COMPREHENSIVE PRIVACY NOTICE RVB | BLACKSTONES AND WELLNESS Version 1.6 | Prepared: October 11, 2026 1. DATA CONTROLLER AND SCOPE Proveedora RVB de Piedras Negras, S.A. de C.V. (“RVB”), with its registered tax address at Calle Oaxaca 1202, Int. 1, Col. Nísperos, C.P. 26020, Piedras Negras, Coahuila de Zaragoza, Mexico, and its place of care at Nísperos Centro Médico, Oaxaca 1202, Colonia Nísperos, C.P. 26020, Piedras Negras, Coahuila, Mexico, is the controller of personal data used in care provided by Blackstones Plastic Surgery and in Wellness services operated by RVB at Nísperos Centro Médico. Dr. Javier Vladimir Ramírez Blanco is the treating plastic surgeon. This notice covers consultations, assessments, planning, care and follow-up for plastic, aesthetic and reconstructive surgery within this operation, as well as wellness and recovery services you engage RVB to provide through Wellness. Consultations, assessments and follow-up take place at Nísperos Centro Médico; surgeries take place at the licensed hospital indicated in each case, which creates and keeps its own record as an independent controller. This notice does not cover the independent practices of other professionals located at Nísperos Centro Médico. Privacy contact: [email protected] | +52 878 688 7636. Reception may provide this notice and receive requests on RVB’s behalf. 2. DATA WE PROCESS As necessary for your requested service, we process these categories. For Wellness, only information relevant to the safety and contraindications of the contracted service and documenting its delivery is collected; a full clinical history is not required for every wellness service: - Identification and contact: name, date of birth, age, sex, address, phone, email and identification document details; emergency contact name and phone; where applicable, identity and authority details of your representative, and the name and relationship of the person responsible for payment when that person is not the patient. - Sensitive health data: reason for consultation, personal and family history, clinical history, physical examination, diagnoses, allergies, medications, treatments, habits and substance use, relevant gynecological/obstetric history, tests and results, medical notes, progress and clinical photographs. - Administrative, payment and tax data: appointments, contracted services, amounts, payment methods and references; name or business name, Mexican tax ID, tax regime, tax address and invoice use when you request an invoice. Data may come from you, your representative, or professionals and facilities legitimately involved in your care. We request only information relevant to each case. 3. PURPOSES AND CONSENT Necessary purposes: scheduling and confirming appointments; assessments and medical and surgical care; creating, consulting and retaining your record; receiving information before consultations; providing results and documents; documenting and monitoring progress, including clinically necessary photographs; coordinating with other providers; assessing the suitability and safety of contracted Wellness services, identifying contraindications and documenting delivery and follow-up; payment and invoicing; complying with health, tax and other applicable obligations; and handling claims and responsibilities related to the service. The following are also necessary: sending you appointment reminders and letting you know when a post-operative check-up or a follow-up visit is due. For sensitive data, we will request express written consent through a signature or an electronic authentication method linking the authorization to you, unless a legal exception applies. Data consent does not replace informed consent for medical procedures. Optional purposes, which we carry out only if you accept them: - Sending you satisfaction surveys after your visit or procedure, with an invitation to share your opinion on Google. The invitation is sent the same way to everyone, whatever their rating, and nothing is offered in return. Anything you post on Google is posted by you and is governed by Google’s terms. - Sending you promotions and invitations to resume a treatment, such as botulinum toxin, fillers or laser, or to follow up on a quote you did not go ahead with. We send no more than one promotional email every 30 days. - Recording how you heard about us and, if you tell us, who referred you, for internal reports. We never tell that person anything about your care. - Publishing images for academic, scientific or advertising purposes, including a before-and-after gallery. Publication requires separate, specific authorization identifying the images or information, purpose, media and scope. For these purposes, your sensitive data is processed only with your express written consent. If you were already a patient before this version of the notice, we will not use your data for them until you authorize it. Refusal does not affect your care or your price. You may refuse from the outset in the consent for the processing of personal data, or later: through the unsubscribe link in every email, at reception, or through the privacy contact. We record each choice with its date. Unsubscribing takes effect in the system immediately and never takes more than 10 business days. Consent for medical care will not be treated as permission to publish photographs. 4. COMMUNICATIONS AND ELECTRONIC SERVICES We use electronic health records, forms and digital document delivery. Access is limited to authorized staff according to their duties. Shared infrastructure at Nísperos does not, by itself, authorize other practices to access your clinical information. We send you an email reminder about 24 hours before your appointment, with links to confirm it or request a change. It comes from [email protected] or, for Plastic Surgery, [email protected]. Reminders include only the date, time, place and those links; they do not include the type of appointment, diagnoses, procedures or results. You may also choose to receive them by WhatsApp or by phone. If you accept it in the consent for the processing of personal data, you may also use WhatsApp for clinical follow-up: sending photos, symptoms and questions to the nursing staff or the physician and receiving instructions. This is optional: if you do not accept it, follow-up takes place in person, by phone or by another agreed means. WhatsApp is a third-party service and must not be used for emergencies. You may change your preference through the privacy contact. Do not share your access links or credentials. Automated appointment reminders and links reach you by WhatsApp from +52 878 688 7636 (Nísperos), a notice-only line that does not take conversations. Plastic Surgery assists you by WhatsApp from +52 878 210 3110 (administrative) and +52 878 122 3432 (post-operative recovery), using the WhatsApp Business app. If your messages include clinical information, such as photos, symptoms or results, we will add it to your record when it is relevant to your care. If you did not accept clinical follow-up by WhatsApp, we will also tell you the agreed channel for follow-up. We use providers that process data on behalf of RVB as processors, under its instructions and with confidentiality and security obligations. Several are located outside Mexico, or process data outside Mexico, mainly in the United States. They cover system hosting (DigitalOcean); secure access to the Mi Nísperos patient portal (Cloudflare); email, calendar and video visits (Google Workspace); receipt of email sent to [email protected] (Zoho Mail); automated WhatsApp messages (Meta’s WhatsApp Business Platform, direct connection); encrypted daily backups that the provider cannot read (Backblaze); electronic invoicing (Facturama); and online card payments (Stripe) and card payments on the clinic's terminal (Mercado Pago Point). External reception or support services processing data on our behalf are subject to the same conditions. The current list of providers is available through the privacy contact. Payment collection in the United States: online card payments (Stripe) and U.S. dollar transfers to the authorized U.S. account are received by Blackstones Global Consulting LLC (Wyoming, United States), the recipient of payments made in the United States. For that purpose, only what is needed to process the payment is sent to the United States: your name, email, the amount, the description of the charge and payment references; card payments are processed by Stripe. It never receives clinical data: no records, diagnoses, photographs or results. It does not provide medical services and may use your data only to receive and record your payment. Cash payments, payments on the clinic’s card terminal (Mercado Pago Point) and transfers to Mexican accounts are received directly by RVB. 5. TRANSFERS We may disclose necessary data to physicians, anesthesiologists, hospitals, laboratories and other facilities involved in your care for diagnosis, treatment and continuity of care, within applicable legal exceptions. Data may also be disclosed to authorities when legally required or pursuant to a duly grounded request. Disclosures will be limited to their justified purpose and comply with applicable health information formalities. Card payment processors (Stripe and Mercado Pago) also process your payment data as independent controllers to prevent fraud and meet their legal obligations, under their own privacy notices. This disclosure is necessary for the payment you make and does not require your consent. When donor tissue is used, we will share with the tissue bank the data needed for graft traceability and the applicable health records. Transfers to insurers or other recipients you request will be documented through specific authorization unless a legal exception applies. Sharing your payment data with Blackstones Global Consulting LLC, the recipient of payments made in the United States (section 4), is a transfer needed for the payment you choose to make in the United States and is limited to the data listed in that section. If you also engage Blackstones Global Consulting LLC directly for different services, such as coordination, and ask RVB to share other data with it, we will obtain specific authorization; that authorization does not cover records, photographs or clinical results. Information you provide directly to the LLC for its own services is subject to that entity’s privacy documentation. Where authorization is required, it will identify the recipient, purpose and data. We do not sell your personal data. Sharing premises or the premises’ brand does not authorize other providers to use your data for their own promotions. 6. RETENTION AND SECURITY Where a clinical record is created, it will be retained for at least five years from the last medical act. Wellness records that are not part of a clinical record will be kept as necessary for the service and applicable obligations and liabilities; the clinical retention period does not automatically apply to them. Longer retention may apply where an obligation or documented legal need exists. Other records are retained according to their purposes and obligations; tax records follow applicable tax law. At the end of the applicable periods, data will be placed in restricted retention where appropriate, and securely deleted. We apply administrative, technical and physical safeguards to protect information and limit unauthorized access, together with confidentiality obligations. If a breach significantly affects your property or non-material rights, we will notify you immediately and without delay, explaining the known facts, affected data, measures taken, protective recommendations and contact for additional information. 7. RIGHTS AND REQUESTS You may exercise rights of access, rectification, cancellation and opposition (ARCO), withdraw consent or limit use or disclosure by emailing [email protected] or submitting a written request at the place of care listed above, addressed to RVB / Blackstones and Wellness Privacy. Include your name, reply contact, request and information helping locate the data. Verify your identity; a representative must also verify their identity and authority. For rectification, identify the correction and provide supporting documents where applicable. You may call for guidance on submitting requests and verifying identity securely. For ARCO requests, we will communicate our determination within twenty business days of receipt and, if granted, implement it within fifteen business days after communicating the response. Legally permitted extensions will be justified and communicated. Requests for clarification or additional documentation will follow the applicable procedure. Access may be provided by a securely delivered electronic copy or on-site consultation and copies, as appropriate. Exercise is free except legally permitted reproduction or delivery costs. For withdrawal and limitation, we will also respond within twenty business days and, if granted, implement the request within fifteen business days after our response. Withdrawal is not retroactive. It does not end retention or processing that must continue under another legal basis; any limitation and its grounds will be explained individually. 8. MINORS AND REPRESENTATIVES We will verify the patient’s identity and the authority of anyone acting on their behalf. A companion, payer or emergency contact is not a representative solely for that reason. You may designate in writing a person authorized to receive information about your care; that person will receive only the information you authorize. Information and participation of minors will follow applicable rules. On reaching legal adulthood, representative access and authorizations will be reviewed while respecting the patient’s decisions and rights. 9. CHANGES, AUTHORITY AND LANGUAGE The current version is available at reception and free of charge through the privacy email. Changes will be announced at reception, with the updated version available through that email. For substantial changes of controller, purposes or transfers, available contact methods will be used and new consent obtained where required before new processing begins. You may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno regarding applicable private-sector data protection procedures. An internal complaint is not a prerequisite where the law does not require it. This notice is provided in Spanish and English. Spanish prevails for interpretive discrepancies without limiting your rights or our duty to provide understandable information. COMPREHENSIVE PRIVACY NOTICE · Version 1.6 · October 11, 2026