L&O Medical - Privacy policy

Last updated:2026-09-14

1. Data controller

This policy describes how we process the personal data of those who visit our website or contact us through the contact form. The data controller is:

Legal name: <RAZON SOCIAL>
Trade name: L&O Medical
Tax ID: <NIT>
Address: <DIRECCION>, <CIUDAD>, Colombia
Email: <CORREO DE CONTACTO>
Bogotá phone: +57 3135759999
Ibagué phone: +57 3004639184
Website: https://www.lyomedical.com.co

2. Scope and acceptance

This policy applies to this website and to the contact channels we offer through it. It does not apply to third-party sites or services you may reach from links published here, nor to conversations you hold with us over WhatsApp, social media or in person during a consultation, which are governed by their own terms and, where applicable, by your medical record.

By using the site or sending us a message you declare that you have read and understood this policy. If you do not agree with it, please do not use the contact form.

3. Data we collect

3.1 Data you give us

Through the contact form we receive your name, your city, your phone number, your email address and the message you choose to write to us. All of those fields are needed in order to reply to you; we collect no other data about you from the website.

3.2 Data collected automatically

IP address, browser type and version, operating system, language, pages visited, time spent and the source of the visit. This data is obtained through cookies and similar technologies for security, operational and analytics purposes, and only once you have accepted the corresponding categories.

3.3 Data we do not collect

This site has no user accounts, does not sell products or services online and does not process payments. We will never ask you through this channel for card details, banking credentials or identity documents.

4. Health data and other sensitive data

The message field is free text and, because this is a medical practice, it may end up containing information about your health. Under articles 5 and 6 of Ley 1581 of 2012, data relating to health is sensitive data and its processing is subject to a heightened standard: we process it only with your explicit authorisation and solely in order to answer your request.

You are never obliged to authorise the processing of sensitive data or to provide it. We ask you not to include diagnoses, test results, medication or any other clinical detail in the form: to write to us it is enough to tell us the general reason for your enquiry. That information belongs in the medical consultation, where it is covered by professional secrecy and by your medical record.

If you do share health information through this channel, we handle it with access restricted to the staff who must reply to you, we do not use it for advertising or targeting, we do not transfer it to third parties for commercial purposes, and we keep it only for as long as is needed to answer your request. The contact form is not a medical record and does not replace a medical assessment.

The form is not an emergency channel. If you are facing a situation that needs immediate care, go to the nearest emergency service or call your local emergency line.

5. What we use your data for

To answer your message, to book or reschedule an appointment, and to give you the information you ask us for about our services.

To follow up on your request and, if you expressly authorise us, to send you information about our services. You may withdraw that authorisation at any time by writing to us.

To protect the site against automated submissions and abuse, to comply with legal obligations that apply to us, and to analyse site usage in aggregate in order to improve it.

6. Basis for processing

We process your data on the authorisation you grant us when you send us the form, in order to attend to the request you address to us, to comply with legal obligations, and on the basis of our legitimate interest in keeping the site secure. You may revoke your authorisation at any time; doing so does not affect the lawfulness of the processing carried out beforehand, nor the legal obligations we must continue to meet.

7. Providers and third parties

To operate the site we rely on providers that process personal data on our behalf and following our instructions. Each one applies its own security measures and privacy policies:

Site hosting and content delivery: Google Cloud.
Usage analytics and aggregate metrics: Google Analytics.
Protection against abuse and automated traffic: Google reCAPTCHA and Firebase App Check.
Receiving and sending the email generated by the contact form.
Location maps for our offices: Google Maps.
Share buttons and campaign measurement on social networks: Meta and X, active only if you accept marketing cookies.

We do not sell, rent or trade your personal data, and under no circumstances do we share health information for advertising purposes.

8. International transfers

Some of our providers run servers outside Colombia, so your data may be stored or processed abroad. When that happens, we require those providers to apply a level of protection equivalent to the one described in this policy through the corresponding contractual mechanisms.

9. Data retention

We keep the messages sent through the form for as long as is needed to attend to your request and follow up on it, and afterwards only for as long as the applicable legal obligations or a possible claim require. Once that period has elapsed, the data is deleted or irreversibly anonymised. Information recorded in the medical record is governed by the special rules that regulate its retention.

10. Security

We apply reasonable technical and organisational measures to protect your data: traffic encryption over HTTPS, verification of the origin of every form submission, and access restricted to authorised staff.

No system is completely invulnerable. If you detect any misuse of your information, let us know immediately so that we can act.

11. Your rights

Under article 8 of Ley 1581 of 2012, as the data subject you may, at any time:

Know, update and rectify your personal data before the controller or the processor.
Request proof of the authorisation granted for the processing, except in the cases where the law waives that requirement.
Be informed, upon request, about the use that has been made of your personal data.
File complaints with the Superintendencia de Industria y Comercio for breaches of data protection rules.
Revoke the authorisation and request the deletion of your data, where no legal or contractual duty prevents it.
Access free of charge the personal data that has been processed.

12. Enquiries and complaints

You may submit your enquiries and complaints by writing to <CORREO DE CONTACTO>, identifying yourself and clearly stating the facts and your request.

We answer enquiries within a maximum of ten (10) business days from receipt. Where it is not possible to answer within that period, we will inform you of the reasons and of the date on which it will be dealt with, which will not exceed five (5) business days after the first period expires. Complaints are answered within a maximum of fifteen (15) business days from the day after receipt, extendable by a further eight (8) business days, after informing you of the reasons for the delay.

If you believe we have not dealt with your request, you may turn to the Superintendencia de Industria y Comercio, the competent authority in Colombia; the law requires that you first exhaust the procedure with us.

13. Cookies and similar technologies

The first time you visit we show you a notice so you can choose which cookies you accept, grouped into four categories: necessary, which make the site work, remember your language and protect the form against automated submissions, and which are always on; preferences, which remember settings such as the light or dark theme; analytics, which let us understand in aggregate how the site is used; and marketing, which covers advertising and the social network share buttons.

Until you choose, no cookie other than the necessary ones is activated. You can change your decision whenever you like from the Cookie settings link in the footer, and withdrawing your consent is as simple as giving it.

You can also block or delete cookies from your browser settings. Bear in mind that, if you disable the necessary cookies, some features of the site may stop behaving correctly.

14. Minors

The site is intended for adults. Providing the data of children and adolescents is not mandatory; where its processing is appropriate, it will be carried out respecting their prevailing rights and with the authorisation of whoever holds parental authority or legal representation.

15. Changes to this policy

We may update this policy to reflect legal or technical changes, or changes in our services. We will always publish the version in force on this page, with its update date.

16. Contact

If you have questions about this policy or about the processing of your data, write to us at <CORREO DE CONTACTO> or contact us on the phone numbers listed in section 1.