Privacy Policy

Last updated: 18 October 2026 · Version 3.1

This policy explains what happens to the information you give us through this website, including the photographs of your smile. We have tried to write it in plain English rather than legal language, because you should be able to understand it before you send us anything.

1. Who is responsible for your data

The company responsible for the processing described in this policy (the data controller) is the entity that receives your enquiry and decides what happens to it:

The clinical team who review your case work at the clinic in Medellín. Your data is handled under Colombian data-protection law (Ley 1581 de 2012 and its regulations), which applies to the clinic, and we apply the same standards to patients located in the United States.

2. What we collect

When you send the consultation form

• Contact details: your name, email address and phone number.
• About your case: the dental procedures you have had before, what you would like to improve, a tentative travel date, and a discount code if you have one.
• Photographs: the images of your teeth and smile that you upload. Please see section 4, because these are treated differently.
• Consent records: the date and time you accepted this policy, and which optional permissions you gave. We keep these because we have to be able to prove that you agreed.

When you send the influencer application form

• The same contact details, plus the social media profiles you choose to share, how you heard about the programme, and whether we should deal with you or with your agency.

Automatically, when you visit

• Our server records standard technical information (the page requested, the date and time, an approximate location derived from the IP address, and the browser type) for security and to keep the site working. We do not use it to build a profile of you.

What we do not collect

• We do not ask for your social security number, passport number or full medical history through this website.
• We do not take card details through this website, and we never ask for them by email or message. See "Payments" below.
• We do not use third-party analytics or advertising cookies unless you accept them. See section 7.

Payments

This website does not process payments and does not receive your card number. When you pay a deposit or a balance, it is handled by one of the following, and their own privacy terms apply to that transaction:

• PayPal — paid through your PayPal account;
• Zelle, ACH or a bank wire — arranged with your own bank;
• A card terminal at the clinic, if you pay the balance in person.

In all of those cases we receive confirmation that a payment was made, the amount, the date, and the name on the transaction. We do not receive or store your full card number. We keep receipts and invoices because tax and accounting law requires it.

If you pay by card, a 5% processing fee applies; this is described in our Terms.

3. Why we use it, and on what legal basis

4. Your clinical photographs are sensitive data

Under Colombian law, information about your health — and photographs from which your health or physical features can be seen — is sensitive personal data, which receives stronger protection than ordinary data.

That means the following, and we want to be explicit about it:

• Sending the photographs is voluntary. You are never obliged to send them. If you would rather not, you can still contact us and we can discuss your case another way, although we may not be able to give you an accurate plan or price.
• We only use them to assess your case and to prepare your plan, and to show them to the clinicians and laboratory staff involved in your treatment.
• We will never publish your photographs, and never use them in advertising or on social media, unless you give a separate, written permission for that specific use. That permission is optional, it is a different document, and refusing it does not affect your assessment in any way.
• You can withdraw that permission at any time and we will stop using them and remove them from wherever we published them.

If you do give permission for your photographs to be used publicly, you will be asked to sign our Image Consent, which sets out exactly which images, where they may appear, and for how long.

5. Who else handles your data

We are a small clinic and we do not sell, rent or trade your data. But we do use service providers (legally, processors) to run things, and they handle your data on our instructions. We would rather tell you who they are than claim that nobody else ever sees it:

We may also disclose your data where the law requires it, for example to a health authority, a court, or a tax authority, and to professional advisers if we need legal or accounting advice.

We do not transfer your data to anyone else, and we do not use it to train machine-learning models.

6. How long we keep it

Why twenty years, and what it means in practice

• Because the record has to outlive the treatment. Colombian rules for clinical records require them to be kept for a long period, so that you — or a dentist treating you years later, perhaps in an emergency in another country — can see exactly what was done, with which materials. Twenty years from your last appointment is the retention period applied to clinical records in Colombia, and it is the period we apply.
• How it is stored, and how the twenty years break down. For the first five years your record stays in our active archive, where it can be retrieved quickly. After five years without a new appointment it moves to our central archive, where access is restricted to the clinical team and retrieval takes longer. It stays there for the remaining fifteen years. Five plus fifteen is the twenty-year period above, and it is also how the regulation describes the archival cycle (Resolución 1995 de 1999, art. 1).
• Your photographs are part of that record and are kept with it. If you gave permission for your photographs to be used publicly, withdrawing that permission removes them from our website and social channels, but the clinical copy remains in your record until the retention period ends.
• Everything else is deleted. If you send us an enquiry and never become a patient, we do not keep it for twenty years: we delete it after 24 months, or sooner if you ask.
• You can always ask. If you ask us to delete something we are not obliged to keep, we will delete it, and we will tell you what we kept and why.

7. Cookies, pixels and tracking

This website loads its measurement and advertising tags through Google Tag Manager. Those tags can set cookies or read information from your browser. We divide them into three categories, and only the first one is active unless you tell us otherwise.

What is set, if you accept

The lifetimes are the platforms' defaults and can change when they update their products. What matters for you is the category switch: turning a category off stops those cookies being set from then on.

What happens before you choose

We use Google Consent Mode v2. Until you make a choice, Google's tags run in a restricted mode that cannot set advertising or analytics cookies. If you accept, the tags receive that signal and start measuring normally. If you reject, they stay restricted — they do not fall back to tracking you by another route.

Other advertising networks

We may add other advertising networks in the future — for example Pinterest, Snapchat, LinkedIn or X. If we do, we will name the provider and its cookies in the table above before we start using it, and the banner will ask you again because the advertising category has changed. We will not quietly add a tracker that is not listed here.

How to change your mind

• A “Cookie settings” button sits at the bottom of every page. It reopens the banner and lets you change either category at any time.
• Turning a category off takes effect immediately for everything loaded afterwards. It does not delete the cookies that were already set — for that, clear cookies for this site in your browser settings.
• You can also block or delete cookies entirely in your browser. The site still works; the form still works.
• If you have a Google account, you can control advertising personalisation at myadcenter.google.com.

Global Privacy Control

If your browser sends a Global Privacy Control signal, we treat it as a request to keep advertising cookies off: the advertising category starts turned off and the banner tells you why. We honour the signal rather than ignoring it.

Third-party privacy policies

• Google — Tag Manager, Analytics and Ads
• Meta — Facebook and Instagram
• TikTok

8. Advertising on Google, Meta and TikTok

We advertise our clinic on search and social platforms: Google (including YouTube), Meta (Facebook and Instagram) and TikTok. This section explains what happens when you reach us through one of those advertisements.

• When you see or interact with an advertisement, the platform processes your information under its own privacy policy, linked in section 7. That processing is theirs, not ours.
• If you complete a lead form on one of those platforms, or click through to this website and send us the consultation form, we receive the information you chose to give us — typically your name, email address, phone number and what you told us about your case.
• We use that information only for the purposes in section 3. We do not sell your data and we do not add it to a database we trade with anyone.
• If you accept advertising cookies, the platform can tell that your visit came from a particular advertisement. That is how we know which advertisements work, and it is the only reason we run them.
• You can ask us to delete what we hold at any time, using section 10. You can also act directly on the platform: every one of them gives you a way to opt out of personalised advertising in its own settings.

Advanced matching: what we send to Meta, and what we never send

If you accept advertising cookies, the Meta pixel can use automatic advanced matching. This means that the name, email address and phone number you type into our form are converted into an irreversible hash (SHA-256) inside your own browser and sent to Meta in that form. Meta uses the hash to recognise that this visit is the same person who saw one of our advertisements, which is how we know which advertisements produce real consultations.

What this does not do:

• Meta never receives the original text of your name, email or phone. Only the hash leaves your browser.
• No health information is sent. The procedures you tick in the form, the reason for your consultation, and your clinical photographs are not part of this mechanism and are never sent to Meta.
• It does not run unless you accept advertising. The pixel is not even loaded until you give that permission, so without it advanced matching cannot happen at all.
• It does not create a profile of you outside Meta's own systems, and we do not receive anything back about who you are.

9. Where your data goes

Our service providers are located in the United States and the European Union, so your data is stored and processed outside Colombia. This is an international transfer of personal data. We only work with providers that offer adequate technical and organisational protection, and we remain responsible for your data under Colombian law regardless of where it is stored.

10. How to access, correct, delete or object

You can exercise the following rights at any time, free of charge:

• Know what data we hold about you and how we have used it.
• Update or correct anything that is wrong or incomplete.
• Delete your data and your photographs, except what we are legally obliged to keep.
• Withdraw your authorisation, including any permission to use your photographs in our marketing.
• Object to a particular use, and ask us to stop.
• Ask for a copy of the data you gave us, in a portable format.

How to do it

Write to luxesmileveneers@gmail.com with the subject line "Data request", or message us on WhatsApp at +1 (727) 423-4213. Tell us what you want us to do. We may ask you to confirm your identity so that we do not hand your data to somebody else.

Our timeframes, under Colombian law:

• Questions and enquiries: answered within 10 business days.
• Complaints and deletion requests: answered within 15 business days.
• If we cannot meet that, we will tell you why and give you a date.

There is no charge, and asking us will not affect the care you receive or the plan we give you.

If you are not satisfied

Please contact us first, using the address above — most problems are solved that way. If you are still not satisfied, you may complain to the Colombian data-protection authority, the Superintendencia de Industria y Comercio (SIC), at www.sic.gov.co. You must usually raise the matter with us first.

11. If you are in the United States

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not "sell" it in the sense used by California law, and we do not use it for targeted advertising off our own site.
• You can ask us for a copy, ask us to correct it, or ask us to delete it, using section 10. We will honour the request regardless of which US state you live in.
• We do not knowingly collect information from children under 18, and we do not direct this website to them.
• If you are a California resident, you also have the right not to be discriminated against for exercising these rights. We do not discriminate: the plan and price we offer you do not depend on whether you ask us to delete your data.

12. Data deletion in detail

Because people ask us this often, here it is step by step. This applies whether you came to us through this website, a WhatsApp message, or a Facebook or Instagram ad.

1. Email luxesmileveneers@gmail.com with the subject "Delete my data", from the same email address you used with us.
2. Tell us if you want everything deleted, or only the photographs, or only the marketing contact.
3. We confirm within 15 business days and tell you what we have deleted.
4. We delete your photographs from our storage and your data from our practice-management system. We also ask our email provider to remove the copies in our mailbox.
5. We will tell you if any record has to be kept by law, and for how long.

If you reached us through Meta, we cannot delete the copy Meta holds of your interaction with their ad — only Meta can do that, through your Facebook settings. We can delete what we hold.

13. Security

Access to your case and photographs is restricted to the team members involved in your treatment. The platform that stores your data encrypts it in transit and at rest, and access requires an individual account. We take reasonable steps to protect it, but no method of transmission over the internet is completely secure, and we cannot promise absolute security.

If a security incident were to affect your personal data, we would tell you and the competent authority as required by law.

14. Changes to this policy

We may update this policy, for example if we change a supplier or add a tool. The version at the top of this page and the date of the last update will always tell you which version is current. If we make a significant change affecting how we use your photographs, we will ask you again before applying it to data you have already given us.

What changed in version 3.1

Version 3.1 documents automatic advanced matching with Meta: the name, email address and phone number you write in our form are hashed in your browser and sent to Meta in that form, so that a visit can be matched to an advertisement you saw. Section 8 now explains exactly what is sent, what never is, and that it only happens if you accept advertising. No other part of the policy changed.

What changed in version 3.0

Version 3.0 added measurement and advertising. Earlier versions of this policy stated that this website did not use cookies, analytics or advertising pixels, and at the time that was true: the site was not running any. We have now added Google Analytics 4, Google Ads, Meta (Facebook and Instagram) and TikTok Ads, all loaded through Google Tag Manager and all blocked until you give permission. Sections 7 and 8 were rewritten to describe them, and a cookie banner and a “Cookie settings” control were added to the site. Nothing you sent us before this change is affected by it.

15. Contact

LUXE SMILE LLC · 7901 4th St N, Ste 300, St Petersburg, FL 33702, United States
Clinic: Luxe Smile · CL 2 #20-50, Q Office, Piso 13, Oficina 1305, El Poblado, Medellín, Colombia
Email: luxesmileveneers@gmail.com
WhatsApp: +1 (727) 423-4213