When a patient asks about their data

A patient may ask what data your institution has about them, ask for it to be corrected or deleted, or ask not to be contacted again. This page explains what to do and what you can handle yourself in Arbol. It isn’t legal advice: read the Privacy Policy and your institution’s procedure.

Your institution comes first

Your institution is the controller of its patients’ data, and Arbol handles it on the institution’s behalf. That’s why, according to Arbol’s privacy policy, a patient’s main channel for these requests is the institution itself.

The patient asks
Through your institution’s channels.
Your institution receives it
Following its data protection procedure.
Your team handles it in Arbol
Look up, correct or block.
Arbol's team helps
When data must be erased for good.

Pass the request to whoever handles data protection at your institution, with the date it arrived. If you don’t know who that is, ask your manager.
Handle in Arbol what’s yours to handle, using the table below, if your institution asks you to and your role allows it.
For what you can’t do yourself, whoever administers Arbol at your organization writes to Arbol’s team at support@getarbol.com.

The patient’s rights and their deadlines

According to the privacy policy for Colombia (in Spanish), as the owner of their data the patient can know, update and correct it; ask for proof of their authorization; find out what it’s been used for; file complaints with the Superintendencia de Industria y Comercio (SIC), Colombia’s data protection authority; and withdraw their authorization and ask for the data to be deleted when there’s no legal or contractual duty to keep it.

The policy also says that inquiries are answered within ten (10) business days at most and claims within fifteen (15) business days at most, as the law requires. That’s why it’s best to pass the request on the same day.

What you can do in Arbol

The patient asks…	What you can do
To know what data you have about them	Find them in Raíz, under People: their record shows their details and their Traceability, with a link to each conversation. In Agenda, under Pacientes: their record shows their details, appointments, notes and files. In Ámbar, under Pacientes. Hand over what your institution decides, only through its channels.
To correct a piece of data	In Raíz, on their record, Actions › Edit details, or click a piece of captured data to change it. In Agenda, on their record’s Datos tab, Editar. Changes are saved with your name.
Not to be contacted again	In Raíz, block their number: no agent answers or contacts that number again. See Manage people and the block list. If your institution sends them messages from other applications, such as Agenda’s reminders, tell whoever administers them.
To delete their data	In Raíz, Delete person removes them from People, but their conversations are kept. To erase their data for good, your institution asks Arbol’s team.
To file a complaint	Pass the complaint to whoever handles data protection at your institution. The privacy policy notes the patient can go to the SIC.

For each application’s steps, see Manage people and the block list and Update a patient’s record.

How to write to Arbol’s team

Write to support@getarbol.com from the email of whoever administers Arbol at your organization.
Say what the patient asked for, when they asked, and your organization’s name and, if you can, its ID.
Don’t put the patient’s data in the first message, such as their name, ID document or phone. Arbol’s team will tell you how to identify them safely.