Information security

In healthcare, information is sensitive. These are the measures we take to protect the information that institutions and site visitors entrust to us.

How we protect information

• Encryption in transit: the site and platform work only over HTTPS (TLS).

• Protected passwords: never stored in plain text; they're stored using secure hashing algorithms.

• Minimal access: each person accesses only what they need, through roles and permissions, and access is revoked when no longer needed.

• Separation by institution: each client's data is managed separately and is only visible to authorized staff.

• Site protection: content security policies, protection against automated submissions, and controls against form and chat abuse.

• Backups: database backups before every major change and according to the plan agreed with each institution.

• Updates: we keep systems and dependencies up to date, and review code before publishing it.

• Activity logging: we keep logs of important changes to detect and clarify incidents.

Our team

Staff with access to institutional information must sign confidentiality agreements and receive training in security, data protection, and the safe use of technology.

If an incident occurs

We have a procedure to contain, investigate, and resolve security incidents. If personal data is affected, we notify the responsible institution and the Superintendence of Industry and Commerce when applicable, as required by Law 1581 of 2012.

Report a vulnerability

If you find a possible vulnerability on our site or in our systems, write to us through the contact form with the subject "Security" and a description to reproduce it. We ask that you not access, modify, or delete other people's data, not disrupt service availability, and give us reasonable time to fix it before disclosing it publicly. We appreciate reports made in good faith.

Last updated: October 25, 2026.