Last updated: October 25, 2026
At Zaharum Medical Spa we respect your privacy. This policy explains how we collect, use and protect your personal data under Colombian data protection law, including Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015). If there is any discrepancy, the Spanish version prevails.
1. Data controller
- Controller: Yulie Lopez, owner of the business Zaharum Med Spa (trade name: Zaharum Medical Spa)
- Address: Calle 10 #42-45, Office 267, El Poblado, Medellín, Antioquia, Colombia
- Email: zaharumspa@gmail.com
- Phone / WhatsApp: +57 318 400 5760
- Website: zaharum.com
2. Data we collect
- Identification and contact: name, phone, WhatsApp, email, country of residence and date of birth.
- Appointment details: services of interest, dates, preferences and messages with us.
- Health data (sensitive data): medical history, skin type, allergies, medications, assessments and clinical records needed to perform your treatments safely.
- Images: before-and-after photos, only with your express consent.
- Payments: billing details. We do not store card numbers; card payments are processed by financial institutions.
- Browsing: IP address, device, pages visited and cookies (see section 9).
3. Purposes
- Booking, confirming and reminding you of appointments, and answering your questions.
- Assessing your case, providing services and following up afterwards.
- Creating and keeping clinical records as required by health regulations.
- Invoicing and meeting legal, accounting and tax obligations.
- Sending you information about services, promotions and reminders, if you agree. You can ask us to stop at any time.
- Asking for your feedback about your visit.
- Measuring website use and the performance of our ads.
4. Sensitive data
Health data and images are sensitive data. Answering questions about them is optional, and we only process them with your prior, express and informed consent. However, some treatments cannot be performed safely without certain medical information. Before-and-after photos are only published with a separate, express consent.
5. Minors
We only process data of people under 18 with the consent of a parent or legal guardian, respecting their best interests and fundamental rights.
6. Consent
We ask for your consent before processing your data. It can be given in writing, verbally, via WhatsApp, through forms, or through clear conduct showing that you gave it. We keep proof of it.
7. Your rights
- Know, update and correct your data.
- Request proof of the consent you gave.
- Be informed about how we use your data.
- File complaints with Colombia’s Superintendence of Industry and Commerce (SIC), after first submitting your request to us.
- Withdraw your consent and/or request deletion of your data, unless we have a legal or contractual duty to keep it (for example, clinical records).
- Access your data free of charge.
8. How to exercise your rights
Write to zaharumspa@gmail.com or WhatsApp +57 318 400 5760 with your name, your request and how to contact you. Requests are handled by Zaharum Medical Spa’s management.
- Inquiries: answered within 10 business days, extendable by 5 more business days with notice of the reason.
- Claims (correction, update, deletion or non-compliance): answered within 15 business days, extendable by 8 more business days. If a claim is incomplete, we will ask you to complete it within 5 days; if 2 months pass without a reply, it will be considered withdrawn.
9. Cookies
We use cookies to make the site work and, only if you accept them, to measure visits and improve our ads:
- Necessary: remember your language and your cookie choice. No consent required.
- Analytics (Google Analytics): tell us how many people visit the site and which pages they view.
- Advertising (Google Ads): measure whether our ads lead to inquiries or bookings.
Analytics and advertising cookies stay off until you click “Accept”. You can change your choice at any time with the “Cookie settings” button or by clearing cookies in your browser.
10. Data sharing and international transfers
We do not sell your data. To operate, we use providers that may store information outside Colombia, such as Google (analytics, advertising, email and storage), Meta (WhatsApp) and our hosting provider. They only receive data as needed to provide their services, with appropriate safeguards. We may also share data with authorities when required by law.
11. Security
We apply reasonable technical, human and administrative measures to prevent loss, misuse or unauthorized access to your information.
12. Effective date
This policy is effective as of October 25, 2026. We keep your data for as long as needed for the purposes above and for the periods required by law; for example, clinical records are kept as required by current health regulations. We will post any significant changes on this page.