Privacy Policy
Last updated: September 22, 2026
Effective date: September 22, 2026
This Privacy Policy explains how Raquel Mejia Physical Therapy (“we,” “us,” or “our”) collects, uses, and protects your personal information when you contact us by WhatsApp, phone, or email, and when you visit our website. We protect your information under Colombia’s Law 1581 of 2012 on data protection and its regulations. We also handle health information consistent with the privacy principles of the United States Health Insurance Portability and Accountability Act (HIPAA).
Data Controller
We are an independent healthcare provider in Colombia that serves U.S. veterans through the VA Foreign Medical Program (FMP). Under Colombian law, we are the data controller (responsable del tratamiento) for the information you share with us.
| Field | Detail |
|---|---|
| Name | Raquel Mejia, PT |
| contact@raquelmejia.com | |
| Phone | +57 315 459 7779 |
| Location | Medellín, Colombia |
1. Information We Collect
When you contact us by WhatsApp, phone, or email, we collect the personal information you choose to share, which may include:
- Name: to address you properly in our response
- Email address: to send you our reply
- Phone number: to contact you if you prefer a phone call
- Message content: to understand your inquiry and provide relevant information
Phone calls: we do not record phone calls, and we do not keep notes of them.
Health Information
Health information, such as a VA disability letter or other documents that list medical conditions, is sensitive data under Colombian law. Sharing it is optional. You can ask about our services and the FMP without sharing any health information.
Before we request any health information or documents, we send you a short notice and ask for your express authorization. Please do not send medical documents until we ask for them. If you send us health information or documents before we ask, we will ask for your express authorization before we use them to evaluate or provide your care. If you do not give it, or if we do not need them, we delete them.
When You Visit Our Website
Our website has no forms and does not ask you for personal information. The code we wrote for this site does not set cookies or store anything on your device. The site uses these tools:
- Vercel Web Analytics: counts page views
- Vercel Speed Insights: measures how fast our pages load
- Contact link clicks: when you click a phone, email, or WhatsApp link, we record an event named
contact_clickwith the kind of link (phone, email, or WhatsApp) - Language switches: when you switch languages, we record an event named
language_switchwith the language you chose
These events do not include your phone number, email address, or the content of any message. According to Vercel’s documentation, Web Analytics works without third-party cookies, identifies visitors by a hash created from the incoming request, and discards visitor sessions after 24 hours (Vercel Web Analytics privacy). Speed Insights data is not tied to any individual visitor or IP address (Vercel Speed Insights privacy).
2. Purpose of Collection
We use the information you send us through these channels for the following purposes:
- Responding to your inquiries about our physical therapy services
- Providing information about VA FMP eligibility and processes
- Scheduling initial consultations or appointments
- Evaluating or providing your care, once you have given your express authorization for health information
- Keeping your clinical record (historia clínica), if you become our patient
- Submitting claims to the VA FMP for your care, if you become our patient
- Communicating with you about your inquiry
We use website analytics only to understand how our website is used and how well it performs.
We will not use your information for marketing purposes or share it with third parties for their marketing purposes.
3. Legal Basis for Processing
We process your personal information on the following grounds:
- Your authorization for contact details and messages: when you write to us or call us with a question, we use your name, contact details, and message only to answer you, as described in this policy. This does not cover health information.
- Your express authorization for health information: before we request health information or documents, we tell you which data are sensitive, what we will use them for, and that answering is optional, and we ask for your express authorization. You can give it in writing, or orally on the phone, in which case we send you a short written message to confirm it. Contacting us, or sending us documents, is not that authorization.
- Legal duties: if you become our patient, Colombian health regulations require us to keep your clinical record (Resolución 1995 de 1999 and Resolución 839 de 2017).
We keep proof of each authorization you give us and of the notice we gave you when we asked for it.
You may withdraw your authorization at any time by contacting us. Withdrawal does not affect processing that took place before it, and it does not require us to delete information that the law requires us to keep, such as your clinical record.
4. Data Retention
We keep personal information only as long as we need it for the purpose it was collected for:
- Inquiries: WhatsApp messages and emails that never become part of a clinical record are kept only as long as necessary to answer your inquiry, and then deleted.
- Clinical record: if you become our patient, the information relevant to your care is recorded in your clinical record (historia clínica), which we keep for at least fifteen (15) years from your last visit (Resolución 839 de 2017, Article 3). Once that information is in your clinical record, we delete the original message or email when we no longer need it.
- Phone calls: we do not record calls or keep notes of them, so nothing from the call itself is kept. If you give us your authorization on the phone, we keep the written message we send you to confirm it.
- Proof of authorization: we keep it for as long as the practice operates, plus five (5) years after it closes.
- Legal claims and data requests: when information is needed for a legal claim or to answer a request to exercise your rights, we keep it only for that purpose and only for as long as it requires.
Database validity: our databases remain in effect for as long as the practice operates, plus the retention periods described above.
5. Third-Party Service Providers
We use the following providers to operate our website and our email. Each one acts as a data processor (encargado del tratamiento): it handles information only on our behalf, under the data processing terms that are part of our service agreement with it. Both are located in the United States, which Colombia’s Superintendency of Industry and Commerce (SIC) lists as a country with an adequate level of data protection.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website hosting and delivery, page-view analytics, performance measurement | United States |
| Google LLC (Google Workspace) | Stores the email you send to contact@raquelmejia.com on our behalf | United States |
If you contact us by WhatsApp, your messages are handled by WhatsApp (WhatsApp LLC, part of Meta) under its own privacy policy. WhatsApp is an independent service you choose to use.
6. Your Rights
You have the following rights regarding your personal information:
Under Colombian Law (Ley 1581 de 2012)
- Right to Access: You can request a copy of the personal information we hold about you
- Right to Update: You can request correction of inaccurate or incomplete information
- Right to Deletion: You can request deletion of your personal information when it is no longer necessary for the purposes collected, unless the law requires us to keep it
- Right to Proof of Authorization: You can request a copy of the authorization you gave us
- Right to Revoke Authorization: You can withdraw your authorization for data processing at any time
- Right to File Complaints: You can file complaints with the Superintendency of Industry and Commerce (SIC)
Our Voluntary Commitment to U.S. Veterans
HIPAA privacy principles guide how we handle health information. As a voluntary commitment of our practice, and not as rights granted to you under HIPAA, we also honor these requests:
- Access: You can request access to your health information
- Amendment: You can request amendments to your health information
- Accounting of disclosures: You can request a list of the disclosures we have made of your health information
- Restrictions: You can request restrictions on certain uses and disclosures
- Confidential communications: You can request that we communicate with you by alternative means or at alternative locations
7. Cross-Border Data Transfers
Our website host (Vercel) and our email provider (Google Workspace) store and process information in the United States on our behalf. Under Colombian law, this is a transmission (transmisión) to data processors, not a transfer to another data controller.
The United States is on the SIC’s list of countries with an adequate level of data protection (Circular Única, Title V, number 3.2). The SIC allows transmissions to these countries on the same terms that govern transfers.
If you become our patient, the FMP claims we send to the VA also go to the United States, for the purpose of paying for your care.
8. Security Measures
We use technical and organizational measures to protect your personal information across the channels we use:
- Website: our website is served over HTTPS/TLS and does not collect personal information through forms
- Email and WhatsApp: messages are handled by the providers described in section 5, under their own security measures. Standard email is not end-to-end encrypted, which is one reason we ask you not to send medical documents until we request them
- Access controls: only authorized personnel have access to the messages and documents you send us, and to the accounts and devices where they are stored
- Data minimization: we ask only for the information we need, and we delete messages we no longer need
While we take reasonable precautions to protect your information, no method of transmission over the Internet or electronic storage is 100% secure.
9. How to Exercise Your Rights
Raquel Mejia handles all requests about your personal information. To exercise any of your privacy rights, please contact her at:
Email: contact@raquelmejia.com Phone: +57 315 459 7779
When submitting a request, please include:
- Your full name and contact information
- A description of the right you wish to exercise
- Any relevant details to help us locate your information
We respond within the deadlines set by Colombian law (Ley 1581 de 2012, Articles 14 and 15):
- Questions about your information (consultas): we respond within ten (10) business days from the day we receive your request. If we cannot meet this deadline, we will tell you why and respond within five (5) additional business days.
- Requests to correct, update, or delete information, or complaints (reclamos): we respond within fifteen (15) business days from the day after we receive your request. If we cannot meet this deadline, we will tell you why and when we will respond, within eight (8) additional business days.
10. Filing Complaints
If you believe your privacy rights have been violated, please contact us first so we can address it. You can also contact these authorities:
Superintendency of Industry and Commerce (SIC)
Colombia: For complaints regarding data protection under Colombian law. Visit the SIC website.
U.S. Department of Health and Human Services, Office for Civil Rights
United States: This office receives complaints about health information privacy under HIPAA. Visit the HHS Office for Civil Rights complaint portal.
11. Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will:
- Update the “Last Updated” date at the top of this policy
- Post the revised policy on our website
We encourage you to review this policy periodically.