: The treatment is subject to the limits derived from the nature of the personal data, the Law and the Constitution. In this sense, the treatment may only be done by people authorized by the holder and / or by the people provided by law. Personal data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the holders or authorized third parties in accordance with the Law.
4.7. Principle of security: The information subject to Treatment by the Data Controller or Data Processor shall be handled with the technical, human and administrative measures necessary to provide security to the records avoiding their adulteration, loss, consultation, use or unauthorized or fraudulent access.
4.8. Principle of confidentiality: All people involved in the treatment of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks that comprise the treatment, and may only provide or communicate personal data when it corresponds to the development of the activities authorized by law and under the terms of the same.

The following definitions are set forth in Article 3 of the LEPD and Article 2.2.2.25.1.3 Section 1 Chapter 25 of Decree 1074 of 2015 (Article 3 of Decree 1377 of 2013).
3.1. Authorization: Prior, express and informed consent of the holder to carry out the treatment of personal data.
3.2. Privacy Notice: Verbal or written communication generated by the responsible party, addressed to the holder for the treatment of his/her personal data, by means of which he/she is informed about the existence of the information treatment policies that will be applicable, the way to access them and the purposes of the treatment that is intended to be given to the personal data.
3.3. Database: Organized set of personal data that is subject to treatment.
3.4. Personal data: Any information linked or that may be associated to one or several determined or determinable natural persons. An example of personal data is the name or identification number, or that may make it determinable, such as physical features.
3.5. Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to the marital status of individuals, their profession or occupation, and their status as merchants or public servants. By their nature, public data may be contained, among others, in public records, public documents, official gazettes and bulletins, duly executed court rulings that are not subject to confidentiality.
3.6. Semi-private data: Data that is not of an intimate, reserved or public nature and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector or group of people or to society in general, such as: Databases containing financial, credit, commercial, commercial, service information and that coming from third countries.
3.7. Private data: It is personal data that, due to its intimate or reserved nature, is only of interest to its owner and requires prior, informed and express authorization for its treatment. Databases containing data such as personal phone numbers and e-mails; labor data, data on administrative or criminal offenses, data managed by tax administrations, financial entities and Social Security management entities and common services, databases on asset or credit solvency, databases with sufficient information to assess the holder’s personality, databases of those responsible for operators providing electronic communication services.
3.8. Sensitive data: Data that affect the privacy of the holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or those that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sex life, and biometric data.
3.9. Data Processor: Natural or legal person, public or private, who by himself or in association with others, carries out the treatment of personal data on behalf of the Data Controller.
3.10. Data Controller: Natural or legal person, public or private, who alone or in association with others, decides on the database and/or the treatment of the data.
3.11. Database administrator: Collaborator in charge of controlling and coordinating the proper application of the data treatment policies once they are stored in a specific database; as well as implementing the guidelines issued by the data controller and the Data Protection Officer.
3.12. Data Protection Officer: It is the natural person who assumes the function of coordinating the implementation of the legal framework on personal data protection, who will process the requests of the holders, for the exercise of the rights referred to in Law 1581 of 2012.
3.13. Data Holder: Natural person whose personal data is the object of treatment.
3.14. Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
3.15. Transfer: The transfer of data takes place when the person responsible and/or in charge of the treatment of personal data, located in Colombia, sends the information or personal data to a recipient, which in turn is responsible for the treatment and is located inside or outside the country.

The purpose of this document is to inform the holders of the information about the personal information treatment policy of the commercial establishment Brighter Smiles, owned by Dr. Gonzaga Tabares Velasquez, as well as to allow the holders of personal data to exercise their right to habeas data, establishing the necessary procedure they must follow if they wish to know, update and rectify the data contained in our databases and/or files. This document is oriented in any case to protect and guarantee what concerns the treatment of personal data, freedoms and fundamental rights that all natural or physical persons have. This document is aligned with the current legislation that regulates Law 1581 of 2012 regarding compliance with the privacy notice that must be provided to the holders of personal information by the commercial establishment called Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez, who acts as the party responsible for the treatment of personal data. This document communicates to the holder of the personal information, the information processing policies that will be applicable to their personal data. Likewise, this manual will explain how to access your personal data, in addition to determining how the personal data provided by you will be treated and subsequently used.

For the commercial establishment named; Brighter Smiles, owned by Dr. Gonzaga Tabares Velasquez, as the entity responsible for the treatment of personal information of its partners, dental specialists, patients, users, clients, collaborators, contractors and/or suppliers, it is of utmost importance to guarantee the right to habeas data incorporated in article 15 of our Political Constitution, developed by Law 1581 of 2012 and current regulations that partially regulate said law. In accordance with the provisions of the current and applicable regulations on data protection, the commercial establishment named: Brighter Smiles, owned by Dr. Gonzaga Tabares Velasquez, is committed to give the appropriate treatment to each and every one of the personal data provided and which in turn are incorporated into our databases and files with the specific purposes for which they were delivered. These purposes are the following and are published on the website at the following link http://www.drgonzagatabares/privacidad/

5.1 To manage a correct provision of the services offered by the company:
– To request, consult and/or change appointments with dental professionals previously arranged or requested by the holder of the personal data.
– To consult and/or update the provision of dental treatment services.
– Allow the verification of the status of services associated with the provision of dental services.
– Generate certificates or certifications requested by holders of personal information.
– Conduct campaigns aimed at educating the user of the health services offered, within the multiple multimedia channels and through social networks that the company has.
– Provide information on programs and special campaigns aimed at disease prevention.
– Analyze the general and individual population risk of health users.
– To allow the analysis and study of health expenditures.
– To allow the qualification and classification of the origin of diseases.
– Conduct satisfaction surveys of the services and care provided.
Note: The data obtained through the treatment of the purposes described above will never be shared with third parties, because it is information considered as sensitive by the regulations.
5.2 To inform about our products and/or services.
5.3 To inform about changes in the policies of information treatment.
5.4 To process orders or any type of request made by you as a user or client of our services through any of the forms of contact that are made available to you: Contact Center, dental office, social networks, and corporate web portal.
5.5 To correctly manage the protection and exercise of the rights of the shareholders of the Brighter Smiles Commercial Establishment owned by Dr. Gonzaga Tabares Velasquez.
5.6 To send informative bulletins.
5.7 To elaborate statistical studies.
5.8 To manage the labor and commercial contractual relationships acquired in a correct manner.
5.9 To Manage pre-judicial and judicial collection processes.
5.10 To Manage requests from administrative and judicial authorities in compliance with its functions.
5.11 To eventually send commercial and advertising communications by any of the means listed below, such as email, SMS, MMS, SOCIAL NETWORKS or any other electronic or physical means known in the present or future, which makes it possible to make commercial and/or advertising communications. Said commercial communications shall be related to products or services offered by the commercial establishment: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez or its affiliates, patients, users, commercial and/or strategic allies with whom a commercial promotion agreement has been reached among its clients.
5.12 The Commercial Establishment named Brighter Smiles owned by Dr. Gonzaga Tabares informs you that your personal data such as name, surname, address, e-mail address, date of birth, profession, city, landline and cell phone, social network profiles and/or Instagram, may be transferred to third parties (with which the Commercial Establishment named Brighter Smiles owned by Dr. Gonzaga Tabares has agreements or alliances) as recipients of commercial offers that may be of interest to you.

• Political Constitution of Colombia. Article 15
• Law 1581 of 2012.
• Decree 1074 of 2015 Chapter 25 and Chapter 26 compiling the decrees: Decree 1377 of 2013
• Decree 886 of 2014.

The Responsible for the treatment of the databases subject of this policy is the Establishment of Commerce called: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez Tabares Nit. 94.431.066-7, whose contact details are as follows:

• City & Department: Cali – Valle.
• Address: Carrera 100 No. 5-169/331 Centro comercial Unicentro Consultorio 612B de Cali.
• E-mail: brightersmiles@drgonzagatabares.com
• Phone Number: 57 – 4870803

The Holder of the personal data shall have the right to:
1.Know, update and rectify their personal data against the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized.
2.Request proof of the authorization granted to the Data Controller, except when expressly exempted as a requirement for the Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.
3.To be informed by the Data Controller or the Data Processor, upon request, regarding the use of their personal data
4.To file complaints before the Superintendence of Industry and Commerce for violations of the provisions of the Law and other regulations that modify, add or complement it
5.To revoke the authorization and/or request the deletion of the data when the Processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or deletion shall proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Controller or Processor has incurred in conduct contrary to the Law and the Constitution.
6.Access free of charge to your personal data that have been subject to Processing.
These rights may be exercised by the following people:
•By the holder, who must prove his identity sufficiently by the various means made available by the responsible party.
•By their successors in title, who must prove such capacity.
•By the Representative and/or attorney-in-fact of the Data Controller, prior accreditation of the representation or power of attorney.
•By stipulation in favor of another or for another.
The rights of children or adolescents shall be exercised by the persons who are empowered to represent them.

9.1 Consultations In accordance with the regulations in force, the holder may consult his/her personal data free of charge in the following cases:
1. at least once every calendar month.
2. Whenever there are substantial modifications to the information treatment policies that motivate new consultations.
For consultations whose periodicity is greater than one per calendar month, the commercial establishment named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez, may only charge the holder for shipping costs, reproduction and, if applicable, certification of documents. Reproduction costs may not be higher than the costs of recovery of the corresponding material. For such purpose, the commercial establishment named: Brighter Smiles, owned by Dr. Gonzaga Tabares Velasquez, shall prove to the Superintendence of Industry and Commerce, when so required, the support of such expenses. The holder of the data may exercise the right of access or consultation of his/her data by means of a written request addressed to the Personal Data Protection Officer of the Commercial Establishment named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez. by e-mail to: brightersmiles@drgonzagatabares.com , in the Subject “Exercise of the right of consultation”, or through postal mail sent to Address: Carrera 100 No. 5-169/331 Centro comercial Unicentro Consultorio 612B of Cali, Valle del Cauca. The request must contain the following information:
– Name and surname of the Holder.
– Photocopy of the holder’s identification card and, if applicable, of the person representing him/her, as well as the document proving such representation.
– Petition in which the request for access or consultation is specified.
– Address for notifications, date and signature of the applicant.
– Documents accrediting the petition formulated, when it corresponds.
– Form of sending the consultation: In writing or by e-mail. For either of the two forms, the Holder must specify the delivery address (physical or electronic). Once the request has been received, the commercial establishment named: Brighter Smiles, owned by Dr. Gonzaga Tabares Velasquez, will resolve the consultation request within a maximum period of ten (10) working days from the date of receipt of the request. When it is not possible to attend the consultation within such term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) business days following the expiration of the first term. These deadlines are set forth in article 14 of the LEPD. Once the consultation process has been exhausted, the holder or assignee may file a complaint before the Superintendence of Industry and Commerce.
9.2 Complaints: The Data Holder or its assignees who consider that the information contained in a database must be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the Law, may file a claim before the Commercial Establishment named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez. which will be processed under the following rules:
The Data Holder may exercise the right of claim by means of a written request addressed to the Personal Data Protection Officer of the Commercial Establishment named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez. by e-mail to: brightersmiles@drgonzagatabares.com , in the Subject “Exercise of the right of claim”, or through postal mail sent to Address: Carrera 100 No. 5-169/331 Centro comercial Unicentro Consultorio 612B de Cali, Valle del Cauca….
The request must contain the following information:
– Name and surname of the Holder.
– Photocopy of the holder’s identification card and, if applicable, of the person representing him/her, as well as the document proving such representation.
– Description of the facts giving rise to the claim.
– Address for notifications, date and signature of the applicant.
• Documents accrediting the request made, when corresponding. The request for rectification must indicate by the holder of the personal information, the data to be rectified or corrected. The holder of the information must accompany his/her request with the necessary documentation or proof that justifies such request for rectification, unless such documentation or proof depends exclusively on the consent of the interested party or the affected party. This is due to the fact that the answers provided by the interested party or the affected party at the time of collecting or obtaining the information is facultative. The request for deletion shall indicate by the holder of the personal information the data to be deleted, providing, if applicable, the documentation or evidence that justifies it. The deletion will result in the blocking of their data and apply reservation procedures that are intended to be treated again to such data, retaining them by the responsible for the sole purpose that they are accessible to administrative or judicial authorities to allow channeling the attention of possible claims or liabilities that may have the responsible or responsible for the treatment, always obeying the statute of limitations that exists on them. Once this period has expired, the data controller must proceed to the definitive cancellation of the personal information of the data subject or affected person in our databases or files.
The request for deletion of the information and the revocation of the authorization will not proceed when the Data Holder has a legal or contractual duty to remain in the database. If the claim is incomplete, the interested party will be required within five (5) days following the receipt of the claim to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been withdrawn. In the event that the person receiving the claim is not competent to resolve it, he/she will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation. Once the complete claim has been received, a legend will be included in the database stating “claim in process” and the reason for the claim, within a term not exceeding two (2) business days. Said legend will be maintained until the claim is decided. The maximum term to attend the claim will be fifteen (15) working days from the day following the date of its receipt. When it is not possible to attend the claim within such term, the interested party will be informed of the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) business days following the expiration of the first term. The holder or assignee may only file a complaint before the Superintendency of Industry and Commerce once he/she has exhausted the consultation or complaint process before the Data Controller or Data Processor.

The function of protection of personal data in the commercial establishment named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez is in charge of the Personal Data Protection Officer, whose appointment is made by the Board of Directors. The Personal Data Protection Officer is the person responsible for the attention of petitions, queries and claims before which the holder of the information may exercise his/her rights to know, update, rectify and delete the data and/or revoke the authorization.
Requests will be handled in accordance with the provisions of paragraph 9 of this policy.

11.1 Personal data of children and adolescents the treatment of personal data of minors or adolescents by the commercial establishment named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez will be carried out always respecting the following requirements:
– Responding to and respecting the best interests of children and adolescents.
– Ensuring respect for their fundamental rights.
Once the above requirements have been met, the commercial establishment named: Brighter Smiles, owned by Dr. Gonzaga Tabares Velasquez, will ask the legal representative of the child or adolescent for authorization prior the minor exercises his or her right to be heard, an opinion that will be assessed taking into account the maturity, autonomy and capacity to understand the matter.
The person responsible and in charge involved in the treatment of personal data of children and adolescents shall ensure the proper use of the same, applying the principles and obligations established in Law 1581 of 2012 and regulatory standards.
11.2 Sensitive Data The treatment of sensitive data is prohibited except for the following reasons:
11.2.1. The Data Holder has given its explicit authorization to such Treatment, except in cases where by law the granting of such authorization is not required. These cases are data of a public nature and cases of medical or health emergency.
11.2.2. The treatment is necessary to safeguard the vital interest of the Data Holder and he/she is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.
11.2.3. The treatment refers to data that are necessary for the recognition, exercise or defense of a right in a legal proceeding.
11.2.4. The Processing has a historical, statistical or scientific purpose.
In this event, the measures leading to the suppression of the identity of the Data Controllers must be adopted. The Establishment of Commerce named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez. identifies the sensitive data eventually collected or stored with the purpose of:
▪ Implement special attention and reinforce their responsibility regarding the treatment of this type of data, which translates into a greater requirement in terms of compliance with the principles and duties established by the current regulations on data protection.
▪ Establish the technical, legal and administrative security levels to treat the information appropriately.
▪ Increase the restrictions on access and use by the personnel of the Establishment of Commerce named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez, and third parties.

12.1. Guarantee the Data Holder, at all times, the full and effective exercise of the right of habeas data.
12.2. Request and keep, under the conditions set forth in this law, a copy of the respective authorization granted by the Data Holder.
12.3. Duly inform the Data Holder about the purpose of the collection and the rights he/she is entitled to by virtue of the authorization granted.
12.4. To keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
12.5. Ensure that the information provided to the Data Processor is truthful, complete, accurate, current, verifiable and understandable.
12.6. Update the information, communicating in a timely manner to the Data Processor, all developments with respect to the data previously provided and take other necessary measures to ensure that the information provided to it is kept up to date.
12.7. Rectify the information when it is incorrect and communicate the relevant information to the Data Processor.
12.8. To provide to the Data Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions of the Law.
12.9. To require the Data Processor at all times to respect the security and privacy conditions of the Data Holder’s information.
12.10. To process the queries and claims formulated in the terms set forth in the Law.
12.11. To adopt an internal manual of policies and procedures to ensure proper compliance with the Law and, in particular, for the handling of queries and claims.
12.12. Inform the Data Controller when certain information is under discussion by the Data Holder, once the claim has been filed and the respective process has not been completed.
12.13. Inform upon request of the Data Holder about the use given to its data.
12.14. To inform the data protection authority when there are violations to the security codes and there are risks in the administration of the Data Holders’ information.
12.15. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

13.1. Guarantee the Data Holder, at all times, the full and effective exercise of the right of habeas data.
13.2. To keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access.
13.3. Timely update, rectify or delete the data under the terms of this law.
13.4. Update the information reported by the Data Controllers within five (5) business days from its receipt.
13.5. To process the queries and claims made by the Data Holders under the terms set forth in the Law.
13.6. Adopt an internal manual of policies and procedures to ensure proper compliance with the Law and, in particular, for the handling of queries and claims.
13.7. To register in the database the legends “claim in process” in the manner regulated by the Law.
13.8. Insert in the database the legend “information under judicial discussion” once notified by the competent authority about judicial proceedings related to the quality of the personal data.
13.9. Refrain from circulating information that is being disputed by the Data Holder and whose blocking has been ordered by the Superintendence of Industry and Commerce.
13.10. To allow access to the information only to those persons who may have access to it.
13.11. To inform the Superintendence of Industry and Commerce when there are violations to the security codes and there are risks in the administration of the information of the Data Holders.
13.12. To comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

Informs all holders of personal information contained in its databases and/or files that, in accordance with the provisions of Law 1581 of 2012 and other regulations in force, the organization has implemented technical, administrative and legal measures necessary to ensure the security of personal data and thus prevent the loss, alteration, access and unauthorized treatment, taking into account the nature of the data stored and the risks to which they are exposed.

For the international transfer and transmission of personal data of the holders, of THE COMMERCIAL ESTABLISHMENT NAMED: BRIGHTER SMILES OWNED BY DR. GONZAGA TABARES VELASQUEZ, will take the necessary measures to ensure that third parties are aware of and agree to comply with this policy. For the transfer of personal data, the following rules shall apply: International transfers of personal data shall observe the provisions of Article 24 of Law 1581 of 2012; that is, the prohibition of transfer of personal data to countries that do not provide adequate levels of data protection and the exceptional cases in which such prohibition does not apply. The international transmissions of personal data that are made between a data controller and a processor to allow the processor to carry out the treatment on behalf of the data controller, will not require to be informed to the holder or to have his consent, when there is a contract in the terms of article 25 of Law 1581 of 2012.

Has a video surveillance system and security cameras inside its facilities and in the access sites, in order to ensure the safety of property or people. The images, photographs, captured and/or filmed videos, recordings and captured images have a recording record of approximately 30 days, which after this time will be deleted. In no way will these images, recordings and/or filming be used or shared with third parties for commercial purposes or activities other than to preserve the security and surveillance of the facilities of the commercial establishment named: BRIGHTER SMILES OWNED DY DR. GONZAGA TABARES VELASQUEZ, will only deliver the videos or recordings by request of competent authority in exercise of its legal functions and undertakes to carefully review the information that will be delivered, so as not to violate the dignity, privacy or good name of any of the people who may appear in such images or videos.

This policy is effective from the date of its publication.
All applied changes will be disclosed through the physical and electronic channels of the ESTABLISHMENT OF COMMERCE NAMED: BRIGHTER SMILES OWNED BY DR. GONZAGA TABARES VELASQUEZ considers pertinent

This policy may be unilaterally modified by the of the commercial establishment named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez. and in order to notify and make it known to the right holders, the of the commercial establishment named: Brighter Smiles owned by Dr. Gonzaga Tabares Velasquez, will do so on its website www.drgonzagatabares.com , except in those cases in which its modification requires the express consent of the right holder, the present document was ratified by the board of directors on January 23, 2018 by act no. 356. the period of validity of the databases is that determined by law.