Personal Data Processing Policy

1. Data Controller

The controller of your personal data is Laboratorio del Dolor (operator of the UNIDOL platform, of the Laboratorio del Dolor), Tax ID (NIT) [to be confirmed], domiciled at Carrera 5 #74-03, Consultorio Piso 1, Clínica Sharón, Las Margaritas, Ibagué, Tolima, Colombia. You can contact us at info@laboratoriodeldolor.com or at +573208396748.

2. Purposes of processing

We process your personal data for the following purposes:

• Responding to your information, contact and assessment-booking requests.
• Managing clinic (IPS) leads and delivering the executive brief.
• Coordinating consultations and UNIDOL Global services for international patients.
• Routing patients to the nearest UNIDOL unit.
• Sending communications related to your request and, with your authorization, commercial information.
• Complying with legal and contractual obligations.

3. Sensitive data (health information)

Some health-related data are sensitive data under Article 5 of Law 1581 of 2012. Their processing requires your explicit, separate authorization. You are not obliged to provide sensitive data, and no service is conditioned on providing it. Where possible, we collect clinical detail directly at the unit rather than through web forms.

4. Data subject rights

As the data subject you have the right to:

• Access, update and rectify your personal data.
• Request proof of the authorization granted.
• Be informed about how your data has been used.
• File complaints with the Superintendencia de Industria y Comercio (SIC).
• Revoke authorization and/or request deletion of your data where applicable.
• Access your personal data free of charge.

5. How to exercise your rights

You can exercise your rights by writing to the data-protection area at info@laboratoriodeldolor.com. We answer inquiries within a maximum of ten (10) business days and claims within a maximum of fifteen (15) business days, under Law 1581 of 2012.

6. Authorization

Authorization to process your data is prior, express and informed, and is collected on each form via an acceptance checkbox. Silence does not constitute authorization. We keep proof of the authorization granted and of the policy version in force at the time of your acceptance.

7. Transfer and transmission of data

To provide our services we may use technology providers (hosting, analytics, messaging, CRM, payment gateway) acting as processors, some located outside Colombia. In such cases we adopt the safeguards required by law for international transfer and transmission of data.

8. Security

We apply reasonable technical, human and administrative measures to protect your data and prevent its alteration, loss, or unauthorized use or access.

9. Validity

This policy is effective from June 2026. Data will be retained for as long as necessary to fulfill the described purposes and applicable legal obligations.

This is a working document. Before final publication it must be completed with the controller's legal name, Tax ID (NIT) and address, and reviewed by Colombian legal counsel. The Spanish version is the legally binding one; this English text is a courtesy translation.