PERSONAL DATA PROCESSING POLICY

scroll

Presentation

FUNDACIÓN VALLE DE LILI, with main office at Cra. 98 #18-49 in Cali, telephone 3319090, web address www.valledellili.org and email datospersonales@fvl.org.co, as the entity responsible for and in charge of the processing and custody of personal data, informs that:

The collection and processing of personal data by FUNDACIÓN VALLE DE LILI is carried out responsibly and legally, in compliance with the right to privacy, habeas data, and the protection of personal data. This is governed by the rules, procedures, and instructions adopted by the Foundation, as well as by the mandate of the Political Constitution of Colombia, Law 1581 of 2012, Decree 1377 of 2013, and other applicable regulations.

FUNDACIÓN VALLE DE LILI has collected, stored, and used personal data for several years and wishes to continue doing so in the future. To this end, and to ensure proper handling as required by law, the Foundation has established the following policy, which is available to the entire internal and external community.

To carry out these actions, FUNDACIÓN VALLE DE LILI requires the free, prior, express, voluntary, and duly informed authorization of users, clients, and any other person. This authorization allows the Institution to collect, gather, store, use, process, compile, manage, update, and dispose of the general, specific, and/or sensitive data that has been provided and incorporated into various databases or electronic repositories of all kinds held by the Institution. This information is and will be used in the performance of FUNDACIÓN VALLE DE LILI's functions as a non-profit institution providing health services, as well as for administrative, commercial, promotional, and communication purposes with data subjects.

Definitions

For the purposes of this personal data processing policy, the following definitions apply:

Authorization: Prior, express and informed consent of the data subject to carry out the processing of personal data.

Privacy Notice: Verbal or written communication generated by the responsible party, addressed to the data subject for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable to them, how to access them and the purposes of the processing that is intended to be given to the personal data.

Database: An organized set of personal data that is subject to processing.

Personal data: Any information linked to or that can be associated with one or more specific or identifiable natural persons.

General information: Contact details, such as: full name, address, landline phone number, mobile phone number, email address.

Specific data: According to the type of relationship: income level, financial data, debt capacity, gross assets, dependents, family group composition, hobbies or interests, assets owned, employment information, marital status.

Public data: Public data includes, among others, data relating to a person's marital status, profession or occupation, and their status as a merchant or public servant.

Sensitive data: This refers to data that affects the privacy of the data subject or whose misuse could lead to discrimination, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in trade unions, social or human rights organizations, or organizations that promote the interests of any political party or guarantee the rights and protections of opposition political parties, as well as data relating to health, sex life, biometric data, and medical history. This data will only be collected, incorporated, and/or stored with the prior authorization of the data subject, and only when necessary for the performance of the contractual relationship with the data subject, provided that the law permits access to such information. Therefore, access to, circulation of, and processing of sensitive data will be restricted and limited to the authorization of the data subject and as stipulated in current regulations.

Data processor: Natural or legal person, public or private, who, alone or in association with others, carries out the processing of personal data on behalf of the data controller.

Data controller: Natural or legal person, public or private, who, alone or jointly with others, decides on the database and/or the processing of the data.

Data Subject: Natural person whose personal data is being processed.

Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation or deletion.

Transfer: Data transfer takes place when the controller and/or processor of personal data sends the information or personal data to a recipient located inside or outside the country.

Transmission: Processing of personal data that involves the communication of the same within or outside the territory of the Republic of Colombia, when its purpose is to carry out a processing.

Principles of data processing

FUNDACIÓN VALLE DE LILI will apply the following principles in a harmonious and comprehensive manner:

a) Principle of legality in data processing: Processing is a regulated activity that must comply with the provisions of the law and other regulations that develop it.

b) Principle of purpose: The processing must be for a legitimate purpose in accordance with the Constitution and the law, which must be communicated to the data subject.

c) Principle of freedom: The processing may only be carried out with the prior, express and informed consent of the data subject.

d) Principle of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable and understandable.

e) Principle of transparency: In the processing, the right of the data subject to obtain from the controller or the processor, at any time and without restrictions, information about the existence of data concerning him or her must be guaranteed.

f) Principle of restricted access and circulation: The processing is subject to the limits derived from the nature of the personal data. In this sense, the processing may only be carried out by persons authorized by the data subject and/or by the persons provided for by law.

g) Security principle: Information subject to processing by the data controller or the data processor must be handled with the technical, human and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, consultation, use or unauthorized or fraudulent access.

h) Principle of confidentiality: All persons involved in the processing of personal data that are not of a public nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks involved in the processing has ended.

Purposes of data processing

FUNDACIÓN VALLE DE LILI will process the information provided and previously authorized by users in the following way:

a. IN GENERAL:

- For all users, students, employees, collaborators, healthcare providers, suppliers, and customers, the information will be used for:
- To proactively understand the needs of its stakeholders in order to innovate in the provision of its services.
- To comply with the obligations arising from existing contractual relationships with its stakeholders.
- To ensure the safety of patients, visitors, collaborators and the community in general who are in the facilities of FUNDACIÓN VALLE DE LILI.
- To communicate to users registered in our systems, SAP, the web portal and/or social networks information about new services, drugs, news, events, academic calls, publications, updates, business innovation, special programs, user education campaigns, commercial events and advertising, always related to the objectives of the Foundation, in accordance with the statutes.

To constantly communicate the needs of users registered on the web portals, in order to strengthen relationships and promote business innovation.
Develop social responsibility programs in accordance with the statutes.
Sharing data provided by collaborators, health professionals and other users with other companies for commercial or contractual purposes, unless expressly revoked by the data owner.
To achieve efficient communication related to our services and partnerships.
To be employed in clinical and/or epidemiological research; identification of clinical, scientific and technological advances.
Report marketing and/or promotional activities of your own services or those with whom you have entered into health service partnerships.
Provide feeding when applicable.
Analyze your data in studies related to health topics.
To know the level of satisfaction and the care provided.
Conduct technical-actuarial, statistical and market trend studies.
Control and prevent fraud and money laundering.
To exchange or transmit information under international agreements or treaties.
Report on changes to the data processing policy.

b. Users and customers

The information will be used for:

To perform the functions specific to the institution.
To endure medical and healthcare services.
Send diagnostic test results and/or conduct research.
Request, consult and/or change appointments with healthcare professionals.
Verify the status of affiliation and associated services related to the Social Security System.
For the delivery of medicines, supplies and/or medical equipment.

Data relating to patients' health will be strictly protected by all collaborators of FUNDACIÓN VALLE DE LILI due to its sensitive nature; therefore, the following will be taken into account when processing data of this nature:

1. Medical and healthcare staff and/or students will have access to sensitive data because the data subject has previously, expressly, and voluntarily provided them with this information. Similarly, by virtue of their professional duties, they will have access to the patient's medical history. In accordance with the required data protection measures, this information will be used for the provision of healthcare services, for general purposes, and to fulfill the corporate purpose of the VALLE DE LILI FOUNDATION.

1. The citizens of FUNDACIÓN VALLE DE LILI are informed about the sensitivity of health data, the obligations and penalties associated with its misuse, and the procedures to follow in its processing. They understand the right of access by individuals other than the data subject and how the data is classified, communicated, and shared. Furthermore, they are aware of the importance of not disclosing medical results that could affect a person's privacy and of not using the personal data of users and members for purposes other than the established medical or administrative objectives. Therefore, at FUNDACIÓN VALLE DE LILI, the protection of information is not only the responsibility of medical and healthcare personnel, but also of all individuals who have access to it within the institution in the course of their duties.

FUNDACIÓN VALLE DE LILI has the appropriate security mechanisms and controls for the protection of sensitive information and its characteristics of confidentiality, integrity and availability.
To ensure the secure delivery of medical results, it is essential that, if the patient is unable to collect them in person, they submit written authorization indicating the name of the authorized person, along with a photocopy of the national identity card of both the patient and the authorized person. If the patient authorizes delivery by email or certified mail, they must sign the form indicating this. These documents will be duly verified, organized, and subsequently filed.
However, medical professionals are directly responsible for patient care. As a teaching hospital, students may attend surgeries, consultations, and/or medical procedures, but patients have the right to decline or limit student interaction during their care. Nevertheless, medical professionals remain directly responsible for patient care.

c. Contractors and suppliers

These data will be used to complement the development of service agreements, joint ventures, and civil and/or commercial relationships, monitoring and managing their commercial performance. Additionally, they will be used to verify suitability and exchange information monthly to facilitate understanding of the services offered by FUNDACIÓN VALLE DE LILI and, in general, all aspects involved in the relationship between FUNDACIÓN VALLE DE LILI and the various Health Insurance Companies (EAPB), Prepaid Medicine providers, Mandatory Traffic Accident Insurance (SOAT), suppliers, and service providers. Furthermore, they will be used to inform these parties about activities or marketing campaigns that may be of interest to them.

The information contained in our databases of past, present, and future healthcare providers and professionals will be used by FUNDACIÓN VALLE DE LILI to gain both an objective and subjective understanding of said providers. This information will be transferred and/or transmitted to other entities only when necessary to comply with applicable legal provisions, if required by public, administrative, and/or labor oversight bodies acting in the exercise of their legal functions, or by court order.

The personal email addresses of healthcare providers, professionals, and/or suppliers will be used to facilitate contact with healthcare professionals, send internal communications of interest, and involve them in institutional activities. Additionally, this is to comply with applicable supplier laws, including, but not limited to, licensing, accreditation, commercial, and tax regulations.

d. Employees and healthcare professionals

The information contained in our databases of former employees, current employees, prospective job candidates, and past, present, or future healthcare professionals will be used by FUNDACIÓN VALLE DE LILI to gain both objective and subjective insights into its personnel. This information will be transferred and/or transmitted to other entities only when necessary to comply with applicable legal provisions, if required by public, administrative, and/or labor oversight bodies acting in the exercise of their legal functions, or by court order.

Corporate emails will be used to facilitate contact between employees, service providers and/or health professionals, to send internal communications of interest, to request them in relation to their functions and to make them participants in institutional activities.

In the case of employees, in addition to the above, access will be permitted to transmit their data to companies that request verification of employment information, authorization of loans or commercial credit, security background checks, after verification of the source and use of the data and in accordance with legal restrictions. Data will also be used for internal promotion processes, verification of qualifications, requests for information from other companies or educational institutions, training, direct contact if required, and, in general, to carry out all administrative and financial procedures directly related to the work for which they are hired.

They will also be used to provide employee wellness programs and plan business activities for the holder and their beneficiaries.

e. Students, residents and interns

FUNDACIÓN VALLE DE LILI develops its educational mission by promoting research in all fields, including the scientific, seeking to achieve efficient communication with students related to patients, the services provided and other activities related to the functions of medical education, fulfilling obligations contracted with our students and evaluating the quality of service.

It carries out marketing of educational programs at both undergraduate and postgraduate levels, as well as congresses, training sessions, workshops, conferences, academic events and surveys related to education, to those who voluntarily wish to participate.

It complies with the laws applicable to private education in Colombia, including, but not limited to, any requirements of the Ministry of National Education or judicial or administrative authorities.

Processing of sensitive data

Because this data is sensitive, the user will be explicitly informed beforehand that they are not obligated to authorize its processing. In addition to the general authorization requirements for the collection of any type of personal data, the user will be informed which of the data to be processed is sensitive and the purpose of the processing, as well as how their express consent will be obtained. No activity may be conditioned on the data subject providing sensitive personal data. Such data may only be processed when:

The owner of the personal data has given explicit authorization for such processing, except in cases where the granting of such authorization is not required by law.
The processing is necessary to safeguard the vital interests of the data subject and the data subject is physically or legally incapable of giving consent.
The processing is carried out in the course of legitimate activities and with appropriate safeguards by a foundation, NGO, association, or any other non-profit organization whose purpose is political, philosophical, religious, or trade union-related, provided that it relates exclusively to its members or to persons who maintain regular contact with it in connection with its purpose. In these cases, the data may not be disclosed to third parties without the data subject's consent.
The processing refers to data that is necessary for the recognition, exercise or defense of a right in a judicial process.
The processing has a historical, statistical, or scientific purpose. In this case, measures must be taken to anonymize the data subjects.
The processing of personal data of children and adolescents will be carried out under the parameters stated above in this policy.

CCTV

The processing of personal data has been defined as “(a)ny operation or set of operations performed on personal data, such as collection, storage, use, circulation, or erasure.” In the case of images of identified or identifiable individuals, operations such as capture, recording, transmission, storage, retention, or reproduction in real time or later, among others, are considered personal data processing and, consequently, are subject to the General Data Protection Regime.

La Fundación Valle del Lili Your personal data is collected through video surveillance for legitimate reasons. The video surveillance carried out by the Fundación Valle del Lili Its general objective is to guarantee the safety of the assets and people located at our premises.

The images captured by the video surveillance systems of the Fundación Valle del Lili will be subject to compliance with the provisions of the Law 1581 of 2012especially its guiding principles.

Purpose of the video surveillance system

Closed-circuit television (CCTV) recording is active at all our locations. These recordings are captured and processed for the legitimate interests of:

Ensuring the safety of our patients, employees, healthcare professionals, suppliers, contractors, customers, and visitors.
Protecting the safety and integrity of our staff.
Safeguarding the security and protection of our administrative and hospital facilities.
To prevent, detect and expose criminal activities.
Reduce company losses and inventory discrepancies.

As a general rule, we will not disclose this information to third parties unless required by order of the competent authorities.

Cases in which authorization is not required

In accordance with Article 10 of Law 1581 of 2013, the authorization of the holder will not be necessary when it comes to:

- a) Information required by a public or administrative entity in the exercise of its legal functions or by court order.
- b) Data of a public nature.
- c) Cases of medical or health emergency.
- d) Processing of information authorized by law for historical, statistical or scientific purposes.

e) Data related to the Civil Registry of persons.

Anyone who accesses personal data without prior authorization must, in any case, comply with the provisions contained in the law.

Legitimation for the exercise of the rights of the holder

The rights of the holders established in the law may be exercised by the following persons (article 20 of Decree 1377 of 2013):

By the holder, who must prove their identity.
By their successors, who must prove their status.
By the representative and/or attorney of the holder, after accreditation of the representation or power of attorney.
By stipulation in favor of another or for another.

The rights of children or adolescents will be exercised by the persons who are authorized to represent them.

People to whom the information can be provided

Information that meets the conditions established in this policy may be provided by FUNDACIÓN VALLE DE LILI to the following persons:

To the owners, their successors or their legal representatives.
To public or administrative entities in the exercise of their legal functions or by court order.
To third parties authorized by the owner or by law.
To the suppliers for the purposes authorized by the owner or those provided for by law.

To this end, the VALLE DE LILI FOUNDATION will ensure that conditions are established binding the provider to its privacy policies, thus protecting users' personal information. Likewise, confidentiality agreements will be established for the handling of information, as well as the obligations of the data controller and processor when the type of delivery warrants it.

Duties of the foundation as the data controller

When requesting authorization from the data subject, the data controller must clearly and expressly inform them of the following:

The processing to which your personal data will be subjected and the purpose thereof.
The optional nature of the response to the questions asked, when these relate to sensitive data or to the data of girls, boys and adolescents.
The rights you have as the owner.
The identification, physical or electronic address and telephone number of the data controller.

1. When requesting authorization from the Data Subject, the Data Controller must clearly and expressly inform them of the following:
2. The processing to which your personal data will be subjected and the purpose thereof.
3. The optional nature of the response to the questions asked, when these relate to sensitive data or to the data of girls, boys and adolescents.
4. Your rights as a Data Subject. The identification, physical or electronic address and telephone number of the Data Controller.
5. VALLE DEL LILI FOUNDATIONAs the data controller, you must keep proof of compliance with the provisions of this section and, when requested by the data subject, provide them with a copy of it.
6. Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.
7. Request and keep, under the conditions provided for in this law, a copy of the respective authorization granted by the Holder.
8. Duly inform the Owner about the purpose of the collection and the rights granted to him by virtue of the authorization granted.
9. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
10. Guarantee that the information provided to the Person in Charge of Treatment is true, complete, exact, updated, verifiable and understandable.
11. Update the information, promptly communicating to the Data Controller all changes regarding the data previously provided and take other necessary measures to ensure that the information provided to the Data Controller remains up to date.
12. Rectify the information when it is incorrect and communicate the pertinent to the Person in Charge of Treatment.

1. Provide the Data Processor, as applicable, only with data whose processing has been previously authorized in accordance with the provisions of this law.
2. Require the Data Processor, at all times, to respect the security and privacy conditions of the Data Subject's information.
3. To process inquiries and claims made in accordance with the terms set forth in this law.
4. Adopt policies and procedures in the areas where applicable to ensure proper compliance with this law and, in particular, for handling inquiries and complaints.
5. Inform the Data Controller when certain information is under discussion by the Data Subject, once the complaint has been filed and the respective process has not been completed.
6. To inform, at the request of the Data Subject, about the use given to their data.
7. Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the holders.
8. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
9. To demonstrate that the Privacy Notice and information processing policies are available when this medium is used.

1. Retain the Privacy Notice template used to fulfill the duty to inform Data Subjects of the existence of information processing policies and how to access them, as long as personal data is processed in accordance with it and the obligations arising from it remain in effect.

Retain proof of the authorization granted by the data subjects for the processing of their personal data. For these purposes,
VALLE DEL LILI FOUNDATION It will deploy the necessary physical and electronic means for the preservation of proof of the authorization granted by the owners of the personal data for the processing thereof, regardless of the means by which said authorization was obtained.

Duties of those in charge of processing

Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.
Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
To promptly update, rectify or delete data in accordance with the terms of this law.
Update the information reported by the Data Controllers within five (5) business days from receipt.
To process inquiries and claims made by the Holders in accordance with the terms set out in this law.
Adopt an internal manual of policies and procedures to ensure proper compliance with this law and, in particular, to address inquiries and complaints from Data Subjects.
Register the phrase “claim in process” in the database in the manner regulated by law.
Insert into the database the legend “information under judicial discussion” once notified by the competent authority about judicial processes related to the quality of personal data.
Refrain from circulating information that is being controversial by the Holder and whose blocking has been ordered by the Superintendency of Industry and Commerce.
Allow access to information only to people who can have access to it.
Inform the Superintendency of Industry and Commerce when there are violations of the security codes and there are risks in the administration of the information of the Holders.
Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

JOINT DUTIES OF THOSE RESPONSIBLE FOR AND IN CHARGE OF THE PROCESSING OF PERSONAL DATA

Establish simple and agile mechanisms that are permanently available to the Data Subjects, so that they can access the personal data that is under the control of those entities and exercise their rights over it.
Take reasonable measures to ensure that the personal data held in the databases are accurate and sufficient and, when requested by the Data Subject or when the controller has been able to notice it, are updated, rectified or deleted, in such a way that they satisfy the purposes of the processing.
Designate a person or area to assume the function of personal data protection, which will process the requests of the Holders for the exercise of the rights referred to in Law 1581 of 2012 and Decree 1377 of 2013.

RIGHTS AS A PERSONAL DATA SUBJECT

The data subject shall have the following rights:

To know, update, and correct your personal data held by the institution. This right may be exercised, among other things, with respect to data that is partial, inaccurate, incomplete, fragmented, misleading, or whose processing is expressly prohibited or has not been authorized.
Request proof of the authorization granted to the institution, except when expressly exempted as a requirement for treatment, in accordance with the provisions of Article 10 of Law 1581 of 2012.
To exercise this right, among others, in the face of partial, inaccurate, incomplete, fragmented data, data that induces error, or those whose processing of information is expressly prohibited or has not been tacitly or in writing authorized for the use of the information in commercials, health promotion or marketing campaigns for informational purposes, loyalty or measurement of satisfaction with the services.
The person exercising the habeas data right must accurately provide the requested contact information in order to process and address their request and fulfill the obligations for exercising their rights.
To be informed by FUNDACIÓN VALLE DE LILI, upon request, regarding the use that has been made of your personal data.
Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of the law and other regulations that modify, add to or complement it.
Access free of charge to the personal data that has been processed.

SPECIAL REQUIREMENTS FOR THE PROCESSING OF PERSONAL DATA OF CHILDREN AND ADOLESCENTS

Fundación Valle de Lili, in compliance with Law 1098 of 2006, Law 1581 of 2012, and constitutional rights, recognizes that minors may become users of the Foundation's products and services, provided they act through, or are duly represented by, their parents or legal guardians, after the minor has exercised their right to be heard. This opinion must be considered taking into account the minor's maturity, autonomy, and capacity to address the matter.

The Foundation assumes the obligation to respect and provide guarantees so that minors who are authorized users of our web portal and, in general, of our products and services, can exercise their right to freedom of expression, to the free development of personality and to information, as enshrined in Law 1098 of 2006.

In compliance with Colombian regulations regarding minors and the responsible conduct to which the Foundation is obligated, we assume the following commitments:

Exclude from our information system any person under the age of 18 who has claimed to be older than this age at the time of registering as a user.
That the best interests of children and adolescents be addressed and respected.
That their fundamental rights be respected.
Report to the authorities any criminal activity that comes to your attention and that endangers the safety of a minor. To this end, we will provide all the cooperation required by state security agencies.
Minors interested in acquiring our services using electronic payment methods must carry out the electronic financial transaction through their parents or guardians, after prior registration and contracting with them.
The Foundation, in the processing of personal data of children and adolescents, will ensure the proper use thereof.

INTERNATIONAL TRANSFER AND TRANSMISSION OF PERSONAL DATA

In order to provide you with better service and to carry out the purposes described in this privacy policy, your personal data may be transmitted and/or transferred to foreign entities and/or servers located in foreign countries, under security conditions that will guarantee compliance with the provisions of Law 1581 of 2012 and Regulatory Decree 1377 of 2013.

The following rules will apply to the transmission and transfer of personal data:

International transfers of personal data must comply with the provisions of Article 26 of Law 1581 of 2012, that is, the prohibition of transferring personal data to countries that do not provide adequate levels of data protection and the exceptional cases in which this prohibition does not apply.

International transfers of personal data between a controller and a processor, to allow the processor to carry out the processing on behalf of the controller, will not require being informed to the data subject or having their consent when there is a contract under the terms of article 25 of Law 1581 of 2012.

The transfer of personal data of any kind to countries that do not provide adequate levels of data protection is prohibited. A country is considered to offer an adequate level of data protection when it meets the standards set by the Superintendency of Industry and Commerce.

Exceptionally, FUNDACIÓN VALLE DE LILI may transfer personal data in the following cases: information for which the data subject has given their express and unequivocal authorization for the transfer; exchange of medical data when required by the treatment of the data subject for reasons of health or public hygiene; bank or stock market transfers in accordance with the legislation that is applicable to them; and transfers agreed within the framework of international treaties to which the Republic of Colombia is a party, based on the principle of reciprocity.

You may also make transfers and/or transmissions necessary for the execution of a contract between the holder and FUNDACIÓN VALLE DE LILI, or for the execution of pre-contractual measures, provided that you have the authorization of the holder.

Finally, legally required transfers will be permitted for the safeguarding of the public interest or for the recognition, exercise or defense of a right in a judicial process.

REGISTRATION AS A USER OF THE WEB PORTAL

The need to provide security to people when accessing the services provided through the Lilinet intranet portals requires the identification and personal data of users, data also necessary for the prevention of fraud and handling of security incidents.

FUNDACIÓN VALLE DE LILI, as administrator of the website www.valledellili.org , reserves the right to keep a user's registration active when the user has not provided truthful information, when the information is treated in a manner contrary to the honest uses that should be given to it, or when the user fails to comply with the policies contained herein or any of the obligations, duties and charges that are acquired at the time of registering on the website.

Users who register on this website will be responsible for any inaccurate, false, or untrue information they provide, and therefore must be truthful and reliable; otherwise, they may be liable for damages caused by this behavior to FUNDACIÓN VALLE DE LILI and/or third parties.

Anyone who uses personal data that does not belong to them will be liable for the penalties established by Colombian law regarding the violation of personal data. Therefore, FUNDACIÓN VALLE DE LILI assumes in good faith that the information provided by the registered user is truthful, accurate, and reliable; consequently, FUNDACIÓN VALLE DE LILI is exempt from any liability related to said information.

This document is an integral part of the Terms and Conditions of the website www.valledellili.org , www.ciudadlili.org and of the legal agreement of the institutional web portals that provide services to external and/or internal users of FUNDACIÓN VALLE DE LILI.

HANDLING OF REQUESTS, REQUESTS FOR CONSULTATION, UPDATING, RECTIFICATION AND DELETION OF PERSONAL DATA

The Risk Management area is responsible for processing requests from data subjects to exercise their rights. This policy applies to all databases it manages within each and every one of its departments, both at its headquarters at Cra. 98 #18-49 in the city of Cali and at all its current or future locations.

FUNDACIÓN VALLE DE LILI informs users, patients, service providers, collaborators and suppliers, as well as users of web portals and/or other tools, that in case of any controversy it will be resolved amicably, through self-composition mechanisms, such as negotiation or conciliation, in the city of Cali.

PROCEDURE FOR EXERCISING THE RIGHT OF HABEAS DATA

a) Inquiries: Inquiries must be submitted through the channel provided by FUNDACIÓN VALLE DE LILI and will be addressed within a maximum of ten (10) business days from the date of receipt. If it is not possible to address the inquiry within this period, the interested party will be informed, stating the reasons for the delay and indicating the date on which their inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the initial period.

b) Complaints: The owner or persons authorized by law who consider that the information contained in the databases should be corrected, updated or deleted, or when they notice the alleged breach of any of the duties contained in the aforementioned law, may file a complaint with the institution, which will be processed under the following rules:

The claim must be submitted in writing to FUNDACIÓN VALLE DE LILI, including the claimant's identification, a description of the events giving rise to the claim, the claimant's address, and any supporting documents. If the claim is incomplete, the claimant will be notified within five (5) days of receipt of the claim to correct the deficiencies. If the claimant fails to provide the required information within two (2) months of the notification date, the claim will be considered withdrawn. If the person receiving the claim within the institution is not authorized to resolve it, they will forward it to the appropriate party within two (2) business days and inform the claimant of the situation.

Once the complete claim is received, a note stating "claim in process" and the reason for the claim will be added to the database within no more than two (2) business days. This note must remain until the claim is resolved.

The maximum term to attend the claim shall be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to deal with the claim within that term, the interested party will be informed of the reasons for the delay and the date on which their claim will be dealt with, which in no case may exceed eight (8) working days following the expiration of the first finished.

c) Contact to resolve your requests: Data subjects may exercise their rights to consult, know, update, rectify and delete their personal data by sending their request to datospersonales@fvl.org.coor via the link: http://valledellili.org/contactanos/ or in writing to the address Cra. 98 #18-49 of Cali, who will process the request in accordance with articles 14 and 15 of Law 1581 of 2012 and 20 to 23 of Decree 1377 of 2013.

The application must contain, at least:

Full name and surnames.
Contact information (physical and/or electronic address and contact telephone numbers).
Means to receive a response to your request.
Reason(s)/fact(s) that give rise to the claim, with a brief description of the right you wish to exercise (know, update, rectify, request proof of the authorization granted, revoke it, delete, access the information).
Signature (if applicable) and identification number.

d) Controls: FUNDACIÓN VALLE DE LILI informs all its users, data subjects whose data is in the databases and/or files, that the necessary technical, human and administrative measures have been implemented to provide security to our records, preventing their alteration, loss, consultation, use or unauthorized or fraudulent access, due to the nature of the data stored and the risks to which they may be exposed.

ENTRY INTO FORCE AND TERM

This policy was approved on August 30, 2019 , replaces the previous one, and will come into effect from the date of its publication on the website.

FUNDACIÓN VALLE DE LILI will retain each user's information for as long as it is required for the purposes described in this policy, unless the data subject requests its deletion. However, personal data must be retained when required to comply with a legal or contractual obligation.

FUNDACIÓN VALLE DE LILI reserves the right to modify this policy at any time. Any modifications will be duly notified and published on the website www.valledellili.org.

This Annex must be strictly adhered to. Any deviation from or non-compliance with it by the employee will be considered a disciplinary offense by the Institution.