How Mountains of Hope collects, uses, shares and protects personal data, and the rights you have over it.
Last updated 20 September 2026. This policy replaces the version dated 21 November 2023.
Mountains of Hope operates a licensed IPS medical facility at Pozo Rubio, Vereda El Tablazo, Rionegro 055437, Antioquia, Colombia, and this website. In this policy "we", "us" and "our" mean Mountains of Hope. We are the data controller for the personal data described here.
For anything to do with your personal data, write to privacy@mountainsofhope.com, or to the postal address above.
Information you give us. Your name, email address, telephone number and country when you book a consultation, join the community, subscribe to anything, or contact us. If you go on to become a guest, we also collect the details needed to plan a stay — travel dates, dietary requirements, emergency contacts and billing information.
Health information. If you become a guest, our medical team collects clinical information about you, including medical history, laboratory and diagnostic results, and the samples you send before arrival. This is sensitive personal data. It is held under our obligations as a licensed medical facility, it is handled only by clinical staff who need it, and it is never used for marketing, sold, or shared with anyone outside your care without your explicit written consent. It is not collected through this website.
Information collected automatically. IP address, approximate location derived from it, browser and device type, referring page, pages viewed and time spent. This is ordinary web analytics and is not linked to your medical records.
Payment information. Card details are entered with our payment processor and are not stored on our servers.
We do not sell personal data, and we do not share it with advertisers.
We use a small number of service providers, each of which handles data only on our instructions:
Some of these providers are located outside Colombia, including in the United States. Where data is transferred internationally we rely on the provider's contractual data-protection commitments, including standard contractual clauses where they apply.
We will also disclose personal data where we are legally required to, or to protect someone's life or safety.
The site sets cookies that are strictly necessary for it to function, and analytics cookies that measure how the site is used. Pages that embed third-party content — the booking scheduler, and videos — can set their own cookies once that content loads, and those providers may collect data as if you had visited their site directly. You can block or delete cookies in your browser; strictly necessary cookies cannot be turned off without breaking parts of the site.
Enquiries and consultation records are kept for three years from your last contact with us, unless you ask us to delete them sooner. Guest and billing records are kept for as long as Colombian law requires. Clinical records are kept for the period required of a licensed medical facility. Analytics data is retained in aggregate.
Everyone. You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to how we are using it, or withdraw a consent you gave. Write to privacy@mountainsofhope.com and we will respond within 30 days. We may need to verify your identity first, and some clinical records cannot be deleted while we are legally required to keep them.
Colombia. Under Ley 1581 de 2012 and Decreto 1074 de 2015 you hold the habeas data rights to know, update and rectify your personal data, to be told how it is being used, to revoke authorisation, and to complain to the Superintendencia de Industria y Comercio. Sensitive data, including health data, is processed only with your explicit authorisation or where the law permits it without one.
European Economic Area and United Kingdom. Under the GDPR and UK GDPR you additionally have the rights to restriction of processing and to data portability, and you may complain to your national supervisory authority.
California. Under the CCPA and CPRA you may request disclosure of the categories and specific pieces of personal information we have collected, request deletion or correction, and opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising these rights.
The site is served over HTTPS. Access to guest and clinical records is restricted to the staff who need it and is logged. No system is perfectly secure, and we do not claim otherwise; if a breach affects your personal data we will notify you and the relevant authority as the law requires.
This site is not directed at children under 16, and we do not knowingly collect their personal data through it. Minors are admitted as guests only with the consent and involvement of a parent or legal guardian.
We update this policy when what we do changes. The date at the top always shows the current version. If a change is significant we will say so on the site.