I. Data Controller

SMO AND SCIENTIFIC SERVICES, S.A.P.I. DE C.V. (hereinafter referred to as "ETCURAE"), with registered address at 500, Lazaro Cardenas Av., San Agustin Residential, San Pedro Garza García, N.L., Mexico, C.P. 66260, in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”) and its Regulations, hereby informs you of the manner in which "ETCURAE" and any of its branches or affiliates collect and process your personal data for the purposes set forth in this Privacy Notice. "ETCURAE" is committed to protecting the information we collect from you or that you may provide to us through any means.

II. Personal Data

“Personal Data” is understood as any information, whether provided directly or indirectly, through electronic means or any other channel, that can be used to identify an individual or that may be directly associated with a person.

The personal data collected by “ETCURAE”, either directly or indirectly, may include the following:

• a) Personal information provided through interviews, documentation, or survey forms.
• b) Information collected via electronic means, visits to our website, email communications, or telephone calls.
• c) Transfers from you to affiliated companies and other legally permitted sources.
• d) Information such as your full name, location, and preferred language.
• e) Contact information to communicate with you, such as email, address, and phone number.
• f) Protected classification characteristics as defined by applicable law, considered sensitive data, such as age, race, ancestry, country of origin, health or medical conditions, sex (including gender, pregnancy, and related medical conditions), or genetic information (including family genetic information).
• g) Commercial information, such as records of products or services offered, purchased, or obtained, or correspondence from you.
• h) Usage information and other similar online activity, as well as data from cookies.
• i) Professional, academic, or employment-related information, such as current or past employment history or performance evaluations.
• j) Other socioeconomic, property, and financial data, taxpayer registration (RFC), CURP, and other data strictly necessary for the purposes mentioned in this Privacy Notice.

The list of personal data mentioned above is illustrative and not exhaustive. It may be limited or extended depending on the services provided.

III. Purposes of Personal Data Processing

“ETCURAE” may use your information for one or more of the following purposes:

1. Research-Related Purposes:

• a) In the case of healthcare professionals, to promote participation in activities, events, programs, and/or research projects;
• b) Where applicable, to prepare the administrative and legal documentation required to facilitate collaboration and/or participation in research;
• c) For medical and scientific purposes in general;
• d) For the processing of biological samples, imaging tests, and/or other diagnostic procedures, including the generation and delivery of results.

2. General Purposes:

• a) To inform you about our services, events, and activities through communication and advertising campaigns;
• b) For commercial prospecting or fulfillment of obligations arising from business operations in which you are involved;
• c) To conduct personnel selection, hiring, consulting, training, monitoring processes, and for statistical and administrative controls;
• d) To carry out surveys and market studies to improve our services and customer experience;
• e) To maintain general communication regarding updates and news from “ETCURAE”;
• f) To facilitate access to information or services offered by “ETCURAE”, our websites, and/or applications;
• g) To identify and authenticate your access rights to our websites and applications;
• i) For testing, research, product or service analysis and development;
• j) As necessary or appropriate to protect our rights, property, or the safety of others;
• k) To comply with legal, tax, or other obligations arising from the relationship with “ETCURAE”;
• l) To respond to government authorities or as required by law, court order, or governmental regulations;
• m) To improve our website and its content presentation;
• n) To fulfill our contractual obligations and enforce rights arising from agreements between you and us;
• o) To develop or build artificial intelligence and machine learning models for the aforementioned purposes, to improve our services and personalize the user experience. By providing your personal data, you consent to its use for optimizing our AI applications.

For the purposes outlined in this Privacy Notice, “ETCURAE” may request your phone number and/or email address. By providing this information, you consent to be contacted via the indicated means.

“ETCURAE” will not use your personal data for purposes incompatible with those mentioned above, unless legally required or authorized, or when in your vital interest.

IV. Collection of Personal Data

Please note that we may receive information about you directly or indirectly, and we will process all collected personal data in accordance with applicable law and as described in this Notice.

In some cases, we may request information through your device using cookies or similar technologies. This information is obtained when you use our website or submit data through electronic means and is subject to the provisions of this Privacy Notice.

We collect personal information following the principles established by law, including legality, quality, consent, information, purpose, loyalty, proportionality, and responsibility.

Personal data may be collected through electronic, optical, audible, or visual means, or by any other legally permitted technology, such as application forms, resumes, interviews, evaluations, surveys, or through our website and online services.

Additionally, we may obtain data from other lawful sources, such as business or telephone directories, job portals, references from companies or individuals, and public databases from government entities.

V. Options and Means to Limit the Use or Disclosure of Data

“ETCURAE” has implemented necessary and sufficient administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, unauthorized use, access, or processing. Personal data is stored in secure databases and computing systems to prevent information leaks. Nevertheless, you may request a limitation on the use or disclosure of your personal data via email to: info@etcurae.com.

Please note that restricting the use or transfer of your data may affect our ability to fulfill the purposes outlined in this Privacy Notice and provide you with the quality services you expect from us.

VI. Means to Exercise “ARCO” Rights (Access, Rectification, Cancellation, and Opposition)

You have the right to exercise your “ARCO” rights, which include:

• a) Access: To know and request a copy of the personal data we hold about you, and to understand how we use or share it.
• b) Rectification: To request that we correct your personal data if it is inaccurate, incorrect, or incomplete.
• c) Cancellation: To request deletion of your data, which involves first blocking it and subsequently removing it permanently.
• d) Opposition: To oppose the processing of your data by stating a legitimate reason for which we should stop using your personal information.

You may exercise your “ARCO” rights by submitting a request to: info@etcurae.com.The request must include the details required under Article 29 of the Law, including:

• a) Your name and address or another means for responding to your request;
• b) Documents proving your identity or, where applicable, legal representation;
• c) A clear and precise description of the data you wish to access, rectify, cancel, or oppose;
• d) Any additional element or document that facilitates locating your data, as well as any other requirement established by the applicable law at the time of the request.

Please note that “ETCURAE” may not be able to cancel or block your personal data in cases as permitted by the Law and its Regulations.

VII. Transfer of Personal Data

Your personal data will be kept strictly confidential and will only be used for the purposes outlined above, unless there is a change in this Privacy Notice.

“ETCURAE” may transfer your personal data to third parties who commit to the same terms of confidentiality and security as described in this Privacy Notice.

We are committed not to transfer your personal information to third parties without your consent, except in the following cases, in accordance with Article 37 of the Law:

• 1. When the transfer is provided for in a law or treaty to which Mexico is a party;
• 2. When the transfer is necessary for medical diagnosis or treatment, or health services management;
• 3. When the transfer is to controlling companies, subsidiaries, or affiliates under common control, or to a parent company operating under the same processes and internal policies;
• 4. When the transfer is necessary pursuant to a contract entered into in the interest of the data subject;
• 5. When the transfer is necessary or legally required for the safeguarding of public interest or for the administration of justice;
• 6. When the transfer is necessary for the recognition, exercise, or defense of a right in a legal proceeding;
• 7. When the transfer is necessary to maintain or fulfill a legal relationship between the data controller and the data subject.

If you do not object, your personal data may be shared with individuals, companies, organizations, or authorities other than us, including Holding Companies, subsidiaries, or affiliates, for centralized data management, personnel updates, activity reporting, or with Certified Medical Societies and Research Institutions, Authorities, or Government Entities for compliance with applicable health laws or regulatory requirements.

Please note that your personal data may be transferred and stored outside your state, province, country, or jurisdiction, where privacy laws may offer a lower level of protection.

In such cases, “ETCURAE” will implement appropriate safeguards, such as data transfer agreements that include standard data protection clauses.

VIII. Retention of Personal Data

Your personal data and any related documentation will be retained for a period of 25 years. In certain circumstances, we may be required to retain data for longer due to legal obligations or other needs. Whenever feasible, our goal is to anonymize information or remove unnecessary identifiers from records retained beyond the retention period.

IX. Revocation of Consent

You may revoke your consent to the processing of your personal data at any time, either fully or partially. However, please note that doing so may affect our ability to fulfill the purposes for which your data was collected and the services you expect from us.

To revoke your consent, please submit a written request via the email address listed in Section V of this Notice.

“ETCURAE” will respond within 20 business days to inform you whether your request is approved. If so, it will be implemented within 15 business days from the date the response is communicated. If documentation must be provided as a result of the exercised right, it will be sent by email or delivered to the address you specify. Although exercising your rights and obtaining information is free, “ETCURAE” reserves the right to charge for shipping and photocopying costs.

X. Changes to the Privacy Notice

“ETCURAE” reserves the right to make changes to this Privacy Notice at any time. Updates will be available through one or more of the following means: (i) on our website; or (ii) via the most recent email address you have provided.

XI. Contact

If you have any questions or comments regarding this Privacy Notice or the processing of your personal data, you may contact us at info@etcurae.com. We will strive to respond promptly and in accordance with applicable laws. Please be aware that additional information may be required to process your request and verify your identity.

Last updated: April 1, 2025