Personal data processing policy
1. Introduction
NEBULA MEDICAL S.A.S. (NIT 901962749-3), hereinafter "THE COMPANY", is a simplified joint-stock company incorporated under the laws of the Republic of Colombia, dedicated to the development and provision of software services based on artificial intelligence for clinical documentation in the health sector, with the purpose of structuring and streamlining the drafting of clinical records in accordance with current regulations. In the development of its corporate purpose, THE COMPANY collects and manages personal data of its various stakeholders. In order to comply with the constitutional and statutory provisions enshrined in Article 15 of the Political Constitution, Law 1581 of 2012, Decree 1074 of 2015, and other regulations governing the protection of personal data, THE COMPANY has adopted this Policy. THE COMPANY has the following contact details: Company name: Nebula Medical S.A.S. NIT: 901962749-3 Address and domicile: Carrera 18 # 93-80 Telephone: 315 632 0743 Website: https://nebula.med Contact email: privacy@nebula.med Data Protection Officer email: privacy@nebula.med
2. Purpose
The purpose of this Policy is to develop the constitutional right to Habeas Data that all individuals have regarding whom THE COMPANY carries out Processing of personal information. The scope of the Processing is delimited by the purposes that have been informed and authorized by the Data Subject. Additionally, it describes the guidelines defined to protect the Personal Data of the Data Subjects with whom THE COMPANY interacts, the purposes of processing the information, the person responsible for addressing inquiries, petitions, complaints and claims, and the procedures that must be taken into account so that Data Subjects can exercise their right to know, update, rectify, and delete their information, as well as the channels through which they can exercise them.
3. Application and Scope
This Policy applies to the databases and physical and digital files containing personal data that are under the administration of THE COMPANY, or that may be known by it by virtue of commercial relations, alliances, covenants or technological interoperability agreements with health service providing institutions (IPS), health promoting entities (EPS), independent health professionals or other actors in the health system. In cases where THE COMPANY directly manages the databases (e.g., user account data, employees, suppliers), it will act as the Data Controller. When THE COMPANY receives or processes personal health data of patients through the use of the platform by the physician, it will act solely and exclusively as the Data Processor, processing the information on behalf and by mandate of the professional or health institution (Data Controller). The Policy applies when the processing of data occurs in Colombian territory. In cases where the processing involves the participation of a processor not established in Colombia, it will be sought that their standards and policies allow THE COMPANY to comply with the fundamental duties it has under the Colombian legal framework.
This Policy is addressed to users of the platform (health professionals, health institutions), patients whose data may be processed through the services of THE COMPANY, candidates, employees, former employees, suppliers, allies, and, in general, the stakeholders for whom THE COMPANY processes personal information. All contributors of THE COMPANY must comply with this Policy. THE COMPANY will carry out the necessary educational and training campaigns so that the areas with the highest level of interaction with personal data administration know the law and the internal guidelines adopted to ensure its compliance.
4. Definitions
Authorization: Prior, express, and informed consent given by the Data Subject to carry out the processing of their personal data.
Personal data: Any information that can associate or identify a specific natural person (such as their name or identification number) or determinable person (such as their physical features).
Sensitive data: Those data that affect the privacy of the Data Subject or may lead to discrimination. They include data relating to health, sexual life, and biometric data. In the context of THE COMPANY, the health data processed correspond solely and exclusively to patients; THE COMPANY does not collect or process health data of physicians. Health professionals could only possibly provide sensitive biometric data (e.g., for authentication on the platform).
Data Processor: Natural or legal person, public or private, who by themselves or in association with others carries out the processing of personal data on behalf of the Data Controller. THE COMPANY acts as a Processor when it processes clinical data of patients on behalf of the physician or health institution.
Data Controller: Natural or legal person, public or private, who decides on the purpose of the databases and/or the processing thereof. The physician or health institution acts as the Controller for the clinical data of their patients.
Data Subject: Natural person whose personal data is subject to processing. In the context of THE COMPANY, they can be patients (in respect of whom THE COMPANY is a Processor of their health data), health professionals, employees, and suppliers (in respect of whom THE COMPANY is a Controller only of their account, contact, commercial or access biometrics data).
Processing: Any operations on personal data, such as collection, storage, use, circulation, or deletion. In the context of THE COMPANY, it includes processing through artificial intelligence algorithms.
PQR: Expression of disagreement or request submitted by a Data Subject regarding the processing of their personal data.
Inferred data: Data obtained from the analytical processing of personal data, interactions of Data Subjects with the services of THE COMPANY, habits, preferences, trends, and behaviors as a user.
Assisted clinical documentation: Software functionality that structures, organizes, and formats clinical information provided by the health professional into a record in accordance with current regulations, without diagnostic, prescription or autonomous clinical decision-making capability.
5. Principles
It is a commitment of THE COMPANY to understand and harmoniously develop the principles established in Law 1581 of 2012 and its regulatory provisions: legality, purpose, freedom, truthfulness, transparency, restricted access, security, confidentiality, and proportionality.
6. Processing A. Processing of sensitive data (Clinical data of patients)
In developing its activity of providing artificial intelligence software for clinical documentation, THE COMPANY processes sensitive personal data related to the health of patients. THE COMPANY expressly clarifies that it does not collect, request, or process data related to the health of medical professionals or account users.
In relation to these clinical patient data, THE COMPANY acts exclusively as the Data Processor. It corresponds solely and exclusively to the health professional or medical institution (acting as the Data Controller) to obtain the prior, express, and documented authorization or informed consent of the patient (Data Subject) for entering and processing their sensitive health data in the platform.
THE COMPANY will process such data strictly adhering to the instructions of the Controller and to the purpose of structuring assisted clinical documentation. In no case will THE COMPANY use patients' sensitive data for marketing, unauthorized profiling, or purposes other than the provision of the service contracted by the physician.
Biometric data that may eventually be requested from the health professional (such as authentication on the platform) are intended to guarantee user identity and prevent fraud.
B. Processing of data using artificial intelligence
THE COMPANY uses artificial intelligence algorithms and data processing techniques to structure clinical documentation and reduce the administrative burden of the health professional. This processing includes:
Processing of clinical data (audio and text) for structuring clinical documentation as directed by the health professional.
Statistical and usage analysis for the technical maintenance and improvement of the platform.
THE COMPANY is committed to ensuring that data processing through AI complies with information security standards applicable to the health sector in Colombia.
C. Nature of the service and medical liability
THE COMPANY operates an assisted clinical documentation tool. The system structures and organizes clinical information provided by the health professional, without diagnostic, prescription or autonomous clinical decision-making capability. All content generated by the platform is illustrative and must be verified, supplemented, and validated by the treating health professional, who retains full autonomy and responsibility over clinical decisions, in accordance with Law 23 of 1981 (Code of Medical Ethics), Resolution 1995 of 1999, and applicable constitutional jurisprudence. In no case does the output of the platform replace the clinical judgment of the treating physician or constitute a medical act. Responsibility for the final content of the medical history rests exclusively with the health professional who signs it, under the terms of Article 34 of Law 23 of 1981 and Judgment T-323 of 2024 of the Constitutional Court.
7. Purposes of data processing A. Platform users (health professionals and institutions as Account and Registration Data Subjects)
Use registration data (name, email, payment) for the proper provision of service and billing.
Develop activities related to the entered contracts, including sending relevant information for their execution.
Measure the level of satisfaction regarding the contracted products and/or services.
Send information about innovations in products and services through authorized means.
B. Patients (data processed through the platform as Processors)
When THE COMPANY processes patient data entered by the physician, the sole purpose will be:
Process clinical information (audio and text) in the context of providing the software service contracted by the physician or institution.
Structure and generate the draft of the assisted clinical documentation to optimize medical time, subject to the physician's final review.
Comply with information security obligations deriving from its role as Data Processor.
C. Candidates, employees, former employees, and suppliers
Develop employment, commercial or contractual relationships, verify references, payroll or professional fees payment, social security system affiliations, and physical access control through CCTV, as appropriate.
8. Validity period and duration of processing
Personal data will be subject to processing by THE COMPANY during the term in which the Data Subject has an active product, service, contract or relationship, plus the term established by law. Additionally, data will be stored in accordance with the principles of necessity and reasonableness. Regarding patients' clinical data (where Nebula is the Processor), these will be maintained according to the retention periods configured in the account of the physician or institution (Controller), who are responsible for ensuring compliance with the medical record retention times (Resolution 1995 of 1999).
9. Rights of the Data Subject
THE COMPANY guarantees and respects the rights of the Data Subjects (physicians, employees, suppliers) in respect of whom it acts as the Controller, which include:
Accessing, updating, and rectifying their personal data.
Requesting proof of the authorization granted to THE COMPANY.
Being informed regarding the use made of their data.
Revoking authorization and/or requesting deletion of the data (when legally applicable).
Filing complaints before the Superintendency of Industry and Commerce (SIC).
Clarification: Patients wishing to exercise their Habeas Data rights regarding their clinical information processed in Nebula must address their request directly to their treating physician or IPS (Data Controller). THE COMPANY will provide technical and operational support to the Controller to help reply to these requests, but it will not directly handle patient PQRs.
10. Person or area responsible for addressing inquiries, petitions, complaints and claims
THE COMPANY has designated a Data Protection Officer, who can be contacted at: Email: privacy@nebula.med Telephone: 315 632 0743
11. Procedures to ensure the exercise of the rights of the Data Subjects
Data Subjects for whom THE COMPANY is the Controller (users, employees) can consult their information or submit claims (updating, deletion) by sending an email to privacy@nebula.med accompanied by their identity document. The inquiry will be answered within a maximum of 10 business days. Claims for correction or deletion will be addressed within a maximum of 15 business days. The Data Subject must complete the prior inquiry or claim procedure before THE COMPANY before addressing the Superintendency of Industry and Commerce.
12. Channels for exercising the rights of the Data Subject
Email: privacy@nebula.med Telephone: 315 632 0743
13. Entry into force of the policy
This Personal Data Processing Policy was adopted by NEBULA MEDICAL S.A.S. in March and may be updated in accordance with current applicable legal regulations. This version was approved in the month of March.