Privacy and Data Processing Policies
The Instituto de Coloproctología ICO SAS, in compliance with Law 1581 of 2012 and other related regulations, is responsible for the processing of your personal data.
The personal data requested by the Instituto de Coloproctología ICO SAS will be used for the following purposes:
a) Carry out the entity’s functions, in line with its mission, which includes activities related to human health.
b) Provide information to third parties in accordance with established confidentiality parameters, in cases where the entity has a contractual relationship and such information is necessary for the fulfillment of the contractual purpose. This includes state authorities, as well as oversight and regulatory bodies.
c) Provide information to oversight entities as stipulated in Law 2195 of 2022, Article 12: Principle of Due Diligence. Report of Suspicious (ROS) and unusual operations, in accordance with Circular 09 of 2016 issued by the SNS, as amended by External Circular 5-5 of 2021 from the SNS.
d) Manage procedures (requests, complaints, claims, reports, suggestions, or commendations).
e) Fulfill the obligations undertaken by the entity in its capacity as an employer, in accordance with the provisions of Law 1581 of 2012.
f) Ensure the safety of individuals, visitors, property, and the entity’s facilities through the use of closed-circuit surveillance cameras.
g) Manage legal, administrative, and judicial procedures in compliance with its corporate purpose.
h) Carry out activities related to social responsibility, well-being, or the generation of benefits.
As the owner of the information, you have the right to access, update, and rectify your personal data and, only in cases where applicable, to delete it or revoke the authorization granted for its processing.
If you require more information to learn about our personal data processing policy and any substantial changes made to it, please refer to our policy.
Si desea presentar una consulta, reclamo o petición de información relacionada con la protección de datos personales puede comunicarse al teléfono 604 3220113 o en la Sede Principal, ICO Metropolitan. Calle 33 N° 43 – 85 Piso 19 y 20, o escribiendo al correo electrónico: gestiondelriesgo@institutoico.co
PERSONAL DATA PROTECTION POLICY
PERSONAL DATA PROCESSING CLAIM FORM
Ethical Complaints Channel
What is it?
A confidential and secure space to communicate with the Ethics Committee and the Risk Committee, in case you have a report regarding ethical conduct or identify any situation you consider contrary to our mission principles and core pillars.
It is intended for all our stakeholders: employees, shareholders, clients, suppliers, external parties, distributors and intermediaries, healthcare service users, and the general community.
Reports are investigated in accordance with previously established internal procedures, which ensure impartiality in the investigation and prevent potential conflicts of interest in case management. The results of the investigation are communicated to the informants, if they so wish.
You may provide your name and contact information if you wish, or you may do so anonymously.
Remember that through the Ethics Reporting Channel you can also submit inquiries about ethical conduct, which will be resolved in light of the organization’s Principles, the definitions provided in the Code of Conduct, the Code of Good Governance, and the entity’s internal policies.
How to Make the Report Successful?
Stay in touch: having the ability to contact the person filing the report is a key factor for the success of an investigation. Therefore, if you wish, you may provide your contact details so we can inform you about the handling of your report. This way, you will be able to follow the progress of the process, answer our questions, or provide additional information. You may leave us a means of contact without revealing your identity.
Tell us all the details: the more information you provide, the greater the chances of confirmation. You must indicate the location where the reported event took place, and you may also identify its categories.
Procedure for Handling Reports
1. Reception
Reports may be submitted through the channel provided by the Institute and will be centralized by the Risk Department, which will be responsible for gathering the information and, whenever possible, seeking the greatest amount of detail about the events.
The whistleblower may file the report anonymously; however, in cases where they choose to reveal their identity, the Institute will ensure strict confidentiality and establish measures to prevent any retaliation against them.
2. Classification and Referral
The reports received by the Institute will be classified according to the subject or category referenced and/or the position of the person being reported. This is done to determine whether the reported facts fall under the Committee’s jurisdiction and to ensure they are assigned to the appropriate area for analysis, thereby guaranteeing timely, objective, and confidential handling of each case.
When a report related to a fraud event is received, senior management must be immediately informed for the corresponding investigation.
3. Investigation
Once informed of the report, the Committee must carry out the necessary investigation in order to verify the reported facts and make a decision within ten (10) business days from the moment it receives the investigation results. This period may be extended only once by the Committee.
The Committee may hire external experts or specialized audits to support the investigation and analysis of cases, as well as to gather any evidence it deems necessary. It may also seek advice from different areas of the Institute when their knowledge and expertise are required. These areas will generate a report that will serve as input for resolving the case.
In the investigations carried out, a fundamental premise will be respect for due process, the right of defense of the individuals involved, and the right to confidentiality.
4. Decision
Based on the analysis and investigation of the report received, the Committee will issue a decision determining the measures, sanctions, or corrective actions to be implemented.
If it is proven that an employee of the Institute has engaged in conduct that violates the Code of Conduct, the Ethics Committee will decide on the applicable sanction, following the guidelines established in the Internal Work Regulations, and will communicate its decision to Human Resources so that the corresponding process may be carried out in accordance with the applicable administrative and legal procedures, always adhering to the relevant internal and external regulations.
In cases where it is not possible to prove the occurrence of the reported conduct, the case will be closed.
In both cases, the decision must be recorded in the minutes of the respective meeting and communicated to the whistleblower, if they have provided contact information.
5. Reconsideration
The Committee’s decisions may be subject to reconsideration by the parties involved, before the same Committee, within five (5) business days following the communication of the decision. The Committee must rule on the reconsideration within no more than ten (10) business days from the receipt of the request.
Once this procedure has been completed, the decision will become final.