Policy for the Treatment of Personal Data

PROGENY SAS identified with NIT 900.834.428-2, hereinafter NOVAFEM, with main address at Calle 98 no.9ª-41 Of 402 of the city of Bogotá, telephone (1) 3598080, with institutional email info@babynovaclinic.com, informs its policy for the treatment of personal data.

1. PURPOSE.

This policy is issued in compliance with Law 1581 of 2012, Decree 1377 of 2013 and other regulations that modify or add to the personal data protection regime. It has the following purposes:

A. Ensure that NOVAFEM as responsible for handling personal information, perform the treatment of the same in compliance with applicable regulations.

B. To guarantee the rights of the information holders.

2. RESPONSIBLE PARTY.

PROGENY SAS identified with NIT 900.834.428-2, with main address at Calle 98 no.9ª-41 Of 402 of the city of Bogotá, telephone (1) 3598080, with institutional e-mail info@babynovaclinic.com.

3. TREATMENT TO WHICH THE DATA WILL BE SUBMITTED.

In the development of its corporate purpose, NOVAFEM, performs the processing of personal data of its patients, employees, suppliers, customers and users of its services, activity that runs directly, or by contractors or agents.

Under the principles of purpose and freedom, the collection of personal data by NOVAFEM will be limited to those personal data necessary, relevant and appropriate for the purpose for which they are collected or required under current regulations. Except in cases expressly provided by law, no personal data will be collected without the authorization of the Holder.

NOVAFEM maintains the confidentiality of personal data subject to processing and may only disclose them at the express request of the monitoring and control entities and authorities that have the legal authority to request it and will allow at any time and free of charge to know, update and correct the personal information of the Holder in accordance with Article 8 of Law 1581 of 2012.

The personal data that NOVAFEM collects through its different means or channels will be used for the activities inherent to its corporate purpose. Likewise, the company may use your personal data to offer and / or inform you, others or services directly offered by NOVAFEM. NOVAFEM may transfer your personal data to third parties, affiliates or subsidiaries, in accordance with its policy of handling personal data.

Data processing includes the collection, storage, management, use, transfer, transmission and destruction, in the manner permitted by law and is carried out for the following specific purpose for each case:

A. Processing of personal data of Patients:

The processing of personal data of patients is intended for NOVAFEM to contact them by text messages, email, physical mail, telephone, and any other suitable means of communication, to provide information, make appointments, confirm data for sending treatments and in general to develop the actions required for the provision of medical services and treatments on male sexual health, also so that in the development of consultations and other services, the doctor can make diagnoses, treatments and other procedures inherent to the health services offered. Health data are considered sensitive data by law and therefore the Holder is not obliged to provide them.

B. Processing of personal data of employees and former employees:

It is carried out to comply with the labor obligations in charge of NOVAFEM, such as payroll payments, payments and reports to the general system of social security in health, attention to consultations, requests, applications, actions and claims, made by the Holder of the information or by its legitimaries, or by entities of the general system of social security in health to which the Holder is or has been linked.

C. Processing of personal data of Suppliers:

Allows the fulfillment of contractual obligations in charge of NOVAFEM, such as payment of fees, payment reports, reports or provision of information that by legal mandate or by internal policies has the obligation to perform, attention to inquiries, requests, applications, actions and claims, made by the Holder of the information or by their legitimaries.

D. Processing of personal data of Clients and/or users:

The Treatment of personal data of Clients, has the purpose that NOVAFEM can comply with the contractual obligations under its responsibility, such as billing, payment reports or provision of information that by legal mandate or by internal policies has the obligation to perform, attention to inquiries, requests, applications, actions and claims, made by the Holder of the information or by their legitimaries.

E. Processing of data of physicians and other health professionals:

The purpose of the processing of personal data of physicians and other health professionals is to periodically contact them by means of text messages, e-mail, physical mail, telephone, and any other suitable means of communication, in order to provide information about health issues and medical and scientific information. Likewise, for the participation of projects carried out for clinical studies or those sponsored by the company. The treatment of data may involve the transfer to third parties with which NOVAFEM has agreements to carry out continuing education activities and for the purpose of granting certificates of attendance.

4. RIGHTS OF THE HOLDERS.

The holders of personal data have the following rights:

a) To know, update and rectify their personal data provided to NOVAFEM as responsible for the Treatment. This right may be exercised, among others against partial, inaccurate, incomplete, fractioned, misleading, or those whose treatment is expressly prohibited or has not been authorized.

b) Request proof of the authorization granted to NOVAFEM except when expressly excepted as a requirement for the Treatment, in accordance with the provisions of Article 10 of Law 1581 of 2012.

c) Be informed by NOVAFEM, upon request, regarding the use given to their personal data.

d) File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 DE 2012 and other rules that modify, add or supplement it.

e) To revoke the authorization and/or request the deletion of the data when the processing does not respect the principles, rights and constitutional and legal guarantees. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that NOVAFEM has incurred in conducts contrary to the Constitution and the law.

f) Access free of charge to your personal data that have been subject to treatment.

5. PROCEDURE FOR THE EXERCISE OF RIGHTS BY DATA OWNERS.

The holders of personal data should direct their queries, requests or claims to the following e-mail address.

a. Consultations: NOVAFEM must attend the consultations in a term of ten (10) working days counted from the date it was received. When it is not possible to comply with this time, the interested party must be informed expressing the reasons for the delay and the date on which the consultation will be attended in a term no longer than five (5) days.

b. Claims: The Data Subject or assignee who considers that the information contained in a database should be subject to correction, updating or deletion, or when he/she notices the alleged breach of any of the duties contained in the law or in this Policy, may submit a claim to NOVAFEM which will be processed under the following rules: i) The claim will be formulated by means of a request addressed to the legal representative of NOVAFEM or to the area in charge of the Treatment, to the e-mail: info@babynovaclinic.com with the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that he/she wants to assert. If the claim is incomplete, NOVAFEM will require the interested party within five (5) days of receipt thereof to correct the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been abandoned. ii) Once the complete claim has been received, a legend will be included in the database stating “claim in process” and the reason for it, within a period not exceeding two (2) business days. Said legend shall be maintained until the claim is decided. iii) The maximum term to address the claim shall be fifteen (15) business days from the day following the date of its receipt. When it is not possible to address the claim within such term, the interested party shall be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. iv) The Data Subject or assignee may file a complaint before the Superintendency of Industry and Commerce, once the consultation or claim process has been exhausted before the Data Controller or Data Processor.

c. Revocation of the authorization and/or deletion of the data: The Data Controllers may at any time request NOVAFEM the deletion of their personal data and/or revoke the authorization granted for the Processing of the same, by filing a complaint, in accordance with the provisions of Article 15 of Law 1581 of 2012, Decree 1377 of 2013 and the Procedure indicated in this Policy.

If upon expiration of the respective legal term, NOVAFEM has not deleted the personal data, the Holder shall have the right to request the Superintendence of Industry and Commerce to order the revocation of the authorization and/or the deletion of the personal data.

Notwithstanding the foregoing, personal data must be retained when required for compliance with a legal or contractual obligation.

6. TEMPORAL LIMITATIONS TO THE TREATMENT OF PERSONAL DATA.

NOVAFEM may only carry out the processing of personal data for the time that is reasonable and necessary, according to the purposes that justified the treatment, taking into account the provisions applicable to the matter in question and the medical, administrative, accounting, tax, legal and historical aspects of the information.

Once fulfilled the purpose or purposes of the Treatment or once expired the maximum legal term in which NOVAFEM has the obligation to conserve the personal data, NOVAFEM will proceed to the suppression of the personal data in its possession.

NOVAFEM and the persons in charge of the treatment must document the procedures for the treatment, conservation and suppression of the personal data in accordance with the dispositions applicable to the matter in question, as well as the instructions given by the Superintendence of Industry and Commerce.

7. VALIDITY OF THE POLICY.

This policy is effective as of June 1, 2015.