Legal

January 1, 2026

IMPORTANT NOTICE

Reading, understanding, and accepting these Terms and Conditions constitute a prior condition for the use of EDEN SUITE. Acceptance is perfected through (i) the signing of any Commercial Proposal, Quotation, or Purchase Order that incorporates them by reference; (ii) the creation or use of access credentials to the platform; or (iii) browsing or using the website. Anyone who does not accept these Terms and Conditions in their entirety must refrain from using EDEN SUITE.

PREAMBLE

These Terms and Conditions of Use (the "Terms") constitute the adhesion contract governing access to and use of the EDEN SUITE platform and of the other services, modules, websites, and digital channels operated by EDEN.

EDEN is the commercial name under which the following operate, jointly or individually as applicable to the country and to the specific commercial instrument: Higia, Inc., a company incorporated under the laws of the State of Delaware, United States of America, and its subsidiaries and related entities, including, by way of illustration and not limitation, Eva Health, S.A.P.I. de C.V. (Mexico); United Surgical Importação e Exportação Ltda. (Brazil); Eden Colombia Latinoamérica S.A.S. (Colombia); as well as the other present or future subsidiaries of the group. The legal entity specifically bound to the Client is identified in the respective Commercial Proposal.

These Terms are published and kept available for permanent public consultation on the website legal.edenmed.com. The version in force and its effective date are those recorded in such repository.

These Terms prevail over any prior, simultaneous, or subsequent agreement, statement, offer, communication, declaration, or verbal representation, whether from commercial, technical, support, or any other area of EDEN's personnel. Only written instruments executed by representatives with sufficient authority that expressly and unequivocally modify, limit, or replace them in the relevant respect shall prevail over these Terms.

CLAUSES

1. Legal Nature and Acceptance

1.1 These Terms constitute an adhesion contract by incorporation by reference, under which EDEN uniformly offers the general conditions under which it provides its services. Their nature is that of general contracting conditions, integrated into the Client's consent through the signing of the respective Commercial Proposal or through any of the other forms of acceptance set forth in these Terms.

1.2 Forms of Acceptance. The Client, its Authorized Users, the website Visitors, and other Subjects defined in Clause 6 express their full and unconditional acceptance of these Terms through any of the following conducts, without any additional handwritten signature being required: (a) the signing—handwritten or electronic—of any Commercial Proposal, Quotation, Purchase Order, registration form, service sheet, or analogous instrument that incorporates them by reference; (b) the creation, receipt, activation, or use of access credentials to EDEN SUITE; (c) browsing, accessing, or using EDEN's websites, portals, mobile applications, or digital channels; (d) the submission or processing of DICOM Studies, User Content, or Identifying Data through EDEN SUITE; and (e) the making of payments or the receipt of services under any commercial instrument in force.

1.3 Prior Knowability. EDEN keeps these Terms published with public, free, and gratuitous access on the website legal.edenmed.com, maintaining a historical repository of previous versions. The Client, its Authorized Users, and other Subjects acknowledge having permanent access to the text in force prior to any act of acceptance and declare having consulted, read, understood, and accepted them in all their scope. Prior consultation is legally presumed to be known from the moment such publication is available.

1.4 Incorporation by Reference in Commercial Proposals. The Commercial Proposals, Quotations, and Purchase Orders issued by EDEN shall include, as standard, an express adhesion clause to these Terms. The signing of the respective commercial instrument by the Client entails full, irrevocable, and unreserved adhesion to these Terms in their version in force at the time of signing, unless the instrument itself provides for express modifications pursuant to Clause 1.6.

1.5 Supplementary Character and Precedence. These Terms govern by default any contractual relationship between EDEN and the Client or User, and operate supplementarily with respect to the specific economic and commercial terms set forth in the Commercial Proposal. Where there is a master agreement, master services agreement, individually negotiated license agreement, or other legal instrument expressly executed by the Parties governing the same subject matter, such instrument shall prevail exclusively to the extent it expressly and unequivocally provides otherwise, with these Terms remaining in force as to all matters not provided for.

1.6 Order of Precedence of Documents. In the event of conflict, the following order of precedence shall prevail: (a) master agreement or individually negotiated license agreement executed by the Parties, as to what is expressly agreed; (b) Commercial Proposal, Quotation, or Purchase Order signed by the Client, as to economic terms, commercial scope, and any express modification to these clauses; (c) these Terms; and (d) the technical Documentation and user manuals of EDEN SUITE.

1.7 Capacity and Representation. Any natural person who accepts these Terms in the name and on behalf of a legal entity, institution, or third party declares and warrants having sufficient, valid, and non-revoked authority to bind such legal entity under the terms set forth herein. EDEN shall not be obligated to verify the sufficiency of such authority, and the acts executed shall be deemed fully valid vis-à-vis EDEN. The natural person who accepts without having sufficient authority shall be personally liable for the damages and losses caused.

2. Definitions

2.1 For purposes of these Terms, the words beginning with a capital letter shall have the meaning attributed to them below, unless the context unequivocally indicates another meaning. The terms defined in the Commercial Proposal shall retain their meaning there for purposes of these Terms.

Software Update. The changes and improvements made by EDEN in EDEN SUITE, including corrections, patches, functionality improvements, security adjustments, and new versions of the AI Models.

Contract Year. Period of twelve (12) consecutive months counted from the Start Date established in the Commercial Proposal, and each subsequent period of twelve (12) months during the Term.

Client. The natural or legal person identified as such in the Commercial Proposal, who contracts EDEN's services. When these Terms refer to the "Client," its obligations, declarations, and acknowledgments shall be understood as also made by its Authorized Users, as applicable to them.

User Content. Text, dictation, instructions, templates, parameters, Studies, metadata, and any other information supplied by the Client, its Authorized Users, or any Subject through EDEN SUITE.

Identifying Data. Any data that, on its own or combined with others, allows identifying or making identifiable a natural person, including, by way of illustration and not limitation, name, date of birth, patient identifier, tax or social security identifiers, biometric data, and the other fields contained in the DICOM metadata of each Study.

Data Subject Rights. The rights that the applicable personal data protection legislation in each jurisdiction recognizes to the data subject with respect to their personal data, including, in Mexico, the ARCO Rights (Access, Rectification, Cancellation, and Opposition) provided for in the Federal Law on the Protection of Personal Data Held by Private Parties ("LFPDPPP") and, in other jurisdictions, the analogous rights provided for in their respective laws.

Development. Additional programming, configuration, or customization work that EDEN performs to adapt EDEN SUITE to the Client's specific needs, the scope, deliverables, schedule, and consideration of which are documented in a Commercial Proposal or specific addendum.

Documentation. The user manuals, technical guides, functional specifications, operational guidelines, and other technical documents that EDEN publishes or makes available regarding EDEN SUITE.

EDEN. The commercial name under which Higia, Inc. and its subsidiaries and related entities operate, jointly or individually, as identified in the specific Commercial Proposal.

EDEN SUITE. EDEN's software platform, composed of the following modules: (a) EDEN PACS: system for the visualization, storage, transfer, and management of medical images; (b) EDEN MANAGEMENT: RIS system for the administration of workflows, schedules, orders, and reports; (c) EDEN INTELLIGENCE: information layer, usage metrics, data visualization, and analytics; (d) EDEN CREATOR: assistant supporting the drafting of conclusions, without interpreting images or issuing diagnosis or recommendations, which does not replace the physician; (e) AI REPORT: drafting agent that transforms the User's dictation or text into structured report drafts, under the physician's exclusive review and control, the release of which requires human signature, and which is provided "as is" and "subject to availability"; (f) EDEN AI: diagnostic support module that runs AI Models on DICOM Studies pursuant to Processing Rules to highlight possible findings, without replacing clinical judgment or releasing the professional from their responsibility; and (g) EDEN PORTAL: web module accessible via URL, intended for patients to consult their centralized record, with a mobile DICOM viewer for the visualization of medical images. The specific composition licensed to each Client is identified in the Commercial Proposal.

Execution. Each occasion on which EDEN AI automatically processes a DICOM Study that complies with the active Processing Rules, applying the corresponding AI Model and recording the event in the Audit Records.

DICOM Study or Study. Set of digital medical images and their metadata header, stored in accordance with the DICOM standard, originating from any modality (DX, CR, CT, MR, US, among others).

Specialty Studies. Medical examinations performed outside the scope of radiology and imaging, when integrated into EDEN SUITE through an electronic document or file representative of the study.

Excess Studies. The Studies processed or uploaded by the Client during a Contract Year in excess of the Annual Package applicable to the respective module, according to the parameters set forth in the Commercial Proposal.

Included Studies. The Studies comprised within the Annual Package applicable to the respective module pursuant to the Commercial Proposal.

Start Date. Date indicated as such in the Commercial Proposal, from which the provision of the service begins and, unless the Commercial Proposal provides otherwise, the billing of the periodic consideration.

Confidential Information. The information, data, or documents shared between EDEN and the Client that, by their nature, context, or by express designation, must be kept secret pursuant to Clause 14.

Dissociated Information. Information that, as a result of a prior procedure of dissociation, anonymization, or irreversible pseudonymization, cannot be associated with an identified or identifiable data subject, under the applicable personal data protection legislation.

Validated Report. Report that, after comprehensive human review, is approved and signed by an Authorized User with the required professional standing; only the Validated Report may be released or communicated to third parties.

Integration. Efforts and work aimed at making EDEN SUITE interact correctly with other systems, modalities, or platforms of the Client or third parties.

Applicable Jurisdiction. The jurisdiction of the country where the Client has its principal domicile, or the one expressly identified in the Commercial Proposal, without prejudice to the choice of substantive law and forum provided for in Clause 36.

Model or AI Model. Artificial intelligence algorithm trained to highlight possible findings in a type of DICOM Study defined by Processing Rules.

Activated AI Module. Each artificial intelligence module with respect to which activation, annual package, consideration, and price per excess study have been agreed in the Commercial Proposal.

Missing Persons Search Regulations. The set of provisions that each jurisdiction imposes on private healthcare service providers regarding the registration, interconnection, and handling of inquiries about disappeared or unidentified persons, including, in Mexico, the General Law on the Matter of Forced Disappearance of Persons, Disappearance Committed by Private Parties, and the National Search System for Persons and its complementary provisions, as well as the analogous laws and mechanisms in force in the other jurisdictions where the Client operates.

Cloud or EDEN Cloud. Set of computing, storage, network, and service resources managed by EDEN on third-party infrastructure—currently provisioned on Amazon Web Services ("AWS")—in which EDEN SUITE and its modules reside and operate, including backup and recovery mechanisms. It comprises environments controlled by EDEN in one or several regions defined by it, with encryption of data in transit and at rest, high availability, and operational continuity, with AWS acting as a sub-processor pursuant to Clause 13.

Patient or Portal End User. The natural person who is the holder of the medical study and accesses EDEN PORTAL to consult their record, according to the specific terms of use of the portal.

Annual Package. Maximum number of Studies comprised within the periodic consideration for the respective module during a Contract Year, as established in the Commercial Proposal.

Commercial Proposal. The written instrument—referred to interchangeably as Commercial Proposal, Quotation, Purchase Order, Service Sheet, or equivalent—signed by the Client that identifies the obligated EDEN entity, the specific economic, commercial, and operational conditions, the scope of the contracted services, and which incorporates these Terms by reference.

Audit Records. Unalterable electronic records that set forth User, date and time, Study identifier, template version, generation, editing, and signature events, result of Executions, and cryptographic seal. Their retention period is that established in Clause 9.6.

Processing Rules. Set of filters on the DICOM Tags (metadata), for example Modality, Body Part Examined, or View Position, configured by EDEN together with the Client to determine which Studies each AI Model will be applied to.

Router. Hardware provided by EDEN, where applicable pursuant to the Commercial Proposal, on which the applications necessary to allow interaction between EDEN SUITE, which resides in the Cloud, and the Client's equipment at each Site are run.

Site. Each physical location of the Client where EDEN SUITE is deployed, installed, or used, pursuant to the Commercial Proposal.

AI Suggestions. Textual outputs or markers generated by AI functionalities from the User Content and Study metadata; they do not constitute diagnosis or clinical recommendation.

Subjects. Collectively, the Client, the Authorized Users, the Visitors, the Patients, and any other person who accesses or uses EDEN SUITE or its digital channels.

User or Authorized User. Natural person registered by the Client with valid credentials to access EDEN SUITE, in accordance with the enabled profiles and roles.

Term. The period during which the Client is obligated to receive and pay for the contracted services, in accordance with the provisions of the Commercial Proposal.

Visitor. Any person who accesses EDEN's public website, its informational content, or its digital channels without holding Authorized User credentials.

3. Subject Matter

3.1 These Terms govern: (a) the non-exclusive, non-transferable, non-sublicensable, revocable, and limited license that EDEN grants to the Client over EDEN SUITE, pursuant to the Commercial Proposal; (b) the obligations, rights, and limitations applicable to the Subjects; (c) the regime for the treatment of information, personal data, and intellectual property; (d) the rules of liability, indemnification, support, service levels, termination, and any other related matter; and (e) cooperation with authorities in matters of health, data protection, identification of persons, and other applicable regulations.

3.2 EDEN SUITE is a technological tool to support the healthcare professional. Under no circumstances does it constitute, nor may it be considered, an autonomous clinical decision-making device. Any decision, diagnosis, treatment, or report requires the supervision, review, and human signature of the qualified professional.

4. Contracting Model and Incorporation by Reference

4.1 The specific economic, commercial, and operational terms—including, by way of illustration, the contracting EDEN entity, the licensed modules, the Annual Package of each module, the annual and total value of the contract, the fixed monthly payment, the price per excess study, the Term, the Sites, the payment schemes, the early-payment discounts, the currency, the payment terms, the default interest, the implementation costs, service policy, training, developments, integrations, on-site support, and migrations, and any other monetary parameters—are documented exclusively in the Commercial Proposal. These Terms do not incorporate figures.

4.2 The signing of the Commercial Proposal by the Client entails full adhesion to these Terms and acceptance of the economic and operational parameters set forth therein. Acceptance of the Commercial Proposal may be effected by handwritten signature, advanced electronic signature, simple electronic signature, acceptance by institutional email, or any other suitable means in accordance with applicable legislation.

4.3 Nature of the Consideration. The consideration agreed in the Commercial Proposal remunerates the availability, reserved capacity, and maintenance of the service by EDEN, and not the actual consumption of Studies by the Client. Consequently, the periodic considerations accrue and are payable by the mere passage of the billing period, regardless of the number of Studies the Client processes or uploads.

4.4 No Accumulation. The Studies Included in the Annual Package of each module are not accumulable to subsequent Contract Years, are not refundable in the event of lower consumption, nor transferable to other modules, Sites, or related entities of the Client, unless expressly agreed otherwise in the Commercial Proposal.

4.5 Risk Allocation. The Client acknowledges and accepts that this economic model reflects: (a) the nature of the service as a reserved-capacity license, and not as a consumption-metered service; (b) the fixed costs EDEN incurs in infrastructure, third-party licensing, and personnel assigned to the Client's operation; and (c) an equitable and proportional allocation of risks between the Parties, in accordance with the contractual freedom among merchants recognized by applicable law, including Article 78 of the Mexican Commercial Code and its analogues in the other jurisdictions.

4.6 Excess Studies. The billing of Excess Studies, as well as the activation of the contractual adjustment procedure due to structural growth of the Client's operation, shall be governed by the parameters, thresholds, and prices set forth in the Commercial Proposal. The mere activation of the adjustment procedure does not confer on the Client a right of early termination nor suspend its payment obligations, which subsist in full.

4.7 Periodic Price Review. EDEN may periodically review the considerations in accordance with the mechanism, thresholds, and formulas indicated in the Commercial Proposal. In the absence of an express mechanism, EDEN may review the considerations every twelve (12) months based on the consumer price index published by the competent statistical authority of the Applicable Jurisdiction, or on the variation of the exchange rate between the local currency and the United States dollar, with the higher adjustment prevailing. Any renegotiation due to extraordinary economic circumstances shall be governed by the corresponding clause of the Commercial Proposal or, failing that, by the principles of good faith and contractual balance.

4.8 Taxes and Withholdings. The agreed considerations do not include applicable indirect taxes, which shall be billed in addition in accordance with current tax legislation. Each Party shall be responsible for its own direct tax obligations. If the applicable tax regulations require the Client to make withholdings, the Client shall remit them to the corresponding authority and deliver the receipts to EDEN; the net amounts actually received by EDEN shall be deemed fulfilled for purposes of the payment obligation, without EDEN having to assume increases for gross-up.

4.9 Default. Failure to meet the payment term set forth in the Commercial Proposal shall generate default interest in accordance with the percentage indicated therein or, failing that, in accordance with the highest rate permitted by applicable legislation. Without prejudice to the other consequences provided for in these Terms, EDEN may: (a) from the sixteenth (16th) calendar day of default, place visual resources within EDEN SUITE as a reminder of the obligation; (b) from the thirty-first (31st) calendar day of default, block access to EDEN SUITE, without prejudice to the other legal actions that may apply.

5. Territorial Scope, Contracting Entity, and Applicable Jurisdiction

5.1 Territorial Scope. These Terms govern the relationships between EDEN and the Subjects in all jurisdictions where EDEN provides its services, including, by way of illustration and not limitation, Mexico, Ecuador, Chile, Peru, the Dominican Republic, and other countries of Latin America where EDEN has present or future operations.

5.2 Contracting Entity. The specific legal entity of the EDEN group obligated to the Client is identified in the respective Commercial Proposal. When the Commercial Proposal does not identify a specific entity, the obligated entity shall be the one maintaining the dominant commercial relationship with the Client or, failing that, Higia, Inc., in its capacity as parent.

5.3 Recognition of Public Policy Rules. The Client and EDEN acknowledge and accept that, notwithstanding the choice of substantive law provided for in Clause 36, the public policy rules in force in the Applicable Jurisdiction—particularly those relating to personal data protection, consumer rights where applicable, health regulation, labor rights of the Client's personnel, search for and identification of persons, and the Client's tax obligations—shall prevail over these Terms to the extent strictly necessary to preserve such public policy. The remainder of the clauses shall retain their full effectiveness.

6. Universe of Subjects

6.1 Client. The natural or legal person identified as such in the Commercial Proposal. The Client is liable to EDEN for the full compliance with these Terms, including for the acts or omissions of its Authorized Users, contractors, and personnel in its service who access or use EDEN SUITE.

6.2 Authorized User. Each natural person registered by the Client with valid credentials. The Authorized User undertakes to: (a) comply with these Terms and the Documentation; (b) use EDEN SUITE exclusively for lawful and professional purposes; (c) safeguard their credentials with diligence, without sharing, transferring, or allowing their use by third parties; (d) comply with the applicable confidentiality and professional secrecy obligations; (e) exercise at all times their autonomous professional judgment regarding the result of the AI functionalities; and (f) immediately notify the Client and EDEN of any improper access, breach, or suspected compromise of credentials.

6.3 Visitor. Any person who accesses EDEN's public website without credentials. The Visitor undertakes to: (a) refrain from using automated data extraction techniques, scraping, reverse engineering, or any act that compromises the security or integrity of the site; (b) respect the intellectual property over the published content; and (c) acknowledge that the information available on the public site is of a general informational nature and does not constitute medical, legal, tax, or any other professional advice.

6.4 Patient or Portal End User. The natural person who is the holder of the medical study and accesses EDEN PORTAL. The Patient's access to the portal is governed supplementarily by these Terms as applicable to them and, principally, by the specific terms of use of EDEN PORTAL and by the privacy notice of the Client providing the healthcare service. EDEN acts exclusively as a provider of the technological tool and not as a provider of the healthcare service.

6.5 Functional Solidarity. The Client shall be liable to EDEN for the acts, omissions, or breaches of the Authorized Users it has registered or authorized, as well as for improper access to EDEN SUITE arising from the inadequate management of credentials or the failure to timely notify deactivations or changes.

7. License of Use

7.1 EDEN grants the Client a license with the following characteristics: non-exclusive, non-transferable, non-sublicensable, revocable, limited, and onerous, to access and use EDEN SUITE online, through the channels enabled by EDEN, by means of Authorized Users' credentials, exclusively for the lawful and professional purposes that are the subject of the contract, during the Term and subject to timely payment of the considerations.

7.2 Scope. The license comprises exclusively: (a) access to and use of EDEN PACS within the contracted Annual Package; (b) access to and use of each Activated AI Module within its respective Annual Package; and (c) the use of the other contracted modules pursuant to the Commercial Proposal and the Documentation. Use by the Client's related entities, affiliates, branches, or different third parties shall require an additional license.

7.3 Restrictions. The Client and the Authorized Users shall refrain from: (a) copying, modifying, translating, disassembling, decompiling, reverse engineering, or creating derivative works of EDEN SUITE; (b) assigning, leasing, lending, sublicensing, marketing, distributing, or making EDEN SUITE available to third parties; (c) removing intellectual property notices; (d) interfering with the operation of EDEN SUITE, circumventing security mechanisms, or using it for unlawful purposes; (e) using EDEN SUITE for purposes other than those provided for herein; (f) using data generated or available through EDEN SUITE to train artificial intelligence models of their own or of third parties without EDEN's express authorization; and (g) performing load, penetration, or security tests without EDEN's prior written authorization.

8. EDEN's Obligations

8.1 EDEN shall make available to the Client the Software Updates and the Documentation necessary for the use of EDEN SUITE, as well as the initial training comprised in the contracted implementation. EDEN retains the right to market EDEN SUITE with third parties without this implying a breach.

8.2 EDEN warrants that EDEN SUITE will be free of material defects in its construction, and that the support materials will be free of defects in materials and workmanship. This warranty does not apply if the malfunction is due to accidents, abuse, improper or negligent use by the Client's Subjects, or breach of the technical prerequisites.

8.3 With respect to the modules with artificial intelligence functionalities (EDEN CREATOR, EDEN AI, and AI REPORT), EDEN assumes no warranties of clinical performance or results; its obligation is limited to reasonable technical availability, the security of processing, and the timely correction of software failures.

8.4 EDEN shall provide general support through the channels defined in EDEN SUITE, with the hourly coverage stipulated in Clause 22. The response and resolution times, priorities, reception hours, and exclusions are governed by Clause 20 (Service Level Agreement). EDEN does not offer support for configurations or problems with the Client's medical image printing or acquisition equipment.

8.5 EDEN's obligations do not comprise the compliance, on behalf of the Client, with regulatory, health, or data protection obligations that applicable regulations directly impose on the Client in its capacity as healthcare service provider or as data Controller.

9. Client's Obligations

9.1 Technical Prerequisites. The Client undertakes to ensure that the use of EDEN SUITE is carried out exclusively on equipment and environments that comply, as a minimum, with the technical conditions that EDEN publishes in its Documentation, including, by way of illustration: minimum computing, memory, storage capacities, stable and sufficient symmetrical connectivity, compatible operating system, and monitors adequate to the clinical use for which they are intended. The primary diagnostic interpretation workstations used by radiologists must have certified medical-grade monitors, with the minimum resolution required by local regulation for each modality, and comply with DICOM Part 14 calibration.

9.2 Institutional Responsibility. The Client shall be responsible for: (a) using and maintaining appropriate and calibrated monitors according to the type of workstation and applicable local regulation; (b) ensuring that diagnostic quality is consistent with best practices; and (c) complying with all current health regulations. The Client acknowledges that the quality of the diagnosis depends on the quality and calibration of the monitor used.

9.3 Go-Live and Initial Training. The Client undertakes to schedule and complete the go-live of EDEN SUITE and the initial training program within the periods set forth in the Commercial Proposal. After the periods have elapsed without the go-live having been completed for reasons attributable to the Client, EDEN—after notice with at least forty-eight (48) hours' advance notice to the declared email address—shall commence billing, without prejudice to the payment of reasonable fees for rescheduling.

9.4 Own Regulatory Compliance. The Client undertakes to comply with all laws, regulations, rules, and official standards applicable to the professional practice of medicine, radiology and imaging, and the provision of healthcare services in the Applicable Jurisdiction, including, without limitation, the general health laws, the clinical record standards, the personal data protection laws (including, in Mexico, the LFPDPPP; in Chile, Law 19.628 and its amendments; in Peru, Law 29733; in Ecuador, the LOPDP; in the Dominican Republic, Law 172-13; and their respective regulations), and the Missing Persons Search Regulations pursuant to Clause 16.

9.5 Ownership of Information. The Client is the sole and exclusive owner of and responsible for the information generated or acquired through EDEN SUITE, including the information of its employees, physicians, and patients. EDEN acts solely as Processor under the applicable personal data protection legislation.

9.6 Retention of Information. The information of the Studies and Specialty Studies shall be stored and protected in the EDEN Cloud for a period of no less than ten (10) years, except as provided in Clause 14 on dissociation and in Clause 21 on cold storage. The Audit Records shall be retained for the same period.

9.7 Metadata and Templates. The Client shall be responsible for the truthfulness, sufficiency, and quality of the DICOM metadata, as well as for the maintenance of the templates and terminology used in AI REPORT and EDEN CREATOR.

9.8 Electrical and Environmental Infrastructure. Where applicable pursuant to the Commercial Proposal, the Client undertakes to provide, install, and keep operational, at each Site where a Router or other EDEN equipment is installed: an uninterruptible power supply system with sufficient autonomy, voltage regulator, surge suppressor, physical ground with reasonable resistance, and dedicated electrical circuit; as well as to install the Router in a space with adequate ventilation, without exposure to direct sunlight, excessive dust, or humidity. EDEN may request evidence of compliance.

9.9 Identifying Data. The Client shall be the sole party responsible for the capture, quality, truthfulness, sufficiency, updating, and consistency of the Identifying Data contained in the DICOM metadata and other patient fields uploaded to EDEN SUITE. EDEN does not standardize, validate, clean, or normalize such Identifying Data, nor does it assume responsibility for the consequences arising from its insufficiency, inaccuracy, heterogeneity, or lack of updating, including those before the authorities in matters of search for and identification of persons.

9.10 Anti-Corruption and Sanctions Compliance. The Client undertakes to act in accordance with applicable laws on the prevention of money laundering, terrorist financing, anti-corruption, and international sanctions, using exclusively funds from lawful sources to fulfill its obligations under these Terms.

10. User Designation and Account Management

10.1 The Client shall designate and notify EDEN in writing of at least one Administrative Officer—and the additional backup administrators it deems necessary—for the management and administration of EDEN SUITE on its behalf, indicating the full name and institutional email address of each.

10.2 Only the Administrative Officer, and where applicable the authorized administrators, may request EDEN to add or remove Users. It shall be the Client's responsibility to ensure that every registered person has the authorization and authority necessary to exercise the functions arising from their access.

10.3 The Client shall keep the data of the Administrative Officer and additional administrators updated, notifying EDEN of any change within three (3) business days following its occurrence.

10.4 EDEN shall not be liable for damages, claims, or losses arising from the improper access to the platform by Users registered at the request of the Client or the Administrative Officer. Any access, action, or omission by such Users shall be understood as attributable to the Client.

10.5 The credentials are personal, non-transferable, and for individual use. The Client shall adopt reasonable security and supervision measures to prevent access by malicious or unauthorized Users, including robust password policies, multi-factor authentication when available, and periodic review of accesses.

10.6 The Administrative Officer shall serve as EDEN's single point of contact for notifications, requirements, and communications arising from the Missing Persons Search Regulations pursuant to Clause 16, and as a valid recipient for any notification that EDEN directs to the registered institutional email.

11. Artificial Intelligence Modules

11.1 Nature. The Activated AI Modules form an integral part of the contracted license. The economic terms of each Activated AI Module are governed exclusively by the Commercial Proposal.

11.2 Configuration of Processing Rules. Prior to the start of EDEN AI operation, the Parties shall define in writing the Processing Rules applicable to each AI Model. The Client shall provide representative Study examples and shall be responsible for its images containing complete and truthful metadata. Any subsequent change to the Rules must be documented and shall take effect when EDEN confirms its technical application.

11.3 AI REPORT: Mandatory Human Signature. No content generated by AI REPORT may be released or communicated to third parties without the approval and human signature of an Authorized User with the required professional standing; only thus shall it have the character of a Validated Report. AI REPORT does not interpret images or issue diagnosis or recommendations; it is a tool to support the medical professional.

11.4 Templates and Terminology. The Client shall define and maintain its templates, mandatory fields, and standardized terminology; EDEN is not responsible for their clinical suitability.

11.5 Calculation Basis and Commercial Activation. The calculation basis of the Annual Package of the AI Modules, the initial evaluation period, the commercial activation mechanisms, and the effects of the Client's silence at the end of the evaluation period are governed by the Commercial Proposal. In the absence of an express rule, the Client's silence at the end of the evaluation period shall operate as a rejection of the activation proposal and shall give rise to the deactivation of the respective module at no cost or penalty.

11.6 Quality and Editing. The Client shall review and edit all content generated by the AI functionalities before its signing or release. EDEN does not warrant the absence of errors, omissions, or inconsistencies in the AI Suggestions.

11.7 Availability. The AI functionalities are provided "as is" and "subject to availability," without warranties of clinical performance or results.

11.8 Traceability. EDEN shall retain versions, edits, approvals, and signature in the Audit Records for the period provided in Clause 9.6.

12. Health Compliance and Prohibited Uses

12.1 EDEN SUITE and its AI modules are tools to support the medical professional and do not replace the clinical judgment or the professional responsibility of the Client and its Users. The Client undertakes to use EDEN SUITE in compliance with the health legislation applicable to its Jurisdiction, including, without limitation: the General Health Law and NOM-004-SSA3-2012 in Mexico, as well as the analogous health laws and technical standards in each jurisdiction where it operates; the regulations of the competent health authorities; and the Missing Persons Search Regulations pursuant to Clause 16.

12.2 Prohibited Uses. EDEN SUITE and its AI modules are not authorized, nor shall they be used: (a) as an autonomous clinical decision-making device; (b) for diagnosis or treatment without human review, supervision, and signature; (c) in contravention of the Documentation or good clinical practices; (d) for clinical research purposes with human subjects without the authorizations and ethics committees required by applicable legislation; (e) for the processing of information of minors without the safeguards required by law; and (f) for any purpose contrary to law, morality, or good customs.

13. Information Security, Sub-Processors, and Transfers

13.1 EDEN shall maintain reasonable and proportional technical, administrative, organizational, and physical measures to protect the data processed through EDEN SUITE, including role-based access controls, encryption in transit and at rest, cryptographic key management, audit records, vulnerability management, backup, and periodic testing. EDEN shall review such measures as the state of the art evolves.

13.2 Sub-Processors. EDEN may rely on providers and sub-processors, including Cloud infrastructure providers (currently AWS) and complementary services (monitoring, telemetry, authentication). EDEN shall require its sub-processors to maintain security measures substantially equivalent to its own and shall be liable for their acts or omissions on the same terms on which it is liable for its own, subject to the caps and exclusions of Clause 18.

13.3 Cross-Border Transfers. The Client acknowledges and accepts that the processing may involve cross-border transfers in accordance with the architecture of the EDEN Cloud, observing the applicable legal bases (including contractual necessity and obligations with the authorities) and maintaining equivalent security measures. The Client, in its capacity as Controller, shall reflect such transfers in its privacy notice or equivalent instrument in accordance with the legislation of its jurisdiction.

13.4 Incident Notification. The Client shall notify EDEN, within a reasonable time, of any security incident of which it becomes aware and that affects the information processed in EDEN SUITE, collaborating in its containment and investigation. EDEN shall notify the Client of material security incidents that affect its data, within reasonable periods in accordance with the nature of the event and applicable regulations. The requirements of authorities in matters of search for and identification of persons do not, by themselves, constitute security incidents for purposes of this Clause.

14. Confidentiality and Personal Data

14.1 Confidentiality. The Subjects may only disclose Confidential Information to persons with a justified need to know it in order to fulfill the obligations arising from these Terms, provided that such persons are subject to an equivalent confidentiality obligation. Any disclosure in contravention shall generate liability for the damages caused. No copies of Confidential Information shall be made without the prior consent of the party that provided it. If an authority requests Confidential Information, the requested party shall notify the other and shall deliver only the requested information, doing what is reasonably possible to protect its confidentiality.

14.2 Confidential Information is considered an industrial secret protected by industrial property laws and other applicable laws. The confidentiality obligations shall subsist indefinitely or, failing that, for the maximum period permitted by applicable legislation.

14.3 Processing of Personal Data. When exchanging personal data, the parties must obtain them lawfully and comply with the legislation in force in the Applicable Jurisdiction, ensuring the integrity and quality of the personal data and maintaining sufficient security measures to protect them against damage, loss, alteration, destruction, or unauthorized use.

14.4 Patient Consent. The Client, whether treating physician or hospital or clinical institution, acknowledges and accepts that EDEN, in its capacity as software provider and Processor, has no direct responsibility nor the capacity to obtain the express and informed consent of patients for the processing of sensitive personal data. Such consent—including the explicit acceptance of data processing—must be managed by the Client, in accordance with medical lex artis and with full adherence to applicable regulations, including legal exceptions.

14.5 Privacy Notice. EDEN maintains its privacy notice available at legal.edenmed.com. Each party shall keep available its respective privacy notice and applicable privacy documentation. The Client shall update its privacy notice to reflect the transfers to EDEN and its sub-processors, the applicable legal bases, and the relevant legal exceptions.

14.6 Data Subject Rights. The Client, in its capacity as Controller, shall directly attend to requests for the exercise of Data Subject Rights. EDEN shall reasonably cooperate with the Client, in its capacity as Processor, to attend to such requests to the extent technically and operationally feasible.

14.7 Sending of Results through Digital Channels. EDEN may send Study results via instant messaging, QR codes, or unique links, using the contact information provided by the Client and by the User who is the holder of the data in the context of the clinical relationship. Such results are transmitted using reasonable encryption and security mechanisms, with unique links that function in practice as access credentials. Any disclosure or sharing of such links is carried out under the exclusive responsibility of whoever shares them.

14.8 Delivery upon Termination. Upon termination of the relationship, EDEN shall deliver to the Client the information of its property and of third parties that it holds in custody, in accordance with the Outbound Data Migration procedure of Clause 25.

15. Dissociation, Service Improvement, and Model Training

15.1 The Parties acknowledge that EDEN may, to the extent permitted by applicable law, subject the information processed through EDEN SUITE to a prior procedure of dissociation, anonymization, or irreversible pseudonymization, resulting in Dissociated Information. Once generated in accordance with these Terms and applicable law, EDEN may use the Dissociated Information for legitimate purposes of research, development, analysis, quality assurance, improvement of functionalities, cybersecurity, generation of metrics, and training or evaluation of its own AI Models and components, without such use having the purpose of identifying any person.

15.2 EDEN shall implement and maintain reasonable and proportional technical, administrative, and physical measures to: (a) minimize the information used by its AI services; (b) ensure the logical separation of domains between EDEN SUITE and the AI modules; (c) protect the information during any phase of processing, including the dissociation process; and (d) reduce risks of re-identification, unauthorized access, leakage, or inference.

15.3 EDEN shall not attempt to re-identify the Dissociated Information nor allow third parties to do so; it shall contractually prohibit re-identification to its sub-processors and authorized providers. If EDEN reasonably determines that a data set does not comply, or has ceased to comply, with the standard of Dissociated Information, it shall treat it as personal data under applicable law and apply the corresponding controls, including, where appropriate, its blocking, suppression, or re-dissociation.

15.4 The Parties acknowledge that, in accordance with applicable law, the consent of data subjects is not required for processing when the personal data have been previously subjected to an irreversible dissociation procedure. Consequently, the Client may not require EDEN to obtain data subjects' consent for the purposes established in this Clause with respect to Dissociated Information; without prejudice to each party remaining responsible for its own information, legal basis, and consent obligations, where applicable, with respect to the identifiable personal data under its control.

15.5 EDEN may generate aggregated, statistical, or synthetic information derived from Dissociated Information, provided that it does not allow identifying any person.

16. Cooperation regarding the Missing Persons Search Regulations

16.1 Regulatory Framework and Role of the Parties. The Parties acknowledge that the Missing Persons Search Regulations in force in each jurisdiction—including, in Mexico, the General Law on the Matter of Forced Disappearance of Persons, Disappearance Committed by Private Parties, and the National Search System for Persons, and the Guidelines, Technical Manuals, and administrative provisions issued by the competent authorities—create obligations of registration, interconnection, and handling of inquiries for private parties that provide healthcare services and administer databases with Identifying Data. The Client is the Controller of the processing; EDEN acts exclusively as Processor and software provider.

16.2 Transfer of Substantive Responsibility. The Client, in its capacity as Controller and healthcare service provider, shall be the sole party obligated to substantive compliance with the Missing Persons Search Regulations, including: (a) determining whether the registration obligation before the corresponding identification platforms or systems applies to it and, where appropriate, requesting and keeping it in force; (b) processing and retaining the corresponding access credentials and authentication means; (c) attending to the requirements of the competent authorities, within the periods and formats required; (d) updating its privacy notice and its legal bases to reflect the legal exception of processing without consent, where applicable; and (e) responding before the authority for the integrity, truthfulness, sufficiency, and updating of the Identifying Data uploaded to the system.

16.3 Basis for the Transfer. The Parties expressly acknowledge and accept that: (a) the DICOM metadata and the Identifying Data residing in EDEN SUITE are captured, uploaded, or supplied by the Client and its Users, without EDEN having control over their content, structure, coding criteria, or truthfulness; (b) the practice of the Client and of the industry regarding patient identifiers is heterogeneous and variable, so the data are not homogenized or standardized at the EDEN SUITE level; (c) consequently, EDEN lacks the material and legal capacity to directly execute comprehensive searches, selective queries, substantive validations, or responses to the authority without specific instructions and operational support from the Client; and (d) this transfer is fully analogous to that provided for with respect to patient consent, since EDEN, as software provider and Processor, is not the appropriate party to directly assume the obligation before the data subject or before the authority.

16.4 EDEN's Cooperation. Without prejudice to the substantive transfer, EDEN shall reasonably cooperate with the Client to: (a) attend to written and specific instructions aimed at its compliance; (b) provide technical information under its control about the storage structure and the relevant DICOM metadata fields; (c) enable, subject to prior quotation and pursuant to Clause 24, the Developments or Integrations necessary for the Client to interconnect directly with the corresponding identification platform or system, or to do so through the homologated provider of its choice; and (d) where applicable, facilitate the specific extraction of information pursuant to Clause 25. EDEN shall not act as operator, intermediary, representative, or interlocutor of the Client before the authorities, nor shall it assume technical, operational, or regulatory obligations before the authority on behalf of the Client.

16.5 Direct Requirements to EDEN. If EDEN receives a requirement, summons, notification, official letter, or other communication from an authority related to the Missing Persons Search Regulations involving the Client's data, EDEN: (a) shall notify the Client within a reasonable time, unless the legal provision itself or the authority expressly prohibits such notification; (b) shall attend to the request, limiting itself strictly to what is expressly required and to what it is technically and legally in a position to provide; and (c) where the regulations permit, shall coordinate the response with the Client.

16.6 Indemnity. The Client shall hold EDEN harmless and keep it free and safe from any fine, sanction, claim, expense, or liability arising from: (a) the Client's breach of the obligations provided for in this Clause or in the Missing Persons Search Regulations; (b) the insufficiency, inaccuracy, heterogeneity, or lack of updating of the Identifying Data uploaded by the Client or its Users; or (c) the determination by a competent authority that the Client should have provided substantive compliance with the obligation and did not do so. This indemnity shall not apply to sanctions imposed on EDEN for proven willful misconduct or gross negligence in its own obligations as Processor.

16.7 Costs. Any development work, technical integration, data export or extraction, or professional services that the Client requires from EDEN to comply with the Missing Persons Search Regulations shall be quoted and billed independently in accordance with the corresponding Commercial Proposal or addendum.

17. Intellectual Property

17.1 EDEN and its licensors retain all rights over EDEN SUITE and its modules, as well as over the software program, source and object code, Models, algorithms, parameters, Documentation, interfaces, designs, databases, and technical know-how, and over the trademarks, trade names, and other distinctive signs of EDEN.

17.2 The Client retains ownership of the Studies, the User Content, the data and metadata it incorporates into EDEN SUITE, and the Validated Reports generated under its review and signature. The Client's trademarks, trade names, and distinctive signs are and shall remain its exclusive property.

17.3 The license is granted solely as a non-exclusive, non-transferable, revocable license without the right to sublicense, for the term of the contract and in accordance with its purpose. These Terms do not assign or transfer any intellectual property.

17.4 The AI Suggestions and the drafts generated by EDEN CREATOR and AI REPORT are for the Client's internal use in the preparation of Validated Reports; as long as there is no human signature, they do not confer additional rights nor may they be released to third parties. The automated generation and the underlying models do not confer on the Client any right over the software program or over the models.

17.5 The Client grants EDEN a non-exclusive, worldwide, perpetual, irrevocable, and free license to use the feedback, comments, and improvement suggestions it provides, for purposes of refining the service, without disclosing Confidential Information or identifiable personal data.

17.6 The Client shall refrain from copying, modifying, translating, disassembling, decompiling, reverse engineering, or creating derivative works; it shall not remove intellectual property notices or circumvent security measures; it shall not assign, lease, sublicense, or make EDEN SUITE available to third parties without EDEN's prior written authorization.

17.7 Third-Party Components and Open Source. Certain functionalities may incorporate third-party or open-source software programs subject to their own licenses; their use does not imply transfer of ownership to the Client; EDEN shall make available the applicable notices where appropriate.

17.8 Notification of Infringements. The Parties shall notify each other without delay of any alleged infringement relating to EDEN SUITE; EDEN may, at its discretion, attend to, defend, or settle such claims, without this implying acknowledgment of liability towards the Client.

17.9 Advertising Use. The Client authorizes EDEN to use its trade name and logo for advertising purposes linked to EDEN SUITE, respecting quality standards and without modifications to the signs. This authorization shall be in force during the life of the contract and may be revoked by the Client with thirty (30) calendar days' prior notice, in which case EDEN shall cease the use in digital media immediately and in printed materials from the next reasonable reprint.

18. Limitation of Liability

18.1 To the maximum extent permitted by applicable law, and except as expressly provided in these Terms, EDEN shall not be liable, under any circumstances, for indirect, incidental, special, punitive, exemplary, or consequential damages, including, without limitation, loss of opportunities; loss of profits, income, or anticipated savings; business interruption; loss, corruption, or restoration of data; or costs of substitute goods or services, arising from or related to the use or the inability to use EDEN SUITE.

18.2 Liability Cap. EDEN's total cumulative liability to the Client for any claim arising from or related to these Terms, EDEN SUITE, or any of its modules (including EDEN CREATOR, EDEN AI, and AI REPORT), whether for contractual, tort, strict, or any other type of liability, shall not exceed, in the aggregate, the amount equivalent to three (3) months of considerations invoiced and actually paid by the Client to EDEN during the twelve (12) months immediately preceding the date of the first written notice of the claim to EDEN pursuant to Clause 32. If at the date of the claim twelve (12) months of billing have not been completed, the cap shall be calculated based on the average monthly amount invoiced and actually paid, multiplied by three (3). The foregoing shall not apply to: (a) damages caused by EDEN's willful misconduct or gross negligence; or (b) cases that, under applicable law, cannot be limited or excluded.

18.3 For clarity: (a) EDEN SUITE, including its AI modules, is a technological support tool and does not replace the professional, clinical, or medical judgment of the Client or its Users; (b) the Client is the sole party responsible for the decisions, interpretations, and actions arising from its use; and (c) EDEN shall not be liable for failures, errors, or delays attributable to services, data, systems, or third parties beyond its control (including infrastructure, telecommunications, or Client integration providers), nor for the use of EDEN SUITE in contravention of the Documentation or of good security and operation practices.

18.4 Essential Element. The Client acknowledges and accepts that: (a) the liability cap constitutes an essential element of the negotiation and of the objective basis of the agreement; (b) without such cap, EDEN would not enter into the contract or make EDEN SUITE available to the Client under the economic conditions provided for; (c) the cap reflects a reasonable and proportional allocation of risks in commercial technology transactions among merchants; and (d) to the extent applicable law imposes restrictions, these shall be interpreted in the broadest sense permitted, without affecting the validity of the rest of the Clause. In the event of conflict between this Clause and any other provision, this Clause shall prevail, except in cases not limitable by law.

18.5 Fines and Sanctions of Third Parties. Neither Party shall be obligated to pay the other fines, sanctions, penalties, or charges imposed by third parties, unless: (a) there is a final resolution of a competent authority imposing them on the obligated party; and (b) the corresponding reimbursement or indemnification obligation is expressly provided for in these Terms. In particular, fines or sanctions arising from the Missing Persons Search Regulations shall be governed by Clause 16.6.

19. Indemnity

19.1 EDEN's Indemnity for Intellectual Property. EDEN shall defend the Client against third-party claims alleging that EDEN SUITE infringes intellectual property rights, and shall cover the costs, expenses, and indemnifications to which it is sentenced by final judgment, subject to Clause 18. The requirements shall be: (a) timely written notice to EDEN; (b) control of the defense and negotiation by EDEN; and (c) reasonable cooperation by the Client. There shall be no indemnity obligation when the claim arises from: (i) unauthorized use or use outside the Documentation; (ii) modifications not made by EDEN; (iii) combination with software, data, or equipment not provided by EDEN; or (iv) User Content.

19.2 If the infringement is established or reasonably probable, EDEN may, at its election: (a) obtain a license allowing continued use; (b) modify EDEN SUITE to avoid the infringement; or (c) if neither of the foregoing is reasonable, terminate the contract or the affected part with a prorated refund of prepaid and unaccrued considerations, as the Client's sole and exclusive remedy for this concept.

19.3 Client's Indemnity. The Client shall hold EDEN harmless from any claim, fine, sanction, damage, or expense arising from: (a) improper or unauthorized use of EDEN SUITE by its Users, contractors, or personnel; (b) User Content uploaded to EDEN SUITE; (c) the Client's breach of health, personal data, tax, labor, or any other regulation applicable to its operation; (d) infringement of medical lex artis or errors in clinical decisions; (e) acts or omissions arising from the Missing Persons Search Regulations pursuant to Clause 16.6; and (f) any claim of a Patient or third party arising from the Client's activity or from the provision of the healthcare service.

20. Service Level Agreement

20.1 Committed Availability. EDEN commits to a monthly availability of EDEN SUITE equal to or greater than ninety-nine point five percent (99.5%) (the "Target Level"), measured as the percentage of the total time of the calendar month in which the platform is operational and accessible, excluding scheduled maintenance windows and the events excluded pursuant to this Clause.

20.2 Scheduled Maintenance Windows. EDEN may perform scheduled maintenance with at least forty-eight (48) hours' prior notice, preferably during hours of low operational activity. Scheduled maintenance and emergency maintenance reasonably necessary to preserve the security or integrity of the service do not count for the calculation of availability.

20.3 Classification of Incidents. The incidents reported by the Client are classified by EDEN according to the corresponding priority, taking into account the description and operational impact. The specific response and resolution times are published in the Documentation. Any reclassification must be documented.

20.4 Attribution Rules. An incident shall be considered attributable to EDEN only when the documented root cause resides in: (a) the EDEN SUITE platform; (b) the EDEN Cloud or its sub-processors; (c) configurations or code under EDEN's operational control; or (d) the Router during the initial warranty period. EDEN shall retain sufficient technical traceability to document the root cause of each critical incident and shall make it available to the Client when the Client reasonably requires it.

20.5 Exclusions. Events whose root cause resides in the Client's technical, operational, or third-party ecosystem shall not be considered attributable to EDEN, including, without limitation: (a) changes in the Client's internal network or firewall; (b) loss of connectivity of the site or of any Site; (c) disconnection, shutdown, restart, or relocation of the Client's medical imaging equipment; (d) local configuration changes not previously notified; (e) outages or failures of the Client's PACS, RIS, HIS, or third-party systems; (f) expiration or deficient rotation of local credentials; (g) outages of the Client's VPN or tunnels; (h) saturation or malfunction of local storage; (i) changes in the Client's security policies or controls; (j) failures, outages, or fluctuations of the Client's electrical infrastructure, or breach of Clause 9.8; (k) actions arising from the Missing Persons Search Regulations attributable to the Client; and (l) analogous causes attributable to the Client's ecosystem. Force majeure events pursuant to Clause 28, suspensions for default, regulatory changes, and use in contravention of the Documentation likewise do not count.

21. Cold Storage, Rehydration, and Retention

21.1 EDEN reserves the right to move to cold storage those Studies older than five (5) years.

21.2 Rehydration Times. The Studies moved to cold storage may require a rehydration time of no more than seventy-two (72) hours from the Client's formal request to restore them to hot access.

21.3 SLA Exclusion. The access times to Studies in cold storage and the rehydration process are expressly excluded from the calculation of availability and from the response and resolution times.

21.4 Extended Hot Storage. The Client may request, through a Commercial Proposal or addendum, the extended retention in hot storage of Studies older than five (5) years, subject to prior quotation of the corresponding additional cost.

22. Support

22.1 EDEN shall provide support through the official channels indicated in EDEN SUITE on its website. The reception of reports of critical incidents shall be maintained 24/7/365. For medium- or low-priority incidents, reception shall take place on business days and hours in accordance with the Mexico City time zone (UTC-6), unless the Commercial Proposal provides for other coverage.

22.2 On-Site Support. On-site support is not included in the ordinary considerations. If required, it shall be quoted and billed independently, considering the geographic location of the Site, travel expenses, fees, and administrative costs, in accordance with the Commercial Proposal or specific addendum.

22.3 Exclusion. EDEN does not offer support for configurations or problems with printing equipment, modalities, peripherals, or third-party systems of the Client. If the Client decides not to contract the on-site support recommended by EDEN for the handling of failures that reasonably require physical presence, EDEN shall be released from any liability arising from the lack of such assistance.

23. Router, Hardware, and Infrastructure

23.1 Ownership and Return. When the Commercial Proposal provides for the delivery of a Router, it shall be the property of EDEN and must be returned at the end of the contract, allowing for normal wear and tear. If not done, the Client shall pay the current value of the equipment plus the associated expenses, covered by the bailment agreement (comodato) executed for that purpose.

23.2 Useful Life and Renewal. The estimated technical useful life of the Router is two (2) to three (3) years in accordance with industry standards, without such estimate constituting a warranty of operation for a determined period or an obligation of replacement at no cost beyond the initial warranty period. Once the useful life is exhausted, the renewal shall be the responsibility of the Client, who shall assume the cost of the new equipment at EDEN's current list price. EDEN shall cover at no charge the associated shipping, reinstallation, configuration, and reactivation services when the need for renewal arises from the normal life cycle. In the event of failures attributable to the Client, all costs shall be borne by it.

23.3 Warranty Exclusions. The Router warranty is excluded when the damage, failure, or interruption is a direct or indirect consequence of: (a) breach of the electrical and environmental infrastructure conditions of Clause 9.8; (b) use of extensions, non-industrial power strips, or provisional electrical connections; or (c) modifications, relocations, or manipulations carried out by personnel not authorized by EDEN.

23.4 Connectivity. EDEN SUITE, including the AI Modules, requires connectivity to Cloud services. The unavailability of connectivity or of the Client's provider services may temporarily limit or suspend such functionalities without liability for EDEN.

24. Integrations with Third-Party Systems and Developments

24.1 When EDEN SUITE is integrated with third-party systems (HIS, RIS, third-party PACS, billing systems), the performance, availability, and behavior of such systems are not EDEN's responsibility. The costs of integration, adaptations, licenses, and maintenance of third-party systems are borne by the Client, unless otherwise documented.

24.2 Scope of Support. EDEN provides technical support exclusively over the components under its operational control, including: the EDEN SUITE platform and its modules; the Router and the connectivity between the Site and the Cloud; the configuration of sending, routing, and processing rules within EDEN SUITE; and the integration interfaces (APIs, web services, HL7/FHIR protocols) on EDEN's side.

24.3 Support Exclusions. EDEN assumes no support, configuration, maintenance, or incident resolution responsibility over: hospital information systems (HIS); enterprise resource planning systems (ERP); billing, accounting, or financial administration systems; third-party electronic clinical records; third-party PACS, RIS, or viewers; laboratory systems (LIS); payment gateways; mail, active directory, or third-party authentication servers; medical image acquisition equipment and its firmware; printers, disc burners, or other peripherals; and the identification platforms or intermediate systems contracted by the Client to attend to the Missing Persons Search Regulations.

24.4 Technical Coordination. When the resolution of an incident requires coordinated action between EDEN and a third-party systems provider, EDEN shall collaborate by providing the technical information under its control. The coordination, contracting, and costs of the third-party provider shall be the Client's responsibility.

24.5 Developments and Professional Services. The Developments, Integrations, and additional professional services shall be governed by the Commercial Proposal or signed addendum specifying scope, deliverables, schedule, and prices. Unless expressly agreed, the results and deliverables of the Developments shall be EDEN's intellectual property, which shall license them to the Client under the terms of Clause 17. The acceptance of deliverables shall be deemed tacit if the Client does not submit observations in writing within ten (10) calendar days following their delivery.

25. Inbound and Outbound Data Migration

25.1 Inbound Migration. When the Commercial Proposal provides for Inbound Data Migration, EDEN shall coordinate with the Client the extraction, transfer, and loading to EDEN SUITE of the Studies and associated information from the previous system, in accordance with the scope, volume, schedule, and prices agreed in the Commercial Proposal. The execution is conditioned upon the Client: (a) proving ownership or authority to transfer the migrated information; (b) granting technical access to its source systems; (c) providing the metadata mapping and technical documentation of the source system; and (d) ensuring the integrity of the linkage between images, reports, and metadata. The Inbound Migration is an independent professional service; the amounts invoiced are not refundable in the event of early termination.

25.2 Outbound Migration. The mass extraction of DICOM Studies or other formats due to termination, migration to another provider, or the Client's request constitutes an additional independent professional service, chargeable in accordance with the Commercial Proposal or specific quotation. EDEN shall deliver a formal quotation within ten (10) business days following the Client's written request. The Outbound Migration shall be paid in advance, as a prior condition for the start of the extraction. EDEN shall not be obligated to begin the Outbound Migration while there are unpaid amounts under the contract.

25.3 Times. The Parties acknowledge that the Inbound Migration and the Outbound Migration require case-by-case estimation, without EDEN guaranteeing specific periods. The times depend on the volume, technical complexity, and availability of destination systems.

25.4 Scope and Format. The Outbound Migration shall comprise the delivery of DICOM Studies and the associated information in the format agreed between the Parties. Any format other than the DICOM standard, transformation, specific anonymization, or additional validation shall be quoted as additional effort.

25.5 Delivery and Settlement. Once the Outbound Migration is completed, the Parties shall execute a delivery-acceptance record and technical settlement documenting the volume effectively transferred. EDEN may proceed with the secure deletion of the Client's information in accordance with the applicable retention policies.

25.6 Read-Only Access Post-Termination. Upon the conclusion of the contract for any cause, EDEN shall maintain the Client's account in suspended mode, with read-only access for one (1) designated Administrator User, during the time remaining to complete the ten (10)-year retention period provided in Clause 9.6, at no additional cost. This mode allows the consultation and specific download of Studies and Validated Reports, but not the uploading of new content or the use of processing, AI, or other operational layer functionalities. Mass extraction must be processed and charged as Outbound Migration.

26. Term, Renewal, and Termination

26.1 Term. The Term shall be that established in the Commercial Proposal. The contract shall automatically renew for periods equal to the one initially agreed, unless either Party notifies in writing its intention not to renew with at least thirty (30) calendar days' advance notice before the expiration of the current period.

26.2 Termination for Breach. Either Party may terminate the contract if the other materially breaches its obligations and does not cure such breach within the following periods: (a) payment obligations: ten (10) business days counted from the receipt of the written notice; (b) non-pecuniary obligations: thirty (30) calendar days counted from the receipt of the written notice. The following constitute, by way of illustration and not limitation, material breaches: unauthorized use of EDEN SUITE, violation of Clauses 14 (Confidentiality), 17 (Intellectual Property), circumvention of security measures, acts of corruption, and any unauthorized assignment.

26.3 Early Termination for Client's Convenience. The Client may terminate the contract early for convenience by written notice with sixty (60) calendar days' advance notice. In such case, the Client undertakes to pay EDEN, as sole and total compensation, the remaining balance of the total value of the contract agreed in the Commercial Proposal, calculated as such total value minus the total of considerations effectively paid and not refunded as of the effective termination date.

26.4 Nature of the Compensation. The Parties acknowledge and expressly agree that the compensation for early termination constitutes a reasonable and proportional estimate of the foreseeable damages and losses, including: (a) the costs of Cloud infrastructure, licensing, and capacity reserved specifically for the Client during the Term; (b) the opportunity cost arising from the inability to reassign such capacity to other potential clients; (c) the assignment of dedicated personnel, technical resources, and support planned for the agreed duration; and (d) the costs of amortization of the initial investment made by EDEN in the Client's implementation. This compensation does not constitute a contractual penalty, but rather indemnification of damages estimated in advance by the Parties in the exercise of their contractual freedom among merchants, and is an essential element of the economic basis of the contract without which EDEN would not have agreed to the Term or the agreed prices. The remaining balance shall be payable in full as of the effective termination date, without prejudice to the Parties agreeing in writing to a payment scheme in installments.

26.5 Termination without Penalty for Cause Attributable to EDEN. The Client may terminate the contract without the obligation to pay the remaining balance when any of the following causes is configured, attributable to EDEN and not cured after notice: (a) material breach by EDEN; (b) monthly availability of the platform below ninety-nine percent (99.0%) during three (3) consecutive months; or (c) two (2) or more critical-priority incidents outside the response or resolution time, in the same calendar quarter, provided that they are attributable to EDEN pursuant to the Attribution Rules. To invoke causes (b) and (c), the Client must notify EDEN in writing and grant it a cure period of thirty (30) calendar days to restore service levels and present a remediation plan.

26.6 Termination for Impossibility or Regulatory Change. EDEN may suspend or terminate, totally or partially, with thirty (30) calendar days' notice, when compliance becomes unlawful, unviable, or disproportionate due to regulatory changes, executive orders, sanctions, export control measures, tariffs, taxes, or other acts of authority that substantially affect the provision. Where possible, EDEN shall propose mitigation measures or reasonable adjustments. Termination for this cause shall not generate an obligation for the Client to pay the remaining balance.

26.7 Effects of Termination. Upon termination for any cause: (a) the use of EDEN SUITE shall immediately cease and Users shall be deactivated; (b) the Client shall pay all amounts accrued as of the effective termination date, including, where applicable, the remaining balance; (c) the Client shall return to EDEN the Router and bailment supplies; (d) the Parties shall execute the Outbound Data Migration procedure; (e) the secure deletion of data shall proceed in accordance with Clause 14 and the applicable retention policies; and (f) Clauses 4 (Billing), 14 (Confidentiality and Personal Data), 15 (Dissociation and AI), 17 (Intellectual Property), 18 (Limitation of Liability), 19 (Indemnity), 32 (Notices), 35 (Nullity), 36 (Dispute Resolution), and this one shall subsist, as applicable.

27. Default, Suspension, and Read-Only Mode

27.1 Without prejudice to the provisions of Clause 4.9, after thirty-one (31) calendar days of default, EDEN may block access to EDEN SUITE. When technically possible, EDEN may enable as a grace measure a read-only mode for fifteen (15) additional calendar days, exclusively for the download of images and Validated Reports already released; no uploads or new functionalities shall be enabled. Full access shall be restored after proof of payment.

28. Force Majeure and Act of God

28.1 If force majeure or an act of God delays or suspends the obligations of the contract for up to five (5) days, the period shall be extended by the same time. If the delay or suspension exceeds thirty (30) days, either Party may terminate the contract in writing without liability, except for the obligations pending at the time of termination. Termination for force majeure shall not generate an obligation for the Client to pay the remaining balance of the total value of the contract.

29. Assignment

29.1 The rights and obligations arising from these Terms may not be assigned partially or totally by the Client without EDEN's prior written consent. EDEN may assign or transfer the contract and these Terms, totally or partially, to its subsidiaries, related entities, successors, or acquirers in corporate reorganization transactions, without the need for the Client's consent, notifying it within the thirty (30) calendar days following.

30. Subcontractors

30.1 EDEN may subcontract, totally or partially, the provision of the service, without the need for the Client's prior authorization, provided that it maintains responsibility for its obligations under these Terms and ensures that its subcontractors comply with substantially equivalent confidentiality and security standards.

31. Anti-Corruption Compliance, Sanctions, and Export Controls

31.1 The Parties undertake that, at the time of acceptance of these Terms, neither they nor their directors, officers, or employees have offered, promised, given, authorized, solicited, or accepted any type of undue advantage, whether economic or of another type, related to the contract, and shall adopt reasonable measures so that their subcontractors, agents, or any other third party under their control or determining influence do the same.

31.2 The Parties undertake to comply with applicable laws on the prevention of money laundering, terrorist financing, export controls, international trade, and economic sanctions (including those administered by OFAC of the United States Department of the Treasury, the United Nations, the European Union, and other competent bodies), refraining from using EDEN SUITE in countries, with persons, or for purposes prohibited by such regulations.

32. Notices and Electronic Acceptance

32.1 Any notice between the Parties must be in writing and signed physically or electronically. They may be sent by physical or electronic mail to the addresses indicated in the Commercial Proposal or, failing that, to the addresses registered by the Parties in their respective systems. Messages from the official emails shall be considered signed with a simple signature and it shall be presumed that the sender has sufficient authority, without prejudice to the use of electronic signature platforms.

32.2 EDEN's Addresses and Emails. The address and email of EDEN for purposes of formal notices shall be, in general terms, that of the contracting EDEN entity set forth in the Commercial Proposal, and supplementarily: legal@edenmed.com. Modifications to the addresses and emails shall be published on legal.edenmed.com.

32.3 Electronic Acceptance. These Terms may be accepted by handwritten signature, advanced electronic signature, simple electronic signature on platforms such as Dropbox Sign, DocuSign, Mifiel, or others similar, acceptance by institutional email, or any suitable means that complies with the applicable e-commerce legislation, having full legal effect.

33. Modifications to the Terms

33.1 EDEN reserves the right to modify these Terms, in whole or in part, as the regulation, the state of the art, market practices, or operational needs evolve. Any modification shall be notified through prior publication on the website legal.edenmed.com with at least thirty (30) calendar days' advance notice before its effective date.

33.2 Notice. The publication on legal.edenmed.com constitutes valid and sufficient notice to all Subjects. EDEN may additionally send notice to the institutional email of the Administrative Officer registered by the Client, without the failure to send individual notice affecting the effectiveness of the modification.

33.3 Tacit Acceptance. After the thirty (30) calendar days have elapsed without the Client expressing in writing its disagreement, the modifications shall be considered fully accepted and binding. The continued use of EDEN SUITE after the effective date of the modifications shall, in any case, constitute unequivocal acceptance.

33.4 Client's Disagreement. If the Client expresses in writing its disagreement with the modifications within the period of thirty (30) calendar days, the Parties shall negotiate in good faith during the following fifteen (15) calendar days. If no agreement is reached, either Party may terminate the contract without penalty, effective at the expiration of the current Contract Year, with both parties retaining their rights and obligations accrued until then.

33.5 Versioning and Repository. EDEN shall maintain on legal.edenmed.com a historical repository of the versions of these Terms, indicating for each its effective date and substitution date. The version applicable to each contractual relationship shall be the one in force at the time of signing the respective Commercial Proposal, except for subsequent modifications accepted pursuant to this Clause.

34. Language

34.1 These Terms are drafted and entered into in the Spanish language, which shall be the official language for their interpretation and execution. Any translation into another language is provided for convenience and shall not prevail over the Spanish text.

35. Nullity, Severability, and Integrity

35.1 In the event that any clause is declared null, invalid, or unenforceable by a competent judicial authority, such clause shall be severed from these Terms. The remainder shall continue in force with full effectiveness, and the Parties undertake to negotiate in good faith a substitute clause that reflects, to the broadest extent permitted, the original intent.

35.2 The titles of the clauses and their numerals are exclusively to facilitate reading and location; interpretation shall be made in accordance with the content of each clause and the instrument considered as a whole.

35.3 These Terms, together with the Commercial Proposal and the addenda that are executed, constitute the entire agreement between the Parties with respect to their subject matter, and supersede any prior, simultaneous, or subsequent agreement, proposal, communication, declaration, or understanding, verbal or written, on the same subject matter.

36. Dispute Resolution, Applicable Law, and Jurisdiction

36.1 Prior Mediation. The Parties agree that any dispute or claim arising out of these Terms, or related to them, their breach, termination, or invalidity, shall be resolved, in the first instance, through alternative dispute resolution methods. The Parties shall submit to a mediation and conciliation procedure administered by a neutral and independent mediator, selected by mutual agreement. It shall be a mandatory requirement to exhaust this procedure prior to the initiation of legal actions, except for urgent provisional or precautionary measures.

36.2 Applicable Law. Except as provided in the respective Commercial Proposal or in a master agreement individually negotiated between the Parties, these Terms shall be governed by and interpreted in accordance with the federal laws of the United Mexican States, with the supplementary application of the Commercial Code and the Federal Civil Code.

36.3 Jurisdiction. If an amicable resolution is not reached, the Parties expressly submit to the jurisdiction of the competent federal courts seated in Mexico City, United Mexican States, waiving any other venue or jurisdiction that may correspond to them, even by reason of their present or future domicile, unless the respective Commercial Proposal establishes a different forum.

36.4 Public Policy Clause. Without prejudice to the choice of law and forum provided for in this Clause, the Parties acknowledge that the public policy rules of the Applicable Jurisdiction—in particular those relating to personal data protection, consumer rights where the consumer is the Subject involved, health regulation, labor rights of the Client's personnel, and tax obligations and search for and identification of persons—shall prevail over these Terms to the extent strictly necessary to preserve such public policy, with the remainder of the clauses maintaining full effectiveness.

37. Prevalence over Verbal Agreements and Previous Versions

37.1 These Terms, in their version in force published on legal.edenmed.com, prevail over any prior, simultaneous, or subsequent statement, offer, promise, declaration, or verbal communication of EDEN personnel, including commercial, technical, support, accounts, or any other area personnel.

37.2 Only modifications, extensions, waivers, or concessions that are recorded in writing in an instrument signed by representatives with sufficient proven authority, whether by formal addendum, master agreement, Commercial Proposal, or equivalent instrument, shall be enforceable against EDEN.

37.3 The previous versions of these Terms are automatically superseded by the version in force as of its effective date, except with respect to rights and obligations accrued previously under the prior versions, which shall retain their original regime.

FINAL PROVISION

These Terms and Conditions of Use of EDEN SUITE enter into force on the date set forth in the official repository legal.edenmed.com. EDEN keeps permanently available the version in force and the historical repository of previous versions.

For any inquiry, clarification, or request related to these Terms, the Subjects may contact the email address legal@edenmed.com.

January 1, 2026

Primary controller: Higia, Inc. (operating under the commercial brand "Eden").

Data Protection Officer (DPO) contact: legal@edenmed.com

1. PREAMBLE

1.1 This Global Privacy Notice (the "Notice") establishes Eden's Universal Privacy & Data Standard (EUPD). This instrument is not an exercise in minimum compliance: it is a statement of principles that deliberately and permanently adopts the highest level of personal data protection recognized in any jurisdiction where Eden operates or may come to operate.

1.2 The EUPD is built on a single axiom: if a local law, present or future, grants the data subject a broader protection than that contained in this Notice, such protection is automatically incorporated into the processing that Eden carries out in that jurisdiction, without the need to amend this document. We refer to this mechanism as the Automatic Maximum Protection Clause (MPA).

1.3 Nevertheless, when Eden identifies that a jurisdiction imposes a more demanding standard than the global EUPD floor, Eden will raise that floor for all jurisdictions, unless doing so is technically or legally unfeasible.

1.4 This Notice applies in all jurisdictions where Eden, through Higia, Inc. or any of its subsidiaries, offers products or services, or carries out any personal data processing operation.

2. IDENTITY OF THE CONTROLLER AND RELATED ENTITIES

2.1 The primary controller of personal data processing is Higia, Inc., domiciled at 300 Delaware Ave., Suite 210 #215, Wilmington, DE 19801, United States of America. The email address of the Data Protection Officer (DPO) is legal@edenmed.com.

2.2 Higia, Inc. operates under the commercial brand "Eden" and has the following subsidiaries, each of which may act as controller or processor depending on the operation in question:

2.2.1 Higia, Inc. — Jurisdiction: United States (Delaware). Domicile: 300 Delaware Ave., Suite 210 #215, Wilmington, DE 19801, United States of America. Role: Parent — Primary controller.

2.2.2 Eva Health, S.A.P.I. de C.V. — Jurisdiction: Mexico. Domicile: Av. Horacio 632, Piso 1, Polanco IV Sección, Miguel Hidalgo, 11550, Mexico City, Mexico. Role: Subsidiary — Controller or Processor.

2.2.3 United Surgical Importação e Exportação Ltda. — Jurisdiction: Brazil. Domicile: Av. Ordem e Progresso 157, Cj. 1713, Várzea da Barra Funda, São Paulo – SP, 01141-030, Brazil. Role: Subsidiary — Controller or Processor.

2.2.4 Eden Colombia Latinoamérica S.A.S. — Jurisdiction: Colombia. Domicile: Calle 96 # 10-29, Oficina 502, Bogotá D.C., Colombia. Role: Subsidiary — Controller or Processor.

2.3 In countries where Eden does not have an incorporated subsidiary (including, by way of illustration but not limitation, Peru, Ecuador, Chile and other jurisdictions in Latin America, the European Union and the rest of the world), services are provided by one of the aforementioned subsidiaries, acting as controller under the instructions and policies of Higia, Inc.

2.4 In the European Union and the European Economic Area, where Higia, Inc. or any of its subsidiaries not established in the EU acts as controller of the data of individuals located in that territory, Eden will designate a representative in accordance with Article 27 of Regulation (EU) 2016/679 (GDPR — General Data Protection Regulation). The representative's contact details will be published at legal.edenmed.com and communicated to the competent supervisory authority.

3. AUTOMATIC MAXIMUM PROTECTION CLAUSE (MPA)

This Notice incorporates the following continuous-update mechanism:

3.1 Automatic incorporation. If, in any jurisdiction where Eden operates or comes to operate, a law, regulation, judicial decision, or data protection authority criterion establishes a right, guarantee, security standard, or transparency obligation more favorable to the data subject than that provided in this Notice, such provision is deemed automatically incorporated into the processing that Eden carries out in that jurisdiction, without the need for a formal amendment to this document.

3.2 Non-regression. The protection standards contained in this Notice constitute an irreducible minimum floor. No local provision offering less protection than this Notice will reduce the rights recognized herein.

3.3 Global elevation. When the review of the Regulatory Correspondence Annex identifies that a jurisdiction imposes a more demanding standard than the global EUPD floor, Eden will assess the feasibility of raising that floor for all jurisdictions. If the elevation is feasible, it will be incorporated in the next version of the Notice.

3.4 Proactive transparency. Eden will publish and keep updated a Regulatory Correspondence Annex on its website (legal.edenmed.com), indicating, for each jurisdiction, the applicable rules and any additional right the data subject may exercise under local law. This Annex is binding on Eden and its subsidiaries.

3.5 Periodic review. Without prejudice to automatic incorporation, Eden will carry out semiannual reviews of the global regulatory landscape to update the Regulatory Correspondence Annex and, where applicable, raise the standards of this Notice.

4. SCOPE OF APPLICATION

4.1 Territorial scope. This Notice applies to every natural person (the "Data Subject") whose personal data is processed by Eden, regardless of: (a) the geographic location of the Data Subject; (b) the country from which the services are accessed; (c) the nationality or residence of the Data Subject; and (d) the Eden Group entity acting as controller or processor.

4.2 Material scope. This Notice applies to all personal data processing carried out by Eden, whether automated, partially automated, or non-automated, including operations carried out through Eden Suite and each of its modules:

4.2.1 Eden PACS (Picture Archiving and Communication System): storage and management of DICOM (Digital Imaging and Communications in Medicine) images.

4.2.2 Eden Management (RIS — Radiology Information System): workflows, schedules, and reports.

4.2.3 Eden Intelligence: analytics and metrics.

4.2.4 Eden Creator: assistant for drafting conclusions; does not generate diagnoses.

4.2.5 AI Report: an agent that transforms dictation into structured drafts; requires a physician's signature for release.

4.2.6 Eden AI: diagnostic support through artificial intelligence models applied to DICOM studies; does not replace clinical judgment.

4.2.7 Eden Portal: web portal with a DICOM viewer for patients.

5. DEFINITIONS

For the purposes of this Notice, the terms defined below shall have the meaning indicated. Where a term is not defined here, the definition given to it by the applicable law in the relevant jurisdiction shall apply.

5.1 Data Protection Authority: any public body with competence over personal data protection in a given jurisdiction (for example, the competent authority in Mexico, the ANPD in Brazil, the SIC in Colombia, the ANPDP in Peru, the SPDP in Ecuador, the Personal Data Protection Agency in Chile, the AEPD in Spain, the CNIL in France, among others).

5.2 Client: a natural or legal person who contracts Eden's products or services, including Eden Suite, through a service agreement. The Client acts as joint controller with respect to the personal data it transmits to Eden, and as processor with respect to the personal data it receives from Eden.

5.3 Consent: a free, specific, informed, and unambiguous expression of the Data Subject's will, by which they accept the processing of their personal data. In the case of sensitive personal data, consent must also be explicit.

5.4 Personal Data: any information relating to an identified or identifiable natural person. A person is considered identifiable if their identity can be determined, directly or indirectly, including through location information and online identification.

5.5 Sensitive Personal Data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life, or sexual orientation of the Data Subject. For Eden's purposes, every DICOM medical image and all clinical data associated with a patient are considered sensitive personal data.

5.6 Data Protection Officer (DPO): a person designated by Eden to oversee compliance with personal data protection obligations, to serve as a point of contact for Data Subjects and Data Protection Authorities, and to advise the Eden Group on the matter.

5.7 Dissociation (Anonymization): a technical procedure by which personal data can no longer be associated with the Data Subject in an irreversible manner, such that the resulting information does not permit identification.

5.8 Eden / Eden Group: Higia, Inc. and any of its subsidiaries, affiliates, or related entities that participate in the processing of personal data.

5.9 Processor: a natural or legal person who processes personal data on behalf of and under the instructions of the Controller.

5.10 Data Protection Impact Assessment (DPIA): a systematic analysis of the risks that a processing operation may pose to the rights and freedoms of Data Subjects, including measures to mitigate such risks. Also known as EIPD (Evaluación de Impacto en Protección de Datos) or RIPD (Relatório de Impacto à Proteção de Dados).

5.11 Security Incident: any event that compromises the confidentiality, integrity, or availability of personal data, including unauthorized access, loss, destruction, alteration, or improper disclosure.

5.12 Controller: a natural or legal person who determines the purposes and means of the processing of personal data. In Eden's context, the Controller varies depending on the legal relationship and applicable jurisdiction, as described in Clause 2 of this Notice.

5.13 High-Risk AI System: an artificial intelligence system classified as high-risk under Regulation (EU) 2024/1689 (AI Act) or other applicable artificial intelligence legislation. Eden AI may be classified as such when operating on health data.

5.14 Data Subject: the natural person to whom the personal data being processed corresponds.

5.15 Processing: any operation or set of operations performed on personal data, by any means, including collection, recording, organization, structuring, storage, adaptation, modification, extraction, consultation, use, communication by transmission, dissemination, comparison, interconnection, restriction, erasure, and destruction.

5.16 User: a natural person who uses Eden Suite through an Eden Client, without a direct contractual relationship with Eden. The User includes patients, medical staff, and administrative staff of the Client.

6. GUIDING PRINCIPLES

All personal data processing carried out by Eden is governed by the following principles, which constitute binding obligations for all entities of the Eden Group and prevail over any restrictive interpretation:

6.1 Lawfulness, fairness, and transparency. All processing will have a valid legal basis, be carried out in good faith, and be communicated to the Data Subject in a clear, accessible, and comprehensible manner.

6.2 Purpose limitation. Personal data will be collected for specified, explicit, and legitimate purposes, and will not be further processed in a manner incompatible with those purposes.

6.3 Data minimization. Only personal data that is adequate, relevant, and strictly necessary for the purposes of the processing will be collected.

6.4 Accuracy. Personal data will be accurate and, where necessary, kept up to date. Reasonable measures will be taken to erase or rectify inaccurate data without delay.

6.5 Storage limitation. Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, unless a legal obligation requires a longer retention period.

6.6 Integrity and confidentiality. Personal data will be processed in a manner that ensures its security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

6.7 Accountability. Eden will be able to demonstrate compliance with all the foregoing principles and with the obligations arising from this Notice and applicable law.

6.8 Privacy by design and by default. Personal data protection will be integrated into the design of all Eden products, services, and processes. The default configuration will always be the most protective of the Data Subject's privacy. In the development of software and information systems that process personal data, Eden will adopt DevPrivOps and DevSecOps practices, integrating privacy and security risk management from the earliest stages of the development lifecycle.

6.9 Non-discrimination. No Data Subject will suffer adverse consequences for exercising their personal data protection rights.

6.10 Surviving confidentiality. The duty of secrecy and confidentiality over the Data Subject's personal data subsists even after the relationship between Eden and the Data Subject, or between Eden and the Client, has ended.

7. CATEGORIES OF DATA SUBJECTS, PERSONAL DATA, AND PURPOSES

Eden processes personal data of the categories of Data Subjects described in this clause. For each category, the types of data collected, the primary purposes (necessary for the legal relationship), and the secondary purposes (not necessary; subject to objection or withdrawal of consent) are detailed. The categories are: (A) Browsing Users; (B) Clients; (B.1) Client Joint Controllership; (C) Eden Suite Users; (D) Candidates; (E) Employees; (F) Subscribers; and (G) Suppliers and Potential Suppliers.

7.1 Browsing Users. These are Data Subjects who browse the website edenmed.com without maintaining a contractual relationship with Eden.

7.1.1 Data collected: (a) IP address (anonymized for analytics purposes); (b) browsing data: pages visited, time spent, navigation sequence, and clicks made; (c) technical device data: browser type, operating system, screen resolution, and language; and (d) data obtained through cookies, web beacons, and JavaScript, subject to the Data Subject's preferences (see Clause 13).

7.1.2 Primary purposes: (a) to ensure the technical functioning and security of the website; and (b) to detect and prevent fraudulent activity or threats to the portal.

7.1.3 Secondary purposes: (a) statistical and geolocation analysis to improve the browsing experience; and (b) content personalization.

7.2 Clients. These are Data Subjects (natural persons or representatives of legal entities) who contract Eden's products or services through a service agreement.

7.2.1 Data collected: (a) identification data: full name, date and place of birth, age, gender, nationality, telephone number, email, copy of official identification (passport or other document), and proof of address; (b) for legal entities: incorporation deed, tax identification (RFC, CNPJ, NIT, or equivalent), and details of the legal representative; (c) financial data: bank accounts, CLABE, or other financial data necessary for the commercial relationship; and (d) location data: tax and commercial address.

7.2.2 Primary purposes: (a) to verify the identity and existence of the Client; (b) to enter into, perform, and develop the services agreement and its accessory instruments; (c) to comply with legal, tax, and regulatory obligations; and (d) to create and manage the databases necessary to provide the service.

7.2.3 Secondary purposes: (a) to send information about Eden's products, services, promotions, or events; and (b) to conduct satisfaction surveys, market analysis, and statistical studies.

7.3 Client Joint Controllership. Eden declares that, in order to provide its services, Clients will transmit to Eden the personal data of third parties under their custody, including data of patients, medical staff, treating physicians, and persons authorized to receive medical information. Consequently:

7.3.1 The Client undertakes to obtain the consent of the Data Subject before transmitting their data to Eden, in accordance with the applicable law in its jurisdiction.

7.3.2 The Client undertakes to establish the necessary legal documentation with the Data Subject (including employment contracts, service agreements, its own privacy notices, and informed consents, as applicable).

7.3.3 The Client undertakes to implement its own administrative, technical, and physical security measures to protect the personal data it manages.

7.3.4 The Client acts as joint controller with respect to the data it transmits to Eden, and as processor with respect to the data it receives from Eden.

7.3.5 Eden, in turn, acts as controller with respect to the data stored on its servers in accordance with the contractual relationship with the Client.

7.4 Eden Suite Users. These are Data Subjects (natural persons) who use Eden Suite through Eden's Clients, without a direct contractual relationship with Eden. This category includes patients, medical staff, radiologists, and administrative staff of the Client.

7.4.1 Data collected: (a) of patients: identification number (hospital record or other), name, sex, date of birth, marital status, nationality, contact details, medical history, information on diagnoses and procedures, DICOM radiological images and associated reports, and results of examinations and laboratory tests; (b) of health professionals: identification data, professional registration data (professional license, CRM, or equivalent), training and specialization data, and system access credentials; (c) of system use: access logs, records of transactions performed, and usage preferences and settings; and (d) of security: electronic security records, access attempts, and authentication data.

7.4.2 Primary purposes: (a) to provide the health services contracted by the Client, including storage, management, and viewing of medical images and reports; (b) to manage the patient's electronic health record; (c) to facilitate clinical communication among health professionals; (d) to ensure the security, integrity, and traceability of medical information; and (e) to comply with legal and regulatory obligations of the health sector.

7.4.3 Secondary purposes: (a) improvement of the quality and experience of Eden Suite services; and (b) research and development of new functionalities, always with anonymized data or with the explicit consent of the Data Subject.

7.4.4 Note on ownership. The data stored by the Client on Eden's servers is the property of the Client or the User, respectively, in accordance with the applicable legal-contractual relationship. The User of a Client must first refer to the privacy notice provided by the Client that contracted Eden's services.

7.4.5 Data generated by AI systems. When a DICOM study is processed by Eden AI or AI Report, the processing metadata (date, model version, type of analysis, and suggested result) are considered personal data associated with the patient and are subject to the same protections as the original images. The Data Subject has the right to know that their data was processed by an artificial intelligence system and to obtain meaningful information about the logic of the processing.

7.5 Candidates. These are Data Subjects who participate in Eden's selection and recruitment processes.

7.5.1 Data collected: (a) identification data: name, address, contact details, and identity document; (b) location data: address; and (c) professional and academic data: educational background, work experience, personal and professional references, and certifications.

7.5.2 Primary purposes: (a) to verify the Candidate's identity; (b) to assess their professional profile and suitability for the position; (c) to establish contact during the selection process; and (d) to create and maintain internal candidate databases.

7.6 Employees. These are Data Subjects who perform personal, subordinate, and remunerated work for Eden, in any jurisdiction.

7.6.1 Data collected: (a) identification data: name, address, telephone, personal and institutional email, marital status, signature, photograph, tax identification, social security number or equivalent, and data of family members and beneficiaries; (b) financial data: bank account and information necessary for payroll and tax compliance; (c) employment data: employment contract, incidents, evaluations, training, and payroll data; (d) academic data: degrees, professional licenses, and certifications; (e) biometric data: fingerprint for access control to facilities (where applicable, with explicit consent); and (f) voice data: recording of calls made through corporate applications, for quality purposes (where applicable, with prior notice).

7.6.2 Primary purposes: (a) to enter into and perform the employment contract and its accessory instruments; (b) to comply with labor, tax, and social security obligations; (c) to manage the employment relationship, including payroll, benefits, training, and evaluation; and (d) to ensure the security of facilities and information systems.

7.7 Subscribers. These are Data Subjects who voluntarily subscribe to Eden's communications (newsletters, commercial information, events).

7.7.1 Data collected: name, position, company, industry, email, and telephone number.

7.7.2 Purposes: (a) sending commercial communications, news, events, and promotions related to Eden; and (b) conducting satisfaction surveys and market studies.

7.7.3 The Subscriber may withdraw their consent and unsubscribe at any time through the unsubscribe link included in each communication or by contacting legal@edenmed.com.

7.8 Suppliers and Potential Suppliers.

7.8.1 Data collected: (a) identification of the company and its representatives; (b) internet and social media presence; and (c) corporate background, reputation, permits, licenses, and certifications.

7.8.2 Primary purposes: (a) to verify the identity and existence of the supplier; (b) to assess the viability of the commercial relationship; and (c) to enter into and perform service agreements.

8. LEGAL BASES FOR PROCESSING

8.1 Eden bases each processing operation on at least one of the following legal bases, in accordance with the applicable law in each jurisdiction:

8.1.1 Consent. A free, specific, informed, and unambiguous expression of the Data Subject's will; explicit for sensitive data. Example: newsletter subscription; processing of employees' biometric data.

8.1.2 Contractual performance. Processing is necessary to enter into or perform a contract with the Data Subject. Example: management of the Client's account; provision of Eden Suite.

8.1.3 Legal obligation. Processing is required by an applicable legal rule. Example: retention of tax records; reporting to health authorities.

8.1.4 Legitimate interest. Processing is necessary to satisfy the legitimate interests of Eden or a third party, provided the rights of the Data Subject do not prevail. Eden documents and balances such interests. Example: network and system security; fraud prevention.

8.1.5 Vital interest. Processing is necessary to protect the life of the Data Subject or another natural person. Example: medical emergencies in the context of Eden Suite.

8.1.6 Public interest or exercise of authority. Processing is necessary for the performance of a task carried out in the public interest. Example: reporting of communicable diseases to health authorities.

8.1.7 Protection of health. In jurisdictions that recognize it (Brazil, LGPD art. 11), the processing of health data for the protection of the Data Subject's health. Example: storage and management of DICOM medical images.

8.1.8 Sectoral regulatory compliance. Processing is necessary to comply with sectoral health regulation (HIPAA Privacy Rule, NOM-004-SSA3, CFM rules, among others). Example: Business Associate Agreements in the U.S.; retention of clinical records in Mexico.

8.2 Eden applies the most protective legal basis available in each jurisdiction. Where there is doubt about the applicable legal basis, Eden will opt to request the Data Subject's consent.

9. RIGHTS OF THE DATA SUBJECT

Eden recognizes and guarantees to every Data Subject, regardless of jurisdiction, the exercise of the following rights. This catalog constitutes the union of all rights recognized by the applicable laws and, by virtue of the Automatic Maximum Protection Clause, extends equally to all Data Subjects:

9.1 Access. To obtain confirmation of whether Eden processes their personal data and, where applicable, to access it, including information about the purposes of the processing, the categories of data, the recipients, the retention periods, and the source of the data.

9.2 Rectification. To request the correction of inaccurate or incomplete personal data.

9.3 Cancellation or erasure (right to be forgotten). To request the deletion of their personal data when it is no longer necessary for the purposes for which it was collected, when they withdraw their consent, when they object to the processing, when the data has been unlawfully processed, or when a legal obligation must be fulfilled.

9.4 Objection. To object to the processing of their personal data at any time, on grounds relating to their particular situation. Eden will cease the processing unless it demonstrates compelling legitimate grounds.

9.5 Restriction of processing (blocking). To request that Eden restrict the processing of their personal data while the accuracy of the data, the lawfulness of the processing, or the balancing of legitimate interests is verified.

9.6 Portability. To receive their personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance.

9.7 Not to be subject to automated decisions. Not to be subject to a decision based solely on the automated processing of their data, including profiling, that produces legal effects or significantly affects them. Eden AI and AI Report generate results that always require review and validation by a medical professional; in no case is a clinical decision adopted on an exclusively automated basis.

9.8 Withdrawal of consent. To withdraw their consent at any time, without affecting the lawfulness of the prior processing. Withdrawal will be as simple as granting consent.

9.9 Information on transfers. To know to which third parties their personal data has been transferred and the applicable safeguards.

9.10 Non-discrimination. Not to suffer retaliation, penalty, or degradation of service for exercising any of the rights recognized herein.

9.11 Complaint before an authority. To file a complaint with the competent Data Protection Authority in their jurisdiction, without prejudice to any other administrative or judicial remedy.

9.12 Confirmation of the existence of processing. To obtain confirmation of whether or not Eden processes their personal data (autonomous right recognized by Brazil's LGPD).

9.13 Information on the possibility of not consenting. To be informed about the possibility of not granting their consent and about the consequences of refusal (autonomous right recognized by Brazil's LGPD).

9.14 Erasure of data processed with consent. To request the deletion of personal data processed on the basis of their consent, even when the processing is lawful (autonomous right recognized by Brazil's LGPD).

9.15 Free consultation. To consult their personal data free of charge at least once each calendar month and whenever there are substantial modifications to the processing policies (recognized by Colombia's Law 1581 of 2012 and analogous rules).

9.16 Compensation. A Data Subject who is harmed as a result of non-compliance with applicable law or this Notice has the right to obtain the corresponding compensation in accordance with the law (recognized by Article 25 of Peru's Law 29733; extensible to all jurisdictions where local law permits).

9.17 Prevention of disclosure. The Data Subject has the right to prevent their personal data from being supplied to third parties, especially when this affects their fundamental rights (recognized by Article 21 of Peru's Law 29733).

9.18 Habeas data. In jurisdictions where a constitutional habeas data action exists (Ecuador, Peru, Brazil, Colombia, among others), the Data Subject may resort directly to the constitutional remedy for the protection of their personal data, independently of the administrative route. Eden recognizes and respects this right and will cooperate with the judicial authorities hearing such actions.

9.19 Procedure for exercising rights.

9.19.1 The Data Subject may exercise any of their rights by sending a request to the email of the Data Protection Officer: legal@edenmed.com. The request must contain, at a minimum: (a) the full name of the Data Subject and a means to receive notifications (email or postal address); (b) documents evidencing their identity or, where applicable, the legal representation of the Data Subject; (c) a clear description of the right they wish to exercise and of the personal data involved; and (d) any other information that facilitates locating the personal data.

9.19.2 Eden will respond to the request within a maximum period of ten (10) business days from receipt of the complete request. Where the complexity or volume of requests justifies it, this period may be extended by an additional period of ten (10) business days, with prior notice to the Data Subject. In Peru, the response period will be eight (8) business days in accordance with the local legislation in force.

9.19.3 Users of Clients. Where the Data Subject is a User who accesses Eden Suite through a Client, the request to exercise rights must be directed in the first instance to the Client (the health service provider) through which the data was collected. Eden will cooperate with the Client to respond to the request.

10. PROCESSING OF SENSITIVE PERSONAL DATA

10.1 Given the nature of Eden's services in the health technology (healthtech) sector, Eden processes the following categories of sensitive personal data: (a) health-related data: medical history, diagnoses, procedures, DICOM radiological images, examination results, and medical reports; (b) biometric data: fingerprint (for employee access control, where applicable); (c) data that may reveal racial or ethnic origin, when it forms part of the patient's medical history; and (d) data generated by AI systems: metadata from the processing of DICOM studies by Eden AI or AI Report, including suggested results, which are classified as sensitive data due to their direct association with the Data Subject's health status.

10.2 The processing of sensitive personal data will be carried out only when at least one of the following conditions is met: (a) the Data Subject has given their explicit consent, having been clearly and specifically informed of the purposes; (b) the processing is necessary for the provision of health services, including preventive medicine, medical diagnosis, and management of health services; (c) the processing is required by a legal or regulatory obligation; (d) the processing is necessary to protect the life or physical integrity of the Data Subject or another person, when the Data Subject cannot give consent; or (e) the processing is carried out with data that has been manifestly made public by the Data Subject.

10.3 In any case, Eden will apply reinforced security measures for the processing of sensitive personal data, including encryption in transit and at rest, role-based access controls, and detailed audit logs.

11. PROCESSING OF DATA OF CHILDREN AND ADOLESCENTS

Eden recognizes that, in the context of health services, it may be necessary to process the personal data of minors. The processing of such data will be governed by the following rules:

11.1 Processing will always be carried out in the best interests of the minor.

11.2 The consent of the minor's parent, guardian, or legal representative will be required, unless a legal exception permits otherwise.

11.3 Eden will consider as a minor any person under eighteen (18) years of age, applying the most protective threshold among the laws of the jurisdictions where it operates.

11.4 The data of minors will only be collected when strictly necessary for the provision of health services.

11.5 Eden will not direct advertising or commercial communications to minors.

11.6 The website edenmed.com is intended for persons over eighteen (18) years of age. Minors should not use it without the supervision of a legal representative.

12. INTERNATIONAL DATA TRANSFERS

Since Eden operates through entities in multiple jurisdictions and uses cloud infrastructure, personal data may be transferred to countries other than the one where it was collected. Eden guarantees that every international transfer will be carried out with the following safeguards:

12.1 Safeguards for transfers.

12.1.1 Standard Contractual Clauses (SCCs). Eden will use contractual clauses approved by the competent authority (including the European Commission's SCCs) to ensure an adequate level of protection.

12.1.2 Binding Corporate Rules (BCRs). Intra-group transfers will be governed by internal policies that ensure a level of protection equivalent to that of this Notice.

12.1.3 Adequacy decisions. Where the competent authority has recognized that the destination country offers an adequate level of protection, the transfer will be carried out on the basis of that decision.

12.1.4 Explicit consent. Where none of the above safeguards is applicable, Eden will request the explicit consent of the Data Subject, informing them of the specific risks of the transfer.

12.2 Sub-processors. Eden may use sub-processors (including cloud infrastructure providers such as Amazon Web Services, Inc.) for the storage and processing of data. Eden guarantees that every sub-processor will be subject to contractual obligations equivalent to those contained in this Notice, will undergo a prior risk assessment, and will maintain an up-to-date register of sub-processors available for consultation.

12.3 Representative in the European Union. In accordance with Article 27 of the GDPR, where Higia, Inc. or any subsidiary not established in the EU acts as controller of the data of individuals located in the European Union or the European Economic Area, Eden will designate a representative established in a member state. The representative will serve as an additional point of contact for supervisory authorities and Data Subjects in the EU. The representative's contact details will be published at legal.edenmed.com.

12.4 Business Associate Agreements (BAA) in the United States. Where Eden provides services to entities qualified as a "covered entity" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), Eden will enter into a Business Associate Agreement (BAA) in accordance with the requirements of the HIPAA Privacy Rule (45 CFR § 164.502(e)) and the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, 164.312). The BAA will establish Eden's obligations as a "business associate," including the limitations on the use and disclosure of Protected Health Information (PHI).

13. COOKIES, WEB BEACONS, AND TRACKING TECHNOLOGIES

13.1 Eden uses cookies and similar technologies on its website and applications for the following purposes:

13.1.1 Strictly necessary cookies. Purpose: technical functioning of the site, security, and authentication. Duration: session. Legal basis: legitimate interest or technical necessity.

13.1.2 Performance or analytics cookies. Purpose: usage analysis, aggregate statistics, and service improvement. Duration: up to 24 months. Legal basis: consent.

13.1.3 Functionality cookies. Purpose: to remember the Data Subject's preferences (language, settings). Duration: up to 12 months. Legal basis: consent.

13.1.4 Advertising or marketing cookies. Purpose: content and advertising personalization. Duration: up to 12 months. Legal basis: consent.

13.2 Upon accessing Eden's website, the Data Subject will be informed through a visible banner about the use of cookies and will be able to manage their preferences. Only strictly necessary cookies will be activated without prior consent. The Data Subject may modify their preferences at any time through their browser settings or Eden's cookie preferences panel.

13.3 Disabling cookies may affect the functionality of the website.

14. SECURITY MEASURES

Eden implements administrative, technical, and physical security measures designed to protect personal data against unauthorized access, loss, alteration, destruction, or misuse. The measures include, by way of illustration but not limitation:

14.1 Technical measures: (a) encryption of data in transit (TLS/SSL) and at rest (AES-256 or equivalent); (b) multi-factor authentication (MFA) for access to critical systems; (c) role-based access control (RBAC) with the principle of least privilege; (d) continuous monitoring and analysis of access and activity logs; (e) periodic security testing, including penetration testing and vulnerability assessments; (f) timely management of patches and security updates; and (g) segmented network architecture with firewalls and intrusion detection and prevention systems (IDS/IPS).

14.2 Administrative measures: (a) formal information security policies and procedures; (b) periodic security and privacy training for all staff; (c) Data Protection Impact Assessments (DPIAs) for new projects or significant changes in processing; (d) a security incident response plan; and (e) Service Level Agreements (SLAs) with providers that include security and privacy commitments.

14.3 Physical measures: (a) physical access control to the facilities where personal data is processed; and (b) geographic redundancy of backups across multiple locations.

14.4 Certifications. Eden maintains ISO 27001 certification (Information Security Management System) and works continuously to obtain and maintain additional certifications relevant to the health sector.

14.5 Privacy by design in software development. In compliance with the technical guidelines issued by Ecuador's Superintendency for Personal Data Protection (SPDP), Article 14 quáter of Chile's Law 21.719, and Article 25 of the GDPR, Eden will integrate personal data protection into all phases of the software development lifecycle of Eden Suite and its modules. This includes: (a) data selection and minimization from the design phase of each functionality; (b) privacy risk analysis integrated into the development pipeline (DevPrivOps); (c) application security testing (SAST, DAST, SCA) as part of the deployment process; and (d) documentation of design decisions related to privacy and justification of the risk metrics used.

15. SECURITY INCIDENT NOTIFICATION

In the event of a Security Incident that may pose a relevant risk or harm to the rights and freedoms of Data Subjects, Eden undertakes to:

15.1 Notify the competent Data Protection Authority within forty-eight (48) hours from the moment Eden becomes aware of the incident. This period adopts the most demanding standard among Eden's jurisdictions of operation (Peru, D.S. 016-2024-JUS, Article 34).

15.2 Notify the affected Data Subjects without undue delay when the incident may entail a high risk to their rights and freedoms.

15.3 Document all security incidents, including their effects and the corrective measures adopted.

15.4 Where Eden acts as a processor, notify the controller (Client) without delay so that the controller can comply with its notification obligations.

15.5 In Peru, additionally, notify the National Center for Digital Security when the incident occurs in digital environments, in accordance with the Regulation of the Personal Data Protection Law.

16. RETENTION PERIODS

16.1 Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, in accordance with the following criteria: (a) for as long as the legal relationship giving rise to the processing subsists; (b) during the limitation period for legal or contractual actions arising from that relationship; (c) during the period required by applicable regulations (tax, labor, health, among others); and (d) when judicial, administrative, or arbitral proceedings are pending.

16.2 Once the applicable retention periods have elapsed, personal data will be securely deleted or irreversibly anonymized.

16.3 Blocking period. During the period between the fulfillment of the purpose and the definitive deletion, personal data will be blocked and may only be accessed to determine legal or contractual liabilities.

17. ANONYMIZATION AND USE OF DISSOCIATED DATA

17.1 Eden may carry out irreversible anonymization processes of personal data for the following purposes: (a) scientific research and technological development; (b) statistical analysis and the development of metrics; (c) improvement of artificial intelligence algorithms and machine learning models; and (d) market studies and commercial analysis.

17.2 Once data has been subjected to an irreversible anonymization process, it ceases to be personal data and, therefore, its further processing is not subject to the provisions of this Notice or of applicable personal data protection law.

17.3 Eden documents the anonymization methods used and periodically assesses the risk of re-identification.

18. AUTOMATED DECISIONS AND ARTIFICIAL INTELLIGENCE

Eden uses artificial intelligence models in the Eden AI and AI Report modules of Eden Suite. It is essential that the Data Subject understands the following:

18.1 No autonomous diagnosis. Eden AI provides diagnostic support; it does not replace the physician's clinical judgment. Every result generated by Eden AI is a suggestion that must be evaluated, validated, or discarded by a qualified medical professional.

18.2 AI Report requires a physician's signature. AI Report transforms medical dictation into structured drafts. No draft is released as a final report without the review and signature of the responsible physician.

18.3 Eden Creator does not generate diagnoses. Eden Creator assists in drafting medical conclusions but does not produce clinical diagnoses.

18.4 Guaranteed human intervention. In no case will a clinical or medical decision be adopted on an exclusively automated basis. The Data Subject has the right to request human intervention, to express their point of view, and to contest the decision.

18.5 Algorithmic transparency. The Data Subject has the right to obtain meaningful information about the logic applied in the automated processing of their data, as well as about the significance and the envisaged consequences of such processing.

18.6 Compliance with the EU Artificial Intelligence Regulation (AI Act). Eden recognizes that the Eden AI and AI Report modules, by operating on health data through artificial intelligence models, may be classified as high-risk AI systems under Regulation (EU) 2024/1689 (AI Act). Consequently, Eden will adopt the following measures with respect to these modules:

18.6.1 Risk management system: implementation of a continuous system for identifying, analyzing, estimating, and evaluating the risks associated with the use of Eden AI.

18.6.2 Data governance: the datasets used for training, validation, and testing of the AI models will meet criteria of quality, representativeness, and absence of bias, to the extent technically feasible.

18.6.3 Technical documentation: Eden will maintain up-to-date technical documentation that allows competent authorities to assess compliance with the applicable requirements.

18.6.4 Record-keeping and traceability: the AI systems will generate automatic records (logs) that allow the functioning of the system to be traced throughout its lifecycle.

18.6.5 Human oversight: Eden AI is designed to be used under the supervision of a qualified medical professional. The system architecture prevents the release of results without human intervention.

18.6.6 Accuracy, robustness, and cybersecurity: Eden will apply measures to ensure adequate levels of accuracy, robustness, and cybersecurity of the AI models, including periodic testing and post-deployment monitoring.

18.7 These obligations will apply regardless of the Data Subject's jurisdiction, as part of Eden's commitment to the highest global standards. In jurisdictions where no specific AI legislation exists, Eden will adopt these measures as a voluntary best practice.

19. DATA PROTECTION OFFICER (DPO)

19.1 Eden has designated a Data Protection Officer (DPO) as the point of contact for all matters related to the processing of personal data. The DPO is accessible in Spanish, Portuguese, and English through the following means: (a) email: legal@edenmed.com; and (b) postal address: Higia, Inc. — Attn: Data Protection Officer — 300 Delaware Ave., Suite 210 #215, Wilmington, DE 19801, USA.

19.2 The DPO has the following functions: (a) to oversee compliance with this Notice and applicable law; (b) to advise Eden on Data Protection Impact Assessments; (c) to serve as a point of contact for Data Subjects and Data Protection Authorities; and (d) to cooperate with Data Protection Authorities in the exercise of their functions.

19.3 In Ecuador, Eden's DPO must be registered with the SPDP in accordance with Resolution SPDP-SPD-2025-0028-R. In Brazil, they will act as Encarregado in accordance with Article 41 of the LGPD. In Peru, they will act as Personal Data Officer in accordance with D.S. 016-2024-JUS. Eden may designate a single DPO for the corporate group, as permitted by applicable laws, provided they can carry out their functions in each jurisdiction.

20. ACCEPTANCE OF THE PRIVACY NOTICE

Acceptance of this Notice is governed by the following principles:

20.1 Affirmative consent. Eden does not presume the Data Subject's consent from the mere use of the website or services. Where consent is the legal basis for the processing, Eden will request a clear affirmative action from the Data Subject (opt-in).

20.2 Granularity. The Data Subject may grant their consent in a differentiated manner for each purpose of the processing, where the applicable law so requires.

20.3 Revocability. Consent may be withdrawn at any time, as simply as it was granted.

21. UPDATES TO THE PRIVACY NOTICE

21.1 Eden reserves the right to modify this Notice at any time to adapt it to regulatory, jurisprudential, technological, or operational changes. Any substantial modification will be communicated to the Data Subject through: (a) publication on the website legal.edenmed.com, with a clear indication of the date of last update; (b) notification by email to Data Subjects whose address Eden holds, when the modification affects previously granted rights; and (c) notice within the Eden Suite platform, when the modification affects platform Users.

21.2 Where the modification requires new consent from the Data Subject, Eden will request it explicitly before the modification takes effect.

22. DATA PROTECTION AUTHORITIES AND COMPLAINTS

22.1 Without prejudice to the Data Subject's right to contact Eden directly, the Data Subject has the right to file a complaint with the competent Data Protection Authority in their jurisdiction. The main authorities in Eden's jurisdictions of operation are listed below:

22.1.1 Mexico — Competent authority for personal data protection. Main legal framework: LFPDPPP and its Regulations.

22.1.2 Brazil — ANPD (Autoridade Nacional de Proteção de Dados). Main legal framework: LGPD (Law No. 13.709/2018).

22.1.3 Colombia — SIC (Superintendencia de Industria y Comercio). Main legal framework: Law 1581 of 2012 and Decree 1377 of 2013.

22.1.4 Peru — ANPDP (Autoridad Nacional de Protección de Datos Personales). Main legal framework: Law 29733 and its Regulations.

22.1.5 Ecuador — SPDP (Superintendencia de Protección de Datos Personales). Main legal framework: LOPDP (Organic Law on Personal Data Protection).

22.1.6 Chile — Personal Data Protection Agency (under implementation). Main legal framework: Law 19.628 and Law 21.719.

22.1.7 European Union — Supervisory authority of the relevant member state. Main legal framework: GDPR (Regulation (EU) 2016/679).

22.1.8 United States — FTC (Federal Trade Commission) and state authorities. Main legal framework: applicable federal and state legislation (HIPAA, CCPA/CPRA, among others).

22.2 Eden reaffirms its willingness to resolve any dispute promptly and amicably through its DPO, without prejudice to the Data Subject's right to approach the competent authorities.

23. APPLICABLE LAW AND JURISDICTION

23.1 This Notice is interpreted and applied in accordance with the personal data protection legislation in force in each jurisdiction where Eden operates. In the event of a conflict between provisions of different jurisdictions, the interpretation most favorable to the Data Subject will prevail, in accordance with the principle of Automatic Maximum Protection established in Clause 3 of this Notice.

23.2 For any dispute arising from the processing of personal data, the courts of the jurisdiction of the Data Subject's domicile will have jurisdiction, unless the applicable law establishes a different rule.

24. CONTACT

24.1 For any question, request, or complaint: (a) email: legal@edenmed.com; (b) postal address: Higia, Inc. — Attn: Data Protection Officer — 300 Delaware Ave., Suite 210 #215, Wilmington, DE 19801, USA; (c) languages of service: Spanish, Portuguese, and English; and (d) EU representative: contact details available at legal.edenmed.com.