Personal data processing and protection policy

This is a translation for information purposes. The Spanish version is the official one.

Document

MA040101D, version 04, dated November 5, 2026. Approved by the General Manager.

To exercise your rights

Write to [email protected], visit us at Calle 19 No. 1-44, Barrio Blanco, Cúcuta, Colombia, or call +57 (607) 595 6075 for guidance.

1. Purpose

To set out the guidelines for processing and protecting the personal data that Servicios Especializados FCB S.A.S. collects, stores, uses, transmits, transfers and, where applicable, deletes, ensuring respect for the rights of data subjects, the confidentiality and security of the information, and compliance with current Colombian personal data protection law.

This policy aims to inform data subjects clearly and transparently about the purposes for which their personal data is processed, the rights they have and the mechanisms the institution has established for exercising them, with special protection for sensitive data related to the provision of health services.

2. Scope

This Personal Data Processing and Protection Policy applies to the processing of the personal data of patients, users, legal representatives, relatives and companions where applicable, workers, job applicants, contractors, suppliers, students, visitors and any other natural persons whose personal data is processed by Servicios Especializados FCB S.A.S. as Data Controller.

It covers the collection, storage, use, consultation, updating, circulation, transmission, transfer, retention and deletion of personal data, by physical, electronic or digital means, in the course of the institution’s healthcare, administrative, employment, contractual, commercial, academic and research activities, in accordance with the purposes communicated to data subjects and the applicable legal provisions.

This policy includes the processing of sensitive personal data, especially health-related data, the information contained in medical records and biometric data, when processed by the institution, with the protection and confidentiality measures required by current law.

Its provisions must be followed by the workers and collaborators of Servicios Especializados FCB S.A.S. and by third parties that process personal data on the institution’s behalf, in accordance with their legal and contractual obligations.

This policy applies without prejudice to the special legal regimes that govern certain types of information, particularly medical records, professional secrecy and information subject to legal confidentiality.

3. Definitions

For the purposes of this Personal Data Processing and Protection Policy, the following definitions apply:

Authorization

The data subject’s prior, express and informed consent to the processing of personal data, when legally required.

Database

An organized set of personal data subject to processing.

Personal data

Any information linked or that can be associated with one or more identified or identifiable natural persons.

Semi-private personal data

Data that is not intimate, confidential or public, and whose knowledge or disclosure may be of interest to the data subject as well as to a certain sector or group of people or to society in general. Its processing is subject to the applicable legal regime.

Sensitive personal data

Data that affects the data subject’s privacy or whose misuse could lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, or membership in unions or certain types of organizations, as well as data about health, sex life and biometric data.

Private personal data

Data that, being intimate or confidential, is relevant only to the data subject and whose processing is subject to the guarantees and conditions set out in the applicable law.

Public personal data

Data that is not semi-private, private or sensitive under the applicable law. Examples include data about a person’s marital status, profession or trade, and status as a merchant or public servant, as provided by law.

Data processor

A natural or legal person, public or private, that alone or jointly with others processes personal data on behalf of the data controller.

Data controller

A natural or legal person, public or private, that alone or jointly with others decides on the database or the processing of personal data.

Data subject

The natural person whose personal data is processed.

Processing

Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.

Privacy notice

A verbal or written communication from the controller to the data subject informing them that data processing policies apply to them, how to access those policies and the purposes for which their personal data is processed.

Transmission of personal data

Processing that involves communicating personal data within or outside Colombia so that a processor can process it on the controller’s behalf.

Transfer of personal data

An operation in which the controller or processor sends personal data to a recipient that in turn acts as a data controller, within or outside Colombia.

Medical record

A private, mandatory and confidential document that records, in chronological order, the patient’s health conditions, the medical acts and the other procedures carried out by the healthcare team involved in their care. Third parties may only see it with the patient’s authorization or in the cases provided by law.

Personal Data Protection Officer

The person designated by Servicios Especializados FCB S.A.S. to coordinate, drive and follow up on personal data protection activities and to help data subjects exercise their rights, according to the responsibilities assigned by the institution.

Personal data security incident

An event that compromises or may compromise the confidentiality, integrity or availability of personal data, including unauthorized access, disclosure, alteration, loss or destruction.

Deletion of personal data

Erasing personal data when legally appropriate, taking into account the purposes of processing, the rights of data subjects and legal obligations to retain information, especially those that apply to medical records.

4.1. Identification of the data controller

Servicios Especializados FCB S.A.S., tax ID (NIT) 900.017.916-0, with its main office in San José de Cúcuta, Norte de Santander, Colombia, is the controller of the personal data collected in the course of its institutional activities.

Identification and contact details:

Company name

Servicios Especializados FCB S.A.S.

Tax ID (NIT)

900.017.916-0.

Address

Calle 19 No. 1-44, Barrio Blanco, San José de Cúcuta, Norte de Santander, Colombia.

Phone

+57 (607) 595 6075.

General email

[email protected].

Personal data protection email

[email protected].

Website

sefcb.co.

Data subjects may exercise their rights to know, access, update, correct and delete their personal data, request proof of the authorization they gave, revoke it when legally appropriate and submit queries or complaints by writing to [email protected] or through the institution’s other service channels.

Requests related to personal data processing will be coordinated by the person or area designated by the institution for personal data protection, according to the assigned responsibilities and established internal procedures.

Queries and complaints will be handled within the time limits and conditions set out in current Colombian personal data protection law.

4.2. Personal data processing policy

Servicios Especializados FCB S.A.S., in pursuing its corporate purpose and its healthcare, administrative, employment, contractual, commercial, academic and research activities, processes the personal data of its different stakeholder groups in accordance with the applicable legal provisions.

Processing includes operations such as the collection, storage, consultation, use, updating, circulation, transmission, transfer, retention and deletion of personal data, for the legitimate, specific purposes communicated to data subjects and in line with the corresponding legal obligations.

The institution recognizes the special protection that sensitive personal data requires, particularly health-related data, and commits to ensuring its confidentiality, integrity, availability and proper processing by applying administrative, technical, physical and organizational measures in line with the risks associated with the information.

Servicios Especializados FCB S.A.S. will process personal data with the data subject’s prior, express and informed authorization when legally required, without prejudice to the exceptions set out in current law.

To meet these commitments, the institution adopts the personal data processing provisions set out in the following sections of this policy.

4.2.1. Channels for exercising data subjects’ rights

Servicios Especializados FCB S.A.S. provides institutional channels so that data subjects, their successors, legal representatives or duly authorized persons, as applicable, can submit queries and complaints about the processing of their personal data.

Through these channels they can exercise their rights to know, access, update, correct and delete personal data, request proof of the authorization they gave, revoke it when legally appropriate and exercise the other rights recognized by current law.

Institutional channels:

Personal data protection email

[email protected].

In person

Calle 19 No. 1-44, Barrio Blanco, San José de Cúcuta, Norte de Santander, Colombia, through the institutional request intake process.

Phone guidance

+57 (607) 595 6075.

To handle requests, the institution may verify the requester’s identity and standing, when applicable, using secure and proportionate mechanisms that protect the confidentiality of the information.

Queries and complaints will be processed in accordance with the requirements, procedures and time limits set out in articles 14 and 15 of Law 1581 of 2012 and other applicable rules.

Requests related to medical records, procedure results and other healthcare information are also subject to the institution’s procedures and to the special rules on confidentiality and access to clinical information.

The institution will keep evidence of the requests received and the responses issued, in accordance with its records management and personal data protection procedures.

4.2.2. Security and confidentiality of personal data

Servicios Especializados FCB S.A.S. commits to protecting the personal data it processes, especially sensitive health-related data, by implementing technical, human, administrative, physical and organizational security measures appropriate to the nature of the information and the risks associated with its processing.

These measures aim to preserve the confidentiality, integrity and availability of the information and to prevent its alteration, loss, destruction, disclosure, consultation, use or unauthorized or fraudulent access.

Access to personal data will be limited to people who, because of their duties and responsibilities, are duly authorized to process it, in line with the principles of necessity, purpose and restricted access.

Workers, contractors, suppliers and other third parties with access to personal data must meet their legal, contractual and institutional security and confidentiality obligations, even after their relationship with the institution ends, as provided by the applicable law.

Servicios Especializados FCB S.A.S. has institutional mechanisms to identify, report, assess, handle and follow up on security incidents that may compromise personal data, and to notify the competent authorities when legally required.

The information in medical records and other healthcare records is subject to the special confidentiality, custody, security and access measures set out in current health regulations.

The operational provisions, specific controls and responsibilities for protecting information are developed in the institution’s internal procedures, manuals and other documents.

4.2.3. Processing of personal and sensitive data in the provision of health services

Servicios Especializados FCB S.A.S., as a healthcare provider, collects and processes the personal data that is necessary, relevant and adequate to identify patients, assess their health, make a diagnosis, provide healthcare services and treatment, carry out clinical follow-up, ensure continuity of care and manage health risk.

The information processed may include identification and contact details, enrollment in the General Social Security Health System, personal and family history, health conditions, results of diagnostic procedures and other clinical information needed for healthcare purposes and to meet the applicable legal obligations.

Health data is sensitive and will therefore be processed under special conditions of protection, confidentiality, security and restricted access, in accordance with current law.

The institution will inform data subjects of the purposes of processing, the sensitive nature of health data, their rights and the conditions under which the information is requested. When authorization is legally required, it must be obtained in advance, expressly and on an informed basis, without prejudice to the exceptions provided by law.

Providing sensitive data is subject to the legal guarantees of the data subject’s freedom and protection. When certain clinical information is necessary to carry out an assessment, procedure or intervention safely, the healthcare staff will explain to the patient why it matters to provide it and the possible clinical consequences of withholding it, respecting the patient’s autonomy and the applicable professional duties.

The information recorded in the medical record and other healthcare documents will be processed in accordance with the special provisions on confidentiality, access, custody, retention and privacy.

Servicios Especializados FCB S.A.S. may process and communicate personal information to meet legal obligations related to the General Social Security Health System, public health, health surveillance and requests from competent authorities, within the limits and conditions set out in the applicable law.

Personal data collected for healthcare will not be used for commercial, advertising or other purposes unrelated to healthcare without the corresponding authorization or another applicable legal basis.

4.2.4. Authorization for the processing of personal data

Servicios Especializados FCB S.A.S. will request and obtain the prior, express and informed authorization of the data subject, or of whoever is legally entitled to give it, when required under current Colombian law.

Authorization may be obtained by physical, electronic, digital or verbal means, or through unequivocal conduct by the data subject from which it can reasonably be concluded that they have given their consent, provided that the mechanism used allows it to be consulted and verified later. Silence can never be interpreted as authorization.

Before obtaining authorization, the institution will inform the data subject, clearly and understandably, of the specific purposes of processing, their rights, the optional nature of answers to questions about sensitive data or data about children and adolescents, and the identity and contact channels of the data controller.

When processing involves sensitive personal data, especially health-related or biometric data, Servicios Especializados FCB S.A.S. will observe the special conditions set out by law, will expressly inform the data subject of the sensitive nature of that data and will obtain their explicit authorization when legally required.

The institution will keep evidence of the authorizations given and the information provided to data subjects, using mechanisms that show how they were obtained and allow the authorized purposes to be verified.

The data subject’s authorization is not required in the cases expressly excepted by law, but this does not release the institution from complying with the principles, duties and protection measures that apply to personal data processing.

Authorizations for commercial, advertising, promotional or image-use purposes must clearly identify those purposes and be managed separately from the processing needed to provide healthcare services.

Authorization to process personal data is separate from the informed consent required for health procedures or interventions, although both may be managed through coordinated institutional mechanisms that distinguish their respective scopes.

Data subjects may request revocation of the authorization and deletion of their personal data when legally appropriate, through the institutional channels set out in this policy, subject to the legal and contractual obligations to retain information.

4.2.5. Processing of personal data in employment, contractual and commercial relationships

Servicios Especializados FCB S.A.S. collects and processes the personal data of job applicants, workers, former workers, contractors, suppliers and natural persons who act as representatives, employees or contacts of paying entities and other organizations with which it has contractual or commercial relationships.

This information will be processed for the following purposes, as appropriate to each relationship:

• Carrying out selection processes, profile assessments, requirement checks and hiring, in accordance with the applicable law.
• Formalizing, performing, managing, supervising and ending employment, civil, commercial or contractual relationships.
• Managing payments, payroll, fees, invoicing, tax and accounting obligations and other commitments arising from those relationships.
• Meeting legal obligations related to enrollment and contributions to the Comprehensive Social Security System, employee benefits and occupational health and safety management.
• Carrying out training, performance evaluation, employee well-being and talent management activities, when applicable.
• Checking supplier and contractor requirements, managing procurement processes, monitoring compliance with obligations and maintaining communications related to contract performance.
• Responding to requests from competent authorities, audits, administrative or judicial proceedings and other applicable legal obligations.
• Keeping the necessary documents and records for the periods set out in the applicable legal and contractual provisions.

Processing will be limited to the information that is necessary, relevant and adequate for the stated purposes, and will be carried out with the data subject’s authorization when legally required or on the basis of the exceptions expressly provided by law.

When sensitive personal data must be processed, especially health information about workers or applicants, Servicios Especializados FCB S.A.S. will observe the special conditions set out in current law, ensuring confidentiality, restricted access and the separation of confidential medical information from the administrative data needed for employment management.

The institution will not require sensitive information for purposes without legal justification and will guarantee data subjects’ rights in accordance with the applicable law.

When a supplier or contractor processes personal data on behalf of Servicios Especializados FCB S.A.S., obligations of confidentiality, security, purpose, restricted access and other conditions appropriate to its role as data processor will be established.

Personal data obtained in employment or contractual relationships will not be used for purposes other than those stated, unless there is an applicable legal basis or the corresponding authorization is obtained.

4.2.6. Processing of the personal data of children and adolescents

Servicios Especializados FCB S.A.S. recognizes the special protection of the personal data of children and adolescents and guarantees that it will be processed with respect for their fundamental rights, dignity, privacy and the principle of the best interests of the child, in accordance with current Colombian law.

The institution may collect and process the personal data of children and adolescents when this serves legitimate, specific and necessary purposes, especially providing health services, clinical assessment, diagnosis, treatment, healthcare follow-up and meeting the applicable legal obligations.

The processing of this information must respect the prevailing rights of minors and be carried out under the special conditions set out in current law.

When authorization is legally required, it will be given by the child’s or adolescent’s legal representative, after the minor has exercised their right to be heard, taking into account their age, maturity, autonomy and ability to understand the scope of the processing of their personal data.

Health data about children and adolescents is sensitive and subject to reinforced measures of confidentiality, security, custody and restricted access, in accordance with personal data protection law and the special provisions that apply to medical records.

The institution will limit the collection and use of minors’ personal data to the information that is necessary and relevant for the stated and legally authorized purposes, avoiding processing that is excessive, incompatible or that may affect their fundamental rights.

Capturing, using or disclosing images, photographs, videos or testimonials of children and adolescents for advertising, commercial, promotional or institutional communication purposes is subject to the corresponding legal authorizations and guarantees, giving special consideration to the best interests of the child and their right to privacy.

Access to minors’ personal and clinical information by their legal representatives, health professionals or authorized third parties will be granted in accordance with the applicable legal provisions, respecting the special conditions of confidentiality, privacy and protection of the minor’s rights.

Servicios Especializados FCB S.A.S. will take the necessary measures to prevent unauthorized access to, use, disclosure or processing of the personal data of children and adolescents, and will guarantee the exercise of their rights through the established institutional mechanisms.

4.2.7. Purposes of processing the personal data of patients, users and their families

Servicios Especializados FCB S.A.S. collects and processes the personal data of patients, users, legal representatives, relatives and companions, when applicable, to carry out the activities involved in providing health services and to meet its legal, administrative and contractual obligations.

This information will be processed for the legitimate, specific purposes communicated to data subjects, and will include, as applicable:

• Identifying and registering patients and users, verifying their personal and contact information, and managing their entry into the institution’s care processes.
• Handling requests for information and the booking, confirmation, changing and cancellation of appointments, and providing guidance on the health services the institution offers.
• Carrying out clinical assessments, consultations, diagnostic procedures, treatments, healthcare follow-up and other activities needed to provide safe, timely and continuous health services.
• Creating, updating, consulting, safeguarding and keeping medical records and other healthcare records, in accordance with the applicable legal provisions.
• Managing service authorizations, verifying entitlement to care, coordinating services with paying entities and carrying out the administrative procedures needed for care.
• Carrying out invoicing, collections, accounts receivable management, medical claims auditing and other administrative and financial activities related to the services provided.
• Carrying out population characterization, disease prevention, health promotion, clinical follow-up and health risk management activities, in line with the institution’s responsibilities and obligations.
• Meeting legal obligations to report information to official health systems, epidemiological surveillance, public health, health authorities and other competent entities, in the cases and under the conditions set out in current law.
• Assessing and improving the timeliness, safety, quality, continuity and satisfaction of health services through audits, indicators, surveys and other institutional evaluation and improvement mechanisms.
• Handling requests, petitions, complaints, claims, suggestions and compliments from users, and managing the institution’s patient services processes.
• Maintaining communications about service delivery, preparation for procedures, delivery or availability of results, healthcare follow-up and administrative information needed for continuity of care, using institutional channels and appropriate identity verification and confidentiality mechanisms.
• Responding to requests from administrative, judicial, health and oversight authorities, when they are legally competent to request the information and within the limits set out in the applicable law.
• Exercising or defending the rights of the institution, data subjects or legitimate third parties in administrative, contractual, judicial or out-of-court proceedings, when processing the data is legally appropriate.
• Carrying out scientific and academic research and health knowledge generation activities, only when the applicable ethical, legal and personal data protection requirements are met, including the required authorizations, confidentiality measures and anonymization or removal of identifying elements when applicable.
• Sending educational, preventive and health promotion information, when this purpose has been duly communicated and has the corresponding authorization or another applicable legal basis.
• Carrying out commercial, advertising or promotional activities, including sending service offers, commercial campaigns and the use of images or testimonials, only when there is valid authorization for those purposes or an applicable legal basis.

The processing of the personal data of relatives, companions and legal representatives will be limited to the purposes related to their participation in the patient’s care, administrative management or meeting legal obligations, respecting the confidentiality of clinical information.

The institution will not use personal data for purposes incompatible with those communicated to the data subject. When new purposes requiring authorization are planned, authorization will be requested in advance, in accordance with current law.

The processing of sensitive data, especially health-related data, is subject to the special protection conditions set out in Colombian law and in the other sections of this policy.

4.2.8. Purposes of processing the personal data of job applicants, workers and former workers

Servicios Especializados FCB S.A.S. collects and processes the personal data of job applicants, workers and former workers to carry out its talent management processes and meet its legal, employment, administrative and contractual obligations.

This personal data will be processed for the following purposes, as applicable:

• Carrying out recruitment, selection, profile assessment, requirement checks, employment references and other activities needed to determine applicants’ suitability, within the applicable legal limits.
• Formalizing, managing, performing, changing and ending employment relationships, including managing contracts, staff changes and related documents.
• Managing payroll, pay, employee benefits, vacations, leave, sick leave, settlements and other financial and employment obligations.
• Managing enrollment, changes and contributions to the Comprehensive Social Security System, family benefit funds and other legally required entities.
• Carrying out onboarding, refresher training, training, education, performance evaluation, professional development, employee well-being and recognition activities.
• Implementing and managing the activities of the Occupational Health and Safety Management System, including occupational risk prevention, monitoring of working conditions and other legally required obligations.
• Managing occupational medical evaluations and their administrative results, respecting the confidentiality of the occupational medical record and the legal restrictions on access to individual medical information.
• Managing identification, access control, physical security and protection mechanisms for the institution’s facilities, resources and information systems.
• Maintaining work and administrative communications related to job duties, institutional activities and the obligations of the employment relationship.
• Carrying out organizational climate, job satisfaction, well-being and institutional improvement assessments, applying the corresponding confidentiality and personal data protection measures.
• Responding to requests from administrative, labor, judicial and oversight authorities when there is a legal obligation to provide information.
• Managing audits, disciplinary processes, internal investigations and administrative or judicial proceedings, respecting legal guarantees, confidentiality and the rights of data subjects.
• Keeping employment, contractual, accounting and administrative documents for the periods set out in the applicable law and meeting obligations that continue after the employment relationship ends.
• Sending communications about training, research, academic development or institutional progress, when they relate to job duties or there is authorization or a legal basis for the processing.

The processing of sensitive personal data, especially health-related data, is subject to the special conditions set out in current law. The institution will limit access to authorized staff and guarantee the confidentiality of medical and occupational information.

The personal data of applicants who are not hired will be kept only for as long as needed to fulfill the stated purposes and applicable legal obligations. Using it for future job openings requires a purpose communicated in advance and the corresponding authorization, when required.

Servicios Especializados FCB S.A.S. will not use the personal data of applicants, workers or former workers for purposes other than those stated, unless there is an applicable legal basis or the corresponding authorization is obtained.

4.2.9. Purposes of processing the personal data of contractors, suppliers and representatives of paying entities

Servicios Especializados FCB S.A.S. collects and processes the personal data of contractors, suppliers, independent professionals and natural persons who act as representatives, employees, delegates or contacts of paying entities and other organizations with which it has commercial, civil or contractual relationships.

This information will be processed for the following purposes, as applicable:

• Identifying, registering and verifying the information of contractors, suppliers, representatives and authorized contacts, and assessing the requirements for establishing contractual or commercial relationships.
• Carrying out the selection, evaluation, engagement, contracting, renewal, follow-up and termination of commercial, civil or contractual relationships.
• Verifying legal, technical, administrative, professional and contractual requirements related to the goods and services supplied to the institution.
• Formalizing, performing, supervising and evaluating compliance with contracts, agreements, purchase orders, service agreements and other contractual instruments.
• Managing invoicing, payments, fees, accounts receivable and payable, reconciliations, collections, withholdings and other applicable accounting, financial and tax obligations.
• Maintaining communications related to contract performance, scheduling, service coordination, follow-up of commitments and administrative management of commercial relationships.
• Managing audits, supplier and contractor performance evaluations, indicator monitoring and improvement of contracted services.
• Verifying compliance with legal and contractual obligations related to social security, occupational health and safety and requirements for entering or remaining in the institution’s facilities, when applicable.
• Managing identification, entry, presence and physical security controls for contractors, suppliers and other third parties authorized to access the institution’s facilities or information systems.
• Responding to requests from administrative, judicial, tax, health and oversight authorities when they are legally competent to request the information.
• Exercising or defending the institution’s rights in administrative, contractual, judicial or out-of-court proceedings, when processing personal data is legally appropriate.
• Keeping the documents and records arising from contractual and commercial relationships for the periods required by the applicable law and the corresponding contractual obligations.

Processing will be limited to the information that is necessary, relevant and adequate for the stated purposes, and will be carried out with the data subject’s authorization when legally required or on the basis of the exceptions provided by law.

When a contractor or supplier processes personal data on behalf of Servicios Especializados FCB S.A.S., the parties must set out the conditions that apply to that processing through the corresponding contractual instruments, including obligations of confidentiality, security, restricted access, authorized use of information, incident handling and compliance with the controller’s instructions.

When a contractual relationship involves communicating personal data to third parties that act as independent data controllers, the institution will verify the purpose, legal basis and conditions that apply to the transfer of information.

Access by contractors, suppliers and third parties to sensitive personal data, especially patients’ clinical information, will be restricted to legally appropriate cases and subject to the corresponding special protection, confidentiality and security measures.

Personal data obtained in contractual or commercial relationships will not be used for purposes other than those stated, unless there is an applicable legal basis or the corresponding authorization is obtained.

4.2.10. Purposes of processing the personal data of students in training placements and academic activities

Servicios Especializados FCB S.A.S. collects and processes the personal data of students, trainees and other people involved in academic training or training placements at the institution, in accordance with the applicable agreements and legal provisions.

This information will be processed for the following purposes, as applicable:

• Identifying, registering and verifying the personal, academic and contact information of students and trainees taking part in institutional training activities.
• Managing the application, selection, acceptance, engagement, entry, presence and completion of training placements and academic activities.
• Verifying compliance with the academic, administrative, legal and safety requirements for placements, including the coverage and enrollment required for each type of engagement.
• Coordinating, carrying out and supervising the training activities set out in agreements with educational institutions.
• Carrying out onboarding, training, guidance, follow-up, academic performance evaluation and verification of competencies related to the authorized activities.
• Preparing and sending academic reports, evaluations, certificates and other documents required by educational institutions, within the authorized purposes and the applicable legal or contractual obligations.
• Managing the participation of students and trainees in clinical, academic, scientific and continuing education activities, according to the corresponding institutional roles and authorizations.
• Maintaining communications related to the scheduling, performance, supervision and evaluation of training placements and other academic activities.
• Managing the payments, financial support, recognition or pay that apply legally or contractually, when applicable.
• Managing identification, entry control, presence, physical security and authorized access to the institution’s facilities, equipment and systems.
• Responding to requests from competent authorities and meeting the legal, academic, administrative and contractual obligations related to training placements.
• Keeping documents and records related to academic activities for the periods set out in the applicable law and the corresponding contractual obligations.

The processing of students’ and trainees’ personal data will be limited to the information that is necessary, relevant and adequate for the stated purposes and will be carried out with the corresponding authorization when legally required.

Students and trainees who, in the course of their authorized activities, have access to patients’ personal data, medical records or confidential institutional information must meet the confidentiality, security and restricted-access obligations set out in current law and the institution’s procedures.

Access to clinical information will be limited to authorized and supervised training activities, according to the applicable competencies, responsibilities and legal conditions. Consulting, copying, extracting, disclosing or using patients’ personal data for purposes unrelated to the activities authorized by the institution is not permitted.

Students’ participation in scientific or academic research projects that involve processing personal data is subject to the applicable ethical, legal and institutional requirements, including the required authorizations and measures to protect data subjects’ identity.

The institution will not use the personal data of students and trainees for purposes other than those stated, unless there is an applicable legal basis or the corresponding authorization is obtained.

4.2.11. Processing of personal data through video surveillance systems

Servicios Especializados FCB S.A.S. may use video surveillance systems in authorized areas of its facilities to help keep patients, users, workers, contractors, visitors and anyone else entering the institution safe, and to protect its property, equipment, infrastructure and resources.

Capturing, recording, storing, consulting, playing back, keeping and, where applicable, communicating images that make it possible to identify natural persons are personal data processing operations and are subject to the principles and obligations set out in current Colombian law.

Video surveillance systems will be used for legitimate, specific purposes communicated in advance, mainly related to physical security, preventing and verifying security incidents and protecting people and institutional property.

Servicios Especializados FCB S.A.S. will inform people of the existence of video surveillance systems through visible, understandable signs at entrances and other relevant areas. These signs will identify the data controller, the purposes of capturing images, the rights of data subjects and how to consult the personal data processing policy.

Cameras will be installed and positioned according to criteria of necessity, proportionality and relevance. No video surveillance devices will be installed in restrooms, changing rooms or other spaces intended for intimate or private activities. In healthcare areas, the need to capture images and its impact on patients’ privacy, dignity and confidentiality will be specially assessed.

Access to images and recordings will be restricted to expressly authorized staff, according to their duties and responsibilities, and technical, administrative and organizational measures will be applied to prevent unauthorized consultation, copying, modification, extraction, disclosure or use.

Images and recordings may be used to verify security incidents and, when legally appropriate, as supporting evidence in administrative, disciplinary or judicial proceedings, respecting the rights of data subjects and the applicable provisions.

Images or recordings will be provided to competent authorities or legally entitled third parties only after verifying that the request is appropriate and with the measures needed to protect the personal data of other people who may appear in the recordings.

Recordings will be kept for as long as needed to fulfill the stated purposes, according to the retention periods set by the institution and the applicable legal obligations. When a recording is needed for an investigation, complaint, authority request or legal proceeding, it may be kept for the legally appropriate period.

Once the purpose of processing has been fulfilled and the applicable retention periods have expired, recordings will be deleted using appropriate mechanisms, unless a legal obligation justifies keeping them.

Capturing audio, using facial recognition or biometric identification, or adding automated image analysis tools are subject to a specific assessment of necessity, proportionality, risks, purposes and legal requirements before implementation.

Data subjects may exercise their rights regarding images and recordings that contain their personal data through the channels set out in this policy, respecting the rights of third parties and the applicable legal limits.

4.2.12. Privacy notice and publication of the personal data processing policy

Servicios Especializados FCB S.A.S., in compliance with Colombian personal data protection law, has mechanisms to inform data subjects of the existence of this Personal Data Processing and Protection Policy, the purposes for which their information is processed and the means established to learn about and exercise their rights.

To this end, the institution has document MA040102D – Privacy Notice, which will be made available to data subjects by physical, electronic or digital means, according to the characteristics of the institution’s processes and the channels used to collect personal data.

The privacy notice will contain, at a minimum:

• The identification, company name and contact details of Servicios Especializados FCB S.A.S. as data controller.
• The specific purposes of processing the personal data.
• The rights of the data subjects.
• The mechanisms the institution provides so that data subjects can learn about and consult this policy, as well as any substantial changes to it or to the privacy notice.
• Special information about the processing of sensitive personal data and the optional nature of providing it, when applicable.

Servicios Especializados FCB S.A.S. will ensure that data subjects can consult the Personal Data Processing and Protection Policy free of charge, at any time and through appropriate means of access.

The institution may publish the privacy notice and the policy on its institutional website, at service points, in admission documents, on physical or electronic forms and through other appropriate means of informing data subjects, as applicable.

When there are substantial changes to the purposes of processing or to conditions that affect the content of the authorization given, the institution will inform data subjects in a timely manner and request a new authorization when legally required.

Servicios Especializados FCB S.A.S. will keep evidence of the mechanisms used to make the privacy notice and the processing policy available to data subjects, in accordance with its internal records management and personal data protection procedures.

Publishing or communicating the privacy notice does not replace the obligation to obtain the data subject’s authorization when legally required, nor does it release the institution from the other obligations set out in the applicable law.

4.3. Duties of the data controller

Servicios Especializados FCB S.A.S., as Personal Data Controller, will fulfill the duties set out in Law 1581 of 2012, its regulations and other applicable rules, guaranteeing the protection of data subjects’ rights and the proper processing of their personal information.

In carrying out these obligations, the institution must:

• Guarantee the data subject, at all times, the full and effective exercise of the constitutional right of habeas data.
• Request and keep proof of the authorization given by the data subject when legally required, using mechanisms that allow it to be consulted and verified later.
• Duly inform the data subject of the purposes for which their personal data is processed, their rights and the institutional channels for exercising them.
• Keep the information under security conditions that prevent its alteration, loss, consultation, use, access or unauthorized or fraudulent disclosure.
• Ensure that the information processed is truthful, complete, accurate, up to date, verifiable and understandable, in accordance with the applicable law.
• Update information in a timely manner and correct personal data when appropriate, taking the measures needed to maintain its quality.
• Process the queries and complaints submitted by data subjects, their successors, legal representatives or duly entitled persons within the time limits set out in current law.
• Adopt and maintain internal policies, procedures and mechanisms that ensure compliance with personal data protection rules and the proper handling of queries and complaints.
• Allow access to information only to people who are legally or institutionally authorized to process it, according to the corresponding purposes and responsibilities.
• Provide data processors, when applicable, only with personal data whose processing is authorized or legally permitted, and ensure that the information provided is adequate for the intended purposes.
• Require data processors to comply with the applicable security, confidentiality, purpose, restricted-access and other legal and contractual obligations.
• Inform data processors in a timely manner of any changes to the personal data provided and communicate the corresponding corrections, updates or restrictions.
• Inform the data processor when certain information is being disputed by the data subject, once the complaint has been filed and until the process has concluded.
• Refrain from circulating information that is being disputed by the data subject and whose blocking has been ordered by the Superintendency of Industry and Commerce.
• Inform the data subject, upon request, of how their personal data has been used, within the conditions set out in current law.
• Inform the Superintendency of Industry and Commerce of breaches of security codes when there are risks in the management of data subjects’ information, in accordance with the applicable legal requirements, conditions and time limits.
• Comply with the instructions and requests issued by the Superintendency of Industry and Commerce in the exercise of its legal powers.
• Guarantee special protection for sensitive personal data, particularly health-related data, as well as the confidentiality, privacy, custody and restricted access of medical records and other healthcare records.
• Respect the prevailing rights of children and adolescents and apply the special guarantees set out for processing their personal data.
• Keep personal data only for the periods needed to fulfill the stated purposes and the applicable legal or contractual obligations, observing the special records retention regimes.
• Implement mechanisms to identify, report, assess, handle and follow up on security incidents that may compromise personal data, taking the containment, correction and notification measures that are legally required.
• Ensure that the transmission, transfer and other forms of communicating personal data to third parties are carried out in accordance with the stated purposes, the required authorizations and the conditions set out in the applicable law.

Servicios Especializados FCB S.A.S. will carry out these duties through the procedures, controls, responsibilities and monitoring mechanisms established in its institutional management system and in its internal documents on personal data protection.

The institution will promote the training and awareness of its workers, contractors and other people authorized to process personal information, in order to strengthen the culture of data protection and prevent unauthorized processing.

4.4. Rights of data subjects

Servicios Especializados FCB S.A.S. recognizes and guarantees the rights of data subjects set out in the Political Constitution of Colombia, Law 1581 of 2012, its regulations and other applicable rules.

Data subjects, personally or through their successors, legal representatives or duly authorized persons, as applicable, may exercise the following rights:

Know their personal data

Request information about the personal data that Servicios Especializados FCB S.A.S. processes.

Update their personal data

Request the updating of information that has changed or is out of date, in accordance with the applicable legal requirements.

Correct their personal data

Request the correction of data that is partial, inaccurate, incomplete, fragmented or misleading, or whose processing is prohibited or has not been authorized, when applicable.

Request proof of authorization

Obtain information and evidence of the authorization given for the processing of their personal data, except in the cases expressly excepted by law.

Be informed about the use of their personal data

Request information about the purposes and the processing carried out with their personal data, within the limits set out in the applicable law.

Access their personal data free of charge

Consult the personal information that has been processed, under the conditions of free access, frequency and other rules set out in current law.

Revoke the authorization

Request revocation of the authorization given for the processing of their personal data, when legally appropriate and provided there is no legal or contractual duty that prevents fully or partially granting the request.

Request deletion of personal data

Request the erasure of their personal data when legally appropriate, particularly when the processing does not respect constitutional and legal principles, rights and guarantees, without prejudice to the corresponding retention obligations.

Submit queries and complaints

Make requests related to knowing, updating, correcting, deleting, revoking and other rights over their personal data, through the institutional channels established for that purpose.

File complaints with the data protection authority

Go to the Superintendency of Industry and Commerce for alleged violations of personal data protection law, once the query or complaint process with the data controller or processor has been completed, in accordance with the law.

Decline to provide sensitive data in the cases provided by law

Be informed that answering questions about sensitive personal data or data about children and adolescents is optional, without prejudice to the legal and clinical requirements that apply to the provision of health services.

These rights will be exercised in accordance with the procedures, requirements, time limits and limitations set out in current Colombian law.

When requests relate to medical records, healthcare records, medical information or other documents subject to legal confidentiality, Servicios Especializados FCB S.A.S. will apply the special provisions on confidentiality, access, custody, retention and protection of the information.

A request to delete personal data or revoke authorization does not automatically erase information that must be kept because of a legal or contractual obligation, including medical records and other records subject to mandatory retention periods.

In these cases, the institution will inform the data subject of the reasons that prevent it from fully or partially granting the request and will limit the processing of the information to the legally permitted purposes.

Servicios Especializados FCB S.A.S. will ensure that data subjects can exercise their rights through the institutional channels set out in this policy, without prejudice to the special mechanisms for accessing medical records and other information subject to legal confidentiality.

4.5. Cases in which the data subject’s authorization is not required

Servicios Especializados FCB S.A.S., in accordance with article 10 of Law 1581 of 2012 and other applicable provisions, may process personal data without the data subject’s authorization only when one of the exceptions expressly established by law applies.

The data subject’s authorization is not required in the following cases:

Information required by competent authorities

When personal data is requested by a public or administrative entity in the exercise of its legal functions or by court order, within the requesting authority’s scope of competence and in compliance with the applicable confidentiality provisions.

Data of a public nature

When the processing involves personal data that is public under Colombian law, respecting the principles of purpose, necessity, restricted circulation and other applicable legal conditions.

Medical or health emergencies

When processing personal data is necessary to handle a medical or health emergency, under the conditions provided by law and limited to the information relevant to the situation that gives rise to the exception.

Historical, statistical or scientific purposes

When the processing of information is authorized by law for historical, statistical or scientific purposes, in compliance with the corresponding legal, ethical and personal data protection requirements. In these cases, the necessary measures will be taken to protect the identity of data subjects and guarantee the confidentiality of the information, including removing identifying elements when legally required.

Data related to the Civil Registry

When the processing involves data covered by this legal exception, respecting the special provisions that govern its access, use and circulation.

Applying any of the exceptions above does not release Servicios Especializados FCB S.A.S. from complying with the principles, duties and protection measures set out in current law.

In particular, when the processing involves sensitive personal data, health-related information or medical records, the institution must observe the special conditions of confidentiality, privacy, security, restricted access and other applicable legal requirements.

Providing information to authorities or legally entitled third parties is subject to verifying the competence, purpose, scope and appropriateness of the request, as well as the corresponding legal restrictions.

The institution will not interpret these exceptions as a general authorization to use, disclose or share personal data for commercial, advertising, promotional or other purposes not permitted by law.

The internal mechanisms for identifying, documenting and verifying that legal exceptions apply will be developed in the institution’s personal data protection procedures.

4.7. Area responsible for handling queries, requests and complaints about personal data

Servicios Especializados FCB S.A.S., in compliance with Colombian personal data protection law, has institutional mechanisms to receive, manage and respond to the queries, requests and complaints submitted by data subjects, their successors, legal representatives or duly entitled persons.

The institution has a formally designated Personal Data Protection Officer, who is responsible for coordinating, guiding and following up on activities related to the exercise of data subjects’ rights, according to the duties and responsibilities set by the institution.

The Patient Information and Services Office (SIAU) will take part in receiving, guiding and routing requests related to the processing of personal data, in accordance with the institution’s procedures.

Requests received by SIAU or through the other official channels will be forwarded promptly to the Personal Data Protection Officer or to the institutional manager designated to handle them, as appropriate.

The institutional processes that collect, store, consult, use or manage personal data must help handle requests, providing the necessary information and taking the appropriate measures within their responsibilities.

Servicios Especializados FCB S.A.S. will ensure that queries and complaints are handled within the time limits set out in current law, through mechanisms that allow them to be recorded, followed up, answered and documented.

While handling these requests, the institution will apply identity verification, standing, confidentiality and restricted-access measures, especially when sensitive personal data, health-related information or medical records are involved.

Data subjects may submit their requests through the institutional channels set out in section 4.2.1 of this policy.

The institution will ensure that submitting requests related to personal data protection rights is not conditional on using a single area or channel, provided the request is received through an enabled institutional channel.

The operating procedures for receiving, classifying, assigning, following up, answering and closing queries and complaints, as well as the responsibilities of the processes involved, will be developed in the institution’s internal personal data protection documents.

Legal responsibility for meeting personal data protection obligations remains with Servicios Especializados FCB S.A.S. as data controller.

4.8. Procedure for exercising data subjects’ rights

Servicios Especializados FCB S.A.S. guarantees data subjects, their successors, legal representatives and duly entitled persons the exercise of their rights to know, access, update, correct and delete their data, revoke authorization and other rights recognized by current Colombian law.

Queries and complaints related to the processing of personal data will be received, managed and answered in accordance with the requirements and time limits set out in Law 1581 of 2012 and other applicable provisions.

4.8.1. Submitting requests

Data subjects may submit their queries and complaints through the institutional channels set out in section 4.2.1 of this policy.

Requests may be made directly by the data subject or by their successors, legal representatives or duly authorized persons, as applicable.

The institution will verify the requester’s identity and standing using mechanisms proportionate to the nature of the information requested, especially when sensitive personal data or confidential clinical information is involved.

4.8.2. Content of requests

To make them easier to handle, requests should include, as applicable:

• Identification of the data subject and of the requester, when they are different people.
• A clear description of the query, complaint or right to be exercised.
• The information needed to identify the personal data related to the request.
• Documents or evidence showing representation or standing, when applicable.
• A means of contact for receiving the institution’s response.

Servicios Especializados FCB S.A.S. will guide requesters when information needs to be added, avoiding unjustified requirements or disproportionate barriers to the exercise of their rights.

4.8.3. Handling queries

Queries about knowing, accessing or receiving information on the processing of personal data will be answered within a maximum of ten (10) business days from the date they are received.

When a query cannot be answered within that period, the institution will inform the requester of the reasons for the delay and the date on which the request will be answered, which may not be more than five (5) business days after the initial period expires.

4.8.4. Handling complaints

Complaints about updating, correcting or deleting personal data, revoking authorization or alleged failure to meet data protection duties will be processed in accordance with article 15 of Law 1581 of 2012 and other applicable provisions.

The maximum period for handling a complaint is fifteen (15) business days from the day after it is received, under the conditions provided by law.

When a complaint cannot be handled within that period, the institution will inform the requester, before the period expires, of the reasons for the delay and the date on which it will be handled, which may not be more than eight (8) business days after the initial period expires.

4.8.5. Incomplete complaints and corrections

When a complaint is incomplete, Servicios Especializados FCB S.A.S. will ask the requester, within five (5) days of receiving it, to correct the identified deficiencies.

If two (2) months pass from the date of that request without the requester providing the information, the complaint will be considered withdrawn, in accordance with the applicable law.

Once the complete complaint has been received, the institution will add a note reading “complaint in process” and its reason to the corresponding database, within a maximum of two (2) business days.

That note will remain until the complaint is decided.

When Servicios Especializados FCB S.A.S. is not competent to resolve a complaint, it will forward it to the appropriate party within the legal time limit and inform the requester.

4.8.6. Responses to requests

The institution’s responses will be clear, complete, timely and consistent with the request submitted, within the limits set out in current law.

When a request to delete personal data or revoke authorization is not legally appropriate, the institution will inform the requester of the reasons that prevent it from fully or partially granting it.

Requests related to medical records and other confidential healthcare information will be handled under the special provisions that apply to their access, confidentiality and retention.

4.8.7. Filing complaints with the data protection authority

The data subject or legally entitled persons may file complaints with the Superintendency of Industry and Commerce for alleged violations of personal data protection law, once the query or complaint process with the data controller or processor has been completed, in accordance with article 16 of Law 1581 of 2012.

4.8.8. Recording and follow-up

Servicios Especializados FCB S.A.S. will adopt mechanisms to record, classify, assign, manage, answer and keep evidence of the queries and complaints received, ensuring compliance with legal time limits and the confidentiality of the information.

The specific responsibilities of the institutional processes and the operating controls for handling these requests will be developed in the internal personal data protection procedures.

4.9. Validity, updates and retention of personal data

This Personal Data Processing and Protection Policy of Servicios Especializados FCB S.A.S. takes effect from the date its updated version is approved and published, in accordance with the institution’s document control procedure.

The policy will remain in force until it is modified, replaced or repealed through the established institutional mechanisms, without prejudice to any updates needed to keep it in line with the applicable law.

4.9.1. Updates to the policy

Servicios Especializados FCB S.A.S. will review and update this policy when there are changes in the law, changes in the purposes of processing, new processes or technologies, changes in the organizational structure or any other circumstance that makes an update necessary.

Changes will be managed under the institution’s document control procedure, ensuring that versions are identified, approved and published and that the corresponding records are kept.

When substantial changes are made to the policy, they will be communicated to data subjects in a timely manner through appropriate and accessible means, in accordance with current law.

When a change in the purposes of processing requires a new authorization from the data subject, the institution will request it in advance, as legally required.

4.9.2. Validity of databases and retention of information

The personal databases managed by Servicios Especializados FCB S.A.S. will remain in force for as long as the legitimate purposes for which they were created and the applicable legal or contractual obligations require.

Personal data will be processed and kept for as long as needed to fulfill those purposes, meet legal or contractual obligations, exercise rights or comply with requests from competent authorities, as applicable.

Retention periods will be determined according to the nature of the information, its purpose, the applicable regulations and the records management instruments adopted by the institution.

4.9.3. Retention of clinical information

Medical records, diagnostic results, healthcare records and other information subject to special retention regimes will be managed in accordance with the applicable health and records regulations.

The institution will guarantee the confidentiality, integrity, availability, privacy, custody and security of clinical information for the legally required periods.

Requests for deletion or revocation of authorization will not lead to the erasure of information that must be kept by law.

4.9.4. End of processing and disposal of personal data

Once the purposes that justified the processing have been fulfilled and the legally required retention periods have expired, Servicios Especializados FCB S.A.S. will assess whether the personal data should be securely deleted, anonymized or otherwise disposed of, in accordance with current law and its institutional procedures.

When a legal or contractual obligation to keep certain information remains, its processing will be limited to the permitted purposes for the corresponding period.

The institution will implement mechanisms to ensure that personal data is kept and disposed of securely, in a documented way and in accordance with the applicable legal requirements.

Related documents and records

MA040101G

Policy for the proper processing of personal information.

MA040102D

Privacy notice.

ME030111P

Institutional document control procedure.

MA040101-R1

Authorization for the processing of personal data.

MA040101-R2

Authorization for the use of personal data and image.

MA040101-R3

Employee confidentiality agreement.

MA040101-R4

Confidentiality agreement for contractors and suppliers.

MA040101-R5

Informed consent for capturing a digital signature.

Change history

Version 01 (September 22, 2016)

Original version.

Version 02 (April 15, 2018)

Corporate image update.

Version 03 (August 31, 2020)

New document code due to changes in the process map.

Version 04 (November 5, 2026)

Complete update of the policy, regulatory alignment, reorganized content, removal of duplications, and updated responsibilities, procedures and document references.