1. Nature of the data processed

General personal data

• Identification, contact, contractual, and administrative information.

Financial data

• Invoicing, payments, and accounting records.

Sensitive data

• Medical history.
• Medical background.
• Diagnostic tests.
• Pre- and post-operative photographs.
• Biometric information.
• Information on physical or mental health status.

2. Express authorization for sensitive data

The processing of sensitive data requires prior, express, and informed authorization.

• It is requested through a separate document.
• It may be revoked by the data subject when legally appropriate.
• Refusal to authorize sensitive data may prevent the coordination of the surgical process.

3. Technical, administrative, and organizational measures

• Restricted access under hierarchical control.
• Confidentiality protocols signed by collaborators.
• Segmentation of access to medical photographs.
• Strong passwords and internal authentication.
• Prohibition of storage on unauthorized personal devices.
• Absolute restriction on the use of images on informal channels.

4. Security breach protocol

In case of unauthorized access, loss, leak, or compromise of sensitive data:

• An internal contingency committee will be activated.
• The incident will be documented.
• The data subject will be notified when required.
• Notification to the Superintendency of Industry and Commerce will be evaluated in accordance with regulations.
• Immediate corrective measures will be adopted.

5. Shared responsibility clause

• Medical information may also be shared with the treating surgeon, hospital institution, and insurance company within the contractual framework.
• Each entity acts as an independent controller of the data it receives.
• Mentoring Medic does not control subsequent processing by authorized third parties in accordance with the law.

Data protection responsibility is limited to Mentoring Medic's effective control.

6. Internal disciplinary regime

Any collaborator, contractor, or associated third party who engages in any of the following behaviors:

• Accesses information without authorization.
• Shares medical images without consent.
• Stores sensitive data on unauthorized devices.
• Disseminates clinical information through informal means.

Will be subject to:

• Immediate termination of the contractual relationship.
• Civil actions for damages.
• Criminal charges when applicable.

7. Limitation of liability

• Mentoring Medic will not be responsible for publications made voluntarily by the patient on social media.
• It will not be responsible for the improper use of data by legally authorized third parties.
• It will not be responsible for external cyberattacks that exceed reasonable security measures implemented.

However, it commits to acting diligently in the event of any incident.

8. Use of images for commercial purposes

No pre- or post-operative photograph will be published without:

• Express, written, and independent authorization.
• Specific consent for advertising purposes.

Authorization may be revoked at any time, unless the image has already been published in active campaigns.

9. Retention and deletion

Data will be retained:

• During the contractual relationship.
• For the time required by legal obligations.
• Until the statute of limitations for legal actions.

The data subject may request deletion when there is no legal duty to retain it.

10. Data subject rights

The data subject may:

• Know, update, and rectify their data.
• Request proof of authorization.
• Revoke consent.
• File a complaint with the SIC.

11. Special warning about clinical photographs

The data subject acknowledges that medical images are part of the clinical process and may be required for:

• Medical follow-up.
• Policy activation.
• Support for audits.

Unauthorized manipulation or alteration of such images by the data subject does not compromise Mentoring Medic's responsibility.