Amena Personal Data Processing Policy

• Version: 1.0
• Effective date: 2026-10-18
• Where it is published: amena.com.co/privacidad and inside the app, in Spanish and English. If the two versions differ, the Spanish version prevails.

Amena is a marketplace to find, book and pay for aesthetics and wellness services in Colombia, in four categories: Beauty and Personal Care, Aesthetic Medicine, Aesthetic Dentistry and Plastic Surgery. This policy explains which personal data we process, why, who we share it with, how long we keep it and how you can exercise your rights.

It is issued in compliance with Law 1581 of 2012 and Chapter 25 of Title 2 of Part 2 of Book 2 of Decree 1074 of 2015, which incorporated Decree 1377 of 2013.

1. In short

• We do not sell your data or hand it to third parties for them to do business with it. This is a permanent decision, not a launch promise.
• Booking a health service reveals information about your health, which the law treats as sensitive data. We only process it with your express authorization, which we ask for at your first booking of any service. It is required to book services with a health or surgical profile, such as Aesthetic Medicine services or laser hair removal. For ornamental or cosmetic services you may decline it and still book.
• You can search and view establishments without creating an account. An account is required to book, with Apple or Google, and requires being 18 or older and verifying your mobile phone.
• You can delete your account from the app. We keep, without data that identifies you, only the records that the law or security requires us to keep.
• We do not track you across other companies' apps or websites, and we do not use your device's advertising identifier.
• Our servers are in the United States, on Amazon Web Services (us-east-1 region).

2. Who the Data Controller is

Amena is the commercial brand under which Bee Analytics SAS operates the marketplace. Bee Analytics SAS is the Data Controller of the data this policy describes.

3. Who this policy applies to

To the people whose data we process when operating Amena:

• Visitors who use the app or the website without an account.
• Clients who create an account to book.
• Establishment staff: owners, managers and receptionists who manage an establishment on Amena.
• Professionals who work at the establishments: stylists, cosmetologists, physicians, dentists, surgeons and others.
• People who appear in before-and-after content that an establishment publishes on Amena.

It covers the iOS app, the amena.com.co website and the tools used by establishments and by the Amena team.

What Amena does not do. Amena does not provide the aesthetic or health services: the establishment you choose provides them. Your medical record and the information about your care are kept by the establishment, under its own responsibility. Amena does not ask you for diagnoses, medical records or photos of your body.

4. Terms we use

• Data subject: the person the data refers to. If you use Amena, you are the data subject of your data.
• Sensitive data: data that affects your privacy or whose misuse can lead to discrimination, such as health data (Law 1581, article 5).
• Controller: whoever decides why and how data is processed. For what this policy describes, it is Bee Analytics SAS (section 2).
• Processor: whoever processes data on behalf of the Controller, following its instructions; for example, the provider that hosts our servers.
• Transmission: handing data to a Processor, inside or outside Colombia, so it processes it on our behalf.
• Transfer: handing data to another Controller, which processes it for its own purposes.

5. What data we process and why

5.1 If you use Amena without an account

Location. The app does not ask for your location. If we later add a feature that uses it, we will update this policy before asking for it.

5.2 If you create a client account

You sign in with Apple or Google. Amena does not handle passwords. To complete sign-up and book you need your first name, last name, email, a verified mobile phone number and your date of birth. Data that Apple or Google already gives us appears prefilled and we do not ask you for it again.

5.3 Bookings

Booking data for health services is sensitive data. See section 6.

5.4 Payments, refunds and Amena Pro

• Payments. Wompi processes them. Today you can pay by card only. We may add other payment methods, such as PSE, Nequi or Apple Pay; if we do, we will update this policy. Amena stores the transaction reference, the amount, the currency, the payment method and the status. Your card details are received by Wompi and never pass through Amena's servers.
• Custody. Amena receives the payment and hands it to the establishment after the service is provided. That is why it processes booking and payment data until settlement.
• Refunds. A card payment is refunded to the same card, through Wompi. We issue the refund within 15 calendar days at most, or sooner if the booking's policy says so.
• Refunds by bank transfer. They only apply if we add a payment method that does not allow the money to be returned automatically. In that case we will ask you in the app for: bank, account type, account holder's document type and number, account holder's name and account number.
• We ask for them after a recent verification of your identity, and they are stored encrypted.
• Only the payments process and finance staff can decrypt them, and every human access is logged.
• To prevent diversion, we compare the account holder's document with the payer's document that Wompi reports for PSE payments.
• When we receive them, we send you a security notice with the bank and the last four digits.
• Once the transfer is confirmed, we delete the name, the document and the full account number. We keep the bank, the last four digits and the receipt, as proof of where your money went.
• Amena Pro. It is an optional membership. If you subscribe, the recurring charge is made to your card through Wompi, which stores your card as a tokenized payment source. Your card details never pass through Amena's servers; we store only the reference to that payment source. We also store your membership status, the plan, the charges and the use of its benefits (waived service fee, late reschedules without penalty, Pro price and priority waitlist), to apply the benefits, charge and invoice.

5.5 Electronic invoicing

• Your invoices. The service fee, rescheduling charges and Amena Pro are invoiced electronically to "final consumer", without your personal data. Amena issues the invoice through Alegra.
• Invoice in your name. Not available today: invoices for the service fee and Amena Pro go to "final consumer", without your personal data. If we offer it later, we will update this policy first.
• Establishments. Amena's invoices to establishments are issued in Alegra with their name and tax ID (NIT). If the establishment is an independent professional, their NIT is their national ID number (cédula).

5.6 Reviews, reports and disputes

• Reviews. Reviews cannot be written today; this describes how they will work when they are available. Only someone who booked through Amena can leave a review. We store the rating and the comment, tied to the booking. The review is public and shows your first name and the initial of your last name. When submitted it goes through a filter of banned terms, and an administrator can hide or remove it.
• Reports. You can report a review with a reason and an optional detail. The establishment never sees who reported it.
• Disputes. If something went wrong with your appointment, you can open a dispute with a reason, your account of up to 1,000 characters and evidence files. The establishment gives its version. What each party provides is not seen by the other; only Amena's administrators see it.
• Free text and health. What you write in a dispute or a report may contain health data. That is why the application can store it but not read it: only administrators read it, through a command that leaves a record, and it never goes to technical logs, metrics or the audit log.

5.7 Communications

• Service notices, by email: bookings, payments, refunds, requests for bank details, changes to this policy and account deletion.
• Security notices, which cannot be turned off: a new sign-in method linked to your account and the receipt of bank details.
• Optional notices: today we only send service and security notices, which cannot be turned off. Any optional or marketing notice we add will be sent only with your acceptance, and you will be able to control it in the app, under Profile > Notifications.
• Marketing messages: we do not send them today. If we send them later, it will only be with your authorization, which will be optional and which you can withdraw at any time.
• Push notifications: we do not send them today. If we add them, the app will ask for your permission in iOS before sending them.
• SMS: only to send you the verification code for your mobile number. We do not use SMS, WhatsApp or other messaging channels for notices.
• Emails are sent through Amazon Simple Email Service (Amazon SES), from Amazon Web Services. Emails to an Apple private relay address go through Apple's relay service.

5.8 Advertising inside Amena

Verified establishments can pay to appear in featured positions, always labeled "Sponsored". The order of results is calculated first without advertising, and paid positions are inserted afterwards in fixed places.

To count impressions and clicks, and to avoid charging an establishment for fake clicks, we calculate three pseudonymous codes (hashes) instead of storing your IP:

• Network: over your IP prefix (the first three blocks in IPv4, or the first 48 bits in IPv6).
• Viewer: over your account identifier if you are signed in; otherwise, over your IP and your user agent.
• Device: over your IP and your user agent.

How they work:

• They are calculated with a random key that changes every day, in Colombian time. While that key exists, the codes are pseudonymous personal data.
• Each day's key is destroyed about 48 hours after that day ends. From then on the codes cannot be reversed or linked to those of another day.
• We use them only to count advertising and prevent fraud. We do not build profiles, we do not identify you from one day to the next and we do not show you targeted advertising.
• Impression and click events are kept for 90 to 122 days. They are then archived encrypted, with the codes and no other data about you, as support for advertising invoices, for 10 years (Commercial Code, article 60, and Law 962 of 2005, article 28).

5.9 iOS app crash diagnostics

We use Sentry, in its United States region, to know when the app fails.

• Only crashes, app hangs and terminations forced by the system are sent. No performance traces, session recordings, screenshots, screen structure or app logs are sent.
• Before leaving the phone, the app removes the installation identifier, the device name and any user identifier, and masks emails, identifiers and sequences of six or more digits, such as phone, ID or card numbers. From web addresses it keeps only the method, the server and the path, without parameters.
• Sentry is configured not to store IP addresses.
• This data is not linked to your identity and is not used to track you.
• It is kept for up to 90 days.
• You can turn off crash reporting in the app, under Profile > Privacy and data, from the version that includes user accounts. Before that version, the test app sends diagnostics without identifying you.

5.10 Establishments and their staff

• If the establishment is an independent professional, the NIT is their national ID number and that data is their personal data.
• Each establishment has a single active bank account. Only the Amena team can change it; the establishment's owner is notified of the change by email, and the new account is put on hold for a period before receiving payments.

5.11 Professionals

• The professional does not have an Amena account. Their data is uploaded by the establishment where they work, and only after uploading the professional's signed authorization to process it.
• Their documents are verified once and are valid at every establishment where they work. Each establishment sees only the status of those documents (valid, expiring soon, expired or under review), never the files.
• Professional's public profile: their name, their photo if any, the services they offer and their specialty. For health services it also shows their professional degree, university and registration number, which are the data that article 55 of Law 23 of 1981 allows a physician to announce, together with their address.

5.12 People who appear in before-and-after content

An establishment may only publish before-and-after images of a patient if it declares that it has the patient's explicit consent. That declaration is recorded with date and user. If you appear in an image published on Amena and did not authorize it, write to us at contacto@amena.com.co and we will remove it within 5 business days at most.

6. Sensitive health data

What is sensitive on Amena.

• That you booked a service with a health or surgical profile: those in Aesthetic Medicine, Aesthetic Dentistry and Plastic Surgery, and those in Beauty that require health habilitation, such as laser hair removal, micropigmentation or deep peels.
• The history of those bookings.
• What you write about your health in a review, a dispute or a report.

Your authorization is express and separate. We ask for it in the app, at your first booking of any service, separately from the general authorization. We always ask for it, whatever the service, so as not to depend on how each one is classified.

• Services with a health or surgical profile: the authorization is a condition for booking them, because the booking itself reveals information about your health.
• Ornamental or cosmetic services, such as a haircut or a facial cleansing: you may decline it and still book. No activity may be conditioned on your providing sensitive data (Decree 1074 of 2015, article 2.2.2.25.2.3).

It is optional. You are not required to authorize the processing of sensitive data or to answer questions about it. Without that authorization you can use Amena for everything else, including bookings of ornamental or cosmetic services, but we cannot handle bookings of health or surgical services.

Who sees it.

• The establishment where you booked, because it needs to know which service it will provide to you.
• Amena's administrators, only for support, verification and disputes. Every read of sensitive data is logged.
• Amazon Web Services, as the Processor that hosts the platform.

What it is not used for. We do not sell it, we do not use it for advertising or profiling, and we do not share it with other establishments. We may only give the establishment aggregated, anonymous statistics about its own business.

7. Children and adolescents

• Amena is intended for people 18 or older. When you sign up we ask for your date of birth, and if you are under 18 you cannot complete sign-up or book.
• In health categories, no advertisement may be directed at minors or use models under 18.
• If we detect that an account belongs to a minor under 18 who declared a false date of birth, we suspend it, cancel their pending bookings with a full refund and delete their data, except what the law requires us to keep.

8. Your authorization

How you give it. In the app, before booking, by accepting this policy. Each purpose is authorized separately:

How we prove it. We keep the exact version of the text you accepted, with its digital fingerprint, the purpose, the channel, the language and the date. That record contains no personal data and is kept even if you delete your account, as proof of the authorization.

When the policy changes in substance, we ask you to accept it again before your next booking. You can keep browsing in the meantime. A wording-only change does not require accepting it again.

How you withdraw it. In the app, under Profile > Privacy and data, or through the channels in section 13.

• Withdrawing an authorization prevents new bookings that need it.
• It does not stop the processing needed to fulfill what is already under way, such as a booking, a refund, a dispute or an invoice. The law does not allow revoking the authorization or deleting the data while there is a legal or contractual duty to keep it. The app tells you this when you revoke.

When your authorization is not needed. In the cases of article 10 of Law 1581, such as an order from an authority or data of a public nature.

9. What we do not do

• We do not sell or hand over your data to third parties.
• We do not track you across other companies' apps or websites, nor use the device's advertising identifier.
• We do not use the advertising codes to identify or profile you.
• We do not store your IP in the audit log or in advertising events.
• We do not identify or merge accounts by matching email addresses.

10. Who we share data with

Each Processor processes data only for the stated purpose and under a contract that requires it to protect the data.

11. International transmissions and transfers

Our servers are on Amazon Web Services, in the us-east-1 region in the United States, from where emails and verification SMS are also sent, the app's crash diagnostics are in Sentry's United States region, the website is served by Cloudflare and the emails you write to us are received by Google Workspace. Your data is therefore transmitted to the United States for those Processors to process it on our behalf.

• With Amazon Web Services, Cloudflare, Google Workspace, Sentry, Alegra and Wompi we have accepted their standard data processing agreements, which govern those transmissions.
• Those agreements serve as transmission contracts under Decree 1074 of 2015 (formerly article 25 of Decree 1377 of 2013), so those transmissions do not require an additional authorization from you.
• Wompi processes payment data in Colombia. Alegra, Apple and Google process data in the places their own policies define.
• We do not transfer your data to other Controllers outside Colombia, except what Apple or Google receive when you sign in with them.

12. Your rights

As a data subject you may, free of charge:

1. Know, update and correct your data, including data that is partial, inaccurate, incomplete or misleading.
2. Request proof of the authorization you gave us.
3. Be informed of how we use your data.
4. File complaints with the Superintendence of Industry and Commerce, after completing the process with us.
5. Revoke the authorization and request the deletion of your data, except when there is a legal or contractual duty to keep it.
6. Access your data free of charge.
7. Not answer questions about sensitive data or about data of children and adolescents.

These rights may be exercised by the data subject, their successors, their representative or attorney-in-fact, and whoever acts under a stipulation in favor of another.

13. How to exercise your rights

Channels.

• In the app, under Profile > Privacy and data: you can exercise your rights, including correcting your data, revoke authorizations and delete your account.
• By email: contacto@amena.com.co
• In writing: Bee Analytics SAS, Calle 54 # 45-101, Medellín, Colombia

To protect your data, we verify that the request comes from the data subject or from someone entitled. A request from the app with your session signed in is already verified. A request by email must be sent from the email registered in your account; if that is not possible, or if you send it in writing, you must attach a copy of your identity document.

Inquiries (to know your data or the authorization):

• We answer them within 10 business days at most from receipt.
• If we cannot within that period, we tell you why and when we will answer, within 5 additional business days at most.

Claims (to correct, update, delete or revoke, or for a breach):

• State your identification, a description of the facts, the address where you want the answer and the documents you want to provide.
• If the claim is incomplete, within 5 days of receiving it we ask you to complete it. If two months pass from that request without you completing it, the claim is deemed withdrawn.
• If we are not competent to resolve it, we forward it to whoever is within 2 business days at most and let you know.
• Within 2 business days at most from receiving the complete claim, we mark your data with the legend "claim in process" and the reason, until it is resolved.
• We answer it within 15 business days at most from the day after receipt. If we cannot, we tell you why and when we will answer, within 8 additional business days at most.

Complaint before the Superintendence of Industry and Commerce. If you are not satisfied with the answer, you may go to the SIC, after having completed this process with us (Law 1581, article 16).

14. Deleting your account

You can request the deletion of your account from the app, under Profile > Privacy and data, or through the channels in section 13.

Before confirming, the app shows you:

• your active bookings and what will happen to each one under its cancellation policy;
• the refunds you will receive, with their method and deadline;
• how long the deletion takes: we anonymize your data within 30 days at most, counted from when your pending bookings and refunds are closed;
• which records we keep without your personal data (see below).

To confirm, you sign in again. If your account uses Apple, that sign-in also revokes Amena's access to your Apple ID.

What happens next.

1. Your sessions are closed and you can no longer book or pay.
2. Your future bookings are cancelled under their policy. If one is within the withdrawal period, it is cancelled as a withdrawal, with a full refund.
3. While your pending bookings and refunds are completed, you can still sign in to check them, open a dispute, send bank details for a refund or cancel the request. Cancelling the request does not restore bookings that were already cancelled.
4. When everything is closed, we delete your sign-in methods, anonymize your name, email, phone number and date of birth, delete the text of your reviews and disputes and the evidence files, and mark the account as deleted.
5. We send you an email confirming it is done. Afterwards we also delete that email address.

What we keep, without data that identifies you: accounting and payment records, invoices, the status history of bookings, proof of your authorizations and the audit log. The law or security requires us to keep them.

If you stop using Sign in with Apple with Amena from your Apple ID settings, Apple notifies us: we remove that sign-in method and, if it was the only one, we open the deletion of your account. In that case your bookings continue as scheduled, because you did not see the effects screen.

15. How we protect your data

• Accounts without personal data. Your account and your personal data live in separate records. Signing in does not depend on your email.
• Sessions. On the phone, tokens are stored in the iOS keychain. On the server we store only a fingerprint of the token, and if someone reuses a stolen one, all sessions in that family are closed.
• Mobile phone verification. Of the code we send you by SMS we store only its fingerprint (hash), and we delete it within 24 hours at most.
• Encryption. Refund bank details and establishments' settlement bank accounts are encrypted with keys that only the payments process and the administrators' command can use, and every human decryption is logged. Establishments' NIT and professionals' national ID numbers are stored encrypted with the AWS key management service (KMS), and every human decryption is also logged. Verification documents and dispute evidence are stored in encrypted storage, scanned for viruses and opened through links that expire shortly.
• In transit. All connections between the app, the web and the servers use TLS 1.2 or higher encryption.
• Separation between establishments. An establishment cannot see another's data: every query is filtered by establishment, and an automated check rejects code that does not do so.
• Least access. Amena staff sign in with two-factor authentication. Administrator actions and reads of sensitive data are recorded in an audit log that cannot be modified and contains only identifiers, never names, emails or text.
• Protected free text. What you write in disputes and reports cannot be read by the application, only by administrators, and it never goes to technical logs.
• Diagnostics filtered on the phone before being sent (section 5.9).

No measure is infallible. If an incident affecting your data occurs, we report it to the Superintendence of Industry and Commerce, through the channel it provides, within 15 business days at most from detecting it, and if it affects you we notify you without undue delay.

16. How long we keep data

17. Responsible area

The legal representative of Bee Analytics SAS handles inquiries and claims under this policy, at contacto@amena.com.co and through the other channels in section 13.

18. Changes and effective period

• This policy is effective from 2026-10-18.
• Each version is stored with its date and is not modified after publication.
• A substantive change is announced in the app and you are asked to accept it again before the next booking. A wording-only change is published without asking for new acceptance.
• The databases will remain in force while Bee Analytics SAS operates the marketplace. Data is kept for the periods in section 16.