Legal information
Personal Data Processing and Privacy Policy
This is an English translation provided for convenience. In case of any difference, the Spanish version prevails.
First version effective since: September 9, 2026. Updated version: October 2026.
1. Data controller
The data controller is Yonathan Masson Lezama, a physician specialized in plastic surgery who practices as an independent professional under the professional name Dr. Jonathan Masson ("Dr. Masson" or "the practice").
- Address: Calle 33 #43-85, Torre Metropolitan Salud, office 823, Medellín, Antioquia, Colombia.
- Email for personal data matters: drmassoncirujanoplastico@gmail.com
- Phone and WhatsApp: +57 300 116 7412
- Website: https://drjonathanmasson.com
2. Legal framework
This policy is issued under article 15 of the Colombian Constitution, Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015). Health information is also governed by Colombian rules on medical confidentiality (Law 23 of 1981) and medical records (Resolution 1995 of 1999 and the rules that amend or complement it).
3. What data we process and why
| Category | Data | Purposes |
|---|---|---|
| Website visitors | Technical browsing data (pages viewed, device and browser type, traffic source, interaction with videos and contact buttons). Only if you accept analytics cookies. | Measure site use in aggregate and improve it. |
| Contact and scheduling | Name, phone, email, country and city, procedure of interest, messages sent by WhatsApp, email or phone. | Answer questions, provide information, coordinate and schedule in-person or virtual consultations, send reminders and follow up on care. |
| Health data and medical records | Medical history, diagnoses, tests, medical notes, informed consents and clinical photographs that are part of care. | Provide health care, keep the medical record, provide post-operative follow-up and meet legal obligations. |
| Material authorized for publication | Photographs, videos and testimonials that the patient authorizes in writing for publication. | Show results and experiences on Dr. Masson's digital channels, within the terms of each authorization. |
| Patients from other countries | In addition: country of residence, travel dates and language needs. | Coordinate the virtual consultation, surgery date, stay and communication in another language. |
We do not use data for purposes other than those stated. If a new purpose arises, we will ask for a new authorization.
4. Sensitive data
Health data, clinical photographs and images of the body are sensitive data. Providing them is optional: no one is required to provide them. However, without the necessary medical information it is not possible to carry out a consultation or surgery safely.
When sensitive data must be processed, the practice will ask for prior, express and informed authorization, will state which data are sensitive and what they will be used for, and will keep proof of that authorization. This also applies to photographs requested by WhatsApp for a virtual consultation. The exceptions in article 6 of Law 1581 of 2012, such as a life-threatening emergency, apply.
5. Medical records
Medical records and clinical documentation, including clinical photographs, are managed in HiMed, the medical records software used by the practice. HiMed is a cloud service of HiMed Solutions S.A.S. (Tax ID 900.150.913-7, Medellín), which acts as data processor on behalf of Dr. Masson under a data transmission agreement that forbids it to use the information for its own purposes. According to HiMed, data is hosted on servers located in Colombia.
- Medical records are confidential. Access is restricted to authorized personnel, according to their role in care.
- They may only be accessed by the patient, by whoever the patient authorizes, and by the authorities and persons permitted by law.
- They are kept for the period required by the rules on medical records. Because of that legal duty, they cannot be deleted during that period.
6. Published photographs, videos and testimonials
Patient material that is published is different from the medical record:
- It is only published with the patient's written authorization, which defines what material, in which channels and to what extent.
- Authorizations cover Dr. Masson's digital channels, including this website in its Spanish and English versions.
- The patient's identity is protected to the extent agreed in the authorization.
- Images are not retouched to alter the result and are not a promise of results.
- Patients may revoke their authorization at any time by writing to the email in this policy. The material will be removed from the website within the response period in section 12, and also from Dr. Masson's social media. Material that third parties copied or shared before the revocation is not under the practice's control, but its removal will be requested where possible.
- Clinical photographs are not published or given to third parties without the corresponding authorization.
7. Who we share data with
Third parties involved in care. Working with operating rooms, laboratories, recovery houses, interpreters or nursing staff does not mean giving them patient data. When medical care requires transmitting data to another provider, only the information necessary for that care will be transmitted, in accordance with health regulations and the applicable authorizations.
Technology providers (processors). To operate, the practice uses providers that process data on its behalf and under its instructions:
| Provider | Purpose |
|---|---|
| HiMed (HiMed Solutions S.A.S.) | Electronic medical records. |
| WhatsApp Business (Meta Platforms) | Communication with patients, scheduling and follow-up. |
| Google (Gmail, Google Analytics, Google Maps and Google Places) | Email, aggregate site measurement (with consent), location map and public reviews. |
| Hostinger | Website hosting. |
Some of these providers, such as WhatsApp and Google, store information outside Colombia, for example in the United States. In those cases data is transmitted in accordance with Law 1581 of 2012 and Decree 1377 of 2013. The medical records software allows information to be exchanged with health system entities; the practice will only use this when required by law or authorized by the patient.
Authorities. Data will be disclosed to judicial or administrative authorities when required by law.
8. Digital advertising
Dr. Masson may advertise on platforms such as Google Ads and Meta Ads. We do not give these platforms medical records, clinical photographs, health data or patient lists.
The site currently has no advertising or tracking pixels installed, such as Meta Pixel. If one is installed in the future, this policy will be updated first and visitors will be asked for consent in the cookie panel.
9. Cookies and similar technologies
| Technology | Type | When it is active | What it does |
|---|---|---|---|
| Cookie preference (browser local storage) | Necessary | Always | Stores whether you accepted or declined analytics cookies. |
| Google Analytics 4 (_ga and _ga_* cookies) | Analytics, optional | Only if you accept | Measures visits, device, source and clicks in aggregate. We do not send names, phone numbers, emails or health data. |
| Google Maps map | Third-party content | Only when you tap "Show map" | Shows the practice's location. Google may process data under its own policy. |
| Google reviews | Third-party content | When the reviews section loads | Shows public reviews of the practice on Google. Your browser connects to Google servers. |
You can change your choice at any time with the "Cookie settings" link in the footer. More about Google: Google Privacy Policy and how Google uses information from sites that use its services.
10. Minors
In Colombia, Law 1799 of 2016 prohibits cosmetic procedures for anyone under 18. Data of minors processed for non-cosmetic procedures will be handled in their best interest and with the authorization of their legal representative.
11. Your rights
As the data subject you have the right to:
- Access, update and correct your data.
- Request proof of the authorization you gave.
- Be informed about how your data has been used.
- File complaints with Colombia's Superintendence of Industry and Commerce (SIC), after completing the inquiry or claim process with the practice.
- Revoke your authorization or request deletion of your data, when there is no legal or contractual duty to keep it.
- Access your data free of charge.
12. How to exercise your rights
Write to drmassoncirujanoplastico@gmail.com with your name, a way to reply, a description of your request and any supporting documents. Requests are handled directly by Dr. Masson, with support from his assistant.
- Inquiries (access to your data): answered within 10 business days. If that is not possible, you will be told why and the answer will be given within 5 additional business days.
- Claims (correction, update, deletion, revocation or a complaint of non-compliance): answered within 15 business days, extendable by up to 8 additional business days with notice. If the claim is incomplete, you will be asked to complete it within 5 days; if 2 months pass without a reply, the claim will be considered withdrawn.
13. Security and retention
The practice applies reasonable technical, human and administrative measures to protect data against loss, consultation or unauthorized use. Contact data is kept while needed for the stated purposes. Medical records are kept for the period required by law.
14. Validity
The first version of this policy has been effective since September 9, 2026, when the website was published. This updated version is effective from October 2026. The databases will remain in force while Dr. Masson practices his profession and the stated purposes remain, without prejudice to legal retention periods. Any significant change will be published on this page.