Dra. Evelyn Melo — Oral Rehabilitation Specialist · Bogotá, Colombia

Personal Data Treatment Policy (Privacy Policy)

Legal document — Last updated: May 11, 2026. The authoritative Spanish version (Colombian legal reference) is published at https://draevelynmelo.com.co/politica-de-privacidad

1. Data Controller Identification

Dr. Evelyn Melo, dentist and Oral Rehabilitation specialist with a valid Professional License issued by the Ministry of Health and Social Protection of Colombia, is the Data Controller of personal data collected through the website draevelynmelo.com.co and associated WhatsApp channels.

2. Applicable legal framework

This policy is governed by Colombian legislation:

  • Political Constitution of Colombia, article 15 (Habeas Data).
  • Statutory Law 1581 of 2012 (General Personal Data Protection Regime).
  • Regulatory Decree 1377 of 2013.
  • Resolution 1164 of 2002 of the Ministry of Health (sensitive health data).

3. Data collected

The Data Controller collects the following personal data through the contact form and WhatsApp messages:

  • Full name.
  • Phone / WhatsApp number.
  • Treatment of interest (free text provided by the Data Subject).
  • Clinical data voluntarily shared by the Data Subject during the booking or consultation process (sensitive data under Law 1581).

4. Purpose of treatment

Data will be processed for the following specific purposes:

  1. Schedule dental assessments and treatments.
  2. Contact the Data Subject via WhatsApp, call or email to coordinate service delivery.
  3. Send appointment reminders and relevant clinical communications.
  4. Comply with applicable legal obligations (electronic invoicing, clinical records per Resolution 1995 of 1999).

Data is not used for mass marketing, database sales, or transfer to third parties for commercial purposes.

5. Data Subject rights

Under article 8 of Law 1581 of 2012, the Data Subject has the following rights:

  • Access: know, update and rectify their data.
  • Rectification: request correction of inaccurate, incomplete or misleading data.
  • Cancellation / Deletion: request deletion of their data when constitutional and legal principles, rights and guarantees are not respected.
  • Opposition: object to data processing when there is no legal or contractual obligation.
  • Consent withdrawal: withdraw consent at any time, except when processing is legally required (e.g. clinical record retention).
  • Proof of authorization: request proof of the authorization granted to the Data Controller.
  • Complaints: file complaints with the Superintendence of Industry and Commerce (SIC) for legal violations.

6. Channel to exercise rights

The Data Subject may exercise their rights through the official WhatsApp channel of the Data Controller (see Request channels section). The Controller will respond within a maximum of fifteen (15) business days for inquiries and ten (10) business days for complaints, per articles 14 and 15 of Law 1581 of 2012.

7. Sensitive data (health) treatment

Clinical data shared during consultation is considered sensitive data under article 5 of Law 1581 of 2012 and is only processed with the express authorization of the Data Subject. Clinical records are kept per Resolution 1995 of 1999 of the Ministry of Health (minimum 20-year retention period for active clinical records).

8. Information security

The Data Controller implements reasonable technical, human and administrative measures to protect data against unauthorized access, loss, alteration or misuse. Digital data is stored on services with encryption in transit (HTTPS/TLS) and two-factor authentication where possible.

9. Cookies and similar technologies

The site uses localStorage to save the visitor's language preference. It does not use advertising tracking cookies, fingerprinting, or sell data to advertising networks. Typography fonts are loaded from Google Fonts, which involves a request to Google's servers.

10. International transfers

The website is hosted on Vercel servers (United States) and uses Cloudflare as a DNS provider. Contact form data is sent via Web3Forms. These are transfers to countries with adequate protection frameworks per SIC standards.

11. Validity and modifications

This policy is effective from the last updated date indicated above. Any modifications will be published at this same URL. Continued use of the website after a modification constitutes acceptance of the new terms.

12. Additional regulatory framework

Complaints to control authority: Superintendencia de Industria y Comercio (SIC) — https://www.sic.gov.co/proteccion-de-datos-personales

Request channels