Privacy policy

Quantum Estética S.A.S, which operates under the trade name Clínica Quantum, with NIT (Colombian tax ID) 901.573.402-4, is the controller of the personal data it collects through this website, its service channels and the delivery of its services, under the medical direction of Dr. Daniela Díez.

Main location: Cl. 7 # 39-290, Consultorio 516, Piso 5, El Poblado, Medellín, Colombia. Argentina location: Av. Gaona 1237, Depto 11-2, Buenos Aires. Personal data requests: WhatsApp +57 300 244 0656, email info@quantumclinica.com, or in writing at the main location.

This policy applies to patients, people interested in our services, website visitors, suppliers, contractors, staff and job applicants, and covers all the physical and digital databases we manage.

We process personal data in accordance with Article 15 of the Political Constitution of Colombia, Ley Estatutaria 1581 de 2012 (Colombia's Data Protection Law), Decreto 1377 de 2013, Decreto 1074 de 2015 and any rules that amend or supplement them. Health information is also handled under Colombian regulations on medical records and medical confidentiality.

For care provided in Argentina, Ley 25.326 (Personal Data Protection Law) and Ley 26.529 (Patient Rights Law) also apply.

Data subject: the individual whose data is processed. Personal data: any information linked to an identified or identifiable individual. Sensitive data: data that affects the data subject's privacy or whose misuse could lead to discrimination, such as health data, sex life, biometric data and clinical photographs.

Processing: any operation performed on personal data, such as collection, storage, use, circulation or deletion. Authorization: the data subject's prior, express and informed consent. Controller: whoever decides on the database and its processing. Processor: whoever processes data on behalf of the controller, such as a technology provider.

Transmission: sharing data with a processor, inside or outside Colombia, so that it processes the data on the controller's behalf. Transfer: sending data to another controller, inside or outside the country.

Identification and contact data: name, ID document, date of birth, phone number, email address, and city and country of residence.

Health data (sensitive): medical history, allergies, medications, diagnosis, progress, informed consents and any other information that makes up your medical record. Also clinical photographs and videos of the treated areas, taken to document your consultation and your progress.

Scheduling and communication data: dates, times and status of your appointments (scheduled, confirmed, attended, canceled), the professional who sees you, the treatments and sessions you received, payments and balances, the reminders and messages we send you along with your replies, and the authorizations and communication preferences you give us.

Browsing data: IP address, device and browser type, pages visited, time on page, clicks on contact buttons and cookie identifiers, obtained through the site's measurement tools and the Meta pixel (see section 15). Payment data: receipts and billing details. We do not store full card details on this website.

Medical care: carrying out your consultation, performing procedures, creating and safekeeping your medical record, holding follow-up visits and monitoring, and handling emergencies related to your treatment.

Appointment management and communication: scheduling, confirming and reminding you of appointments, including an automatic WhatsApp reminder the day before each appointment, and answering your questions by WhatsApp, phone call, email or messaging, in Colombia or in Argentina depending on the location you choose.

Treatment follow-up and marketing communications: reminding you when a follow-up visit for a treatment you received is due, and sending you information about services, news and promotions, only if you authorize it separately. You can withdraw this authorization at any time without affecting your medical care (see section 10).

Administrative and legal management: billing, collections, accounting, tax obligations, handling requests, complaints and claims, requests from authorities, and defense against claims.

Service improvement: measuring use of the website and the quality of care with statistical or anonymized data. Advertising: measuring the results of our ads on Facebook and Instagram, showing ads to people who visited this site or to similar profiles, and improving our campaigns, through the Meta pixel (see section 15). Suppliers, contractors and staff: managing the contractual or employment relationship and meeting the legal obligations that arise from it.

You are not required to provide sensitive data. However, some health data is essential to give you safe care, and without it we may not be able to perform the procedure.

Your medical record is confidential. It is only accessed by the healthcare staff involved in your care, and it is only shared with third parties in the cases the law allows, such as at your request, your representative's request or a competent authority's request.

Clinical photographs and videos are used for your medical record and follow-up. They are only published on the website or on social media, as before and after results, with your express, separate and written authorization, taking care not to identify you unless you agree. You can withdraw that authorization at any time and we will remove the material from our channels.

We only process data of children and adolescents when it is necessary for their care, with authorization from their legal representative and respecting their best interests and fundamental rights.

We request your authorization in advance, expressly and on an informed basis: in writing, through digital means such as forms or messages, verbally, or through unequivocal conduct, such as sending us your details to book an appointment. We keep proof of that authorization.

Under the law, authorization is not required for data of a public nature, medical or health emergencies, information requested by an authority in the exercise of its duties, processing authorized by law for historical, statistical or scientific purposes, or civil registry data.

We do not sell or rent your personal data.

We may transmit it to processors that provide services to us, under agreements that limit its use to the purposes of this policy and require confidentiality and security: the medical records and medical scheduling software (HiMed), the contact management and WhatsApp messaging platform (Kommo and Meta's WhatsApp Business API), the clinic's own database and automations (Supabase), website hosting, and billing providers, laboratories or supporting professionals.

Each system receives only what it needs: the messaging platform knows your name, ID document, cell phone number, email, date of birth and appointment details, but never your diagnosis, clinical notes or photographs; that information stays in your medical record and in the clinic's private storage.

Some of these providers have servers outside Colombia, for example in the United States. Also, if you are seen at the Argentina location, the information needed for your care may circulate between both locations. In these cases we require adequate levels of protection and, when the law requires it, your authorization.

Meta Platforms (Facebook and Instagram) receives the browsing data its pixel records on this site, as explained in section 15. Meta processes it as an independent controller, under its own privacy policy, and may do so on servers outside Colombia, including in the United States.

We will also provide information to judicial, health or administrative authorities when required by law or by a competent order.

When you book your first appointment, we ask you for two separate authorizations, whose text you can read in our privacy notice (/en/privacy-notice/). The first covers your care and appointment reminders; the second, which is optional, covers treatment follow-ups and promotions. We keep your answer and its date as proof of the authorization.

Appointment reminders: the day before, you receive a WhatsApp message from the clinic's number, using an approved template, with the date and time, which lets you confirm or ask for a change. Your reply updates the appointment status in our schedule. It is a service message: it contains no clinical information.

Follow-ups and promotions: only if you authorized them. We send at most one message per week, Monday to Friday between 7:00 a.m. and 7:00 p.m. and Saturdays between 8:00 a.m. and 3:00 p.m., never on Sundays or public holidays, in accordance with Ley 2300 de 2023 (Colombia's law limiting contact hours for marketing messages). We do not send follow-ups to anyone who already has an upcoming appointment booked.

You can withdraw your authorization for follow-ups by replying BAJA ("unsubscribe") to any message or by writing to us; we stop sending them the same day and note it in your record. You can also ask us to stop sending reminders; in that case we will contact you through the channel you choose.

To measure the effectiveness of our advertising, when a person who came from an ad books or attends an appointment, we report that event to Meta through its Conversions API, identified only by the encrypted (hashed) cell phone number and without the treatment, diagnosis or any other health data. You can object to this use by writing to us.

As a data subject you can: access, update and correct your data; request proof of the authorization you gave; be informed about how we have used it; revoke the authorization or request deletion of your data when legal principles, rights and guarantees are not respected; access your data free of charge; and file complaints with the Superintendencia de Industria y Comercio (Colombia's data protection authority) once you have completed the inquiry or claim process with us.

Deletion and revocation do not apply when there is a legal or contractual duty to keep the data. In particular, the medical record must be kept for the periods set by health regulations, although you can ask us to stop using your data for marketing or publication purposes.

You can send your request by WhatsApp to +57 300 244 0656, by email to info@quantumclinica.com, or in writing at our main location. Include your full name, ID document, contact details, a clear description of what you are requesting and any supporting documents. If you are acting on behalf of another person, attach the document that proves you represent them.

Inquiries: we answer them within a maximum of ten (10) business days from receipt. If that is not possible, we will tell you why and give you a new date, which will not exceed five (5) additional business days.

Claims (correction, update, deletion, revocation or non-compliance): we handle them within a maximum of fifteen (15) business days from the day after receipt, extendable by up to eight (8) more business days with prior notice. If the claim is incomplete, we will ask you to complete it within the following five (5) days; if two (2) months go by without you completing it, the claim will be considered withdrawn.

We are committed to guaranteeing the exercise of the right of habeas data, keeping proof of authorizations, informing you of the purpose of processing, keeping information accurate and up to date, correcting it when it is wrong, handling inquiries and claims within the legal deadlines, and notifying the authority when there are risks in the management of the information.

We apply reasonable technical, human and administrative measures: restricted access with username and password, encryption of website communications, physical safekeeping of documents and confidentiality agreements with staff. No system is infallible; if an incident affecting your data occurs, we will report it to the authority and to the affected data subjects as required by law.

We keep data for as long as it is needed for the purposes described and for the periods required by health, accounting and tax regulations. Once those periods are over, we securely delete or anonymize it.

This site uses cookies and measurement tools. Some are for analytics and performance and collect statistical information about browsing.

With your authorization, we also use the Meta pixel, a tool from Meta Platforms, Inc. and Meta Platforms Ireland Limited, the companies behind Facebook and Instagram. When you visit the site, the pixel records the pages you view and clicks on the WhatsApp buttons, along with technical data: your IP address, browser and device, the page you came from, the ad identifier if you came from an ad, and the pixel's own cookies (such as _fbp and _fbc, which last up to 90 days).

We use it to know how many people come from our ads and message us, to show ads to people who visited the site and to similar profiles, and to improve our campaigns. If you have a Facebook or Instagram account, Meta may link this information to it and use it under its Privacy Policy (facebook.com/privacy/policy). Meta may process this data outside Colombia, including in the United States.

The address of the page you visit may reveal the treatment you are looking into (for example, the Botox page). We do not send the pixel your name, your phone number, the content of your conversations or any data from your medical record.

Your choice: the Meta pixel is only enabled if you accept it in the cookie notice that appears when you enter the site. You can change your decision at any time from "Cookie preferences" at the bottom of every page; if you decline, the pixel is turned off and we delete its cookies from your browser. You can also block or delete third-party cookies in your browser settings, adjust how Meta uses your activity on other sites from the Facebook or Instagram Accounts Center (Ad preferences and Your activity off Meta technologies), or write to us to exercise your rights. Declining these cookies does not prevent you from using the site.

When you message us on WhatsApp or follow us on Instagram, Facebook or TikTok, those services also process your data under their own privacy policies.

This policy is effective from its publication on this website. We may update it to reflect legal changes or changes in our services. We will publish the current version with its update date and, if a change affects the authorized purposes, we will let you know and ask for a new authorization when appropriate.

The databases will remain in effect for as long as the purposes for which they were collected and the legal retention periods remain in force.