Privacy Policy

1. Who is responsible for your information

TRT Optima is operated by:

Legal entity

Andes Biolabs SAS

NIT

902060792-3

Registered address

Edificio Chelsea, Piso 7, Cra. 48 #19 Sur-100, Zona 2, Envigado, Antioquia 050021, Colombia

Privacy email

[email protected]

Telephone/WhatsApp

+57 305 472 8234

Responsible person or department

Jesse Locke

In this policy, “TRT Optima,” “we,” and “our” refer to this legal entity.

We act as the data controller for the personal information whose collection and use we determine. This policy addresses our website, assessments, communications, and administrative and care-coordination activities.

Physicians, laboratories, pharmacies, and other healthcare providers may separately control information used to deliver their services, including clinical records. Their own privacy notices and professional obligations may also apply.

2. Information we collect

The information we collect depends on your interaction with us.

Contact and identification information

This may include your name, contact details, preferred language, age or date of birth, city, and identification details where needed for a specific service or administrative requirement.

Information you provide about your health

If you choose to complete an assessment or share information for care coordination, this may include symptoms, medical history, medications, treatment history, laboratory results, prescriptions, and information about sexual or reproductive health.

Communications and service records

This may include messages, attachments, appointment requests, support conversations, consent records, and information needed to follow up on your request.

Billing and transaction information

This may include billing details, invoices, payment status, transaction references, and payment confirmations. Payment providers process information submitted through their own payment systems under their applicable terms and privacy notices.

Please do not send payment-card security codes through WhatsApp or email.

Website information

Depending on the technologies enabled, our website may process IP addresses, browser and device information, server logs, and information about website interactions. Section 8 explains cookies and similar technologies.

We receive information directly from you and, where authorized or otherwise legally permitted, from providers involved in the services you request.

3. How we use information

We use relevant information to:

• —Respond to questions and requests.
• —Manage assessments and coordinate physician review.
• —Arrange appointments, laboratory services, and other requested services.
• —Coordinate prescriptions, pharmacy fulfillment, or delivery when applicable.
• —Provide administrative support and follow-up.
• —Process billing, payments, and service administration.
• —Maintain authorization records and handle privacy requests.
• —Protect our systems, investigate misuse, and resolve service issues.
• —Meet applicable legal obligations and respond to valid authority requests.

Where separately authorized, we may also send educational or promotional communications.

Any additional use requiring a new authorization will be explained before that use begins.

4. Health information and authorization

Information about health and sexual life is sensitive personal data.

You are not obliged to answer questions requesting sensitive information. We will explain why it is requested and seek your explicit authorization where required. If a particular assessment needs clinical information, you can discuss what is necessary and what alternatives are available.

We request prior, informed authorization for personal-data processing unless a legal exception applies. Reading this policy or browsing the website does not, by itself, authorize every use described here.

Authorization for data processing is separate from consent to medical treatment and from permission to receive marketing.

5. WhatsApp, email, and online assessments

We use communication channels and assessment tools to receive requests and help coordinate services.

When you contact us through WhatsApp, your messages may be accessed by authorized team members and processed through the business-messaging systems used to manage enquiries and support.

These channels also involve third-party services with their own data-processing practices. Information received by our business may be retained in our service systems; deleting a message from your device does not necessarily remove those records.

You can begin with a general request for an appointment. Ask our team about an appropriate channel before sending particularly sensitive documents.

Please avoid sending information about another person unless you have authority to do so.

6. When we share information

We share information relevant to the stated purpose with the following recipients, where authorized or otherwise permitted by law:

Providers involved in your requested care

Physicians, laboratories, pharmacies, and other relevant providers may receive information needed to assess or deliver the services you request.

Operational service providers

Providers supporting website hosting, assessments, communications, customer management, document storage, scheduling, payments, and technical maintenance may process information for those functions.

Providers processing information on our behalf are subject to appropriate contractual requirements.

Delivery providers

Where delivery is arranged, providers may receive the contact, address, and order information needed to fulfill it.

Professional advisers and authorities

Information may be disclosed where necessary for professional advice, legal obligations, valid authority requests, or the establishment, exercise, or defense of legal claims.

We limit disclosures to information relevant to the purpose. We do not sell your personal information.

7. Processing outside Colombia

Some technology providers may store or process information outside Colombia.

An international transfer to another controller and processing by a provider acting on our behalf are different arrangements. We apply the applicable Colombian requirements, including appropriate contractual protections, authorization, or another permitted mechanism.

You can contact our privacy representative for information about the providers and international processing relevant to your data.

8. Cookies and website technologies

Cookies and similar technologies can support website functions, remember preferences, measure usage, or support advertising.

The website’s cookie information must identify the technologies actually used, their purposes, providers, and duration.

Where optional analytics or advertising technologies are enabled, we request the applicable authorization before activating them. You can change your choices through the website’s cookie settings.

Rejecting optional cookies does not prevent you from reading public information or contacting our team.

We do not send assessment answers, laboratory results, prescriptions, or private health messages to advertising platforms. Tracking configurations must also prevent the disclosure of sensitive information through page addresses, form fields, or event labels.

9. Marketing and other optional uses

Promotional messages require a separate choice from the information needed to respond to your request or coordinate a service.

You can withdraw marketing permission through the unsubscribe option provided or by contacting our team. This does not prevent necessary communications about services you have requested.

Using your testimonial, photograph, or identifiable experience in our marketing requires separate permission describing the proposed use.

10. How long we keep information

We retain information for the period needed for its authorized purpose and applicable legal or contractual requirements.

Retention depends on the record:

• —Enquiry records support responding to and following up on your request.
• —Service and assessment records support the services requested and relevant accountability requirements.
• —Financial records follow applicable accounting and tax requirements.
• —Authorization and privacy-request records document choices and how requests were handled.
• —Technical records support security and system operation for an appropriate, limited period.

Information may be retained longer when necessary for an unresolved complaint, legal proceeding, or another applicable obligation.

When retention is no longer justified, we delete the information or irreversibly anonymize it, including through applicable backup-retention processes.

Clinical records held by healthcare providers may have separate mandatory retention requirements. A request to delete information from TRT Optima does not automatically delete a provider’s clinical record.

You may ask about the retention period applicable to a particular record.

11. Information security

We use technical, organizational, and administrative safeguards appropriate to the information and risks involved. These include restricting access to authorized people and managing the providers who process information for us.

No communication or storage system is completely risk-free. If you suspect unauthorized access, an incorrectly addressed message, or another privacy issue, contact our privacy representative.

We assess incidents and make notifications required by applicable law.

12. Your rights and how to exercise them

You may request access to, correction of, or updates to your information; evidence of authorization; and an explanation of its use. You may also request deletion or withdraw authorization, subject to applicable retention obligations.

Send your request to [email protected] or Edificio Chelsea, Piso 7, Cra. 48 #19 Sur-100, Zona 2, Envigado, Antioquia 050021, Colombia. Include your name, a return contact, and what you want us to review. We may request proportionate identity or representative-authority verification.

Access enquiries are answered within 10 business days; a notified extension may add up to 5. Complaints are answered within 15 business days from the day after receipt; a notified extension may add up to 8.

We will explain any missing information needed to process a request.

After completing the enquiry or complaint procedure with us, you may complain to Colombia’s Superintendencia de Industria y Comercio.

Privacy requests are free of charge.

Superintendencia de Industria y Comercio

13. Information about children and adolescents

Information involving children and adolescents requires special protection. Where processing is legally appropriate, it must respect their best interests and rights, with the necessary representative authorization and consideration of their views according to maturity.

Please contact us before submitting information on behalf of a minor so we can explain the appropriate process.

14. Changes to this policy

This policy takes effect on the date shown above and applies while we process information within its scope.

We may update it to reflect changes in services, processing, or legal requirements. Material changes will be communicated through an appropriate channel. Where a change requires a new authorization, we will request it before beginning that processing.