COMPREHENSIVE PRIVACY NOTICE

H&H BUSINESS LAB S.A. DE C.V. presents the following Privacy Notice in compliance with the provisions of the Federal Law on Protection of Personal Data Held by Individuals (LFPDPPP, by its abbreviation in Spanish), its regulations (RLFPDPPP, by its abbreviation in Spanish) and other applicable regulations; where we make known our commitment to safeguard your privacy and communicate what we do with your personal data.

H&H BUSINESS LAB S.A. DE C.V., with fiscal residence at Chihuahua Street number 10, Roma Norte, Cuauhtémoc, Mexico City, Zip Code 06700; website: www.medexlab.mx is responsible for the use, management and protection of your personal data.

I. The personal data that will be subjected to treatment

To carry out the purposes described later in this privacy notice, we will use the following personal data for:

• Identifying and contact data.
• Data on physical characteristics.

In addition to the personal data listed above, we will use the following personal data considered as sensitive, it means, those that affect the most intimate sphere of the owner or whose misuse may give rise to discrimination or entail a potential risk for it. We affirm that the data that will be stated is used with special protection, for the purposes set out in this privacy notice:

• Financial data such as debit/credit card numbers.
• Data on social security.
• History of medical evaluation.
• Data on the requested study.
• Verification of compliance with the requirements to carry out the study/sample.
• Specific data by type of study/sampling, such as:
  • Physical and eating habits
  • Medical history
  • Data on the reproductive process
  • Data on sexual life
  • Data on the follow-up to your diagnosis (only in studies that need guidance)

II. For what purposes will we use your information?

The information that we previously collect from you will be used for the following purposes, which are necessary for the service you request:

• Formation of a unique profile per patient.

• Identification, access and continuity of patient care.
• Offer effective communication, such as information from the study, pathologies, possible results detected by the studies / sampling, notify about discomfort during the study / sampling, results with health risks, as well as resolve doubts in the care process.
• Administration and use of medicines in case of an allergic reaction.
• Offer recommendations and aftercare.
• Validation of the results of the studies with your attending physician.
• Creation and conservation of the patient’s clinical record.
• Support in generating a diagnosis.
• Quality of the study result.

Additionally, we will use your information for the following secondary purposes, which are not necessary for the requested service, but which allow and facilitate us to provide you with better care:

• Analysis and statistics.
• Creation of profile on consumption of clinical, imaging and ophthalmic studies.
• Counselling by diagnosis.

• Participation in Research Protocols.
• Measurements of the quality of study results and service.
• Marketing or advertising.

You have five business days to notify your opposition to the processing of your personal data for secondary purposes; you can do so by requesting it in a free format, where we ask you to indicate the limitations for the processing of your data, as well as the root causes of said limitations. In the application, we also ask you to include an official identification and all that information to contact you: full name, phone / cell phone number and / or email; directing your request to the mail contacto@medexlab.mx.

We confirm that we will process the data specifically for the purposes you authorize us.

III. With whom do we share your information and for what purposes?

We inform you that your information is shared within the country with the following areas, institutions, companies, organizations or authorities other than us, for the following purposes:

Recipients of the personal data	Purpose	Approval
Attending physician	Attention, follow-up and review of results	No
Hospital that provided the health service	Updating and conservation of the clinical record	Yes
Federal and state judicial authorities	For defense or exercise of a right in a judicial process	No
Employer in labor matters and in the hiring process	Knowledge of the state of health for the position	No
Federal institutions in the field of health and research	Knowledge of health conditions, epidemics, data and statistics	Yes

Note: in the box above, we inform you of the transfers we make at the national level and the purposes for which your information will be submitted. In addition, we notify you that H&H BUSINESS LAB S.A. DE C.V. will strive for the third party recipient to adhere in compliance with the assumptions of article 37 of the Law (transfers provided for in a law or treaty, when the information is necessary for the prevention or medical diagnosis, treatment or management of health care, for any company of the person responsible that operates under the same conditions of internal processes or policy,  where the information is necessary under a contract, where the information is necessary to safeguard a public interest, for the administration or administration of justice; when the information is necessary for the exercise of the defense of a right in a judicial process or for the maintenance or fulfillment of a legal relationship),in coordination with the purposes set out in this privacy notice.

In summary of the above, and without prejudice, you as the owner of your information, grant your consent for the processing of your personal and sensitive data, as well as the transfers marked in this Privacy Notice in compliance with the provisions of the Law and its Regulations.

But in case you do not want your information to be used for these purposes, request your opposition by writing in free format, where we ask you to indicate the limitations for the processing of your data, as well as the root causes of said limitations. In the application, we also ask you to include an official identification and all that information to contact you: full name, phone / cell phone number and / or email; directing your request to the  mail contacto@medexlab.mx.

We confirm that we will process the data specifically for the purposes you authorize us.

IV. Limit the use or disclosure of your personal data

In order to limit the use and disclosure of your information, we offer you the following means in which you can register so that your information is not processed and in the event that you do not wish to obtain publicity from us:

1. Public Registry to Avoid Advertising; for more information, see profeco’s website.
2. Public Registry of Users; for more information, see the Condusef website.
3. Exercise of ARCO rights and revocation of consent.

V. Exercise of ARCO rights and revocation of consent

The Law provides every holder with a series of benefits that guarantee the power of decision and control they have over their information, as well as the right to the protection of their personal data. Any owner may exercise their rights of Access, Rectification, Cancellation and Opposition (ARCO rights, for its acronyms) at any time. We also notify you that there are no prerequisites for the exercise of any of them. In the same way, you can revoke your consent to the processing of your personal data, except for the exceptions set out in article 10 and its fractions of the Law(article 10 of the Law explicitly marks the exceptions in which a consent will not be necessary for the processing of personal data, such as that it is provided for in a law,  that the information is in public access sources, that the data are subjected to a dissociation process, has the obligation to comply with obligations of a legal relationship, there is an emergency situation where the owner can potentially be damaged, are necessary to receive medical care, prevention or diagnosis, medical treatments, management of health services while the holder is not in a position to grant his consent or is dictated  resolution of competent authority).

1. Information and documentation for the request for the exercise of ARCO rights and revocation of consent.

Documentation necessary for the exercise of ARCO rights or revocation of consent:

• Description of the request: The description must be clear and precise about the personal data to which you wish to exercise your ARCO rights or revocation of consent.
• Simple copy of the documents accrediting the identity of the holder or legal representative, and signed power of attorney letter from the legal representative.
• Identification data of the owner: full name, date of birth, telephone / cell phone number, email or address.

2. Submission of the application:

• Personal Data Department:
• Responsible: _____________________________
• Address: __________________________________
• E-mail: ______________________________
• Cell Phone: _______________________________
• Opening Hours of operation:
  From Monday to Friday from ______ am to _____ pm.
  Saturdays from _____am to _____ pm.
  Sunday and holidays from _____ am to _______ pm.
  
  

3. Processing of the exercise of ARCO rights or revocation of consent:

• Send the request: the owner must send his request for the exercise of ARCO rights or revocation of consent to the person in charge of H&H BUSINESS LAB S.A. DE C.V.
• Attention to the request: 20 business days from the date the request has been received by the person in charge of H&H BUSINESS LAB S.A. DE C.V. and issue an acknowledgement of receipt to the holder.

Delivery of acknowledgment:

• Physical documentation: the confirmation will be recorded in the application on the date of receipt.
• Electronic documentation: confirmation of receipt of documents will be sent by email.
• Validation of requirements: the responsible department will verify compliance with the documentation necessary to exercise ARCO rights or the revocation of consent. In the event that anomalies or missing in the documentation are identified, access to personal data may be denied in compliance with the provisions of article 34 and its fractions of the Law; notifying the response, attached with the information that supports it.

Note: the term of care may be interrupted when the information provided in the request is insufficient or erroneous, does not comply with the documents to exercise the request for ARCO rights or revocation of consent. The Head of H&H BUSINESS LAB S.A. DE C.V. request the holder, for the only time, to provide the missing documents or requirements to meet the request within five business days of receipt of the request; the holder has a period of 10 business days to meet the request from the receipt of the notification. If you do not respond to the request, the request to exercise your rights or revocation of consent will be designed as not submitted, but if, on the contrary, the complete documentation is received, the person in charge of H&H BUSINESS LAB S.A. DE C.V. will do what is marked in the subsection «: Attention to the request».

4. Response to the request: 15 business days from the date on which the person in charge notifies the holder that his request is appropriate. For the request for access to your personal data to become effective, you must prove the identity of the applicant.

Note: the aforementioned deadlines may be extended, provided that this is justified by the circumstances of the case.

In case of presenting any doubt in the process of the exercise of ARCO rights or revocation of consent, you can request more information at the email contacto@medexlab.mx.

VI. Use of tracking technology on our Internet portal

H&H BUSINESS LAB S.A. DE C.V. uses mechanisms in remote or local means of electronic, optical or other communication, by which we collect personal data automatically and simultaneously at the time you make contact with them. Below we will define more clearly the means we use:

1. Cookies: are files sent by a site that are then stored on the user’s computer or device, in which previous activities and data entered are recorded to offer a more personalized experience. Within these cookies can be stored the pages you have visited within the site, information that has been entered by the user through forms, among others; in order to make your experience more fluid and personalized within the site. An example of the information used within cookies is the username and password, with which the site identifies the user and allows to display information that is intended only for that person.
   • What kind of cookies do we use? Session cookies: with these files we save the login information when you access our site once. These cookies are deleted once you leave the site or a short time later.
2. Web beacons: are objects embedded in the content of a site or e-mail with the aim of verifying if a user has entered said content. The most common uses are to keep track of access to an e-mail or to be used in usage statistics.

These are commonly small, transparent images, or tags within the code so they don’t intercede with the user experience.

3. The personal data we collect through these technologies are:
   • The username and passwords for a session.
   • Language preferred by the user.
   • The region in which the user is located.
   • Browser type.
   • The user’s operating system type.
   • The start and end date and time of a user’s session.
   • Web pages visited by a user.
   • Searches performed by a user.
4. For what purposes do we use your personal data?
   • For database creation.
   • Create traffic to clinic by segmenting data for campaigns and/or markets.
   • Improve the patient experience by addressing their complaints.
   • Support in the request for consultations on social networks.
   • Analysis.

Use of the mobile applications «MEDEXLAB APP» AND»MEDEXLAB CHEMICAL «related to clinical analysis tests

1.-The use of the mobile applications called «Medexlab App» and «Medex Químico», have the purpose of generating appointments for the application of clinical analysis and its subsequent processing to obtain results.

2.- The mobile application called «Medexlab App», collects the following personal data:

-Full name

-Email address

-Birthdate

-Telephone

-Passport number or identity document of country origin.

The procedure carried out through this mobile application is as follows:

-The applicant may upload a photograph of his identity document for internal use
of H&H BUSINESS LAB S.A. DE C.V in case of request for correction of data. It should be noted that this photograph is not shared with any person or entity whether public or private and that the use of the camera of the mobile device is completely optional for the applicant.

-The applicant, once registered, can generate an appointment for the application of the test that corresponds to the clinical analysis.

Once the clinical analysis has been carried out, the applicant receives the results via email and through the mobile application.

3.- The mobile application called «Medexlab Químico», which is for internal use, carries out the following procedure:

-Review the appointments generated by the applicants through the mobile application «Medexlab App».

-Validate the results obtained once the sample has been taken.

-The camera of the mobile device is used to upload evidence of the result of the clinical analyses carried out on the applicant.

Using the camera of the mobile device in the mobile application «MEDEXLAB APP»

In the event that the applicant for an appointment for the clinical analysis application requires some correction in their personal data, they have the option to, through the camera of their mobile device, take a photograph of their identity document and upload it to the mobile application.

For the information generated through the camera, its treatment is reiterated in the same terms contained in this notice.

The use of the camera of the mobile device is completely optional for the applicant.

VII. Changes to the Privacy Notice

This privacy notice may undergo modifications, changes or updates derived from new legal requirements, our own needs for the prevention services, diagnostic and ophthalmic products that we offer, our privacy practices or for other reasons.

We promise to keep you informed about the changes that this privacy notice may undergo, through the site www.medexlab.mx  or physically at the general reception of your closet clinic.