Version 0.3 · draft pending legal review. Effective 28 October 2026. Details in square brackets will be completed once Pempol Pay Inc’s corporate details are confirmed. This is a courtesy translation: if it differs from the Spanish version, the Spanish version prevails.
This policy explains how Citaltiva collects, uses, stores, shares and protects the personal data of people who visit this site, patients who use its channels and health professionals who join the platform. It was prepared under Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled in Single Regulatory Decree 1074 of 2015) and any rules that amend or supplement them.
1. Data controller
- Controller: Pempol Pay Inc, the company that develops and owns the citaltiva.com.co site and the Citaltiva brand. In this policy, “Citaltiva” means Pempol Pay Inc.
- Registration or tax identification number: [to be completed]. Country of incorporation and registered address: [to be completed].
- Service operations: Medellín and its Metropolitan Area, Antioquia, Colombia. The processing of data of people in Colombia is governed by Colombian law.
- Email for personal data matters: gerencia@citaltiva.com
- Administrative WhatsApp: +1 786 461 5951 (administrative matters only; it does not answer health questions).
2. What Citaltiva is and in what capacity it processes data
Citaltiva is a technology platform providing administrative and marketing services to health professionals. It is not a healthcare provider (IPS), a health insurer (EPS) or an insurance company, it does not provide health services and it has no access to medical records.
- As controller, Citaltiva processes the data of visitors, of people who contact it and of the professionals who join.
- As processor, when a patient requests an appointment with a professional through the platform, Citaltiva processes that data on behalf of the chosen professional or practice, who is the controller of their relationship with the patient. That relationship is governed by a data transmission agreement with each professional.
3. Data we process
- Site visitors: technical data needed to display the page securely (IP address, browser, server logs) and your cookie preferences. Only if you accept analytics cookies, pseudonymous browsing data measured with Google Analytics 4. See the Cookie Policy.
- People who write to us: name, phone number, email and the content of the message you send by email or WhatsApp.
- Patients who request an appointment (once the feature is available): name, phone number, email, the specialty or professional chosen and preferred times.
- Health professionals: identification and contact details, degree and specialty, ReTHUS registration number, REPS registration where applicable, practice information, profile photo and text, subscription billing details and the documents you provide for insurer and prepaid health plan application support.
Sensitive and health data. We do not ask for symptoms, diagnoses, medical history or test results, and we ask you not to send them through our channels. If you share them anyway, we will not use them for any purpose and we will delete them. Answering questions about sensitive data is always optional.
Children and adolescents. The site is intended for adults. When a request concerns a minor, it must be made by their legal representative, respecting the best interests of the child.
4. Purposes
- Answering enquiries, requests and complaints.
- Managing administrative appointment requests and sending them to the professional you chose.
- Verifying the identity and authorisation of professionals in ReTHUS and REPS before publishing a profile.
- Managing subscriptions, invoicing and collecting payment for the plans purchased by professionals.
- Providing the paperwork support for insurer and prepaid health plan applications that the professional requests, without guaranteeing approval.
- Keeping the site secure, preventing fraud and meeting legal, accounting and tax obligations.
- Producing aggregated or anonymised statistics.
- Only with your separate, optional consent: sending educational prevention content or commercial communications. You can withdraw that consent at any time.
We do not sell personal data, we do not use it for advertising based on health data and we do not share it with third parties so they can send you advertising.
5. Consent
We ask for your prior, express and informed consent before processing your data, except where the law does not require it. We keep proof of your consent (date, channel and version of the text accepted). A summary of the conditions is available in the Privacy Notice.
6. Who we share data with
- The professional you chose, only with the data needed to manage your request.
- Providers acting as processors under contract, with confidentiality and security obligations: web hosting (Hostinger), web analytics (Google Analytics 4, only with your consent), email, messaging and, once active, the payment gateway.
- Insurers and prepaid health plan companies, only with the documents the professional authorises us to submit on their behalf.
- Authorities, when required by a legal or court order.
International transfers and transmissions. Some providers store information outside Colombia, for example the site’s servers, WhatsApp’s (Meta) when you choose to write to us that way, or Google’s (Google LLC, United States) if you accept analytics cookies. These transmissions are made with providers offering adequate levels of protection or under transmission agreements, in accordance with Law 1581 of 2012 and Decree 1074 of 2015. [Pending: list the final providers and countries.]
7. Your rights
As the data subject you may, free of charge:
- Access, update and correct your data.
- Request proof of the consent you gave us.
- Be informed about how we have used your data.
- Withdraw your consent or ask for your data to be deleted when there is no legal or contractual duty to keep it.
- File complaints with Colombia’s Superintendence of Industry and Commerce (SIC), after first completing the enquiry or complaint process with Citaltiva.
- Access your data free of charge at least once a month and whenever this policy changes.
8. How to exercise your rights
Write to gerencia@citaltiva.com with your name, ID document, a description of your request, the address or email where we should reply and, if applicable, any supporting documents. If you are acting on someone else’s behalf, attach the document that authorises you.
- Enquiries: we reply within 10 business days at most. If that is not possible, we will tell you why and reply within the following 5 business days.
- Complaints (correction, update, deletion or non-compliance): we reply within 15 business days at most, extendable by up to 8 more business days with prior notice. If a complaint is incomplete, we will ask you to complete it within 5 days; if 2 months pass without a response, it will be considered withdrawn. While it is being resolved, the data will be flagged as “complaint in progress”.
More information in Your data rights.
9. Security and retention
We apply reasonable technical, human and administrative measures to prevent the loss, unauthorised access or misuse of data: encrypted connections (HTTPS), least-privilege access, protected administrator accounts and providers with security commitments. No system is infallible; if an incident affects your data, we will report it to the SIC and to the people affected as required by law.
We keep data only for as long as needed for its purpose and to meet legal obligations (for example, accounting and tax obligations). After that we delete or anonymise it. [Pending: retention periods by data type.]
10. Cookies
The site uses only necessary cookies unless you accept other categories. Read the Cookie Policy or change your choice in Cookie settings.
11. Changes to this policy
We will publish any change on this page with its effective date. If a change affects the purposes for which you gave consent, we will let you know and, where appropriate, ask for new consent.
Pending legal review: the controller’s corporate details, the list of processors and countries, retention periods, data transmission agreements with professionals and confirmation of the obligation to register databases in the National Database Registry.