Privacy Policy and Personal Data Processing

Effective date: September 7, 2026

At CuidarConAmor we know that caring also means protecting privacy.

Our application and our website may process information about people living with Alzheimer's or other dementias, as well as information about relatives, caregivers and other people involved in their care. Some of this information may constitute sensitive personal data, particularly data relating to health.

That is why we want to explain clearly what information we process, what we use it for, who it may be shared with, how we protect it and what your rights are.

This Privacy Policy and Personal Data Processing Policy is adopted in accordance with the Political Constitution of Colombia, Statutory Law 1581 of 2012, Decree 1074 of 2015 and the other applicable Colombian personal data protection regulations.

1. Data controller

The controller of the personal data collected through CuidarConAmor is:

• Controller: Samuel Adolfo Celis Acevedo
• Service name: CuidarConAmor
• Address: Medellín, Antioquia, Colombia
• Email: [email protected]
• Phone: 573043864640
• Website: cuidarconamor.co

Requests relating to privacy and personal data protection will be handled through [email protected].

2. Who this policy applies to

This policy applies to the processing of personal data carried out through the website, the mobile application and other services associated with CuidarConAmor.

The information may correspond mainly to:

• people who create an account in CuidarConAmor;
• relatives and caregivers;
• people living with Alzheimer's or other forms of dementia;
• people invited to take part in a care circle;
• people who contact us or request support.

3. Information we may collect

3.1. Information about the user or caregiver

Depending on the features used, we may process information such as:

• name;
• email address;
• information needed to create and manage the account;
• relationship with the person being cared for;
• information you voluntarily write in notes, observations or records;
• application settings and preferences;
• information relating to the subscription and account status.

3.2. Information about the person being cared for

CuidarConAmor allows information to be recorded in order to help organize and coordinate care.

Depending on the features used, this information may include:

• name, nickname or chosen way of identifying the person;
• information relating to Alzheimer's, dementia or other health conditions;
• medications;
• doses;
• medication schedules;
• observations about the person's general condition;
• tracking records;
• routines;
• relevant events relating to their care;
• memories or biographical information voluntarily added to the life story book;
• other information the user chooses to record in order to organize care.

Some of this information constitutes sensitive data, particularly that relating to health.

3.3. Technical information

We may automatically collect certain technical data needed to provide, maintain, protect and improve the service, such as:

• device type;
• operating system and version;
• application version;
• technical identifiers needed for the service to function;
• operational logs;
• information about errors and application failures;
• security information needed to prevent unauthorized access.

CuidarConAmor does not use health information for targeted advertising and does not sell personal data to advertisers.

4. Sensitive data

Colombian law considers sensitive data to be data affecting the privacy of the data subject or whose improper use may lead to discrimination. Data relating to health belongs to this category.

At CuidarConAmor we may process sensitive data because some features of the application require information relating to a person's condition and care.

Where authorization is legally required, we will request prior, express and informed authorization for the processing of such data.

Anyone asked for sensitive information will be informed that they are not obliged to authorize its processing, except in the cases expressly provided for by applicable law.

CuidarConAmor will seek to collect only the information reasonably necessary for the features used by the user.

5. Purposes of processing

Personal data may be processed for the following purposes:

• creating, authenticating and managing accounts;
• enabling the creation and management of profiles of people being cared for;
• storing and displaying the records entered by users;
• organizing medications, doses, schedules, routines and reminders;
• enabling the tracking and recording of information relating to care;
• generating summaries from the recorded information;
• enabling the life story book and other support tools to work;
• allowing authorized members of a care circle to view or share information;
• sending notifications relating to the application's features;
• generating guidance through artificial intelligence tools when the user expressly requests that feature;
• providing technical support and answering enquiries;
• managing subscriptions and account operation;
• detecting and preventing fraud, abuse, unauthorized access or security incidents;
• diagnosing errors and improving the stability, security and performance of the service;
• handling requests, enquiries and complaints relating to data protection;
• complying with legal obligations or valid requests from competent authorities.

We will not use personal data for purposes incompatible with those reported at the time of collection without obtaining any additional authorizations legally required.

6. What we do not do with your data

CuidarConAmor does not sell personal data.

Nor do we trade health information with insurers, employers, laboratories, advertisers or other organizations so that they may use it for their own advertising or commercial purposes.

We do not use the medical or care information recorded in the application to build advertising profiles.

7. Artificial intelligence

CuidarConAmor may offer guidance features assisted by artificial intelligence.

When the user chooses to use one of these features, the information needed to process the query may be sent to the technology provider used by CuidarConAmor to generate the response.

CuidarConAmor currently uses Anthropic (Claude) technology for certain artificial intelligence features.

We will seek to limit the information sent to the artificial intelligence provider to what is necessary to generate the response, and to avoid sending directly identifiable information unnecessarily.

Use of these features is optional.

8. Care circles

CuidarConAmor allows certain information to be shared with other people who are part of a care circle.

Access is granted through the mechanisms enabled by the application and must be limited to authorized persons.

Users may see who has access to the circle and, where the relevant feature allows it, withdraw that access.

People who receive access to another person's information must use it solely for purposes relating to that person's care and must respect their privacy and confidentiality.

9. Information about a person other than the user

A particular characteristic of CuidarConAmor is that the person using the application may record information belonging to another person.

For example, a child, spouse, relative or caregiver may record information relating to a person living with Alzheimer's or another dementia.

Being a relative or caregiver does not in itself grant unlimited authorization to dispose of another person's personal data.

Anyone recording information belonging to a third party must have the authorization or standing required by applicable law.

Where the data subject can validly grant authorization, their prior, express and informed authorization must be obtained when required.

Where the data subject is physically or legally incapacitated and processing sensitive data is necessary to safeguard their vital interest, the special rules provided for in Colombian law will apply, including the involvement of their legal representative where appropriate.

CuidarConAmor may request information or documentation reasonably necessary to verify the standing of anyone seeking to exercise rights or make decisions regarding another person's data.

10. Technology providers

To operate CuidarConAmor we need to use specialized technology providers. These may include:

• Google Firebase / Google Cloud: authentication, infrastructure, storage and database services.
• Cloudflare: infrastructure, security, protection and delivery of content and requests associated with the service.
• Anthropic (Claude): processing of requests made through the artificial intelligence features.

These providers may process information only to the extent necessary to deliver the contracted technology services, in accordance with the applicable contractual terms and the corresponding instructions where they act as data processors.

We may replace or add technology providers where necessary to deliver the service. Where such a change involves a substantial modification in the way we process personal data, we will update this policy and adopt any measures legally required.

11. Processing of information outside Colombia

Some of our technology providers have infrastructure located outside Colombia.

For this reason, certain data may be subject to international transmission, storage or processing.

Where applicable, CuidarConAmor will adopt the legal, contractual, organizational and technical measures required by Colombian law to protect the information and regulate its processing by providers located in other countries.

International processing of information does not alter the rights that Colombian law grants to data subjects.

12. Data retention

We will retain personal data only for as long as reasonably necessary to provide the service, fulfil the stated purposes and meet applicable legal obligations.

While an account remains active, we will retain the information needed to provide the features used by the user.

Termination or non-renewal of a subscription does not necessarily mean the immediate deletion of personal data.

Where the data subject or a person with standing requests deletion and that request is appropriate, we will begin the corresponding process. Removal of information from active systems will take place in accordance with our technical procedures and the periods needed to complete backup, security and legal compliance processes.

Certain information may be retained for an additional period where there is a legal obligation, where it is necessary to handle claims, prevent fraud, protect rights or comply with requests from competent authorities.

The databases will remain valid for as long as necessary to fulfil the purposes described in this policy and for as long as a legitimate purpose or legal obligation justifying their processing subsists.

13. Information security

We adopt technical, administrative and organizational measures designed to protect information against loss, alteration, misuse, unauthorized access, disclosure or consultation.

The measures used, as applicable, include:

• encryption of information in transit;
• protection mechanisms for stored information provided by our technology infrastructure;
• user authentication;
• access controls;
• rules designed to restrict access to the authorized members of each care circle;
• technical security controls and logs;
• measures designed to prevent unauthorized access.

No technology system can guarantee absolute security. If we identify a security incident involving personal data, we will adopt the containment, investigation, correction, documentation and notification measures required by applicable law.

14. Rights of data subjects

Under Colombian law, data subjects have the right to:

• know, update and rectify their personal data;
• request proof of the authorization granted, where applicable;
• be informed, upon request, about the use made of their data;
• access their personal data being processed, free of charge;
• request deletion of their data where appropriate;
• revoke authorization in the cases permitted by law;
• file complaints with the Superintendence of Industry and Commerce regarding possible breaches of data protection rules, once the corresponding procedure before CuidarConAmor has been exhausted where that is required;
• exercise the other rights recognized by applicable law.

These rights may be exercised by the data subject and by other persons with standing under the law.

15. How to exercise your rights

The person responsible for handling petitions, enquiries and complaints relating to personal data is:

• CuidarConAmor privacy officer
• Email: [email protected]

The request must allow us to identify the data subject and clearly understand what is being requested.

Depending on the case, we may request:

• the data subject's name;
• sufficient identification of the requester;
• a description of the request;
• an email address or other means of receiving the response;
• documents evidencing representation or standing where the request is made on behalf of another person;
• additional documents strictly necessary to verify the request.

We will use this information solely to verify the identity or standing of the requester and to process the petition.

Enquiries

When you want to know what personal information we process about you or about a person you legally represent, you may submit an enquiry [email protected].

Enquiries will be handled within the time limits set by Colombian law.

The general maximum period will be ten (10) business days from receipt of the enquiry.

If it is not possible to respond within that period, we will inform you of the reason for the delay and the date on which we will respond. That extension will not exceed five (5) business days following the expiry of the initial period.

Complaints

Requests relating to correction, updating, deletion, revocation of authorization or possible breaches will be handled as complaints.

The complaint must contain, as a minimum:

• identification of the data subject or person with standing;
• a description of the facts or of what is being requested;
• contact information for receiving the response;
• any documents the requester considers relevant.

If the complaint is incomplete, we may request further information from the requester within five (5) business days of its receipt.

The complaint will be handled within a maximum period of fifteen (15) business days from the day following its complete receipt.

If it is not possible to respond within that period, we will inform the requester of the reasons for the delay and the new response date, which may not exceed eight (8) business days following the expiry of the initial period.

16. Revocation of authorization and deletion

Data subjects may request revocation of authorization or deletion of their personal data in the cases where this is appropriate under Colombian law.

The request will not proceed where there is a legal or contractual duty requiring certain information to be retained, or where another legal basis permits or requires its retention.

Deleting an account and deleting personal data are related processes, but they may have different scope depending on applicable legal and technical obligations.

17. Minors

CuidarConAmor is designed to be used through accounts belonging to people over eighteen (18) years of age.

We do not knowingly allow accounts to be created by minors.

If information belonging to a child or adolescent were exceptionally to be processed, the special rules provided for by Colombian law for the protection of their data will apply, and their fundamental rights and best interests will prevail.

18. Cookies and similar technologies

The website and the application may use technologies strictly necessary to enable their operation, maintain sessions, protect security or remember certain preferences.

We do not use cookies or similar technologies to sell health information or to carry out behavioural advertising based on the health data recorded in CuidarConAmor.

If in the future we incorporate analytics, advertising or other technologies requiring consent or additional information under applicable law, we will update our information and consent mechanisms accordingly.

19. Requests from authorities

We may disclose information where there is a legal obligation, a court order or a valid request from a competent authority, and where the requirements established by applicable law are met.

In such cases we will seek to limit the information provided to what is strictly necessary to comply with the corresponding request.

20. Changes to this policy

We may update this Privacy Policy and Personal Data Processing Policy when our features, providers, processing practices or the applicable rules change.

The current version will be available on our website and will state the date of its last update.

Where we make substantial changes affecting the purposes of processing or requiring new authorization under applicable law, we will inform users and request the corresponding authorizations where necessary.

21. Data protection authority

In Colombia, the competent authority on personal data protection is the Superintendence of Industry and Commerce (SIC).

Data subjects may turn to that authority in accordance with the requirements and procedures established by Colombian law.

22. Contact

For enquiries, requests, complaints or any concern relating to privacy and personal data protection you may contact:

• CuidarConAmor
• Controller: Samuel Adolfo Celis Acevedo
• Medellín, Antioquia, Colombia
• Email: [email protected]
• Phone: 573043864640

Effective date

This Privacy Policy and Personal Data Processing Policy takes effect onSeptember 7, 2026.

The databases subject to this policy will remain in force for as long as they are necessary to fulfil the purposes described here, a relationship with users or data subjects exists, or a legal obligation or legitimate purpose justifying their retention subsists.