Legal notice

bluMEDICA LATAM S.A. DE C.V. (hereinafter BLUMEDICA) is responsible for the protection of the personal data you enter on this website.

All requests and procedures relating to your personal data will be handled by bluMEDICA LATAM, S.A. DE C.V., and must be submitted using any of the contact details indicated below:

• Address: Fujiyama número 74, Colonia Las Águilas, Delegación Álvaro Obregón, código postal 01710, Ciudad de México.
• Telephone: (55) 5920 9768
• Email: [email protected] — please confirm by telephone that your email has been received correctly.

By accessing this website you agree to receive the cookies transmitted through it. “Cookies” are data files generated when you connect to a web page or website and are stored on your computer’s hard drive. They may contain information about your browsing behaviour within the website, such as: the time of browsing, the time spent on our website, the sections visited and the web pages you accessed before ours. These data are not transferred and are for internal use only, and they are obtained for the following purposes: to learn about your behaviour and preferences as an internet user, in order to generate better promotions and targeted sales; to improve this website and adapt it to the behaviour of the users who visit it; and to process registrations and send information.

A Cookie cannot read data or information from the user’s hard drive, nor can it read Cookies created by other sites or pages.

The procedure for disabling cookies and other technologies depends on the browser you are using, as follows:

• SELECT THE “SETTINGS” OR “TOOLS” OPTION ACCORDING TO YOUR BROWSER AND SELECT THE “DISABLE COOKIES” OPTION. THIS PROCESS DISABLES COOKIES FOR THE ENTIRE BROWSER, NOT ONLY FOR OUR WEBSITE.

You can look up information on the most common browsers and find out how to adjust your cookie preferences on the websites of the browser you use.

However, if you disable cookies, some features of our WEBSITE may also be disabled and your use of the website may be limited.

As a result of legislative developments, internal policies or new requirements for the provision or offering of our services, this privacy notice may be subject to modifications or updates, which will be made known to you by publishing them on the website www.blumedica.mx (Doctors’ Privacy Notice section).

If you consider that your right to the protection of your personal data has been affected by any action or omission on our part, or you suspect that the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations and other applicable legislation have been violated, you may file a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI). For more information, visit www.inai.org.mx.

What personal data will we ask for and how will we collect them?

Please note that the services provided by bluMEDICA consist solely of providing a technology platform through which HEALTHCARE PROFESSIONAL users access the website www.opensalud.mx and/or www.openpsicologos.com (hereinafter the WEBSITE), where they can contact patients who request their healthcare services, under the terms offered on the website.

The personal data collected are the following:

A) Personal data:

• Full name
• Age
• Tax address and home address
• Home telephone and mobile phone
• Email address
• Federal Taxpayer Registry number (RFC)
• Official photo ID
• Professional licence (cédula profesional)
• Education
• Degrees, certificates, specialities, etc.
• Training and skills
• Courses or studies currently in progress
• Languages

B) Sensitive data:

• Place and date of birth
• Nationality

C) Financial data:

• Debit card number and bank.
• Bank account details.

The data subject is responsible for the truthfulness and authenticity of the data they provide, and therefore releases bluMEDICA from any complaint, claim, report, irregularity and, in general, from any liability in this regard.

For what purposes will we use your personal data?

A) Purposes for the existence, maintenance and fulfilment of the legal relationship with the data controller:

1. Contacting the data subject
2. Confirming the identity of the data subject.
3. Verifying the information provided by the data subject.
4. Learning about the background, skills and work and professional training of the data subject
5. Approval and inclusion of the data subject in the website directory
6. Payment for services
7. Invoicing

B) In addition, we will use your personal information for the following purposes, which are not necessary for the provision, existence, maintenance and fulfilment of the requested services, but which allow us to offer you better service and attention:

1. Sending advertising, promotions and information about our products.
2. Keeping in touch with you for clarifications, suggestions, complaints and surveys to assess the quality of our service.

The purposes in section B) will only apply when you subscribe to the newsletter on our website by entering your email address; accordingly, please note that at the end of each and every email you receive from us, you have the option to unsubscribe from our newsletter list whenever you wish.

bluMEDICA is responsible solely and exclusively for the personal data registered on the platform / website. bluMEDICA disclaims any liability for any additional information requested or offered by the patient.

Please note that your PERSONAL AND FINANCIAL DATA will be processed by the payment service provider OPENPAY, through the website www.openpay.mx, to which you will be redirected, and bluMEDICA will also store your bank details. These purposes do not require the express consent of the data subject, under article 37, sections IV and VII, of the FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES, as they are necessary for the provision, existence, maintenance and fulfilment of our services; the data subject therefore gives their consent for the processing of their personal data under the terms indicated.

With regard to your PERSONAL AND SENSITIVE DATA, please note that when you access the WEBSITE and enter your data, a user profile is created, and patient users of the WEBSITE will only have access to the information you authorise and select on the WEBSITE, which complies with the regulations for the protection of your personal data and processes your data in accordance with this PRIVACY NOTICE. These purposes do not require the consent of the data subject, under article 37, sections II and VII, of the FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES; the data subject therefore expressly gives their consent for the processing and transfer of their data under the terms described.

We also inform you that our WEBSITE operates from a remote data centre, in which all information relating to PERSONAL and SENSITIVE DATA is stored; such data are therefore also STORED on that platform, as this is necessary to provide the services you have requested. This platform offers security and confidentiality of personal data and, to that end, has a secure server using the SSL (Secure Socket Layer) protocol, so that the information you send is transmitted encrypted to ensure its protection. However, despite increasingly secure tools, the protection of data sent over the Internet cannot be 100% guaranteed; therefore, once received, all necessary precautions are taken to safeguard the information, in accordance with the law.

How can you access, rectify or cancel your personal data, or object to their use?

You have the right to know which of your personal data we have collected, what we use them for and the conditions under which we use them (Access).

You also have the right to request the correction of your personal information if it is outdated, inaccurate or incomplete (Rectification); to have it deleted from our records or databases when you consider that it is not being used in accordance with the principles, duties and obligations set forth in the Law (Cancellation); and to object to the use of your personal data for specific purposes (Objection). These rights are known as ARCO rights.

To exercise any of the ARCO rights, you must follow the procedure set out below:

1. Prepare a request, which must contain:
   1. Your name, address and email address so that we can send you the response to your request.
   2. The documents proving your identity or, where applicable, that of your legal representative.
   3. A clear and precise description of:
      • The personal data in respect of which you wish to exercise any of the ARCO rights,
      • Which right you wish to exercise, and
      • What the exercise of that right consists of.
   4. Any other element or document that makes it easier to locate the corresponding personal data.
2. The request must be addressed to bluMEDICA and submitted through any of the means of communication listed in this privacy notice, in the section “How can you contact us?”.
3. Once the request for ACCESS, RECTIFICATION, CANCELLATION OR OBJECTION regarding personal data has been received, bluMEDICA will respond to your request within a maximum of twenty business days and, if it is found to be admissible, it will be carried out within a maximum of fifteen business days from the date on which the response was communicated to you online, via the email address you provided for that purpose.
4. Likewise, the information or personal data you may have requested through the exercise of the right of ACCESS will be sent to you online, to the email address you provided.
5. As regards the right of cancellation or objection, the procedure set forth in articles 106, 107 and 108 of the REGULATIONS OF THE FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES will be followed.

The procedure described above is free of charge and is without prejudice to any other faster mechanism that we may establish and that we will make known to you by publishing it on the website www.blumedica.mx (Doctors’ Privacy Notice section).

If you have any questions about the above procedure, you may contact bluMEDICA through any of the means of communication listed in this privacy notice, in the section “How can you contact us?”, where all your questions will be answered.

How can you revoke your consent to the use of your personal data?

You may revoke the consent you may have given us for the processing of your personal data. However, please bear in mind that not in all cases will we be able to comply with your request or stop using the data immediately, as we may be required by a legal obligation to continue processing your personal data.

You should also bear in mind that, for certain purposes, revoking your consent will mean that the service you intend to request cannot be provided or that it will be terminated immediately.

The procedure and requirements for revoking consent are as follows:

1. Prepare a request, which must contain:
   1. Your name, address and email address so that we can send you the response to your request.
   2. The documents proving your identity or, where applicable, that of your legal representative.
   3. A clear and precise description of:
      • The personal data in respect of which you wish to revoke your consent and the reasons for the revocation.
      • Any other element or document that makes it easier to locate the corresponding personal data.
2. The request must be addressed to bluMEDICA and sent through any of the means of communication listed in this privacy notice, in the section “How can you contact us?”.
3. Once the request for REVOCATION OF THE CONSENT given for the processing of personal data has been received, bluMEDICA will have a maximum of twenty business days to resolve your request which, if admissible, will be carried out within a maximum of fifteen business days from the date on which the response was communicated to you.

The procedure described above is free of charge and is without prejudice to any other faster mechanism that we may establish and that we will make known to you by publishing it on the website www.blumedica.mx (Doctors’ Privacy Notice section).

If you have any questions about the above procedure, you may contact bluMEDICA through any of the means of communication listed in this privacy notice, in the section “How can you contact us?”, where all your questions will be answered.

How can you limit the use or disclosure of your personal information?

You may request to be included in the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad), managed by the FEDERAL CONSUMER PROTECTION AGENCY (PROFECO), so that your personal data are not used to send you advertising or promotions from companies offering goods or services. For more information about this registry, you can visit the PROFECO website or contact the agency directly.

What personal data will we ask for and how will we collect them?

Please note that the services provided by bluMEDICA consist solely of providing a technology platform through which users access the website www.opensalud.mx and/or www.openpsicologos.com (hereinafter the WEBSITE), where they can contact healthcare specialists.

While browsing, you may be asked for the following data:

A) Personal:

• Full name
• Age/Date of birth
• Gender (male, female)
• Address (street, number, apartment, borough, postcode, city, state)
• Landline and mobile phone
• Email
• In the case of minors or persons with any type of disability, the name, occupation, landline and mobile phone numbers and email of their parents or guardian.

B) Financial:

• Tax address
• Credit or debit card details (card number, cardholder and bank).
• Federal Taxpayer Registry number (RFC)

C) Sensitive data:

• Medical history and current conditions, hereditary diseases, genetic information and general state of health
• Medical tests, treatments or prescriptions
• Racial or ethnic origin
• Sexual orientation

For what purposes will we use your personal data?

The personal data we collect are used for the following purposes:

A) Purposes necessary for the provision, existence, maintenance and/or fulfilment of the requested services:

• Scheduling and managing appointments with the specialist you have selected (the appointment may be in person, by video call, online or a second opinion)
• Establishing contact between you and the doctor or specialist you have selected.
• Issuing prescriptions and reports
• Creating a user profile, which will allow you to interact on the WEBSITE and will contain your digital medical record, which may only be consulted by the doctor or specialist you have chosen for your consultation.
• Contacting you with information related to the service you requested on the WEBSITE.

B) In addition, we will use your personal information for the following purposes, which are not necessary for the provision, existence, maintenance and fulfilment of the requested services, but which allow us to offer you better service and attention:

• Sending advertising, promotions and information about our services.
• Keeping in touch with you for clarifications, suggestions, complaints and surveys to assess the quality of our service.

The purposes in section B) will only apply when you subscribe to the newsletter on our website by entering your email address; accordingly, please note that at the end of each and every email you receive from us, you have the option to unsubscribe from our newsletter list whenever you wish.

bluMEDICA is not responsible for any personal, financial and/or sensitive data that you provide, outside the WEBSITE, to the doctor or healthcare professional you have chosen for consultation or treatment.

With whom do we share your personal information and for what purposes?

Please note that your PERSONAL AND FINANCIAL DATA will be processed by the payment service provider OPENPAY, through the website www.openpay.mx, to which you will be redirected, and bluMEDICA will also store your bank details. These purposes do not require the express consent of the data subject, under article 37, sections IV and VII, of the FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES, as they are necessary for the provision, existence, maintenance and fulfilment of our services; the data subject therefore gives their consent for the processing of their personal data under the terms indicated.

With regard to your PERSONAL AND SENSITIVE DATA, please note that when you access the WEBSITE and enter your data, a user profile and a digital medical record are created, which can only be accessed by the doctor(s) or healthcare professionals you authorise and select on the WEBSITE, who must comply with the regulations for the protection of your personal data and process your data in accordance with this PRIVACY NOTICE and the WEBSITE PRIVACY NOTICE. These purposes do not require the consent of the data subject, under article 37, sections II and VII, of the FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES; the data subject therefore expressly gives their consent for the processing and transfer of their data to the doctors or medical specialists they choose from the WEBSITE Directory.

We also inform you that our WEBSITE operates from a remote data centre, in which all information relating to PERSONAL and SENSITIVE DATA is stored; such data are therefore also STORED on that platform, as this is necessary to provide the services you have requested. This platform offers security and confidentiality of personal data and, to that end, has a secure server using the SSL (Secure Socket Layer) protocol, so that the information you send is transmitted encrypted to ensure its protection. However, despite increasingly secure tools, the protection of data sent over the Internet cannot be 100% guaranteed; therefore, once received, all necessary precautions are taken to safeguard the information, in accordance with the law.

How can you access, rectify or cancel your personal data, or object to their use?

You have the right to know which of your personal data we have collected, what we use them for and the conditions under which we use them (Access).

You also have the right to request the correction of your personal information if it is outdated, inaccurate or incomplete (Rectification); to have it deleted from our records or databases when you consider that it is not being used in accordance with the principles, duties and obligations set forth in the Law (Cancellation); and to object to the use of your personal data for specific purposes (Objection). These rights are known as ARCO rights.

To exercise any of the ARCO rights, you must follow the procedure set out below:

1. Prepare a request, which must contain:
   1. Your name, address and email address so that we can send you the response to your request.
   2. The documents proving your identity or, where applicable, that of your legal representative.
   3. A clear and precise description of:
      • The personal data in respect of which you wish to exercise any of the ARCO rights,
      • Which right you wish to exercise, and
      • What the exercise of that right consists of.
   4. Any other element or document that makes it easier to locate the corresponding personal data.
2. The request must be addressed to bluMEDICA and submitted through any of the means of communication listed in this privacy notice, in the section “How can you contact us?”.
3. Once the request for ACCESS, RECTIFICATION, CANCELLATION OR OBJECTION regarding personal data has been received, bluMEDICA will respond to your request within a maximum of twenty business days and, if it is found to be admissible, it will be carried out within a maximum of fifteen business days from the date on which the response was communicated to you online, via the email address you provided for that purpose.
4. Likewise, the information or personal data you may have requested through the exercise of the right of ACCESS will be sent to you online, to the email address you provided.
5. As regards the right of cancellation or objection, the procedure set forth in articles 106, 107 and 108 of the REGULATIONS OF THE FEDERAL LAW ON THE PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES will be followed.

The procedure described above is free of charge and is without prejudice to any other faster mechanism that we may establish and that we will make known to you by publishing it on the website www.blumedica.mx (Patients’ Privacy Notice section).

If you have any questions about the above procedure, you may contact bluMEDICA through any of the means of communication listed in this privacy notice, in the section “How can you contact us?”, where all your questions will be answered.

How can you revoke your consent to the use of your personal data?

You may revoke the consent you may have given us for the processing of your personal data. However, please bear in mind that NOT IN ALL CASES will we be able to comply with your request or stop using the data immediately, as we may be required by a legal obligation to continue processing your personal data.

You should also bear in mind that, for certain purposes, revoking your consent will mean that the service you intend to request cannot be provided or that it will be terminated immediately.

The procedure and requirements for revoking consent are as follows:

1. Prepare a request, which must contain:
   1. Your name, address and email address so that we can send you the response to your request.
   2. The documents proving your identity or, where applicable, that of your legal representative.
   3. A clear and precise description of:
      • The personal data in respect of which you wish to revoke your consent and the reasons for the revocation.
      • Any other element or document that makes it easier to locate the corresponding personal data.
2. The request must be addressed to bluMEDICA and sent through any of the means of communication listed in this privacy notice, in the section “How can you contact us?”.
3. Once the request for REVOCATION OF THE CONSENT given for the processing of personal data has been received, bluMEDICA will have a maximum of twenty business days to resolve your request which, if admissible, will be carried out within a maximum of fifteen business days from the date on which the response was communicated to you.

The procedure described above is free of charge and is without prejudice to any other faster mechanism that we may establish and that we will make known to you by publishing it on the website www.blumedica.mx (Privacy Notice section).

If you have any questions about the above procedure, you may contact bluMEDICA through any of the means of communication listed in this privacy notice, in the section “How can you contact us?”, where all your questions will be answered.

How can you limit the use or disclosure of your personal information?

You may request to be included in the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad), managed by the FEDERAL CONSUMER PROTECTION AGENCY (PROFECO), so that your personal data are not used to send you advertising or promotions from companies offering goods or services. For more information about this registry, you can visit the PROFECO website or contact the agency directly.