Personal data processing policy

Version 2.0 · Effective as of October 14, 2026

This policy is issued in compliance with:

  • Article 15 of the Political Constitution;
  • Law 1581 of 2012;
  • Decree 1074 of 2015 (Chapters 25 and 26 of Title 2, Part 2, Book 2), which compiles Decree 1377 of 2013;
  • any other regulations that modify or complement them.

1. Data Controller

  • Company name: DOCTOOLS MEDICAL SAS
  • Domicile and address: Cra. 44 #38-11, Office 8F, 8th Floor, Barranquilla, Atlántico, Colombia
  • Email: doctools.co@gmail.com
  • Phone and WhatsApp: +57 321 501 3863
  • Website: doctools.co

Inquiries and complaints regarding personal data are handled directly by Doctools via the email doctools.co@gmail.com.

2. Definitions

We use the terms from Law 1581 of 2012:

  • Data Subject: the individual whose data is being processed.
  • Processing: any operation performed on data, such as collection, storage, use, circulation, or deletion.
  • Authorization: the prior, express, and informed consent of the Data Subject.
  • Data Processor: the party that processes data on behalf of the Data Controller.
  • Transfer: the sending of data to another Data Controller.
  • Transmission: the sending of data to a Data Processor.

3. Data we collect

  • Identification and contact: name, identification number (ID or tax ID for invoicing), email address, phone number, and shipping and billing addresses.
  • Purchase data: products, values, order history, returns, and customer service communications.
  • Payment data: processed directly by Mercado Pago and PayPal. Doctools does not receive or store your full card number.
  • Browsing data: IP address, device and browser type, pages visited, and cookie identifiers, in accordance with the Cookies Policy and what you have accepted in the cookie notice.
  • Record of your authorizations: the date, time, and version of the documents you accepted.

Sensitive data. We do not request sensitive data (for example, health data). If we were ever to request it, providing it would be optional, and we would inform you explicitly.

Minors. The site is intended for adults. We do not knowingly collect data from children or adolescents.

4. Purposes of processing

We process your data for the following purposes:

  1. To process, dispatch, and deliver your orders, and to track them.
  2. To issue sales invoices and comply with accounting, tax, and legal obligations.
  3. To handle requests, complaints, claims, withdrawal requests, payment reversals, and warranties.
  4. To send you information regarding your order status.
  5. To prevent fraud and protect the site's security.
  6. To perform statistical analysis to improve the site and our products.
  7. To send you commercial communications, news, and promotions via email, WhatsApp, or SMS, only if you have given us your authorization to do so.
  8. To show you advertising related to our products on platforms such as Meta (Facebook and Instagram), only if you accepted marketing cookies.

You may withdraw your authorization for purposes (g) and (h) at any time. Doing so will not affect the other purposes.

Commercial contact hours. In accordance with Law 2300 of 2023, we will only contact you for commercial purposes:

  • Monday to Friday, from 7:00 a.m. to 7:00 p.m.;
  • Saturdays, from 8:00 a.m. to 3:00 p.m.;
  • never on Sundays or holidays;
  • a maximum of once per week per channel.

5. Your rights as a Data Subject

According to Article 8 of Law 1581 of 2012, you have the right to:

  1. know, update, and rectify your data;
  2. request proof of the authorization you gave us;
  3. be informed of the use we make of your data;
  4. file complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law, after having exhausted the inquiry or complaint process with Doctools;
  5. revoke your authorization or request the deletion of your data, when there is no legal or contractual duty to keep it;
  6. access your data free of charge.

6. How to exercise your rights

Write to us at doctools.co@gmail.com with the subject line 'Datos personales'. Indicate:

  • your name;
  • your identification number;
  • a description of your request;
  • the address or email where you wish to receive the response;
  • any documents you wish to support your claim.

If you are acting on behalf of another person, attach the document proving that you represent them.

  • Inquiries: we respond within a maximum of ten (10) business days from receipt. If it is not possible to do so within that timeframe, we will inform you of the reason, and the response will arrive within a maximum of five (5) additional business days.
  • Complaints (correction, update, deletion, or revocation): we respond within a maximum of fifteen (15) business days. This period may be extended by up to eight (8) additional business days, after notifying you of the reason.
    • If the complaint is missing information, we will ask you to complete it within the following five (5) days.
    • If two (2) months pass without you completing it, we will understand that you have withdrawn your claim.

7. Authorization and proof

We request your authorization in a prior, express, and informed manner via a checkbox that you must mark, separate from the Terms and Conditions, in:

  • the shopping cart;
  • the contact form;
  • the subscription form.

We keep proof of each authorization: the date, time, channel, and version of this policy. This allows us to provide it to you if you request it or if the authorities require it.

8. Who we share your data with

We only share your data with third parties that help us operate, and only for the aforementioned purposes:

  • Shopify Inc. and its affiliates: e-commerce platform and site hosting.
  • Mercado Pago and PayPal: payment processing.
  • Courier companies and shipping platforms: order dispatch.
  • Meta Platforms: measurement and advertising, only if you accepted marketing cookies.
  • Authorities: when required by law or a competent order.

Some of these providers are outside of Colombia, for example, in the United States or Canada. Therefore, your data may be transferred or transmitted internationally. By authorizing this policy, you expressly authorize such transfer or transmission (Article 26 of Law 1581 of 2012). We only share data with providers that offer adequate protection measures.

We do not sell your personal data.

9. Security

We use reasonable technical, human, and administrative measures to protect your data against loss, unauthorized consultation, use, or access. These include:

  • encrypted connection (HTTPS);
  • restricted access to authorized personnel.

10. Retention period

We keep your data as long as necessary for the described purposes. Additionally, we store it during the periods required by accounting, tax, and commercial regulations: accounting books and supporting documents, for example, are kept for ten (10) years according to Article 28 of Law 962 of 2005.

Data used only for commercial purposes is deleted when you revoke your authorization.

11. Validity and changes

This policy is effective as of October 14, 2026. The databases will be active as long as Doctools continues its corporate purpose.

If we make substantial changes, we will inform you via this site or via email before applying them. If the purposes change, we will ask for a new authorization.