Personal data policy

1. Who is responsible for your data

The data controller is Based Evidence S.A.S., a Colombian company registered under tax ID (NIT) 901.758.828-3, with registered address in Medellín, Antioquia, Colombia.

For anything related to this policy: ceo@basedevidence.com · +57 305 435 4147.

2. What we collect

Only what you give us voluntarily:

• From the contact form: name, job title, work email, organisation, type of organisation, the type of need you select and the message you write.
• From the booking calendar: name, email and whatever you include when booking.
• If you email us directly: whatever your message contains.

We do not use tracking cookies, we do not do advertising profiling and we do not buy contact databases. We do not request sensitive data or clinical information about identifiable individuals through this website. If your enquiry involves that kind of information, we handle it through project channels, under a signed agreement, not through the form.

3. What we use it for

To answer your enquiry, prepare the conversation, draft a proposal where relevant, and maintain the exchange that follows from that contact. Nothing else.

We do not sell or transfer your data for commercial purposes. Writing to us does not add you to a mailing list: if we ever send a newsletter, it will be because you explicitly asked for it.

4. Who else sees it

Two providers are involved on the technical side and act as data processors:

• Web3Forms processes the form submission and delivers it to our inbox.
• Microsoft 365 hosts our email and the booking calendar.

Both operate servers outside Colombia, so submitting the form involves an international transfer of your data. By submitting it, you authorise that transfer. No other third party receives this information.

5. How long we keep it

For as long as the relationship lasts, and for whatever period the accounting and legal obligations arising from it require. If the contact does not lead to a project, we delete the data once it is no longer needed, or earlier if you ask us to.

6. Your rights

As the data subject you may access, update and correct the information we hold about you; request proof of the authorisation you granted; be told how we have used it; withdraw your authorisation and request deletion; and file a complaint with the Colombian Superintendency of Industry and Commerce.

These rights are free of charge and you may exercise them as often as you wish.

7. How to exercise them

Write to ceo@basedevidence.com with the subject line Data protection, stating what you are requesting and something that allows us to identify you.

Under articles 14 and 15 of Colombian Law 1581 of 2012, we answer queries within ten working days and complaints within fifteen working days. If we need longer, we tell you before the deadline expires and explain why.

8. Data inside a research project

When a project involves processing patient or participant data, we act as processors on behalf of the responsible institution, under the data agreement it defines and with approval from the relevant ethics committee. We never use that data for any purpose other than the project, never merge it into this contact database, and return or delete it at the end of the engagement as agreed.

9. Effective date and changes

This policy is effective from August 2026. If we amend it, we will publish the new version at this same address with its date. We will tell anyone with an active relationship with us about any substantial change.

Last updated: August 2026. This document describes our actual data handling practices; it does not replace the legal advice each organisation should obtain for its own circumstances.