You Deserve to Know
When you submit a quote request, you share personal information (name, contact details, country) and potentially sensitive medical information (health conditions, imaging, photos). You have a right to know what happens to that information: who sees it, where it is stored, how long we keep it, and how to have it deleted. This article answers those questions directly.
What We Collect
The quote request form collects the fields described in Every Field on the Form, Explained: name, email, phone/WhatsApp, country, procedure, situation, timeline, and free-text message. If you send photos or medical records during the follow-up process, those are collected as well.
We also collect standard web analytics data through Google Analytics (GA4): page views, referral source, device type, and general location (city-level, not address). This data is anonymized and used to understand how patients find and use this site. It is not linked to your quote request.
Who Sees Your Information
| Who | What They See | Why |
|---|---|---|
| Coordinators | All submitted fields | To review, triage, and match your request to a clinic |
| Clinics / Surgeons | Medical details, photos, imaging (with your implicit consent via submission) | To evaluate your case and build a personalized quote |
| No one else | N/A | Your information is not sold, shared with advertisers, or used for any purpose beyond processing your quote request |
When your request is shared with a clinic, it goes to the medical team (surgeon, coordinator, or patient liaison), not to marketing or sales departments. The information shared is the minimum needed for the clinic to evaluate your case and prepare a quote.
How Your Information Is Stored
Form submissions are processed through Google's infrastructure (Google Apps Script and Google Workspace). Your data resides in a Google Workspace account secured with two-factor authentication. Photos and medical records shared via WhatsApp or email are stored in the same infrastructure. We do not store your information on local servers, USB drives, or third-party platforms outside of Google Workspace.
We do not have access to your passwords, financial account numbers, or government identification numbers. We do not ask for these, and you should not send them. If a "coordinator" asks for your credit card number, social security number, or bank login, they are not us. Report it immediately.
How Long We Keep It
Active requests (from submission to completed procedure or decision not to proceed) are retained for the duration of the process plus 12 months. After that, records are archived or deleted depending on whether the patient completed a procedure (archived for follow-up and continuity purposes) or decided not to proceed (deleted).
You can request deletion at any time by emailing andy@colombiamedical.co or messaging on WhatsApp. Deletion includes all submitted data, photos, medical records, and communication history. We honor deletion requests within 30 days. Once deleted, the data cannot be recovered.
What We Do Not Do
We do not sell your information to third parties. We do not share your information with other patients. We do not use your medical photos for marketing or promotional purposes (unless you provide explicit, separate written consent, which is never assumed). We do not contact you for unrelated products or services. We do not retain your information indefinitely. And we do not share your information with clinics you have not been matched with.
Photos: A Special Case
For cosmetic procedures, photos are a critical part of the evaluation. Without them, the surgeon cannot assess your case and the quote is a guess. But medical photos are also among the most sensitive information you share. Here is how they are handled specifically.
Photos are shared with the evaluating surgeon and their clinical team. They are used only for medical evaluation and surgical planning. They are not published, not used in marketing, not shown to other patients, and not shared beyond the clinical team reviewing your case. If you later request deletion, photos are deleted along with all other records.
If a clinic wants to use your before-and-after photos for their portfolio or website, they must obtain your explicit, separate, written consent. This consent is never assumed, never bundled into the general patient agreement, and never required as a condition of treatment. You can always say no to photo use for marketing without affecting your care or pricing.
We recommend patients take their own pre-procedure photos in addition to those taken by the clinic. Your personal copies serve as a baseline reference and protect you in the unlikely event of a dispute about outcomes.
Your Rights
You have the right to know what information we hold about you (request a copy by emailing andy@colombiamedical.co). You have the right to correct inaccurate information. You have the right to request deletion of all or part of your file. You have the right to withdraw from the process at any time without explanation or penalty. You have the right to ask who has seen your information and when. And you have the right to ask questions about any of the above and receive a clear, direct answer.
If you are concerned about sending sensitive medical information through a digital form, you have alternatives. You can submit a minimal request (name, email, procedure) and share medical details only during a live WhatsApp or video conversation, which reduces the amount of information stored in text form. You can also request that your records be deleted immediately after the evaluation is complete, retaining only the quote itself. These accommodations do not slow the process or cost anything extra.
This is not a legal privacy policy (that document is at /privacy.html). This is a plain-language explanation of what happens to your information when you submit a quote request, written to give you enough confidence to share what is needed for the process to work.
Third-Party Services
We use a limited number of third-party services to operate this site and process requests. Google Workspace stores form submissions and communication records. Google Analytics collects anonymized site usage data. WhatsApp (Meta) is used for real-time communication. No other third parties have access to your personal or medical information. We do not use CRM platforms, marketing automation tools, or data brokers. Your information stays within the tools listed above and is not exported, synced, or shared beyond them.
If any of these services experience a data breach that may affect your information, we will notify you directly via the contact method you provided. This is a commitment, not a legal obligation in every jurisdiction. We make it because it is the right thing to do.
Want to See the Numbers First?
Check procedure-specific cost estimates before you submit your request. US cash-pay vs Colombia ranges, worked through line by line. How we build an estimate →