Privacy Policy
Effective date: October 18, 2026 · Version 2026-10-18 · Leer en español
This policy explains what personal information Hestia Interpreting collects, why, who we share it with, how long we keep it, and how you can see, correct or delete it. It covers this website (hestiainterpreting.com), our portal for staff and interpreters (portal.hestiainterpreting.com), our forms and our email.
1. Who is responsible
Hestia Interpreting is operated by Weidmar Pelaez Chica, a sole proprietor domiciled in Cali, Colombia, while the company is being formed. He is responsible for your information and is also the person who answers your privacy questions and requests.
- Address: Carrera 15 #31A-08, Cali
- Phone: +57 315 999 7892
- Email: weidmar@hestiainterpreting.com
Because we process information from Colombia, Colombian data-protection law applies in addition to U.S. law.
Law 1581 of 2012, art. 2; Decree 1377 of 2013, art. 13.
2. What we collect and why
- Agencies that use the request form on our home page: organization, work email, phone, language, whether a certified interpreter is needed, requested date and time, notes, and the IP address of the request (to block abuse; we delete it after 30 days). We use it to answer, quote, schedule and bill. Please do not include patient names or health details in the notes.
- People who apply to join our network: name, city, languages, email, phone, how you heard about us, referral code and the IP address of the application. We use it to review your application and contact you.
- Interpreters in our network: contact details, languages and credentials, the address you choose for distance calculations, availability, rates, whether you use your own vehicle, assignments, invoices and payments, tax information (Form W-9), bank details for payment, insurance certificates, and the result of a background check that you authorize in a separate document. We use it to offer you assignments, pay you, follow tax rules, verify qualifications and defend legal claims.
- Assignment information from client agencies: date, time and place of the appointment, language, type of service, the agency's case or reference number, and a coded reference to the patient. When closing an assignment, the interpreter may upload a photo of a form signed at the appointment, which can show the patient's name. This is protected health information (see section 4).
- Portal users: email, sign-in records, two-step verification settings and an activity log, to keep accounts secure.
- Website visitors: we do not use analytics or advertising tools. Our hosting provider processes technical data (such as IP address and browser) to deliver and protect the site, and error reports from the portal reach Sentry with emails and phone numbers removed.
Law 1581 of 2012, arts. 4 and 12; Cal. Bus. & Prof. Code §22575(b)(1).
3. Your authorization
We ask for your authorization before collecting your information, with a checkbox, a signature or, in the agency request form on our home page, by sending the form after reading the notice next to its button, and we keep proof of it (date and the version of this policy). We never take silence as authorization. We do not need it only in the cases the law lists, such as information requested by a public authority or a court.
Sensitive information. Apart from the assignment information in section 4, which client agencies send us, we do not ask you for sensitive information, such as health, ethnic origin, political or religious views, sex life or biometric data. If we ever need it, we will tell you which information is sensitive and why we need it, answering will be optional, and we will ask for your express authorization. The same applies to questions about children and teenagers.
Law 1581 of 2012, arts. 5, 6, 7, 9, 10 and 12(c); Decree 1377 of 2013, arts. 6, 7 and 8.
4. Health information (HIPAA)
The details of an assignment sent to us by a client agency are protected health information under HIPAA. We handle them only on the agency's behalf and only to staff, deliver and bill the assignment. We do not accept assignments with health information from an agency until it has signed a business associate agreement with us, and the interpreter assigned receives only what the assignment requires, after signing a business associate agreement too. Our database is designed not to store patient names: before saving, we replace the name with a code. The original email stays in our business email account. The exception is the photo of a signed form from closing an assignment (section 2): it is kept in private file storage, only our staff can open it, each time someone opens it is recorded, and it is deleted 30 days after the agency pays for that assignment (or, if the assignment is never billed, 30 days after its date).
45 CFR 164.502(b), 164.502(e) and 164.504(e).
5. Who we share it with
We do not sell personal information or share it for advertising. We share it only to provide our services or when the law requires it:
- Client agencies: the name and qualifications of the interpreter assigned to their request.
- Interpreters: the details of an assignment they are offered or accept.
- Service providers that process data for us under their data-processing terms:
- Supabase: database, sign-in and file storage (United States).
- Cloudflare: hosting and network security (United States and its global network).
- Google: business email (Google Workspace) and the Gmail connection in section 6 (United States).
- Resend: automatic emails such as appointment notices (Brazil).
- Sentry: error reports from the portal, with emails and phone numbers removed (United States).
- OpenStreetMap Foundation: turning addresses into map coordinates (Nominatim) and map images in the staff portal (United Kingdom).
- OSRM public server (run by FOSSGIS e.V.): the driving distance between an interpreter's home and an assignment, to estimate mileage; it receives only the map coordinates of both places (Germany).
- The people and tools, including AI-assisted tools, that develop and maintain our software, using test data whenever possible.
- For interpreters, the background-check company named in the separate disclosure you sign.
- Authorities, when a law or a court order requires it.
Law 1581 of 2012, art. 26; Decree 1377 of 2013, arts. 24 and 25; Cal. Bus. & Prof. Code §22575(b)(1).
6. Google user data (Gmail)
Our staff can connect Hestia's own business mailbox to the portal. To allow it, Google asks for the Gmail permission to read messages and change their labels ("gmail.modify"). Our software uses it only as follows:
- It looks only at messages from the client agencies registered in the portal (our staff add each agency's email domains): unread messages of any date and read messages from the last 30 days that it has not processed yet. From them it extracts the appointment details: date and time, language, place, format (in person, video or phone), the agency's reference number and the quoted fee.
- It keeps only those details, the sender's address, a short version of the subject (only words such as "confirmation" or "cancel" and a date), Gmail's message ID and the message's own Message-ID with a short code computed from the subject (not the subject itself), so the same message is never imported twice. With each message it also keeps a short note written by the software itself (which details it extracted or why it could not import it), never text copied from the message. It does not keep the text of the message, the original subject or the attachments, and it replaces the patient's name with a code before saving (section 4).
- It creates three labels in the mailbox if they do not exist ("Hestia-procesado", "Hestia-no-registrado" and "Hestia-sin-agencia"). After processing a message, it adds "Hestia-procesado" and removes the "unread" label; a message it could not import gets one of the other two labels and stays unread for our staff to review. It never sends, deletes or edits messages, and it does not access any other account.
We use this data only to schedule and bill assignments. We do not sell it, use it for advertising or to decide on credit, or use it to create, train or improve artificial-intelligence or machine-learning models. Our staff see it to schedule assignments and review imports; anyone else, including the people who maintain our software, sees it only when necessary for security (such as investigating a bug or abuse) or to comply with the law.
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
Google Workspace User Data and Developer Policy; Google API Services User Data Policy.
7. Cookies and Do Not Track
We only use what is strictly necessary: sign-in cookies for staff and interpreters, a short-lived security cookie when staff connect the mailbox, and your language choice saved in your browser. We use no advertising or analytics cookies. Our hosting provider may set a security cookie to filter automated abuse.
We do not track visitors over time or across other websites, and we do not allow other companies to do so through our site. That is why we treat every browser the same way, whether or not it sends a "Do Not Track" signal.
Cal. Bus. & Prof. Code §22575(b)(5) and (6).
8. How long we keep it
- Applications we do not move forward with: up to 12 months after our last contact, then we anonymize them.
- Interpreter tax information (Form W-9): as long as U.S. tax rules require, and no more than 7 years after the last payment.
- Photos of signed forms from closing an assignment: 30 days after the agency pays for that assignment, or 30 days after the assignment date if it is never billed (for example, if it was cancelled). A photo that was uploaded but never attached to a closing is deleted the next day.
- The IP address of the home page request form: 30 days.
- Agency requests, assignments and invoices: as long as we need them to answer the request or perform the work, and afterwards as long as tax, accounting and contract rules or our agreement with the agency require. Then we delete or de-identify them.
Our databases remain in force for as long as Hestia Interpreting operates.
Decree 1377 of 2013, arts. 11 and 13 (Decree 1074 of 2015, arts. 2.2.2.25.2.8 and 2.2.2.25.3.1).
9. Your rights
You can:
- know, update and correct your information;
- ask for proof of your authorization;
- ask how we have used your information;
- revoke your authorization or ask us to delete your information, unless a legal or contractual duty requires us to keep it;
- access your information free of charge, at least once a month and whenever this policy changes substantially;
- complain to Colombia's Superintendence of Industry and Commerce (SIC, Superintendencia de Industria y Comercio), after first making your request to us.
If you live in the United States, including California, you can use the same channel to review the information we hold about you and ask us to change it.
Law 1581 of 2012, arts. 8 and 16; Decree 1377 of 2013, arts. 9 and 21; Cal. Bus. & Prof. Code §22575(b)(2).
10. How to make a request
Write to weidmar@hestiainterpreting.com with your name and a way to confirm who you are, what you are asking for and why, the email or postal address where you want our answer, and any document you want us to consider. You can ask yourself, or through your heirs, your legal representative or someone you authorize, who must show that they represent you.
- Questions (what information we have and how we use it): we answer within 10 business days. If we cannot, we tell you why and answer within 5 more business days.
- Claims (to correct, delete or revoke, or to report that we did not follow this policy): if your claim is missing information, we ask you for it within 5 days of receiving it; if you do not send it within 2 months, we consider the claim withdrawn. Within 2 business days of receiving a complete claim we mark your record "claim in process". We answer within 15 business days; if we cannot, we tell you why and answer within 8 more business days. If the claim is about information that another company is responsible for, we forward it to them within 2 business days and tell you.
If you ask what we hold, we send you a copy of your information. If you ask us to delete it or revoke your authorization, we delete or anonymize it, except what a law or a contract requires us to keep (for example, tax records of payments we made to you), and we tell you what we kept and until when.
Business days are counted on the Colombian calendar.
Law 1581 of 2012, arts. 14 and 15; Decree 1377 of 2013, arts. 9 and 20.
11. Security
We use personal accounts with role-based permissions, access rules inside the database, two-step verification available to staff, encrypted connections and encrypted daily backups. If an incident puts your information at risk, we inform the SIC and, when the information came from a client agency, that agency.
Law 1581 of 2012, art. 17(d) and (n); 45 CFR 164.410.
12. Children
Our website is not directed to children under 13 and we do not knowingly collect their information online. Information about a minor patient that reaches us with an assignment is handled as health information (section 4).
15 U.S.C. §6502; Law 1581 of 2012, art. 7; Decree 1377 of 2013, art. 12.
13. Changes to this policy
We post every change on this page with a new effective date and version. Before applying a substantial change, such as a new purpose or a new kind of recipient, we notify by email the people whose email address we have.
Decree 1377 of 2013, art. 13; Cal. Bus. & Prof. Code §22575(b)(3) and (4).