Personal data policy

1. Who is responsible for your data

Wellnest coordinates medical journeys to Medellín, Colombia. The party responsible for processing your personal data is:

• PENDIENTE — nombre completo o razón social
• ID: PENDIENTE — cédula o NIT
• Address: PENDIENTE — dirección física, Medellín, Antioquia, Colombia
• Email for data matters: contact@wellnest.com.co
• Phone / WhatsApp: +57 319 341 4825

This policy covers wellnest.com.co, the flight search at vuelos.wellnest.com.co, our social links page, and any conversation we have over WhatsApp, email, phone or direct message.

2. What we collect

• Identity and contact: name, email, phone, country and city.
• What you tell us about the trip: procedures you're interested in, whether you travel with a companion, your tentative month, and the budget you state.
• Browsing data: the page you landed on, where you came from, the campaign that brought you, device type, IP address, and the exact date and time you accepted this policy.
• Trip details, only if you move forward: dates, flights, lodging and, when a booking requires it, passport or ID number.
• Payments: only the reference returned by the payment processor.

We never store card numbers. The payment processor captures and holds them, not us.

Your medical record is written by your doctor, not by Wellnest. If you authorize us to process your health data (section 3), the surgeon or dentist treating you can record your assessment and follow-up in the Wellnest medical portal. Those records are signed by them, nobody else can change them, and only the medical team assigned to your case and the Wellnest staff coordinating your care can see them. Every time someone opens your record, it is logged.

3. About health data

Telling us which procedure interests you is data about your health, and Colombian law classifies it as sensitive data (Law 1581 of 2012, article 5).

That changes two things, and you should know them before writing to us:

• You are not required to give it. You can contact us without naming a procedure and we'll still help you.
• We never make anything conditional on it. No service, price or attention depends on you authorizing the processing of sensitive data.

If you choose to tell us, you expressly authorize us to use it solely for the purposes in section 4.

If you send us photos for the free assessment. In the planner on our page you can, if you want, send us photos of the area you're interested in and tell us what you're looking for, so the doctor or specialist can give you their opinion. It's optional and has its own authorization, separate from the others. The photos are seen only by the medical team and the Wellnest staff coordinating your care; they are kept in private storage, with no public links, and deleted with the rest of your data if you request erasure. They are never published or used as "before and after" without a separate written authorization from you.

4. What we use it for

• Building your trip estimate and explaining what it includes.
• Contacting you over WhatsApp, email or phone to answer your questions.
• Coordinating your assessment with the partner surgeon or dentist.
• Booking the hotel, recovery house and transfers.
• Issuing quotes, collecting payment, invoicing and bookkeeping.
• Supporting you before, during and after the trip, including post-operative logistics.
• Meeting Colombian legal, accounting and tax obligations.
• Measuring, in aggregate, which channels and campaigns work.

Separately, and only if you tick the optional box: sending you news, seasonal offers and travel tips you did not ask for. It is a different purpose, so it carries its own authorization.

That box starts unticked and conditions nothing: leave it alone and we still answer you, quote you and coordinate your whole trip. The only thing we don't do is write to you about what you never asked about.

You can withdraw it whenever you like, through the unsubscribe link in every email or by replying STOP to any message. Only the commercial side stops: anything about your trip — your appointment, your flight, your quote — keeps arriving, because that is not advertising.

5. Who we share it with

Coordinating a medical journey requires other parties. We share only what is strictly necessary with:

• The surgeon, dentist or clinic assessing and treating you.
• The hotel and the recovery house.
• The transfer operator.
• The payment processor.
• The financing partner, only if you ask for it.
• Technology providers hosting the site, the database and our email, and our artificial intelligence provider (Anthropic).

Each one gets the minimum to do their part: the hotel gets your name and dates, not your procedure.

We do not sell your data or hand it to third parties for advertising.

International transfer. Our servers and working tools may sit outside Colombia, mainly in the United States and the European Union. By accepting this policy you authorize that transfer, subject to the safeguards in section 9.

6. How long we keep it

• If you write and don't move forward: two years from the last contact. After that we delete or anonymize it.
• If you travel with us: as long as Colombian contractual, accounting and tax obligations require, which for accounting records reaches ten years.
• The evidence of your authorization: for as long as we process your data and any period the law requires afterwards, because it is the proof that you authorized us.
• Your medical record: what your doctor signs is kept for fifteen years from your last visit, as Colombian Resolution 839 of 2017 requires. Because of that legal duty it is not deleted even if you ask us to erase the rest of your data (Decree 1377 of 2013, art. 9): it is detached from your commercial file and kept only with what is needed to identify you.

7. Your rights

As the data subject, Law 1581 (article 8) gives you the right to:

• Know, free of charge, what data we hold about you.
• Update and correct it when it is incomplete or wrong.
• Ask us for proof of the authorization you gave.
• Be told how we have used it.
• Withdraw your authorization and ask us to delete it.
• File complaints with Colombia's Superintendence of Industry and Commerce.

If you are in the European Union or the United Kingdom, the GDPR additionally gives you data portability, restriction of processing, the right to object, and the right to complain to your supervisory authority. Our legal basis is your consent and, once a trip is contracted, performance of that contract.

8. How to exercise them

Write to contact@wellnest.com.co with your name, a way to reach you, and what you need. WhatsApp works too.

The deadlines are set by Colombian law and we meet them:

• Enquiry (finding out what we hold): ten business days, extendable by five more.
• Claim (correct, delete or withdraw): fifteen business days, extendable by eight more.

If a claim arrives incomplete, we ask for what's missing within the following five days. If two months pass without a reply, it is treated as withdrawn.

Before going to the Superintendence of Industry and Commerce, the law requires exhausting this process with us first (Law 1581, article 16).

Withdrawal is immediate for commercial purposes. If a trip is already underway, some data must be kept for contractual and accounting obligations: if so, we tell you exactly what and why.

9. How we protect it

• Restricted-access database. No table is public.
• Encryption in transit (HTTPS) and at rest.
• Documents in private storage, reachable only through temporary links.
• Access limited to staff who need it for their work, with a record of who enters.
• Zero storage of card data.

No system is infallible. If an incident compromises your data, we will tell you and report it to the competent authority where required.

10. Cookies and measurement

We use the minimum needed for the site to work and to know which campaign each visit came from. You can block cookies in your browser: the site still works.

To know whether the page works, we count, without knowing who you are, how far people read and how many visits ask for their estimate. It uses no cookies and is not shared with third parties: the visit is a random number that disappears when you close the tab, and we do not store your IP, your browser or anything you type. It is deleted after 13 months. If your browser has «Global Privacy Control» or «Do Not Track» turned on, we count nothing.

The AI chat on the page. If you write to our virtual assistant, what you type is sent to our artificial intelligence provider (Anthropic) so it can answer; before sending it we remove any emails and phone numbers you include, and under its terms it does not use it to train its models. We do not store the conversation: it lives only in your browser tab and is deleted when you close it. To cap usage we count how many messages are sent each day using a code derived from your IP that changes daily and is deleted after two days; the IP itself is not stored. It is an AI: it gives no medical advice and it can be wrong, so please don't type health or personal details into the chat.

11. Minors

Our services are not directed at people under 18 and we do not knowingly collect their data. If we find data from a minor without their legal guardian's authorization, we delete it.

12. Changes to this policy

If we change it, we publish the new version here with its number and date. We keep previous versions, because your authorization is tied to the version in force on the day you gave it. We notify substantial changes through the same channel you contacted us on.

13. Term

Version 2026-10-v7, in force since September 30, 2026. The databases remain active for as long as Wellnest provides its services and throughout the retention periods in section 6.