Cookie and similar technologies policy

Controller

The intended website controller is I-ME International Medical Enterprise.

Email: inmedicalime@gmail.com.

WhatsApp / phone: +57 300 717 2757.

Legal name: INTERNATIONAL MEDICAL ENTERPRISE. IME. S.A.S..

Tax ID / NIT: 901871720-1.

Registered address: CL 28 SUR 29 83, Envigado, Antioquia, Colombia.

Official privacy channel: inmedicalime@gmail.com.

What cookies and similar technologies are

Cookies are small files or identifiers that may be stored in the user's browser or device to enable website operation, remember preferences, improve experience, measure usage, strengthen security or enable third-party integrations.

Similar technologies may also be used, such as local storage, session storage, pixels, SDKs, tags, device identifiers, server logs and analytics tools.

Colombian legal framework

Colombia does not have an autonomous cookie law equivalent to the European model. However, where cookies or similar technologies identify or make a natural person identifiable, their use must comply with Law 1581 of 2012, including the principles of purpose limitation, freedom, transparency, security, restricted circulation and access, as well as authorization and data subject rights rules.

Technologies currently used

Based on the technical information available for the website, the site may use:

Local or session storage: for theme preference, navigation, cart, quote list and user experience operation.

Technical security logs: to prevent abuse, errors, fraud, unauthorized access and maintain traceability.

Necessary cookies or identifiers: to enable navigation, security, forms, quotes, checkout and essential functions when active.

Initial technical operating inventory.

Based on the currently projected website architecture, and using public practices observed in Colombian medical-equipment commerce sites that combine catalog, contact forms, WhatsApp, warranty flows, analytics and payment gateways, I-ME adopts the following initial technical inventory. This inventory must be verified in production whenever a new website version is deployed:

Technology / identifier: ime_theme or equivalent · Category: Preferences · Purpose: Remember visual theme, language or basic user-experience settings. · Provider or responsible party: I-ME / website · Estimated duration: Persistent until deleted by the user · Processing basis: Functionality requested by the user · Notes: Must not be used for profiling.

Technology / identifier: ime_quote_cart or equivalent · Category: Strictly necessary · Purpose: Temporarily keep products added to quote, cart or interest list. · Provider or responsible party: I-ME / website · Estimated duration: Session or limited persistence · Processing basis: Pre-contractual request · Notes: Must be minimized and must not include sensitive data.

Technology / identifier: ime_consent or equivalent · Category: Strictly necessary · Purpose: Store cookie and data-processing consent preferences. · Provider or responsible party: I-ME / website · Estimated duration: Up to 12 months or until a relevant policy change · Processing basis: Legal compliance and accountability · Notes: Must record accepted policy version.

Technology / identifier: Server / hosting logs · Category: Security · Purpose: Security, availability, error diagnosis, abuse prevention and traceability. · Provider or responsible party: Hosting / CDN / technology provider · Estimated duration: According to security and log policy · Processing basis: Legitimate security interest · Notes: Must be limited to what is necessary.

Technology / identifier: WhatsApp link / API / widget, if activated · Category: Third-party integration · Purpose: Enable voluntary commercial contact via WhatsApp. · Provider or responsible party: Meta / WhatsApp and/or widget provider · Estimated duration: According to third-party policies · Processing basis: User request and channel authorization · Notes: When clicked, the user may be subject to third-party policies.

Technology / identifier: Wompi gateway, if activated · Category: Payment · Purpose: Process Colombian payments, reconciliation, anti-fraud and transaction confirmation. · Provider or responsible party: Wompi / Bancolombia or applicable provider · Estimated duration: According to provider policy · Processing basis: Contractual performance and legal obligation · Notes: I-ME must not store full card data.

Technology / identifier: Stripe gateway, if activated · Category: International payment · Purpose: Process international payments, reconciliation, anti-fraud and transaction confirmation. · Provider or responsible party: Stripe or applicable provider · Estimated duration: According to provider policy · Processing basis: Contractual performance and legal obligation · Notes: Activate only with account, contract and enabled countries.

Technology / identifier: Supabase Auth / Storage / Database, if activated · Category: Functional / security · Purpose: Admin authentication, product storage, requests and traceability. · Provider or responsible party: Supabase / I-ME · Estimated duration: According to internal configuration · Processing basis: Pre-contractual/contractual execution and security · Notes: Review international transfers and RLS.

Technology / identifier: Google Analytics 4, Matomo, Microsoft Clarity or other analytics, if activated · Category: Non-essential analytics · Purpose: Measure traffic, performance, aggregate navigation and errors. · Provider or responsible party: Analytics provider · Estimated duration: According to configuration · Processing basis: Prior consent where not strictly necessary · Notes: Must remain disabled until acceptance if identification or profiling is involved.

Technology / identifier: Meta Pixel, Google Ads, LinkedIn Insight Tag or other pixels, if activated · Category: Advertising / remarketing · Purpose: Campaign measurement, audiences, conversions and remarketing. · Provider or responsible party: Advertising provider · Estimated duration: According to configuration · Processing basis: Prior, express and informed consent · Notes: Must not be activated without banner/CMP and policy update.

Technology / identifier: Fonts, maps, videos, CDN or external scripts · Category: Third-party integration · Purpose: Load visual resources, maps, videos, libraries or performance tools. · Provider or responsible party: Relevant provider · Estimated duration: According to provider · Processing basis: Technical necessity or consent depending on case · Notes: Prefer local resources where possible.

This inventory does not by itself authorize installation of non-essential tools. Any advanced analytics, advertising, remarketing, profiling, maps, external chat or external CRM tool must undergo technical, legal and security review before production.

Categories

Strictly necessary cookies or technologies.

These enable navigation, security, temporary preference storage, cart, quote list, forms and essential processes. Some functions may not operate properly without them.

Preferences.

These remember user choices such as language, visual theme, region, products added to quotes or experience settings.

Analytics.

These measure visits, pages viewed, performance, errors and aggregated website behavior. No definitive tool is currently confirmed.

As an internal rule, non-essential analytics will not be activated until a technical inventory, documented purpose, data-minimization configuration and consent mechanism, where required, exist. Admissible tools may include Google Analytics 4, Matomo, Microsoft Clarity or an equivalent tool, subject to technical and legal approval.

Advertising, remarketing and pixels.

These measure campaigns, create audiences, perform remarketing or personalize advertising. No advertising pixel installation is currently confirmed.

I-ME must not activate advertising, remarketing or profiling technologies without prior approval, operating banner/CMP, consent record and express update of this policy. These tools may include Meta Pixel, Google Ads, LinkedIn Insight Tag or other pixels only where a documented commercial need and valid legal basis exist.

Third-party integrations.

These may include WhatsApp, payment gateways, maps, CRM, chat, forms, CDN, videos, fonts, hosting, Supabase, Wompi, Stripe or other providers.

Actual providers must be documented in the technical inventory before deployment. At minimum, WhatsApp, hosting/CDN, payment gateways, CRM, forms, Supabase, analytics tools, external scripts, fonts, maps and video players will be reviewed.

Consent

Strictly necessary technologies may operate without additional consent when indispensable to provide the service requested by the user. Non-essential analytics, advertising, remarketing, profiling or third-party cookies must be activated only where there is a valid legal basis and, where applicable, prior, express and informed authorization.

Managing and withdrawing consent

Users may manage or withdraw consent through:

Cookie preference panel: website banner or preference panel when non-necessary cookies are activated; until then, browser settings and privacy request channel.

Browser settings.

Privacy request channel: inmedicalime@gmail.com.

Provisional email: inmedicalime@gmail.com.

I-ME will implement a banner or CMP before activating non-essential cookies, advanced analytics, advertising, remarketing or profiling. The panel must allow users to accept, reject and modify preferences, preserve proof of consent and avoid blocking essential browsing when users reject non-necessary cookies.

Third parties

Third parties that install cookies or similar technologies may process data under their own policies. I-ME International Medical Enterprise must contractually verify that such providers comply with appropriate data protection, security and confidentiality standards.

Updates

This policy must be updated whenever cookies, pixels, analytics tools, CRM, external chat, payment gateways, third-party scripts or equivalent technologies are added, removed or modified.