Privacy notices

COMPREHENSIVE PRIVACY NOTICE RVB | BLACKSTONES AND WELLNESS Version 1.6 | Prepared: October 11, 2026 1. DATA CONTROLLER AND SCOPE Proveedora RVB de Piedras Negras, S.A. de C.V. (“RVB”), with its registered tax address at Calle Oaxaca 1202, Int. 1, Col. Nísperos, C.P. 26020, Piedras Negras, Coahuila de Zaragoza, Mexico, and its place of care at Nísperos Centro Médico, Oaxaca 1202, Colonia Nísperos, C.P. 26020, Piedras Negras, Coahuila, Mexico, is the controller of personal data used in care provided by Blackstones Plastic Surgery and in Wellness services operated by RVB at Nísperos Centro Médico. Dr. Javier Vladimir Ramírez Blanco is the treating plastic surgeon. This notice covers consultations, assessments, planning, care and follow-up for plastic, aesthetic and reconstructive surgery within this operation, as well as wellness and recovery services you engage RVB to provide through Wellness. Consultations, assessments and follow-up take place at Nísperos Centro Médico; surgeries take place at the licensed hospital indicated in each case, which creates and keeps its own record as an independent controller. This notice does not cover the independent practices of other professionals located at Nísperos Centro Médico. Privacy contact: [email protected] | +52 878 688 7636. Reception may provide this notice and receive requests on RVB’s behalf. 2. DATA WE PROCESS As necessary for your requested service, we process these categories. For Wellness, only information relevant to the safety and contraindications of the contracted service and documenting its delivery is collected; a full clinical history is not required for every wellness service: - Identification and contact: name, date of birth, age, sex, address, phone, email and identification document details; emergency contact name and phone; where applicable, identity and authority details of your representative, and the name and relationship of the person responsible for payment when that person is not the patient. - Sensitive health data: reason for consultation, personal and family history, clinical history, physical examination, diagnoses, allergies, medications, treatments, habits and substance use, relevant gynecological/obstetric history, tests and results, medical notes, progress and clinical photographs. - Administrative, payment and tax data: appointments, contracted services, amounts, payment methods and references; name or business name, Mexican tax ID, tax regime, tax address and invoice use when you request an invoice. Data may come from you, your representative, or professionals and facilities legitimately involved in your care. We request only information relevant to each case. 3. PURPOSES AND CONSENT Necessary purposes: scheduling and confirming appointments; assessments and medical and surgical care; creating, consulting and retaining your record; receiving information before consultations; providing results and documents; documenting and monitoring progress, including clinically necessary photographs; coordinating with other providers; assessing the suitability and safety of contracted Wellness services, identifying contraindications and documenting delivery and follow-up; payment and invoicing; complying with health, tax and other applicable obligations; and handling claims and responsibilities related to the service. The following are also necessary: sending you appointment reminders and letting you know when a post-operative check-up or a follow-up visit is due. For sensitive data, we will request express written consent through a signature or an electronic authentication method linking the authorization to you, unless a legal exception applies. Data consent does not replace informed consent for medical procedures. Optional purposes, which we carry out only if you accept them: - Sending you satisfaction surveys after your visit or procedure, with an invitation to share your opinion on Google. The invitation is sent the same way to everyone, whatever their rating, and nothing is offered in return. Anything you post on Google is posted by you and is governed by Google’s terms. - Sending you promotions and invitations to resume a treatment, such as botulinum toxin, fillers or laser, or to follow up on a quote you did not go ahead with. We send no more than one promotional email every 30 days. - Recording how you heard about us and, if you tell us, who referred you, for internal reports. We never tell that person anything about your care. - Publishing images for academic, scientific or advertising purposes, including a before-and-after gallery. Publication requires separate, specific authorization identifying the images or information, purpose, media and scope. For these purposes, your sensitive data is processed only with your express written consent. If you were already a patient before this version of the notice, we will not use your data for them until you authorize it. Refusal does not affect your care or your price. You may refuse from the outset in the consent for the processing of personal data, or later: through the unsubscribe link in every email, at reception, or through the privacy contact. We record each choice with its date. Unsubscribing takes effect in the system immediately and never takes more than 10 business days. Consent for medical care will not be treated as permission to publish photographs. 4. COMMUNICATIONS AND ELECTRONIC SERVICES We use electronic health records, forms and digital document delivery. Access is limited to authorized staff according to their duties. Shared infrastructure at Nísperos does not, by itself, authorize other practices to access your clinical information. We send you an email reminder about 24 hours before your appointment, with links to confirm it or request a change. It comes from [email protected] or, for Plastic Surgery, [email protected]. Reminders include only the date, time, place and those links; they do not include the type of appointment, diagnoses, procedures or results. You may also choose to receive them by WhatsApp or by phone. If you accept it in the consent for the processing of personal data, you may also use WhatsApp for clinical follow-up: sending photos, symptoms and questions to the nursing staff or the physician and receiving instructions. This is optional: if you do not accept it, follow-up takes place in person, by phone or by another agreed means. WhatsApp is a third-party service and must not be used for emergencies. You may change your preference through the privacy contact. Do not share your access links or credentials. Automated appointment reminders and links reach you by WhatsApp from +52 878 688 7636 (Nísperos), a notice-only line that does not take conversations. Plastic Surgery assists you by WhatsApp from +52 878 210 3110 (administrative) and +52 878 122 3432 (post-operative recovery), using the WhatsApp Business app. If your messages include clinical information, such as photos, symptoms or results, we will add it to your record when it is relevant to your care. If you did not accept clinical follow-up by WhatsApp, we will also tell you the agreed channel for follow-up. We use providers that process data on behalf of RVB as processors, under its instructions and with confidentiality and security obligations. Several are located outside Mexico, or process data outside Mexico, mainly in the United States. They cover system hosting (DigitalOcean); secure access to the Mi Nísperos patient portal (Cloudflare); email, calendar and video visits (Google Workspace); receipt of email sent to [email protected] (Zoho Mail); automated WhatsApp messages (Meta’s WhatsApp Business Platform, direct connection); encrypted daily backups that the provider cannot read (Backblaze); electronic invoicing (Facturama); and online card payments (Stripe) and card payments on the clinic's terminal (Mercado Pago Point). External reception or support services processing data on our behalf are subject to the same conditions. The current list of providers is available through the privacy contact. Payment collection in the United States: online card payments (Stripe) and U.S. dollar transfers to the authorized U.S. account are received by Blackstones Global Consulting LLC (Wyoming, United States), the recipient of payments made in the United States. For that purpose, only what is needed to process the payment is sent to the United States: your name, email, the amount, the description of the charge and payment references; card payments are processed by Stripe. It never receives clinical data: no records, diagnoses, photographs or results. It does not provide medical services and may use your data only to receive and record your payment. Cash payments, payments on the clinic’s card terminal (Mercado Pago Point) and transfers to Mexican accounts are received directly by RVB. 5. TRANSFERS We may disclose necessary data to physicians, anesthesiologists, hospitals, laboratories and other facilities involved in your care for diagnosis, treatment and continuity of care, within applicable legal exceptions. Data may also be disclosed to authorities when legally required or pursuant to a duly grounded request. Disclosures will be limited to their justified purpose and comply with applicable health information formalities. Card payment processors (Stripe and Mercado Pago) also process your payment data as independent controllers to prevent fraud and meet their legal obligations, under their own privacy notices. This disclosure is necessary for the payment you make and does not require your consent. When donor tissue is used, we will share with the tissue bank the data needed for graft traceability and the applicable health records. Transfers to insurers or other recipients you request will be documented through specific authorization unless a legal exception applies. Sharing your payment data with Blackstones Global Consulting LLC, the recipient of payments made in the United States (section 4), is a transfer needed for the payment you choose to make in the United States and is limited to the data listed in that section. If you also engage Blackstones Global Consulting LLC directly for different services, such as coordination, and ask RVB to share other data with it, we will obtain specific authorization; that authorization does not cover records, photographs or clinical results. Information you provide directly to the LLC for its own services is subject to that entity’s privacy documentation. Where authorization is required, it will identify the recipient, purpose and data. We do not sell your personal data. Sharing premises or the premises’ brand does not authorize other providers to use your data for their own promotions. 6. RETENTION AND SECURITY Where a clinical record is created, it will be retained for at least five years from the last medical act. Wellness records that are not part of a clinical record will be kept as necessary for the service and applicable obligations and liabilities; the clinical retention period does not automatically apply to them. Longer retention may apply where an obligation or documented legal need exists. Other records are retained according to their purposes and obligations; tax records follow applicable tax law. At the end of the applicable periods, data will be placed in restricted retention where appropriate, and securely deleted. We apply administrative, technical and physical safeguards to protect information and limit unauthorized access, together with confidentiality obligations. If a breach significantly affects your property or non-material rights, we will notify you immediately and without delay, explaining the known facts, affected data, measures taken, protective recommendations and contact for additional information. 7. RIGHTS AND REQUESTS You may exercise rights of access, rectification, cancellation and opposition (ARCO), withdraw consent or limit use or disclosure by emailing [email protected] or submitting a written request at the place of care listed above, addressed to RVB / Blackstones and Wellness Privacy. Include your name, reply contact, request and information helping locate the data. Verify your identity; a representative must also verify their identity and authority. For rectification, identify the correction and provide supporting documents where applicable. You may call for guidance on submitting requests and verifying identity securely. For ARCO requests, we will communicate our determination within twenty business days of receipt and, if granted, implement it within fifteen business days after communicating the response. Legally permitted extensions will be justified and communicated. Requests for clarification or additional documentation will follow the applicable procedure. Access may be provided by a securely delivered electronic copy or on-site consultation and copies, as appropriate. Exercise is free except legally permitted reproduction or delivery costs. For withdrawal and limitation, we will also respond within twenty business days and, if granted, implement the request within fifteen business days after our response. Withdrawal is not retroactive. It does not end retention or processing that must continue under another legal basis; any limitation and its grounds will be explained individually. 8. MINORS AND REPRESENTATIVES We will verify the patient’s identity and the authority of anyone acting on their behalf. A companion, payer or emergency contact is not a representative solely for that reason. You may designate in writing a person authorized to receive information about your care; that person will receive only the information you authorize. Information and participation of minors will follow applicable rules. On reaching legal adulthood, representative access and authorizations will be reviewed while respecting the patient’s decisions and rights. 9. CHANGES, AUTHORITY AND LANGUAGE The current version is available at reception and free of charge through the privacy email. Changes will be announced at reception, with the updated version available through that email. For substantial changes of controller, purposes or transfers, available contact methods will be used and new consent obtained where required before new processing begins. You may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno regarding applicable private-sector data protection procedures. An internal complaint is not a prerequisite where the law does not require it. This notice is provided in Spanish and English. Spanish prevails for interpretive discrepancies without limiting your rights or our duty to provide understandable information. COMPREHENSIVE PRIVACY NOTICE · Version 1.6 · October 11, 2026

COMPREHENSIVE PRIVACY NOTICE NOTICE B | RHEUMATOLOGY, LABORATORY AND PHARMACY Version 1.2 | Prepared: October 10, 2026 1. DATA CONTROLLER AND SCOPE Dr. Dariela de la Garza García, acting as an individual (the “Data Controller”), at Oaxaca 1202, Colonia Nísperos, C.P. 26020, Piedras Negras, Coahuila, Mexico, is responsible for personal data processing relating to Rheumatology consultations, follow-up, in-office procedures (such as joint aspirations and injections) and administration of treatments, including infusions and advanced therapy, Clinical Laboratory services, and Pharmacy sales and dispensing. This notice covers these services within this independent operation at Nísperos Centro Médico. It does not cover Blackstones, Wellness or other controllers’ practices. Shared reception, premises or software do not change this identification. Privacy contact: [email protected] | +52 878 688 7636. Reception may provide this notice and receive requests on behalf of Dr. Dariela de la Garza García. 2. DATA WE PROCESS As necessary for each service, we process these categories: - Identification and contact: name, date of birth, age, sex, address, phone, email and identification details where necessary; emergency contact and representative identity and authority details where applicable. - Sensitive health data: personal and family history, symptoms, examination, diagnoses, allergies, treatments and medications, tests, results, notes and progress relevant to Rheumatology; for Laboratory services, test orders, relevant clinical information, sample type and identifiers, results and validation; for Pharmacy, prescription and prescriber details, medication, dosage and information required for dispensing and legally required health records. Clinical photographs are collected only when needed to document Rheumatology care. - Administrative, payment and tax data: appointments, services or products purchased, amounts, payment methods and references; name or business name, Mexican tax ID, tax regime, tax address and invoice use when you request an invoice. Data may come from you, your representative, or professionals and facilities legitimately involved in your care. An ordinary Pharmacy purchase does not require a Rheumatology record or a complete health history. Only data needed for the transaction and its legal obligations is requested. 3. PURPOSES AND CONSENT Necessary purposes: scheduling and confirming appointments where applicable; providing rheumatology consultations, assessments and follow-up; recording orders, identifying and tracing samples, performing and validating laboratory tests and delivering results; verifying prescriptions where appropriate, selling and dispensing medicines, and keeping required health records; creating, consulting and retaining records appropriate to the service; receiving relevant information beforehand; coordinating care; payment and invoicing; complying with health, tax and other applicable obligations; and handling claims and responsibilities related to the service. The following are also necessary: sending you appointment reminders and letting you know when a check-up or a follow-up visit is due. For sensitive data we will request express written consent through a signature or an electronic authentication method linking authorization to you, unless a legal exception applies. Data consent does not replace informed consent for medical procedures where required. Optional purposes, which we carry out only if you accept them: - Sending you satisfaction surveys after your visit or procedure, with an invitation to share your opinion on Google. The invitation is sent the same way to everyone, whatever their rating, and nothing is offered in return. Anything you post on Google is posted by you and is governed by Google’s terms. - Sending you promotions and invitations to resume a visit or a service, or to follow up on a quote you did not go ahead with. We send no more than one promotional email every 30 days. - Recording how you heard about us and, if you tell us, who referred you, for internal reports. We never tell that person anything about your care. - Publishing information or images that identify you for academic, scientific or advertising purposes. Publication requires separate, specific authorization identifying the images or information, purpose, media and scope. For these purposes, your sensitive data is processed only with your express written consent. If you were already a patient before this version of the notice, we will not use your data for them until you authorize it. Refusal does not affect your care, your purchase of products or your price. You may refuse from the outset in the consent for the processing of personal data, or later: through the unsubscribe link in every email, at reception, or through the privacy contact. We record each choice with its date. Unsubscribing takes effect in the system immediately and never takes more than 10 business days. Consent for care or services does not authorize publication of information or images. 4. COMMUNICATIONS AND ELECTRONIC SERVICES We use electronic health records, forms and digital document delivery. Access is limited to authorized staff according to their duties. Shared infrastructure at Nísperos does not, by itself, authorize other practices to access your clinical information. We send you an email reminder about 24 hours before your appointment, with links to confirm it or request a change. It comes from [email protected]. Reminders include only the date, time, place and those links; they do not include the type of appointment, diagnoses, procedures or results. You may also choose to receive them by WhatsApp or by phone. If you accept it in the consent for the processing of personal data, you may also use WhatsApp for clinical follow-up: sending photos, symptoms and questions to the nursing staff or the physician and receiving instructions. This is optional: if you do not accept it, follow-up takes place in person, by phone or by another agreed means. WhatsApp is a third-party service and must not be used for emergencies. You may change your preference through the privacy contact. Do not share your access links or credentials. We use providers that process data on behalf of Dr. Dariela de la Garza García as processors, under her instructions and with confidentiality and security obligations. Several are located in, or process data in, the United States. They cover system hosting (DigitalOcean); secure access to the Mi Nísperos patient portal (Cloudflare); email, calendar and video visits (Google Workspace); receipt of email sent to [email protected] (Zoho Mail); encrypted daily backups that the provider cannot read (Backblaze); electronic invoicing (Facturama); and card payments (Stripe or Mercado Pago, depending on the payment method). External reception or support services processing data on our behalf are subject to the same conditions. The current list of providers is available through the privacy contact. 5. TRANSFERS We may disclose necessary data to ordering or treating physicians, reference laboratories, hospitals and other facilities involved in your care for diagnosis, treatment and continuity of care, within applicable legal exceptions. Card payment processors (Stripe and Mercado Pago) also process your payment data as independent controllers to prevent fraud and meet their legal obligations, under their own privacy notices. This disclosure is necessary for the payment you make and does not require your consent. Data may also be disclosed to authorities when legally required or pursuant to a duly grounded request. Disclosures will be limited to their justified purpose and comply with applicable health information formalities. Laboratory results are delivered to the patient or a legitimately authorized person after verification. Disclosure to the ordering physician is limited to the relevant care and applicable legal basis; shared premises do not authorize general access. Suspected adverse drug reactions are reported to the health authority and, where applicable, to the holder of the medication's marketing authorization, under pharmacovigilance rules and with only the identifying data those rules require. Transfers to insurers, pharmaceutical patient support programs or other recipients you request will be documented through specific authorization unless a legal exception applies. Where authorization is required, it will identify the recipient, purpose and data. We do not sell your data. Sharing an address, reception or software with other practices does not authorize those practices to use your information for their own promotions. 6. RETENTION AND SECURITY Clinical records created will be retained for at least five years from the last medical act. Longer retention may apply where an obligation or documented legal need exists. Other service records are retained according to their purposes and obligations; tax records follow applicable tax law. At the end of the applicable periods, data will be placed in restricted retention where appropriate, and securely deleted. We apply administrative, technical and physical safeguards to protect information and limit unauthorized access, together with confidentiality obligations. If a breach significantly affects your property or non-material rights, we will notify you immediately and without delay, explaining the known facts, affected data, measures taken, protective recommendations and contact for additional information. 7. RIGHTS AND REQUESTS You may exercise rights of access, rectification, cancellation and opposition (ARCO), withdraw consent or limit use or disclosure by emailing [email protected] or submitting a written request at the address above, addressed to Privacy - Dr. Dariela de la Garza García. Include your name, reply contact, request and information helping locate the data. Verify your identity; a representative must also verify their identity and authority. For rectification, identify the correction and provide supporting documents where applicable. You may call for guidance on submitting requests and verifying identity securely. For ARCO requests, we will communicate our determination within twenty business days of receipt and, if granted, implement it within fifteen business days after communicating the response. Legally permitted extensions will be justified and communicated. Requests for clarification or additional documentation will follow the applicable procedure. Access may be provided by a securely delivered electronic copy or on-site consultation and copies, as appropriate. Exercise is free except legally permitted reproduction or delivery costs. For withdrawal and limitation, we will also respond within twenty business days and, if granted, implement the request within fifteen business days after our response. Withdrawal is not retroactive. It does not end retention or processing that must continue under another legal basis; any limitation and its grounds will be explained individually. 8. MINORS AND REPRESENTATIVES We will verify the patient’s identity and the authority of anyone acting on their behalf. A companion, payer or emergency contact is not a representative solely for that reason. Information and participation of minors will follow applicable rules. On reaching legal adulthood, representative access and authorizations will be reviewed while respecting the patient’s decisions and rights. 9. CHANGES, AUTHORITY AND LANGUAGE The current version is available at reception and free of charge through the privacy email. Changes will be announced at reception, with the updated version available through that email. For substantial changes of controller, purposes or transfers, available contact methods will be used and new consent obtained where required before new processing begins. You may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno regarding applicable private-sector data protection procedures. An internal complaint is not a prerequisite where the law does not require it. This notice is provided in Spanish and English. Spanish prevails for interpretive discrepancies without limiting your rights or our duty to provide understandable information. COMPREHENSIVE PRIVACY NOTICE · Version 1.2 · October 10, 2026

COMPREHENSIVE PRIVACY NOTICE NOTICE C | RADIOLOGY Version 1.2 | Prepared: October 10, 2026 1. DATA CONTROLLER AND SCOPE Dr. Daniel de la Garza García, acting as an individual (the “Data Controller”), at Oaxaca 1202, Colonia Nísperos, C.P. 26020, Piedras Negras, Coahuila, Mexico, is responsible for personal data processing relating to Radiology and imaging services, including preparation, performance, interpretation and delivery of the examinations provided to you, as well as image-guided diagnostic and therapeutic procedures (aspirations, biopsies and drainages) and the sending of samples to pathology laboratories. This notice covers these services within this independent operation at Nísperos Centro Médico. CT-guided procedures are performed at the licensed hospital indicated in each case, which creates and keeps its own medical record as an independent controller. It does not cover Blackstones, Wellness or other controllers’ practices. Shared reception, premises or software do not change this identification. Privacy contact: [email protected] | +52 878 688 7636. Reception may provide this notice and receive requests on behalf of Dr. Daniel de la Garza García. 2. DATA WE PROCESS As necessary for each service, we process these categories: - Identification and contact: name, date of birth, age, sex, address, phone, email and identification details where necessary; emergency contact and representative identity and authority details where applicable. - Sensitive health data: examination orders and reasons, ordering physician, relevant history and symptoms, pregnancy information where relevant, allergies, medications (including blood thinners), coagulation tests, implants and relevant contraindications, tissue or fluid samples obtained during procedures, necessary prior studies, diagnostic images, reports, results, and performance and interpretation records. Information concerning kidney function or contrast agents is collected only where relevant to the examination actually offered. - Administrative, payment and tax data: appointments, contracted services, amounts, payment methods and references; name or business name, Mexican tax ID, tax regime, tax address and invoice use when you request an invoice. Data may come from you, your representative, or professionals and facilities legitimately involved in your care. A full clinical history from other specialties is not requested where unnecessary for the examination. The listed categories apply according to the modality actually offered and the patient’s circumstances. 3. PURPOSES AND CONSENT Necessary purposes: scheduling and confirming appointments where applicable; reviewing examination orders and suitability; identifying safety conditions and contraindications; preparing, performing and interpreting radiology and imaging examinations; preparing reports and making images and results available to authorized persons; creating, consulting and retaining records appropriate to the service; receiving relevant information beforehand; coordinating care; payment and invoicing; complying with health, tax and other applicable obligations; and handling claims and responsibilities related to the service. The following are also necessary: sending you appointment reminders and letting you know when a check-up or a follow-up visit is due. For sensitive data we will request express written consent through a signature or an electronic authentication method linking authorization to you, unless a legal exception applies. Data consent does not replace informed consent for medical procedures where required. Optional purposes, which we carry out only if you accept them: - Sending you satisfaction surveys after your visit or procedure, with an invitation to share your opinion on Google. The invitation is sent the same way to everyone, whatever their rating, and nothing is offered in return. Anything you post on Google is posted by you and is governed by Google’s terms. - Sending you promotions and invitations to resume a visit or a service, or to follow up on a quote you did not go ahead with. We send no more than one promotional email every 30 days. - Recording how you heard about us and, if you tell us, who referred you, for internal reports. We never tell that person anything about your care. - Publishing information or images that identify you for academic, scientific or advertising purposes. Publication requires separate, specific authorization identifying the images or information, purpose, media and scope. For these purposes, your sensitive data is processed only with your express written consent. If you were already a patient before this version of the notice, we will not use your data for them until you authorize it. Refusal does not affect your care or your price. You may refuse from the outset in the consent for the processing of personal data, or later: through the unsubscribe link in every email, at reception, or through the privacy contact. We record each choice with its date. Unsubscribing takes effect in the system immediately and never takes more than 10 business days. Consent for care or services does not authorize publication of information or images. 4. COMMUNICATIONS AND ELECTRONIC SERVICES We use electronic health records, forms and digital document delivery. Access is limited to authorized staff according to their duties. Shared infrastructure at Nísperos does not, by itself, authorize other practices to access your clinical information. We send you an email reminder about 24 hours before your appointment, with links to confirm it or request a change. It comes from [email protected]. Reminders include only the date, time, place and those links; they do not include the type of appointment, diagnoses, procedures or results. You may also choose to receive them by WhatsApp or by phone. If you accept it in the consent for the processing of personal data, you may also use WhatsApp for clinical follow-up: sending photos, symptoms and questions to the nursing staff or the physician and receiving instructions. This is optional: if you do not accept it, follow-up takes place in person, by phone or by another agreed means. WhatsApp is a third-party service and must not be used for emergencies. You may change your preference through the privacy contact. Do not share your access links or credentials. We use providers that process data on behalf of Dr. Daniel de la Garza García as processors, under his instructions and with confidentiality and security obligations. Several are located in, or process data in, the United States. They cover system hosting (DigitalOcean); secure access to the Mi Nísperos patient portal (Cloudflare); email, calendar and video visits (Google Workspace); receipt of email sent to [email protected] (Zoho Mail); encrypted daily backups that the provider cannot read (Backblaze); electronic invoicing (Facturama); and card payments (Stripe or Mercado Pago, depending on the payment method). External reception or support services processing data on our behalf are subject to the same conditions. The current list of providers is available through the privacy contact. 5. TRANSFERS We may disclose necessary data to ordering or treating physicians, reference laboratories, hospitals and other facilities involved in your care for diagnosis, treatment and continuity of care, within applicable legal exceptions. Card payment processors (Stripe and Mercado Pago) also process your payment data as independent controllers to prevent fraud and meet their legal obligations, under their own privacy notices. This disclosure is necessary for the payment you make and does not require your consent. Data may also be disclosed to authorities when legally required or pursuant to a duly grounded request. Disclosures will be limited to their justified purpose and comply with applicable health information formalities. Delivery or disclosure of images and reports to the ordering physician, patient or representative is limited to the relevant care, after verifying identity, authorization or the applicable legal basis. Other practices do not receive access merely because they share the premises. Transfers to insurers or other recipients you request will be documented through specific authorization unless a legal exception applies. Where authorization is required, it will identify the recipient, purpose and data. We do not sell your data. Sharing an address, reception or software with other practices does not authorize those practices to use your information for their own promotions. 6. RETENTION AND SECURITY Clinical records created will be retained for at least five years from the last medical act. Longer retention may apply where an obligation or documented legal need exists. Other service records are retained according to their purposes and obligations; tax records follow applicable tax law. At the end of the applicable periods, data will be placed in restricted retention where appropriate, and securely deleted. We apply administrative, technical and physical safeguards to protect information and limit unauthorized access, together with confidentiality obligations. If a breach significantly affects your property or non-material rights, we will notify you immediately and without delay, explaining the known facts, affected data, measures taken, protective recommendations and contact for additional information. 7. RIGHTS AND REQUESTS You may exercise rights of access, rectification, cancellation and opposition (ARCO), withdraw consent or limit use or disclosure by emailing [email protected] or submitting a written request at the address above, addressed to Privacy - Dr. Daniel de la Garza García. Include your name, reply contact, request and information helping locate the data. Verify your identity; a representative must also verify their identity and authority. For rectification, identify the correction and provide supporting documents where applicable. You may call for guidance on submitting requests and verifying identity securely. For ARCO requests, we will communicate our determination within twenty business days of receipt and, if granted, implement it within fifteen business days after communicating the response. Legally permitted extensions will be justified and communicated. Requests for clarification or additional documentation will follow the applicable procedure. Access may be provided by a securely delivered electronic copy or on-site consultation and copies, as appropriate. Exercise is free except legally permitted reproduction or delivery costs. For withdrawal and limitation, we will also respond within twenty business days and, if granted, implement the request within fifteen business days after our response. Withdrawal is not retroactive. It does not end retention or processing that must continue under another legal basis; any limitation and its grounds will be explained individually. 8. MINORS AND REPRESENTATIVES We will verify the patient’s identity and the authority of anyone acting on their behalf. A companion, payer or emergency contact is not a representative solely for that reason. Information and participation of minors will follow applicable rules. On reaching legal adulthood, representative access and authorizations will be reviewed while respecting the patient’s decisions and rights. 9. CHANGES, AUTHORITY AND LANGUAGE The current version is available at reception and free of charge through the privacy email. Changes will be announced at reception, with the updated version available through that email. For substantial changes of controller, purposes or transfers, available contact methods will be used and new consent obtained where required before new processing begins. You may contact Mexico’s Secretaría Anticorrupción y Buen Gobierno regarding applicable private-sector data protection procedures. An internal complaint is not a prerequisite where the law does not require it. This notice is provided in Spanish and English. Spanish prevails for interpretive discrepancies without limiting your rights or our duty to provide understandable information. COMPREHENSIVE PRIVACY NOTICE · Version 1.2 · October 10, 2026