Website privacy policy

01Controller and contact channels

SUMAR INTEGRAL SAS, tax ID (NIT) 902108376-1. Registered address: Carrera 52b 37-05, Rionegro, Antioquia, Colombia. Website: sumarintegral.com. Privacy requests are received at sumarcap@sumarintegral.com and forwarded to SUMAR's team responsible for handling them. Business WhatsApp: +57 313 501 1197. The same address is the general commercial contact; to exercise your personal data rights, use the subject stated in this policy.

02Scope and purposes

Optional measurement aims to understand visits, pages viewed, general traffic sources and the usefulness of contact links. It is not used for personalized advertising, selling data, clinical profiles, patient decisions or association with the CRM. The form remains disabled until its integration and corresponding policy are available. Do not send diagnoses, medical records or other sensitive data through this website's contact channels.

03Statistics and technical data

Umami, hosted for SUMAR, loads only after you authorize statistics. It receives the public path without query strings or fragments, static title, language and basic browser or screen characteristics; external traffic sources are limited to the domain. Umami processes connection information to calculate session, device, browser and approximate location statistics. The server receives the IP address to handle the connection; this service must not be understood as the complete absence of personal-data processing.

Permitted events record contact clicks and the link's generic placement. Names, emails, phone numbers, messages, form fields and consent receipt identifiers are not sent to Umami. Unknown events and paths are filtered. Even without clinical data, a visited path may reflect an interest in mental health; the scope remains limited and no health profiles are created.

04Your choice and its receipt

You may reject analytics without losing access to the website or its contact channels. Optional checkboxes are not preselected. You can also save a choice or accept the available statistics. Heatmaps and session recordings are disabled and are not authorized by accepting statistics. Any future activation will require a separate notice and authorization.

Your preference is stored locally in the browser for up to 180 days, with the date and notice version. Authorizing statistics creates a separate receipt with a random reference, version, language, fingerprint of the displayed text, choice and server timestamp. It contains no IP address, name, email, form content or browsing history. Its reference remains in the browser to validate or update the choice; it is not sent to Umami. This mechanism documents a browser's choice; it does not independently verify a visitor's legal identity.

You can change or withdraw authorization through Analytics preferences in the footer. Withdrawal immediately stops new transmissions and is recorded in the receipt; if the service is unavailable, measurement remains off and recording the withdrawal is retried when you return. Withdrawal does not automatically delete previously collected statistics. Do Not Track and Global Privacy Control are respected. Analytics does not load if the receipt cannot be confirmed.

05Retention

Statistics are retained for 90 days and deleted through daily maintenance. Choice receipts are retained for 365 days after each record to handle requests and document the choice, with daily cleanup. Browser preferences expire after 180 days. These periods are implementation decisions, not universal legal minimums.

Restricted local database backups are kept for a maximum of seven days; deleted data may remain for up to seven additional days in an older backup. These are not off-VPS disaster recovery backups. Notice versions are archived to interpret receipts. Services may generate operational error and security logs, rotated by size up to three 10 MB files per service; web and receipt request access logging is not enabled. Additional manual copies must be inventoried, protected and retired according to their purpose.

06Hosting and external services

The website, Umami and receipt records are hosted on a VPS contracted with Hostinger, at a data center in the United States, according to information supplied by the client. Hosting may involve international processing on SUMAR's behalf. SUMAR must maintain applicable safeguards and data-processing agreements with the provider and assess its subprocessors; this policy does not replace those agreements.

WhatsApp and email links only open external services when selected. Their providers' terms then also apply. Accepting statistics does not load advertising integrations, external maps or recorders.

07Rights and requests

Under Colombian Law 1581 of 2012 and its regulations, you may access, update and correct your data; request proof of authorization and information about use; obtain free access; request withdrawal or deletion where applicable and file complaints with the Superintendencia de Industria y Comercio after completing the applicable procedure before the controller.

Write to sumarcap@sumarintegral.com with subject Personal data – website. Explain your request and provide a response channel. SUMAR will proportionately verify identity or representation when necessary; do not send passwords or clinical data. For receipt-related requests, retain its reference in your browser preferences to help locate it. Statistics without a personal identifier may not allow a visit to be linked to a specific person.

Inquiries are handled within ten business days of receipt, with a notified, reasoned extension of up to five business days where applicable. Complaints are handled within fifteen business days starting the day after receipt, with a notified, reasoned extension of up to eight business days where applicable. Incomplete complaints are subject to a correction request within five days; failure to correct within two months is treated as withdrawal. Requests outside SUMAR's responsibility are forwarded to the appropriate party within two business days and the requester is informed. A complaint-in-progress marker is recorded where applicable.

08Security and changes

Measures include HTTPS, restricted dashboard access, request origin and size controls, rate limiting, event filtering and separation of receipts from statistics. Administrator two-factor authentication requires enrollment by the responsible person; additional interface protection remains in place meanwhile. No system provides zero risk.

Material changes in purposes, categories or controllers will be communicated and a new choice requested where applicable. The current text and version will be available on this page. Processing sensitive data, minors' data, authenticated platforms or new purposes requires a specific assessment before expanding this policy.