Legal

Last updated: September 17, 2026

IMPORTANT NOTICE

Reading, understanding, and accepting these Terms and Conditions constitute a prior condition for the use of EDEN SUITE. Acceptance is perfected through (i) the signing of any Commercial Proposal, Quotation, or Purchase Order that incorporates them by reference; (ii) the creation or use of access credentials to the platform; or (iii) browsing or using the website. Anyone who does not accept these Terms and Conditions in their entirety must refrain from using EDEN SUITE.

PREAMBLE

These Terms and Conditions of Use (the "Terms") constitute the adhesion contract governing access to and use of the EDEN SUITE platform and of the other services, modules, websites, and digital channels operated by EDEN.

EDEN is the commercial name under which the following operate, jointly or individually as applicable to the country and to the specific commercial instrument: Higia, Inc., a company incorporated under the laws of the State of Delaware, United States of America, and its subsidiaries and related entities, including, by way of illustration and not limitation, Eva Health, S.A.P.I. de C.V. (Mexico); United Surgical Importação e Exportação Ltda. (Brazil); Eden Colombia Latinoamérica S.A.S. (Colombia); as well as the other present or future subsidiaries of the group. The legal entity specifically bound to the Client is identified in the respective Commercial Proposal.

These Terms are published and kept available for permanent public consultation on the website legal.edenmed.com. The version in force and its effective date are those recorded in such repository.

These Terms prevail over any prior, simultaneous, or subsequent agreement, statement, offer, communication, declaration, or verbal representation, whether from commercial, technical, support, or any other area of EDEN's personnel. Only written instruments executed by representatives with sufficient authority that expressly and unequivocally modify, limit, or replace them in the relevant respect shall prevail over these Terms.

CLAUSES

1. Legal Nature and Acceptance

1.1 These Terms constitute an adhesion contract by incorporation by reference, under which EDEN uniformly offers the general conditions under which it provides its services. Their nature is that of general contracting conditions, integrated into the Client's consent through the signing of the respective Commercial Proposal or through any of the other forms of acceptance set forth in these Terms.

1.2 Forms of Acceptance. The Client, its Authorized Users, the website Visitors, and other Subjects defined in Clause 6 express their full and unconditional acceptance of these Terms through any of the following conducts, without any additional handwritten signature being required: (a) the signing—handwritten or electronic—of any Commercial Proposal, Quotation, Purchase Order, registration form, service sheet, or analogous instrument that incorporates them by reference; (b) the creation, receipt, activation, or use of access credentials to EDEN SUITE; (c) browsing, accessing, or using EDEN's websites, portals, mobile applications, or digital channels; (d) the submission or processing of DICOM Studies, User Content, or Identifying Data through EDEN SUITE; and (e) the making of payments or the receipt of services under any commercial instrument in force.

1.3 Prior Knowability. EDEN keeps these Terms published with public, free, and gratuitous access on the website legal.edenmed.com, maintaining a historical repository of previous versions. The Client, its Authorized Users, and other Subjects acknowledge having permanent access to the text in force prior to any act of acceptance and declare having consulted, read, understood, and accepted them in all their scope. Prior consultation is legally presumed to be known from the moment such publication is available.

1.4 Incorporation by Reference in Commercial Proposals. The Commercial Proposals, Quotations, and Purchase Orders issued by EDEN shall include, as standard, an express adhesion clause to these Terms. The signing of the respective commercial instrument by the Client entails full, irrevocable, and unreserved adhesion to these Terms in their version in force at the time of signing, unless the instrument itself provides for express modifications pursuant to Clause 1.6.

1.5 Supplementary Character and Precedence. These Terms govern by default any contractual relationship between EDEN and the Client or User, and operate supplementarily with respect to the specific economic and commercial terms set forth in the Commercial Proposal. Where there is a master agreement, master services agreement, individually negotiated license agreement, or other legal instrument expressly executed by the Parties governing the same subject matter, such instrument shall prevail exclusively to the extent it expressly and unequivocally provides otherwise, with these Terms remaining in force as to all matters not provided for.

1.6 Order of Precedence of Documents. In the event of conflict, the following order of precedence shall prevail: (a) master agreement or individually negotiated license agreement executed by the Parties, as to what is expressly agreed; (b) Commercial Proposal, Quotation, or Purchase Order signed by the Client, as to economic terms, commercial scope, and any express modification to these clauses; (c) these Terms; and (d) the technical Documentation and user manuals of EDEN SUITE.

1.7 Capacity and Representation. Any natural person who accepts these Terms in the name and on behalf of a legal entity, institution, or third party declares and warrants having sufficient, valid, and non-revoked authority to bind such legal entity under the terms set forth herein. EDEN shall not be obligated to verify the sufficiency of such authority, and the acts executed shall be deemed fully valid vis-à-vis EDEN. The natural person who accepts without having sufficient authority shall be personally liable for the damages and losses caused.

2. Definitions

2.1 For purposes of these Terms, the words beginning with a capital letter shall have the meaning attributed to them below, unless the context unequivocally indicates another meaning. The terms defined in the Commercial Proposal shall retain their meaning there for purposes of these Terms.

Software Update. The changes and improvements made by EDEN in EDEN SUITE, including corrections, patches, functionality improvements, security adjustments, and new versions of the AI Models.

Contract Year. Period of twelve (12) consecutive months counted from the Start Date established in the Commercial Proposal, and each subsequent period of twelve (12) months during the Term.

Client. The natural or legal person identified as such in the Commercial Proposal, who contracts EDEN's services. When these Terms refer to the "Client," its obligations, declarations, and acknowledgments shall be understood as also made by its Authorized Users, as applicable to them.

User Content. Text, dictation, instructions, templates, parameters, Studies, metadata, and any other information supplied by the Client, its Authorized Users, or any Subject through EDEN SUITE.

Identifying Data. Any data that, on its own or combined with others, allows identifying or making identifiable a natural person, including, by way of illustration and not limitation, name, date of birth, patient identifier, tax or social security identifiers, biometric data, and the other fields contained in the DICOM metadata of each Study.

Data Subject Rights. The rights that the applicable personal data protection legislation in each jurisdiction recognizes to the data subject with respect to their personal data, including, in Mexico, the ARCO Rights (Access, Rectification, Cancellation, and Opposition) provided for in the Federal Law on the Protection of Personal Data Held by Private Parties ("LFPDPPP") and, in other jurisdictions, the analogous rights provided for in their respective laws.

Development. Additional programming, configuration, or customization work that EDEN performs to adapt EDEN SUITE to the Client's specific needs, the scope, deliverables, schedule, and consideration of which are documented in a Commercial Proposal or specific addendum.

Documentation. The user manuals, technical guides, functional specifications, operational guidelines, and other technical documents that EDEN publishes or makes available regarding EDEN SUITE.

EDEN. The commercial name under which Higia, Inc. and its subsidiaries and related entities operate, jointly or individually, as identified in the specific Commercial Proposal.

EDEN SUITE. EDEN's software platform, composed of the following modules: (a) EDEN PACS: system for the visualization, storage, transfer, and management of medical images; (b) EDEN MANAGEMENT: RIS system for the administration of workflows, schedules, orders, and reports; (c) EDEN INTELLIGENCE: information layer, usage metrics, data visualization, and analytics; (d) EDEN CREATOR: assistant supporting the drafting of conclusions, without interpreting images or issuing diagnosis or recommendations, which does not replace the physician; (e) AI REPORT: drafting agent that transforms the User's dictation or text into structured report drafts, under the physician's exclusive review and control, the release of which requires human signature, and which is provided "as is" and "subject to availability"; (f) EDEN AI: diagnostic support module that runs AI Models on DICOM Studies pursuant to Processing Rules to highlight possible findings, without replacing clinical judgment or releasing the professional from their responsibility; and (g) EDEN PORTAL: web module accessible via URL, intended for patients to consult their centralized record, with a mobile DICOM viewer for the visualization of medical images. The specific composition licensed to each Client is identified in the Commercial Proposal.

Execution. Each occasion on which EDEN AI automatically processes a DICOM Study that complies with the active Processing Rules, applying the corresponding AI Model and recording the event in the Audit Records.

DICOM Study or Study. Set of digital medical images and their metadata header, stored in accordance with the DICOM standard, originating from any modality (DX, CR, CT, MR, US, among others).

Specialty Studies. Medical examinations performed outside the scope of radiology and imaging, when integrated into EDEN SUITE through an electronic document or file representative of the study.

Excess Studies. The Studies processed or uploaded by the Client during a Contract Year in excess of the Annual Package applicable to the respective module, according to the parameters set forth in the Commercial Proposal.

Included Studies. The Studies comprised within the Annual Package applicable to the respective module pursuant to the Commercial Proposal.

Start Date. Date indicated as such in the Commercial Proposal, from which the provision of the service begins and, unless the Commercial Proposal provides otherwise, the billing of the periodic consideration.

Confidential Information. The information, data, or documents shared between EDEN and the Client that, by their nature, context, or by express designation, must be kept secret pursuant to Clause 14.

Dissociated Information. Information subjected to anonymization that does not permit direct or indirect identification of an individual under the applicable legal standard and reasonably available means. Pseudonymization or removal of direct identifiers alone does not amount to anonymization.

Validated Report. Report that, after comprehensive human review, is approved and signed by an Authorized User with the required professional standing; only the Validated Report may be released or communicated to third parties.

Integration. Efforts and work aimed at making EDEN SUITE interact correctly with other systems, modalities, or platforms of the Client or third parties.

Applicable Jurisdiction. The jurisdiction of the country where the Client has its principal domicile, or the one expressly identified in the Commercial Proposal, without prejudice to the choice of substantive law and forum provided for in Clause 36.

Model or AI Model. Artificial intelligence algorithm trained to highlight possible findings in a type of DICOM Study defined by Processing Rules.

Activated AI Module. Each artificial intelligence module with respect to which activation, annual package, consideration, and price per excess study have been agreed in the Commercial Proposal.

Missing Persons Search Regulations. The set of provisions that each jurisdiction imposes on private healthcare service providers regarding the registration, interconnection, and handling of inquiries about disappeared or unidentified persons, including, in Mexico, the General Law on the Matter of Forced Disappearance of Persons, Disappearance Committed by Private Parties, and the National Search System for Persons and its complementary provisions, as well as the analogous laws and mechanisms in force in the other jurisdictions where the Client operates.

Cloud or EDEN Cloud. Set of computing, storage, network, and service resources managed by EDEN on third-party infrastructure—currently provisioned on Amazon Web Services ("AWS")—in which EDEN SUITE and its modules reside and operate, including backup and recovery mechanisms. It comprises environments controlled by EDEN in one or several regions defined by it, with encryption of data in transit and at rest, high availability, and operational continuity, with AWS acting as a sub-processor pursuant to Clause 13.

Patient or Portal End User. The natural person who is the holder of the medical study and accesses EDEN PORTAL to consult their record, according to the specific terms of use of the portal.

Annual Package. Maximum number of Studies comprised within the periodic consideration for the respective module during a Contract Year, as established in the Commercial Proposal.

Commercial Proposal. The written instrument—referred to interchangeably as Commercial Proposal, Quotation, Purchase Order, Service Sheet, or equivalent—signed by the Client that identifies the obligated EDEN entity, the specific economic, commercial, and operational conditions, the scope of the contracted services, and which incorporates these Terms by reference.

Audit Records. Unalterable electronic records that set forth User, date and time, Study identifier, template version, generation, editing, and signature events, result of Executions, and cryptographic seal. Their retention period is that established in Clause 9.6.

Processing Rules. Set of filters on the DICOM Tags (metadata), for example Modality, Body Part Examined, or View Position, configured by EDEN together with the Client to determine which Studies each AI Model will be applied to.

Router. Hardware provided by EDEN, where applicable pursuant to the Commercial Proposal, on which the applications necessary to allow interaction between EDEN SUITE, which resides in the Cloud, and the Client's equipment at each Site are run.

Site. Each physical location of the Client where EDEN SUITE is deployed, installed, or used, pursuant to the Commercial Proposal.

AI Suggestions. Textual outputs or markers generated by AI functionalities from the User Content and Study metadata; they do not constitute diagnosis or clinical recommendation.

Subjects. Collectively, the Client, the Authorized Users, the Visitors, the Patients, and any other person who accesses or uses EDEN SUITE or its digital channels.

User or Authorized User. Natural person registered by the Client with valid credentials to access EDEN SUITE, in accordance with the enabled profiles and roles.

Term. The period during which the Client is obligated to receive and pay for the contracted services, in accordance with the provisions of the Commercial Proposal.

Visitor. Any person who accesses EDEN's public website, its informational content, or its digital channels without holding Authorized User credentials.

3. Subject Matter

3.1 These Terms govern: (a) the non-exclusive, non-transferable, non-sublicensable, revocable, and limited license that EDEN grants to the Client over EDEN SUITE, pursuant to the Commercial Proposal; (b) the obligations, rights, and limitations applicable to the Subjects; (c) the regime for the treatment of information, personal data, and intellectual property; (d) the rules of liability, indemnification, support, service levels, termination, and any other related matter; and (e) cooperation with authorities in matters of health, data protection, identification of persons, and other applicable regulations.

3.2 EDEN SUITE is a technological tool to support the healthcare professional. Under no circumstances does it constitute, nor may it be considered, an autonomous clinical decision-making device. Any decision, diagnosis, treatment, or report requires the supervision, review, and human signature of the qualified professional.

4. Contracting Model and Incorporation by Reference

4.1 The specific economic, commercial, and operational terms—including, by way of illustration, the contracting EDEN entity, the licensed modules, the Annual Package of each module, the annual and total value of the contract, the fixed monthly payment, the price per excess study, the Term, the Sites, the payment schemes, the early-payment discounts, the currency, the payment terms, the default interest, the implementation costs, service policy, training, developments, integrations, on-site support, and migrations, and any other monetary parameters—are documented exclusively in the Commercial Proposal. These Terms do not incorporate figures.

4.2 The signing of the Commercial Proposal by the Client entails full adhesion to these Terms and acceptance of the economic and operational parameters set forth therein. Acceptance of the Commercial Proposal may be effected by handwritten signature, advanced electronic signature, simple electronic signature, acceptance by institutional email, or any other suitable means in accordance with applicable legislation.

4.3 Nature of the Consideration. The consideration agreed in the Commercial Proposal remunerates the availability, reserved capacity, and maintenance of the service by EDEN, and not the actual consumption of Studies by the Client. Consequently, the periodic considerations accrue and are payable by the mere passage of the billing period, regardless of the number of Studies the Client processes or uploads.

4.4 No Accumulation. The Studies Included in the Annual Package of each module are not accumulable to subsequent Contract Years, are not refundable in the event of lower consumption, nor transferable to other modules, Sites, or related entities of the Client, unless expressly agreed otherwise in the Commercial Proposal.

4.5 Risk Allocation. The Client acknowledges and accepts that this economic model reflects: (a) the nature of the service as a reserved-capacity license, and not as a consumption-metered service; (b) the fixed costs EDEN incurs in infrastructure, third-party licensing, and personnel assigned to the Client's operation; and (c) an equitable and proportional allocation of risks between the Parties, in accordance with the contractual freedom among merchants recognized by applicable law, including Article 78 of the Mexican Commercial Code and its analogues in the other jurisdictions.

4.6 Excess Studies. The billing of Excess Studies, as well as the activation of the contractual adjustment procedure due to structural growth of the Client's operation, shall be governed by the parameters, thresholds, and prices set forth in the Commercial Proposal. The mere activation of the adjustment procedure does not confer on the Client a right of early termination nor suspend its payment obligations, which subsist in full.

4.7 Periodic Price Review. EDEN may periodically review the considerations in accordance with the mechanism, thresholds, and formulas indicated in the Commercial Proposal. In the absence of an express mechanism, EDEN may review the considerations every twelve (12) months based on the consumer price index published by the competent statistical authority of the Applicable Jurisdiction, or on the variation of the exchange rate between the local currency and the United States dollar, with the higher adjustment prevailing. Any renegotiation due to extraordinary economic circumstances shall be governed by the corresponding clause of the Commercial Proposal or, failing that, by the principles of good faith and contractual balance.

4.8 Taxes and Withholdings. The agreed considerations do not include applicable indirect taxes, which shall be billed in addition in accordance with current tax legislation. Each Party shall be responsible for its own direct tax obligations. If the applicable tax regulations require the Client to make withholdings, the Client shall remit them to the corresponding authority and deliver the receipts to EDEN; the net amounts actually received by EDEN shall be deemed fulfilled for purposes of the payment obligation, without EDEN having to assume increases for gross-up.

4.9 Default. Failure to meet the payment term set forth in the Commercial Proposal shall generate default interest in accordance with the percentage indicated therein or, failing that, in accordance with the highest rate permitted by applicable legislation. Without prejudice to the other consequences provided for in these Terms, EDEN may: (a) from the sixteenth (16th) calendar day of default, place visual resources within EDEN SUITE as a reminder of the obligation; (b) from the thirty-first (31st) calendar day of default, block access to EDEN SUITE, without prejudice to the other legal actions that may apply.

5. Territorial Scope, Contracting Entity, and Applicable Jurisdiction

5.1 Territorial Scope. These Terms govern the relationships between EDEN and the Subjects in all jurisdictions where EDEN provides its services, including, by way of illustration and not limitation, Mexico, Ecuador, Chile, Peru, the Dominican Republic, and other countries of Latin America where EDEN has present or future operations.

5.2 Contracting Entity. The specific legal entity of the EDEN group obligated to the Client is identified in the respective Commercial Proposal. When the Commercial Proposal does not identify a specific entity, the obligated entity shall be the one maintaining the dominant commercial relationship with the Client or, failing that, Higia, Inc., in its capacity as parent.

5.3 Recognition of Public Policy Rules. The Client and EDEN acknowledge and accept that, notwithstanding the choice of substantive law provided for in Clause 36, the public policy rules in force in the Applicable Jurisdiction—particularly those relating to personal data protection, consumer rights where applicable, health regulation, labor rights of the Client's personnel, search for and identification of persons, and the Client's tax obligations—shall prevail over these Terms to the extent strictly necessary to preserve such public policy. The remainder of the clauses shall retain their full effectiveness.

6. Universe of Subjects

6.1 Client. The natural or legal person identified as such in the Commercial Proposal. The Client is liable to EDEN for the full compliance with these Terms, including for the acts or omissions of its Authorized Users, contractors, and personnel in its service who access or use EDEN SUITE.

6.2 Authorized User. Each natural person registered by the Client with valid credentials. The Authorized User undertakes to: (a) comply with these Terms and the Documentation; (b) use EDEN SUITE exclusively for lawful and professional purposes; (c) safeguard their credentials with diligence, without sharing, transferring, or allowing their use by third parties; (d) comply with the applicable confidentiality and professional secrecy obligations; (e) exercise at all times their autonomous professional judgment regarding the result of the AI functionalities; and (f) immediately notify the Client and EDEN of any improper access, breach, or suspected compromise of credentials.

6.3 Visitor. Any person who accesses EDEN's public website without credentials. The Visitor undertakes to: (a) refrain from using automated data extraction techniques, scraping, reverse engineering, or any act that compromises the security or integrity of the site; (b) respect the intellectual property over the published content; and (c) acknowledge that the information available on the public site is of a general informational nature and does not constitute medical, legal, tax, or any other professional advice.

6.4 Patient or Portal End User. The natural person who is the holder of the medical study and accesses EDEN PORTAL. The Patient's access to the portal is governed supplementarily by these Terms as applicable to them and, principally, by the specific terms of use of EDEN PORTAL and by the privacy notice of the Client providing the healthcare service. EDEN acts exclusively as a provider of the technological tool and not as a provider of the healthcare service.

6.5 Functional Solidarity. The Client shall be liable to EDEN for the acts, omissions, or breaches of the Authorized Users it has registered or authorized, as well as for improper access to EDEN SUITE arising from the inadequate management of credentials or the failure to timely notify deactivations or changes.

7. License of Use

7.1 EDEN grants the Client a license with the following characteristics: non-exclusive, non-transferable, non-sublicensable, revocable, limited, and onerous, to access and use EDEN SUITE online, through the channels enabled by EDEN, by means of Authorized Users' credentials, exclusively for the lawful and professional purposes that are the subject of the contract, during the Term and subject to timely payment of the considerations.

7.2 Scope. The license comprises exclusively: (a) access to and use of EDEN PACS within the contracted Annual Package; (b) access to and use of each Activated AI Module within its respective Annual Package; and (c) the use of the other contracted modules pursuant to the Commercial Proposal and the Documentation. Use by the Client's related entities, affiliates, branches, or different third parties shall require an additional license.

7.3 Restrictions. The Client and the Authorized Users shall refrain from: (a) copying, modifying, translating, disassembling, decompiling, reverse engineering, or creating derivative works of EDEN SUITE; (b) assigning, leasing, lending, sublicensing, marketing, distributing, or making EDEN SUITE available to third parties; (c) removing intellectual property notices; (d) interfering with the operation of EDEN SUITE, circumventing security mechanisms, or using it for unlawful purposes; (e) using EDEN SUITE for purposes other than those provided for herein; (f) using data generated or available through EDEN SUITE to train artificial intelligence models of their own or of third parties without EDEN's express authorization; and (g) performing load, penetration, or security tests without EDEN's prior written authorization.

8. EDEN's Obligations

8.1 EDEN shall make available to the Client the Software Updates and the Documentation necessary for the use of EDEN SUITE, as well as the initial training comprised in the contracted implementation. EDEN retains the right to market EDEN SUITE with third parties without this implying a breach.

8.2 EDEN warrants that EDEN SUITE will be free of material defects in its construction, and that the support materials will be free of defects in materials and workmanship. This warranty does not apply if the malfunction is due to accidents, abuse, improper or negligent use by the Client's Subjects, or breach of the technical prerequisites.

8.3 With respect to the modules with artificial intelligence functionalities (EDEN CREATOR, EDEN AI, and AI REPORT), EDEN assumes no warranties of clinical performance or results; its obligation is limited to reasonable technical availability, the security of processing, and the timely correction of software failures.

8.4 EDEN shall provide general support through the channels defined in EDEN SUITE, with the hourly coverage stipulated in Clause 22. The response and resolution times, priorities, reception hours, and exclusions are governed by Clause 20 (Service Level Agreement). EDEN does not offer support for configurations or problems with the Client's medical image printing or acquisition equipment.

8.5 EDEN's obligations do not comprise the compliance, on behalf of the Client, with regulatory, health, or data protection obligations that applicable regulations directly impose on the Client in its capacity as healthcare service provider or as data Controller.

9. Client's Obligations

9.1 Technical Prerequisites. The Client undertakes to ensure that the use of EDEN SUITE is carried out exclusively on equipment and environments that comply, as a minimum, with the technical conditions that EDEN publishes in its Documentation, including, by way of illustration: minimum computing, memory, storage capacities, stable and sufficient symmetrical connectivity, compatible operating system, and monitors adequate to the clinical use for which they are intended. The primary diagnostic interpretation workstations used by radiologists must have certified medical-grade monitors, with the minimum resolution required by local regulation for each modality, and comply with DICOM Part 14 calibration.

9.2 Institutional Responsibility. The Client shall be responsible for: (a) using and maintaining appropriate and calibrated monitors according to the type of workstation and applicable local regulation; (b) ensuring that diagnostic quality is consistent with best practices; and (c) complying with all current health regulations. The Client acknowledges that the quality of the diagnosis depends on the quality and calibration of the monitor used.

9.3 Go-Live and Initial Training. The Client undertakes to schedule and complete the go-live of EDEN SUITE and the initial training program within the periods set forth in the Commercial Proposal. After the periods have elapsed without the go-live having been completed for reasons attributable to the Client, EDEN—after notice with at least forty-eight (48) hours' advance notice to the declared email address—shall commence billing, without prejudice to the payment of reasonable fees for rescheduling.

9.4 Own Regulatory Compliance. The Client undertakes to comply with all laws, regulations, rules, and official standards applicable to the professional practice of medicine, radiology and imaging, and the provision of healthcare services in the Applicable Jurisdiction, including, without limitation, the general health laws, the clinical record standards, the personal data protection laws (including, in Mexico, the LFPDPPP; in Chile, Law 19.628 and its amendments; in Peru, Law 29733; in Ecuador, the LOPDP; in the Dominican Republic, Law 172-13; and their respective regulations), and the Missing Persons Search Regulations pursuant to Clause 16.

9.5 Ownership of Information. The Client is the sole and exclusive owner of and responsible for the information generated or acquired through EDEN SUITE, including the information of its employees, physicians, and patients. EDEN acts solely as Processor under the applicable personal data protection legislation. Contractual ownership does not transfer or limit individuals’ rights over their personal data. These roles concern clinical processing on the Client’s behalf; each party is responsible for its processing for its own purposes under applicable law.

9.6 Retention of Information. The information of the Studies and Specialty Studies shall be stored and protected in the EDEN Cloud for a period of no less than ten (10) years, except as provided in Clause 14 on dissociation and in Clause 21 on cold storage. The Audit Records shall be retained for the same period.

9.7 Metadata and Templates. The Client shall be responsible for the truthfulness, sufficiency, and quality of the DICOM metadata, as well as for the maintenance of the templates and terminology used in AI REPORT and EDEN CREATOR.

9.8 Electrical and Environmental Infrastructure. Where applicable pursuant to the Commercial Proposal, the Client undertakes to provide, install, and keep operational, at each Site where a Router or other EDEN equipment is installed: an uninterruptible power supply system with sufficient autonomy, voltage regulator, surge suppressor, physical ground with reasonable resistance, and dedicated electrical circuit; as well as to install the Router in a space with adequate ventilation, without exposure to direct sunlight, excessive dust, or humidity. EDEN may request evidence of compliance.

9.9 Identifying Data. The Client shall be the sole party responsible for the capture, quality, truthfulness, sufficiency, updating, and consistency of the Identifying Data contained in the DICOM metadata and other patient fields uploaded to EDEN SUITE. EDEN does not standardize, validate, clean, or normalize such Identifying Data, nor does it assume responsibility for the consequences arising from its insufficiency, inaccuracy, heterogeneity, or lack of updating, including those before the authorities in matters of search for and identification of persons.

9.10 Anti-Corruption and Sanctions Compliance. The Client undertakes to act in accordance with applicable laws on the prevention of money laundering, terrorist financing, anti-corruption, and international sanctions, using exclusively funds from lawful sources to fulfill its obligations under these Terms.

10. User Designation and Account Management

10.1 The Client shall designate and notify EDEN in writing of at least one Administrative Officer—and the additional backup administrators it deems necessary—for the management and administration of EDEN SUITE on its behalf, indicating the full name and institutional email address of each.

10.2 Only the Administrative Officer, and where applicable the authorized administrators, may request EDEN to add or remove Users. It shall be the Client's responsibility to ensure that every registered person has the authorization and authority necessary to exercise the functions arising from their access.

10.3 The Client shall keep the data of the Administrative Officer and additional administrators updated, notifying EDEN of any change within three (3) business days following its occurrence.

10.4 EDEN shall not be liable for damages, claims, or losses arising from the improper access to the platform by Users registered at the request of the Client or the Administrative Officer. Any access, action, or omission by such Users shall be understood as attributable to the Client.

10.5 The credentials are personal, non-transferable, and for individual use. The Client shall adopt reasonable security and supervision measures to prevent access by malicious or unauthorized Users, including robust password policies, multi-factor authentication when available, and periodic review of accesses.

10.6 The Administrative Officer shall serve as EDEN's single point of contact for notifications, requirements, and communications arising from the Missing Persons Search Regulations pursuant to Clause 16, and as a valid recipient for any notification that EDEN directs to the registered institutional email.

11. Artificial Intelligence Modules

11.1 Nature. The Activated AI Modules form an integral part of the contracted license. The economic terms of each Activated AI Module are governed exclusively by the Commercial Proposal.

11.2 Configuration of Processing Rules. Prior to the start of EDEN AI operation, the Parties shall define in writing the Processing Rules applicable to each AI Model. The Client shall provide representative Study examples and shall be responsible for its images containing complete and truthful metadata. Any subsequent change to the Rules must be documented and shall take effect when EDEN confirms its technical application.

11.3 AI REPORT: Mandatory Human Signature. No content generated by AI REPORT may be released or communicated to third parties without the approval and human signature of an Authorized User with the required professional standing; only thus shall it have the character of a Validated Report. AI REPORT does not interpret images or issue diagnosis or recommendations; it is a tool to support the medical professional.

11.4 Templates and Terminology. The Client shall define and maintain its templates, mandatory fields, and standardized terminology; EDEN is not responsible for their clinical suitability.

11.5 Calculation Basis and Commercial Activation. The calculation basis of the Annual Package of the AI Modules, the initial evaluation period, the commercial activation mechanisms, and the effects of the Client's silence at the end of the evaluation period are governed by the Commercial Proposal. In the absence of an express rule, the Client's silence at the end of the evaluation period shall operate as a rejection of the activation proposal and shall give rise to the deactivation of the respective module at no cost or penalty.

11.6 Quality and Editing. The Client shall review and edit all content generated by the AI functionalities before its signing or release. EDEN does not warrant the absence of errors, omissions, or inconsistencies in the AI Suggestions.

11.7 Availability. The AI functionalities are provided "as is" and "subject to availability," without warranties of clinical performance or results.

11.8 Traceability. EDEN shall retain versions, edits, approvals, and signature in the Audit Records for the period provided in Clause 9.6.

12. Health Compliance and Prohibited Uses

12.1 EDEN SUITE and its AI modules are tools to support the medical professional and do not replace the clinical judgment or the professional responsibility of the Client and its Users. The Client undertakes to use EDEN SUITE in compliance with the health legislation applicable to its Jurisdiction, including, without limitation: the General Health Law and NOM-004-SSA3-2012 in Mexico, as well as the analogous health laws and technical standards in each jurisdiction where it operates; the regulations of the competent health authorities; and the Missing Persons Search Regulations pursuant to Clause 16.

12.2 Prohibited Uses. EDEN SUITE and its AI modules are not authorized, nor shall they be used: (a) as an autonomous clinical decision-making device; (b) for diagnosis or treatment without human review, supervision, and signature; (c) in contravention of the Documentation or good clinical practices; (d) for clinical research purposes with human subjects without the authorizations and ethics committees required by applicable legislation; (e) for the processing of information of minors without the safeguards required by law; and (f) for any purpose contrary to law, morality, or good customs.

13. Information Security, Sub-Processors, and Transfers

13.1 EDEN shall maintain reasonable and proportional technical, administrative, organizational, and physical measures to protect the data processed through EDEN SUITE, including role-based access controls, encryption in transit and at rest, cryptographic key management, audit records, vulnerability management, backup, and periodic testing. EDEN shall review such measures as the state of the art evolves.

13.2 Sub-Processors. EDEN may rely on providers and sub-processors, including Cloud infrastructure providers (currently AWS) and complementary services (monitoring, telemetry, authentication). EDEN shall require its sub-processors to maintain security measures substantially equivalent to its own and shall be liable for their acts or omissions on the same terms on which it is liable for its own, subject to the caps and exclusions of Clause 18.

13.3 Cross-Border Processing. The Client acknowledges international processing necessary for EDEN’s Cloud architecture. EDEN will document and implement the mechanism and safeguards required for each flow, distinguishing transfers to third-party controllers from communications to processors or subprocessors. Where standard clauses are required, their mandatory text, modules and annexes will be completed and incorporated and applicable formalities satisfied before the transfer. The Client will reflect relevant flows in its privacy notice and meet its obligations as Controller. Commercial acceptance does not replace required legal bases, authorizations or transfer mechanisms.

13.4 Incident Notification. The Client shall notify EDEN, within a reasonable time, of any security incident of which it becomes aware and that affects the information processed in EDEN SUITE, collaborating in its containment and investigation. EDEN shall notify the Client of material security incidents that affect its data, within reasonable periods in accordance with the nature of the event and applicable regulations. The requirements of authorities in matters of search for and identification of persons do not, by themselves, constitute security incidents for purposes of this Clause. Where personal data are affected, initial notice to the Controller will be given without undue delay and in sufficient time to meet applicable statutory deadlines, even if investigation continues; any shorter mandatory period prevails.

14. Confidentiality and Personal Data

14.1 Confidentiality. The Subjects may only disclose Confidential Information to persons with a justified need to know it in order to fulfill the obligations arising from these Terms, provided that such persons are subject to an equivalent confidentiality obligation. Any disclosure in contravention shall generate liability for the damages caused. No copies of Confidential Information shall be made without the prior consent of the party that provided it. If an authority requests Confidential Information, the requested party shall notify the other and shall deliver only the requested information, doing what is reasonably possible to protect its confidentiality. Notice of an authority’s request will be withheld or deferred where disclosure is prohibited by law or the competent authority.

14.2 Confidential Information is considered an industrial secret protected by industrial property laws and other applicable laws. The confidentiality obligations shall subsist indefinitely or, failing that, for the maximum period permitted by applicable legislation.

14.3 Processing of Personal Data. When exchanging personal data, the parties must obtain them lawfully and comply with the legislation in force in the Applicable Jurisdiction, ensuring the integrity and quality of the personal data and maintaining sufficient security measures to protect them against damage, loss, alteration, destruction, or unauthorized use.

14.4 Patient Consent. The Client, as healthcare provider and Controller, will obtain and retain consent or authorization for sensitive-data processing where required, in the applicable form, or document a valid statutory exception for the particular purpose. EDEN, as Processor and software provider, handles data on the Client’s behalf and does not replace its patient relationship or its duty to inform and obtain consent. Health, life-protection or research exceptions apply only within their legal conditions. Each party retains mandatory obligations applicable to its own activities.

14.5 Privacy Notice. EDEN maintains its Global Privacy Notice in Spanish, English and Portuguese at legal.edenmed.com. Each party will maintain its applicable privacy documentation and accurately describe purposes, roles and data flows. The Client will include processing by EDEN and its subprocessors in its information to Data Subjects, with the required lawful bases and authorizations.

14.6 Data Subject Rights. The Client, in its capacity as Controller, shall directly attend to requests for the exercise of Data Subject Rights. EDEN shall reasonably cooperate with the Client, in its capacity as Processor, to attend to such requests to the extent technically and operationally feasible.

14.7 Sending of Results through Digital Channels. EDEN may send Study results via instant messaging, QR codes, or unique links, using the contact information provided by the Client and by the User who is the holder of the data in the context of the clinical relationship. Such results are transmitted using reasonable encryption and security mechanisms, with unique links that function in practice as access credentials. Any disclosure or sharing of such links is carried out under the exclusive responsibility of whoever shares them.

14.8 Delivery upon Termination. Upon termination of the relationship, EDEN shall deliver to the Client the information of its property and of third parties that it holds in custody, in accordance with the Outbound Data Migration procedure of Clause 25.

15. Dissociation, Service Improvement, and Model Training

15.1 The Parties acknowledge that EDEN may anonymize information processed through EDEN SUITE within applicable law, instructions and contractual permissions. Collection of personal data and the preceding anonymization process must have a valid legal basis. Once the Dissociated Information standard is met, EDEN may use it for research, development, analysis, quality assurance, feature improvement, cybersecurity, metrics and training or evaluation of its own models and components, without identifying any individual.

15.2 EDEN shall implement and maintain reasonable and proportional technical, administrative, and physical measures to: (a) minimize the information used by its AI services; (b) ensure the logical separation of domains between EDEN SUITE and the AI modules; (c) protect the information during any phase of processing, including the dissociation process; and (d) reduce risks of re-identification, unauthorized access, leakage, or inference.

15.3 EDEN shall not attempt to re-identify the Dissociated Information nor allow third parties to do so; it shall contractually prohibit re-identification to its sub-processors and authorized providers. If EDEN reasonably determines that a data set does not comply, or has ceased to comply, with the standard of Dissociated Information, it shall treat it as personal data under applicable law and apply the corresponding controls, including, where appropriate, its blocking, suppression, or re-dissociation.

15.4 Use of Dissociated Information meeting the applicable legal anonymization standard does not require consent to personal-data processing for that anonymous output. This rule does not waive legal requirements for the preceding collection and processing. The Client may not require EDEN to obtain consents for permitted use of Dissociated Information; each party retains its notice, lawfulness and consent obligations for personal data under its control.

15.5 EDEN may generate aggregated, statistical, or synthetic information derived from Dissociated Information, provided that it does not allow identifying any person.

16. Cooperation regarding the Missing Persons Search Regulations

16.1 Regulatory Framework and Role of the Parties. The Parties acknowledge that the Missing Persons Search Regulations in force in each jurisdiction—including, in Mexico, the General Law on the Matter of Forced Disappearance of Persons, Disappearance Committed by Private Parties, and the National Search System for Persons, and the Guidelines, Technical Manuals, and administrative provisions issued by the competent authorities—create obligations of registration, interconnection, and handling of inquiries for private parties that provide healthcare services and administer databases with Identifying Data. The Client is the Controller of the processing; EDEN acts exclusively as Processor and software provider.

16.2 Transfer of Substantive Responsibility. The Client, in its capacity as Controller and healthcare service provider, shall be the sole party obligated to substantive compliance with the Missing Persons Search Regulations, including: (a) determining whether the registration obligation before the corresponding identification platforms or systems applies to it and, where appropriate, requesting and keeping it in force; (b) processing and retaining the corresponding access credentials and authentication means; (c) attending to the requirements of the competent authorities, within the periods and formats required; (d) updating its privacy notice and its legal bases to reflect the legal exception of processing without consent, where applicable; and (e) responding before the authority for the integrity, truthfulness, sufficiency, and updating of the Identifying Data uploaded to the system. This contractual allocation does not exclude obligations or compliance with requests imposed directly on EDEN by law or a competent authority.

16.3 Basis for the Transfer. The Parties expressly acknowledge and accept that: (a) the DICOM metadata and the Identifying Data residing in EDEN SUITE are captured, uploaded, or supplied by the Client and its Users, without EDEN having control over their content, structure, coding criteria, or truthfulness; (b) the practice of the Client and of the industry regarding patient identifiers is heterogeneous and variable, so the data are not homogenized or standardized at the EDEN SUITE level; (c) consequently, EDEN lacks the material and legal capacity to directly execute comprehensive searches, selective queries, substantive validations, or responses to the authority without specific instructions and operational support from the Client; and (d) this transfer is fully analogous to that provided for with respect to patient consent, since EDEN, as software provider and Processor, is not the appropriate party to directly assume the obligation before the data subject or before the authority.

16.4 EDEN's Cooperation. Without prejudice to the substantive transfer, EDEN shall reasonably cooperate with the Client to: (a) attend to written and specific instructions aimed at its compliance; (b) provide technical information under its control about the storage structure and the relevant DICOM metadata fields; (c) enable, subject to prior quotation and pursuant to Clause 24, the Developments or Integrations necessary for the Client to interconnect directly with the corresponding identification platform or system, or to do so through the homologated provider of its choice; and (d) where applicable, facilitate the specific extraction of information pursuant to Clause 25. EDEN shall not act as operator, intermediary, representative, or interlocutor of the Client before the authorities, nor shall it assume technical, operational, or regulatory obligations before the authority on behalf of the Client.

16.5 Direct Requirements to EDEN. If EDEN receives a requirement, summons, notification, official letter, or other communication from an authority related to the Missing Persons Search Regulations involving the Client's data, EDEN: (a) shall notify the Client within a reasonable time, unless the legal provision itself or the authority expressly prohibits such notification; (b) shall attend to the request, limiting itself strictly to what is expressly required and to what it is technically and legally in a position to provide; and (c) where the regulations permit, shall coordinate the response with the Client.

16.6 Indemnity. The Client shall hold EDEN harmless and keep it free and safe from any fine, sanction, claim, expense, or liability arising from: (a) the Client's breach of the obligations provided for in this Clause or in the Missing Persons Search Regulations; (b) the insufficiency, inaccuracy, heterogeneity, or lack of updating of the Identifying Data uploaded by the Client or its Users; or (c) the determination by a competent authority that the Client should have provided substantive compliance with the obligation and did not do so. This indemnity shall not apply to sanctions imposed on EDEN for proven willful misconduct or gross negligence in its own obligations as Processor.

16.7 Costs. Any development work, technical integration, data export or extraction, or professional services that the Client requires from EDEN to comply with the Missing Persons Search Regulations shall be quoted and billed independently in accordance with the corresponding Commercial Proposal or addendum.

17. Intellectual Property

17.1 EDEN and its licensors retain all rights over EDEN SUITE and its modules, as well as over the software program, source and object code, Models, algorithms, parameters, Documentation, interfaces, designs, databases, and technical know-how, and over the trademarks, trade names, and other distinctive signs of EDEN.

17.2 The Client retains ownership of the Studies, the User Content, the data and metadata it incorporates into EDEN SUITE, and the Validated Reports generated under its review and signature. The Client's trademarks, trade names, and distinctive signs are and shall remain its exclusive property.

17.3 The license is granted solely as a non-exclusive, non-transferable, revocable license without the right to sublicense, for the term of the contract and in accordance with its purpose. These Terms do not assign or transfer any intellectual property.

17.4 The AI Suggestions and the drafts generated by EDEN CREATOR and AI REPORT are for the Client's internal use in the preparation of Validated Reports; as long as there is no human signature, they do not confer additional rights nor may they be released to third parties. The automated generation and the underlying models do not confer on the Client any right over the software program or over the models.

17.5 The Client grants EDEN a non-exclusive, worldwide, perpetual, irrevocable, and free license to use the feedback, comments, and improvement suggestions it provides, for purposes of refining the service, without disclosing Confidential Information or identifiable personal data.

17.6 The Client shall refrain from copying, modifying, translating, disassembling, decompiling, reverse engineering, or creating derivative works; it shall not remove intellectual property notices or circumvent security measures; it shall not assign, lease, sublicense, or make EDEN SUITE available to third parties without EDEN's prior written authorization.

17.7 Third-Party Components and Open Source. Certain functionalities may incorporate third-party or open-source software programs subject to their own licenses; their use does not imply transfer of ownership to the Client; EDEN shall make available the applicable notices where appropriate.

17.8 Notification of Infringements. The Parties shall notify each other without delay of any alleged infringement relating to EDEN SUITE; EDEN may, at its discretion, attend to, defend, or settle such claims, without this implying acknowledgment of liability towards the Client.

17.9 Advertising Use. The Client authorizes EDEN to use its trade name and logo for advertising purposes linked to EDEN SUITE, respecting quality standards and without modifications to the signs. This authorization shall be in force during the life of the contract and may be revoked by the Client with thirty (30) calendar days' prior notice, in which case EDEN shall cease the use in digital media immediately and in printed materials from the next reasonable reprint.

18. Limitation of Liability

18.1 To the maximum extent permitted by applicable law, and except as expressly provided in these Terms, EDEN shall not be liable, under any circumstances, for indirect, incidental, special, punitive, exemplary, or consequential damages, including, without limitation, loss of opportunities; loss of profits, income, or anticipated savings; business interruption; loss, corruption, or restoration of data; or costs of substitute goods or services, arising from or related to the use or the inability to use EDEN SUITE.

18.2 Liability Cap. EDEN's total cumulative liability to the Client for any claim arising from or related to these Terms, EDEN SUITE, or any of its modules (including EDEN CREATOR, EDEN AI, and AI REPORT), whether for contractual, tort, strict, or any other type of liability, shall not exceed, in the aggregate, the amount equivalent to three (3) months of considerations invoiced and actually paid by the Client to EDEN during the twelve (12) months immediately preceding the date of the first written notice of the claim to EDEN pursuant to Clause 32. If at the date of the claim twelve (12) months of billing have not been completed, the cap shall be calculated based on the average monthly amount invoiced and actually paid, multiplied by three (3). The foregoing shall not apply to: (a) damages caused by EDEN's willful misconduct or gross negligence; or (b) cases that, under applicable law, cannot be limited or excluded.

18.3 For clarity: (a) EDEN SUITE, including its AI modules, is a technological support tool and does not replace the professional, clinical, or medical judgment of the Client or its Users; (b) the Client is the sole party responsible for the decisions, interpretations, and actions arising from its use; and (c) EDEN shall not be liable for failures, errors, or delays attributable to services, data, systems, or third parties beyond its control (including infrastructure, telecommunications, or Client integration providers), nor for the use of EDEN SUITE in contravention of the Documentation or of good security and operation practices.

18.4 Essential Element. The Client acknowledges and accepts that: (a) the liability cap constitutes an essential element of the negotiation and of the objective basis of the agreement; (b) without such cap, EDEN would not enter into the contract or make EDEN SUITE available to the Client under the economic conditions provided for; (c) the cap reflects a reasonable and proportional allocation of risks in commercial technology transactions among merchants; and (d) to the extent applicable law imposes restrictions, these shall be interpreted in the broadest sense permitted, without affecting the validity of the rest of the Clause. In the event of conflict between this Clause and any other provision, this Clause shall prevail, except in cases not limitable by law.

18.5 Fines and Sanctions of Third Parties. Neither Party shall be obligated to pay the other fines, sanctions, penalties, or charges imposed by third parties, unless: (a) there is a final resolution of a competent authority imposing them on the obligated party; and (b) the corresponding reimbursement or indemnification obligation is expressly provided for in these Terms. In particular, fines or sanctions arising from the Missing Persons Search Regulations shall be governed by Clause 16.6.

19. Indemnity

19.1 EDEN's Indemnity for Intellectual Property. EDEN shall defend the Client against third-party claims alleging that EDEN SUITE infringes intellectual property rights, and shall cover the costs, expenses, and indemnifications to which it is sentenced by final judgment, subject to Clause 18. The requirements shall be: (a) timely written notice to EDEN; (b) control of the defense and negotiation by EDEN; and (c) reasonable cooperation by the Client. There shall be no indemnity obligation when the claim arises from: (i) unauthorized use or use outside the Documentation; (ii) modifications not made by EDEN; (iii) combination with software, data, or equipment not provided by EDEN; or (iv) User Content.

19.2 If the infringement is established or reasonably probable, EDEN may, at its election: (a) obtain a license allowing continued use; (b) modify EDEN SUITE to avoid the infringement; or (c) if neither of the foregoing is reasonable, terminate the contract or the affected part with a prorated refund of prepaid and unaccrued considerations, as the Client's sole and exclusive remedy for this concept.

19.3 Client's Indemnity. The Client shall hold EDEN harmless from any claim, fine, sanction, damage, or expense arising from: (a) improper or unauthorized use of EDEN SUITE by its Users, contractors, or personnel; (b) User Content uploaded to EDEN SUITE; (c) the Client's breach of health, personal data, tax, labor, or any other regulation applicable to its operation; (d) infringement of medical lex artis or errors in clinical decisions; (e) acts or omissions arising from the Missing Persons Search Regulations pursuant to Clause 16.6; and (f) any claim of a Patient or third party arising from the Client's activity or from the provision of the healthcare service.

20. Service Level Agreement

20.1 Committed Availability. EDEN commits to a monthly availability of EDEN SUITE equal to or greater than ninety-nine point five percent (99.5%) (the "Target Level"), measured as the percentage of the total time of the calendar month in which the platform is operational and accessible, excluding scheduled maintenance windows and the events excluded pursuant to this Clause.

20.2 Scheduled Maintenance Windows. EDEN may perform scheduled maintenance with at least forty-eight (48) hours' prior notice, preferably during hours of low operational activity. Scheduled maintenance and emergency maintenance reasonably necessary to preserve the security or integrity of the service do not count for the calculation of availability.

20.3 Classification of Incidents. The incidents reported by the Client are classified by EDEN according to the corresponding priority, taking into account the description and operational impact. The specific response and resolution times are published in the Documentation. Any reclassification must be documented.

20.4 Attribution Rules. An incident shall be considered attributable to EDEN only when the documented root cause resides in: (a) the EDEN SUITE platform; (b) the EDEN Cloud or its sub-processors; (c) configurations or code under EDEN's operational control; or (d) the Router during the initial warranty period. EDEN shall retain sufficient technical traceability to document the root cause of each critical incident and shall make it available to the Client when the Client reasonably requires it.

20.5 Exclusions. Events whose root cause resides in the Client's technical, operational, or third-party ecosystem shall not be considered attributable to EDEN, including, without limitation: (a) changes in the Client's internal network or firewall; (b) loss of connectivity of the site or of any Site; (c) disconnection, shutdown, restart, or relocation of the Client's medical imaging equipment; (d) local configuration changes not previously notified; (e) outages or failures of the Client's PACS, RIS, HIS, or third-party systems; (f) expiration or deficient rotation of local credentials; (g) outages of the Client's VPN or tunnels; (h) saturation or malfunction of local storage; (i) changes in the Client's security policies or controls; (j) failures, outages, or fluctuations of the Client's electrical infrastructure, or breach of Clause 9.8; (k) actions arising from the Missing Persons Search Regulations attributable to the Client; and (l) analogous causes attributable to the Client's ecosystem. Force majeure events pursuant to Clause 28, suspensions for default, regulatory changes, and use in contravention of the Documentation likewise do not count.

21. Cold Storage, Rehydration, and Retention

21.1 EDEN reserves the right to move to cold storage those Studies older than five (5) years.

21.2 Rehydration Times. The Studies moved to cold storage may require a rehydration time of no more than seventy-two (72) hours from the Client's formal request to restore them to hot access.

21.3 SLA Exclusion. The access times to Studies in cold storage and the rehydration process are expressly excluded from the calculation of availability and from the response and resolution times.

21.4 Extended Hot Storage. The Client may request, through a Commercial Proposal or addendum, the extended retention in hot storage of Studies older than five (5) years, subject to prior quotation of the corresponding additional cost.

22. Support

22.1 EDEN shall provide support through the official channels indicated in EDEN SUITE on its website. The reception of reports of critical incidents shall be maintained 24/7/365. For medium- or low-priority incidents, reception shall take place on business days and hours in accordance with the Mexico City time zone (UTC-6), unless the Commercial Proposal provides for other coverage.

22.2 On-Site Support. On-site support is not included in the ordinary considerations. If required, it shall be quoted and billed independently, considering the geographic location of the Site, travel expenses, fees, and administrative costs, in accordance with the Commercial Proposal or specific addendum.

22.3 Exclusion. EDEN does not offer support for configurations or problems with printing equipment, modalities, peripherals, or third-party systems of the Client. If the Client decides not to contract the on-site support recommended by EDEN for the handling of failures that reasonably require physical presence, EDEN shall be released from any liability arising from the lack of such assistance.

23. Router, Hardware, and Infrastructure

23.1 Ownership and Return. When the Commercial Proposal provides for the delivery of a Router, it shall be the property of EDEN and must be returned at the end of the contract, allowing for normal wear and tear. If not done, the Client shall pay the current value of the equipment plus the associated expenses, covered by the bailment agreement (comodato) executed for that purpose.

23.2 Useful Life and Renewal. The estimated technical useful life of the Router is two (2) to three (3) years in accordance with industry standards, without such estimate constituting a warranty of operation for a determined period or an obligation of replacement at no cost beyond the initial warranty period. Once the useful life is exhausted, the renewal shall be the responsibility of the Client, who shall assume the cost of the new equipment at EDEN's current list price. EDEN shall cover at no charge the associated shipping, reinstallation, configuration, and reactivation services when the need for renewal arises from the normal life cycle. In the event of failures attributable to the Client, all costs shall be borne by it.

23.3 Warranty Exclusions. The Router warranty is excluded when the damage, failure, or interruption is a direct or indirect consequence of: (a) breach of the electrical and environmental infrastructure conditions of Clause 9.8; (b) use of extensions, non-industrial power strips, or provisional electrical connections; or (c) modifications, relocations, or manipulations carried out by personnel not authorized by EDEN.

23.4 Connectivity. EDEN SUITE, including the AI Modules, requires connectivity to Cloud services. The unavailability of connectivity or of the Client's provider services may temporarily limit or suspend such functionalities without liability for EDEN.

24. Integrations with Third-Party Systems and Developments

24.1 When EDEN SUITE is integrated with third-party systems (HIS, RIS, third-party PACS, billing systems), the performance, availability, and behavior of such systems are not EDEN's responsibility. The costs of integration, adaptations, licenses, and maintenance of third-party systems are borne by the Client, unless otherwise documented.

24.2 Scope of Support. EDEN provides technical support exclusively over the components under its operational control, including: the EDEN SUITE platform and its modules; the Router and the connectivity between the Site and the Cloud; the configuration of sending, routing, and processing rules within EDEN SUITE; and the integration interfaces (APIs, web services, HL7/FHIR protocols) on EDEN's side.

24.3 Support Exclusions. EDEN assumes no support, configuration, maintenance, or incident resolution responsibility over: hospital information systems (HIS); enterprise resource planning systems (ERP); billing, accounting, or financial administration systems; third-party electronic clinical records; third-party PACS, RIS, or viewers; laboratory systems (LIS); payment gateways; mail, active directory, or third-party authentication servers; medical image acquisition equipment and its firmware; printers, disc burners, or other peripherals; and the identification platforms or intermediate systems contracted by the Client to attend to the Missing Persons Search Regulations.

24.4 Technical Coordination. When the resolution of an incident requires coordinated action between EDEN and a third-party systems provider, EDEN shall collaborate by providing the technical information under its control. The coordination, contracting, and costs of the third-party provider shall be the Client's responsibility.

24.5 Developments and Professional Services. The Developments, Integrations, and additional professional services shall be governed by the Commercial Proposal or signed addendum specifying scope, deliverables, schedule, and prices. Unless expressly agreed, the results and deliverables of the Developments shall be EDEN's intellectual property, which shall license them to the Client under the terms of Clause 17. The acceptance of deliverables shall be deemed tacit if the Client does not submit observations in writing within ten (10) calendar days following their delivery.

25. Inbound and Outbound Data Migration

25.1 Inbound Migration. When the Commercial Proposal provides for Inbound Data Migration, EDEN shall coordinate with the Client the extraction, transfer, and loading to EDEN SUITE of the Studies and associated information from the previous system, in accordance with the scope, volume, schedule, and prices agreed in the Commercial Proposal. The execution is conditioned upon the Client: (a) proving ownership or authority to transfer the migrated information; (b) granting technical access to its source systems; (c) providing the metadata mapping and technical documentation of the source system; and (d) ensuring the integrity of the linkage between images, reports, and metadata. The Inbound Migration is an independent professional service; the amounts invoiced are not refundable in the event of early termination.

25.2 Outbound Migration. The mass extraction of DICOM Studies or other formats due to termination, migration to another provider, or the Client's request constitutes an additional independent professional service, chargeable in accordance with the Commercial Proposal or specific quotation. EDEN shall deliver a formal quotation within ten (10) business days following the Client's written request. The Outbound Migration shall be paid in advance, as a prior condition for the start of the extraction. EDEN shall not be obligated to begin the Outbound Migration while there are unpaid amounts under the contract.

25.3 Times. The Parties acknowledge that the Inbound Migration and the Outbound Migration require case-by-case estimation, without EDEN guaranteeing specific periods. The times depend on the volume, technical complexity, and availability of destination systems.

25.4 Scope and Format. The Outbound Migration shall comprise the delivery of DICOM Studies and the associated information in the format agreed between the Parties. Any format other than the DICOM standard, transformation, specific anonymization, or additional validation shall be quoted as additional effort.

25.5 Delivery and Settlement. Once the Outbound Migration is completed, the Parties shall execute a delivery-acceptance record and technical settlement documenting the volume effectively transferred. EDEN may proceed with the secure deletion of the Client's information in accordance with the applicable retention policies.

25.6 Read-Only Access Post-Termination. Upon the conclusion of the contract for any cause, EDEN shall maintain the Client's account in suspended mode, with read-only access for one (1) designated Administrator User, during the time remaining to complete the ten (10)-year retention period provided in Clause 9.6, at no additional cost. This mode allows the consultation and specific download of Studies and Validated Reports, but not the uploading of new content or the use of processing, AI, or other operational layer functionalities. Mass extraction must be processed and charged as Outbound Migration.

26. Term, Renewal, and Termination

26.1 Term. The Term shall be that established in the Commercial Proposal. The contract shall automatically renew for periods equal to the one initially agreed, unless either Party notifies in writing its intention not to renew with at least thirty (30) calendar days' advance notice before the expiration of the current period.

26.2 Termination for Breach. Either Party may terminate the contract if the other materially breaches its obligations and does not cure such breach within the following periods: (a) payment obligations: ten (10) business days counted from the receipt of the written notice; (b) non-pecuniary obligations: thirty (30) calendar days counted from the receipt of the written notice. The following constitute, by way of illustration and not limitation, material breaches: unauthorized use of EDEN SUITE, violation of Clauses 14 (Confidentiality), 17 (Intellectual Property), circumvention of security measures, acts of corruption, and any unauthorized assignment.

26.3 Early Termination for Client's Convenience. The Client may terminate the contract early for convenience by written notice with sixty (60) calendar days' advance notice. In such case, the Client undertakes to pay EDEN, as sole and total compensation, the remaining balance of the total value of the contract agreed in the Commercial Proposal, calculated as such total value minus the total of considerations effectively paid and not refunded as of the effective termination date.

26.4 Nature of the Compensation. The Parties acknowledge and expressly agree that the compensation for early termination constitutes a reasonable and proportional estimate of the foreseeable damages and losses, including: (a) the costs of Cloud infrastructure, licensing, and capacity reserved specifically for the Client during the Term; (b) the opportunity cost arising from the inability to reassign such capacity to other potential clients; (c) the assignment of dedicated personnel, technical resources, and support planned for the agreed duration; and (d) the costs of amortization of the initial investment made by EDEN in the Client's implementation. This compensation does not constitute a contractual penalty, but rather indemnification of damages estimated in advance by the Parties in the exercise of their contractual freedom among merchants, and is an essential element of the economic basis of the contract without which EDEN would not have agreed to the Term or the agreed prices. The remaining balance shall be payable in full as of the effective termination date, without prejudice to the Parties agreeing in writing to a payment scheme in installments.

26.5 Termination without Penalty for Cause Attributable to EDEN. The Client may terminate the contract without the obligation to pay the remaining balance when any of the following causes is configured, attributable to EDEN and not cured after notice: (a) material breach by EDEN; (b) monthly availability of the platform below ninety-nine percent (99.0%) during three (3) consecutive months; or (c) two (2) or more critical-priority incidents outside the response or resolution time, in the same calendar quarter, provided that they are attributable to EDEN pursuant to the Attribution Rules. To invoke causes (b) and (c), the Client must notify EDEN in writing and grant it a cure period of thirty (30) calendar days to restore service levels and present a remediation plan.

26.6 Termination for Impossibility or Regulatory Change. EDEN may suspend or terminate, totally or partially, with thirty (30) calendar days' notice, when compliance becomes unlawful, unviable, or disproportionate due to regulatory changes, executive orders, sanctions, export control measures, tariffs, taxes, or other acts of authority that substantially affect the provision. Where possible, EDEN shall propose mitigation measures or reasonable adjustments. Termination for this cause shall not generate an obligation for the Client to pay the remaining balance.

26.7 Effects of Termination. Upon termination for any cause: (a) the use of EDEN SUITE shall immediately cease and Users shall be deactivated; (b) the Client shall pay all amounts accrued as of the effective termination date, including, where applicable, the remaining balance; (c) the Client shall return to EDEN the Router and bailment supplies; (d) the Parties shall execute the Outbound Data Migration procedure; (e) the secure deletion of data shall proceed in accordance with Clause 14 and the applicable retention policies; and (f) Clauses 4 (Billing), 14 (Confidentiality and Personal Data), 15 (Dissociation and AI), 17 (Intellectual Property), 18 (Limitation of Liability), 19 (Indemnity), 32 (Notices), 35 (Nullity), 36 (Dispute Resolution), and this one shall subsist, as applicable.

27. Default, Suspension, and Read-Only Mode

27.1 Without prejudice to the provisions of Clause 4.9, after thirty-one (31) calendar days of default, EDEN may block access to EDEN SUITE. When technically possible, EDEN may enable as a grace measure a read-only mode for fifteen (15) additional calendar days, exclusively for the download of images and Validated Reports already released; no uploads or new functionalities shall be enabled. Full access shall be restored after proof of payment.

28. Force Majeure and Act of God

28.1 If force majeure or an act of God delays or suspends the obligations of the contract for up to five (5) days, the period shall be extended by the same time. If the delay or suspension exceeds thirty (30) days, either Party may terminate the contract in writing without liability, except for the obligations pending at the time of termination. Termination for force majeure shall not generate an obligation for the Client to pay the remaining balance of the total value of the contract.

29. Assignment

29.1 The rights and obligations arising from these Terms may not be assigned partially or totally by the Client without EDEN's prior written consent. EDEN may assign or transfer the contract and these Terms, totally or partially, to its subsidiaries, related entities, successors, or acquirers in corporate reorganization transactions, without the need for the Client's consent, notifying it within the thirty (30) calendar days following.

30. Subcontractors

30.1 EDEN may subcontract, totally or partially, the provision of the service, without the need for the Client's prior authorization, provided that it maintains responsibility for its obligations under these Terms and ensures that its subcontractors comply with substantially equivalent confidentiality and security standards.

31. Anti-Corruption Compliance, Sanctions, and Export Controls

31.1 The Parties undertake that, at the time of acceptance of these Terms, neither they nor their directors, officers, or employees have offered, promised, given, authorized, solicited, or accepted any type of undue advantage, whether economic or of another type, related to the contract, and shall adopt reasonable measures so that their subcontractors, agents, or any other third party under their control or determining influence do the same.

31.2 The Parties undertake to comply with applicable laws on the prevention of money laundering, terrorist financing, export controls, international trade, and economic sanctions (including those administered by OFAC of the United States Department of the Treasury, the United Nations, the European Union, and other competent bodies), refraining from using EDEN SUITE in countries, with persons, or for purposes prohibited by such regulations.

32. Notices and Electronic Acceptance

32.1 Any notice between the Parties must be in writing and signed physically or electronically. They may be sent by physical or electronic mail to the addresses indicated in the Commercial Proposal or, failing that, to the addresses registered by the Parties in their respective systems. Messages from the official emails shall be considered signed with a simple signature and it shall be presumed that the sender has sufficient authority, without prejudice to the use of electronic signature platforms.

32.2 EDEN's Addresses and Emails. The address and email of EDEN for purposes of formal notices shall be, in general terms, that of the contracting EDEN entity set forth in the Commercial Proposal, and supplementarily: legal@edenmed.com. Modifications to the addresses and emails shall be published on legal.edenmed.com.

32.3 Electronic Acceptance. These Terms may be accepted by handwritten signature, advanced electronic signature, simple electronic signature on platforms such as Dropbox Sign, DocuSign, Mifiel, or others similar, acceptance by institutional email, or any suitable means that complies with the applicable e-commerce legislation, having full legal effect.

33. Modifications to the Terms

33.1 EDEN reserves the right to modify these Terms, in whole or in part, as the regulation, the state of the art, market practices, or operational needs evolve. Any modification shall be notified through prior publication on the website legal.edenmed.com with at least thirty (30) calendar days' advance notice before its effective date.

33.2 Notice. The publication on legal.edenmed.com constitutes valid and sufficient notice to all Subjects. EDEN may additionally send notice to the institutional email of the Administrative Officer registered by the Client, without the failure to send individual notice affecting the effectiveness of the modification.

33.3 Tacit Acceptance. After the thirty (30) calendar days have elapsed without the Client expressing in writing its disagreement, the modifications shall be considered fully accepted and binding. The continued use of EDEN SUITE after the effective date of the modifications shall, in any case, constitute unequivocal acceptance.

33.4 Client's Disagreement. If the Client expresses in writing its disagreement with the modifications within the period of thirty (30) calendar days, the Parties shall negotiate in good faith during the following fifteen (15) calendar days. If no agreement is reached, either Party may terminate the contract without penalty, effective at the expiration of the current Contract Year, with both parties retaining their rights and obligations accrued until then.

33.5 Versioning and Repository. EDEN shall maintain on legal.edenmed.com a historical repository of the versions of these Terms, indicating for each its effective date and substitution date. The version applicable to each contractual relationship shall be the one in force at the time of signing the respective Commercial Proposal, except for subsequent modifications accepted pursuant to this Clause.

34. Language

34.1 These Terms are drafted and entered into in the Spanish language, which shall be the official language for their interpretation and execution. Any translation into another language is provided for convenience and shall not prevail over the Spanish text.

35. Nullity, Severability, and Integrity

35.1 In the event that any clause is declared null, invalid, or unenforceable by a competent judicial authority, such clause shall be severed from these Terms. The remainder shall continue in force with full effectiveness, and the Parties undertake to negotiate in good faith a substitute clause that reflects, to the broadest extent permitted, the original intent.

35.2 The titles of the clauses and their numerals are exclusively to facilitate reading and location; interpretation shall be made in accordance with the content of each clause and the instrument considered as a whole.

35.3 These Terms, together with the Commercial Proposal and the addenda that are executed, constitute the entire agreement between the Parties with respect to their subject matter, and supersede any prior, simultaneous, or subsequent agreement, proposal, communication, declaration, or understanding, verbal or written, on the same subject matter.

36. Dispute Resolution, Applicable Law, and Jurisdiction

36.1 Prior Mediation. The Parties agree that any dispute or claim arising out of these Terms, or related to them, their breach, termination, or invalidity, shall be resolved, in the first instance, through alternative dispute resolution methods. The Parties shall submit to a mediation and conciliation procedure administered by a neutral and independent mediator, selected by mutual agreement. It shall be a mandatory requirement to exhaust this procedure prior to the initiation of legal actions, except for urgent provisional or precautionary measures.

36.2 Applicable Law. Except as provided in the respective Commercial Proposal or in a master agreement individually negotiated between the Parties, these Terms shall be governed by and interpreted in accordance with the federal laws of the United Mexican States, with the supplementary application of the Commercial Code and the Federal Civil Code.

36.3 Jurisdiction. If an amicable resolution is not reached, the Parties expressly submit to the jurisdiction of the competent federal courts seated in Mexico City, United Mexican States, waiving any other venue or jurisdiction that may correspond to them, even by reason of their present or future domicile, unless the respective Commercial Proposal establishes a different forum.

36.4 Public Policy Clause. Without prejudice to the choice of law and forum provided for in this Clause, the Parties acknowledge that the public policy rules of the Applicable Jurisdiction—in particular those relating to personal data protection, consumer rights where the consumer is the Subject involved, health regulation, labor rights of the Client's personnel, and tax obligations and search for and identification of persons—shall prevail over these Terms to the extent strictly necessary to preserve such public policy, with the remainder of the clauses maintaining full effectiveness.

37. Prevalence over Verbal Agreements and Previous Versions

37.1 These Terms, in their version in force published on legal.edenmed.com, prevail over any prior, simultaneous, or subsequent statement, offer, promise, declaration, or verbal communication of EDEN personnel, including commercial, technical, support, accounts, or any other area personnel.

37.2 Only modifications, extensions, waivers, or concessions that are recorded in writing in an instrument signed by representatives with sufficient proven authority, whether by formal addendum, master agreement, Commercial Proposal, or equivalent instrument, shall be enforceable against EDEN.

37.3 The previous versions of these Terms are automatically superseded by the version in force as of its effective date, except with respect to rights and obligations accrued previously under the prior versions, which shall retain their original regime.

FINAL PROVISION

These Terms and Conditions of Use of EDEN SUITE enter into force on the date set forth in the official repository legal.edenmed.com. EDEN keeps permanently available the version in force and the historical repository of previous versions.

For any inquiry, clarification, or request related to these Terms, the Subjects may contact the email address legal@edenmed.com.

Last updated: September 17, 2026

Eden Group privacy coordination: Higia, Inc. The entity and role applicable to each processing activity are identified in Clauses 2 and 7.

Data Protection Officer (DPO) contact: legal@edenmed.com

1. PREAMBLE

1.1 This Global Privacy Notice establishes the Eden Universal Privacy & Data Standard (EUPD): a shared commitment to lawful processing, transparency, security and respect for individual rights. Eden applies the obligations in force that govern each processing activity and the additional safeguards expressly undertaken in this Notice.

1.2 The EUPD is built on a single axiom: if a local law, present or future, grants the data subject a broader protection than that contained in this Notice, such protection is automatically incorporated into the processing that Eden carries out in that jurisdiction, without the need to amend this document. We refer to this mechanism as the Automatic Maximum Protection Clause (MPA).

1.3 Nevertheless, when Eden identifies that a jurisdiction imposes a more demanding standard than the global EUPD floor, Eden will raise that floor for all jurisdictions, unless doing so is technically or legally unfeasible.

1.4 This Notice applies in all jurisdictions where Eden, through Higia, Inc. or any of its subsidiaries, offers products or services, or carries out any personal data processing operation.

2. IDENTITY OF THE CONTROLLER AND RELATED ENTITIES

2.1 Higia, Inc., the Eden Group parent company, coordinates this Notice from 300 Delaware Ave., Suite 210 #215, Wilmington, DE 19801, United States of America. The privacy and Data Protection Officer (DPO) contact is legal@edenmed.com. The entity contracting for or performing each processing activity assumes the role determined by its purpose and actual activities; group coordination does not make Higia, Inc. the controller of all clinical data.

2.2 Higia, Inc. operates under the commercial brand "Eden" and has the following subsidiaries, each of which may act as controller or processor depending on the operation in question:

2.2.1 Higia, Inc. — United States (Delaware). Address: 300 Delaware Ave., Suite 210 #215, Wilmington, DE 19801, United States of America. Role: parent company and controller or processor according to the processing activity.

2.2.2 Eva Health, S.A.P.I. de C.V. — Jurisdiction: Mexico. Domicile: Av. Horacio 632, Piso 1, Polanco IV Sección, Miguel Hidalgo, 11550, Mexico City, Mexico. Role: Subsidiary — Controller or Processor.

2.2.3 United Surgical Importação e Exportação Ltda. — Jurisdiction: Brazil. Domicile: Av. Ordem e Progresso 157, Cj. 1713, Várzea da Barra Funda, São Paulo – SP, 01141-030, Brazil. Role: Subsidiary — Controller or Processor.

2.2.4 Eden Colombia Latinoamérica S.A.S. — Jurisdiction: Colombia. Domicile: Calle 96 # 10-29, Oficina 502, Bogotá D.C., Colombia. Role: Subsidiary — Controller or Processor.

2.3 In markets where Eden has no incorporated subsidiary, the service is provided by the group entity identified in the applicable contract or instrument. That entity acts as processor when handling data on the Client’s behalf and instructions, and as controller for its own lawful purposes. Server location or the mere receipt, storage or return of data does not change that role.

2.4 European Union and European Economic Area. Where an Eden entity not established in that territory is subject to Article 3(2) of Regulation (EU) 2016/679 (GDPR), as controller or processor, it will appoint a representative in writing under Article 27 unless a statutory exemption applies. Where appointment is required, the representative’s details will be published at legal.edenmed.com and made available to Data Subjects and competent authorities.

3. AUTOMATIC MAXIMUM PROTECTION CLAUSE (MPA)

This Notice incorporates the following continuous-update mechanism:

3.1 Automatic incorporation. Any binding provision in force that grants broader protection applies, from its effective date, to the processing activity it governs, without awaiting an amendment to this Notice. Regulatory guidance and recommendations are assessed according to their legal status; this Notice does not turn future or inapplicable rules into current legal obligations.

3.2 Non-regression. The protection standards contained in this Notice constitute an irreducible minimum floor. No local provision offering less protection than this Notice will reduce the rights recognized herein.

3.3 Global enhancement. Eden will review the standards applicable in its markets and assess extending additional protections across the group where legally and technically feasible. Improvements will be incorporated into the next update of this Notice.

3.4 Regulatory transparency. Clauses 8, 10, 12 and 22 identify the principal requirements and frameworks by jurisdiction. Eden will keep this information current at legal.edenmed.com and, through its DPO, respond to questions about the applicable regime and additional rights under local law.

3.5 Periodic review. Eden will review the regulatory landscape every six months to update this Notice and assess improvements, without deferring compliance with binding requirements that take effect between reviews.

4. SCOPE OF APPLICATION

4.1 Territorial scope. This Notice applies to every natural person (the "Data Subject") whose personal data is processed by Eden, regardless of: (a) the geographic location of the Data Subject; (b) the country from which the services are accessed; (c) the nationality or residence of the Data Subject; and (d) the Eden Group entity acting as controller or processor.

4.2 Material scope. This Notice applies to all personal data processing carried out by Eden, whether automated, partially automated, or non-automated, including operations carried out through Eden Suite and each of its modules:

4.2.1 Eden PACS (Picture Archiving and Communication System): storage and management of DICOM (Digital Imaging and Communications in Medicine) images.

4.2.2 Eden Management (RIS — Radiology Information System): workflows, schedules, and reports.

4.2.3 Eden Intelligence: analytics and metrics.

4.2.4 Eden Creator: assistant for drafting conclusions; does not generate diagnoses.

4.2.5 AI Report: an agent that transforms dictation into structured drafts; requires a physician's signature for release.

4.2.6 Eden AI: diagnostic support through artificial intelligence models applied to DICOM studies; does not replace clinical judgment.

4.2.7 Eden Portal: web portal with a DICOM viewer for patients.

5. DEFINITIONS

For the purposes of this Notice, the terms defined below shall have the meaning indicated. Where a term is not defined here, the definition given to it by the applicable law in the relevant jurisdiction shall apply.

5.1 Data Protection Authority: a public body competent to supervise a processing activity under applicable law. The principal authorities and the regulatory framework of each market are identified in Clause 22.

5.2 Client: an individual or legal entity that contracts for Eden products or services. For clinical data processed in Eden Suite on its behalf, the Client determines the purposes and acts as Controller; Eden acts as Processor under documented instructions. Each party’s processing for its own purposes is governed by its actual role and lawful basis.

5.3 Consent: a freely given, specific, informed and unambiguous indication that the Data Subject agrees to processing for a particular purpose. For sensitive data it must be explicit and satisfy additional required formalities, including written form where required by law.

5.4 Personal Data: any information relating to an identified or identifiable natural person. A person is considered identifiable if their identity can be determined, directly or indirectly, including through location information and online identification.

5.5 Sensitive Personal Data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic, biometric or health data, sex life or sexual orientation. DICOM images and clinical data are treated as sensitive where linked or linkable to an individual; anonymized information is governed by Clauses 5.7 and 17.

5.6 Data Protection Officer (DPO): a person designated by Eden to oversee compliance with personal data protection obligations, to serve as a point of contact for Data Subjects and Data Protection Authorities, and to advise the Eden Group on the matter.

5.7 Dissociation (Anonymization): a process that prevents direct or indirect identification of an individual under the applicable legal standard, taking account of reasonably available means and efforts and the risk of re-identification. Pseudonymization and removing direct identifiers alone do not amount to anonymization; data that can identify an individual remain protected.

5.8 Eden / Eden Group: Higia, Inc. and any of its subsidiaries, affiliates, or related entities that participate in the processing of personal data.

5.9 Processor: a natural or legal person who processes personal data on behalf of and under the instructions of the Controller.

5.10 Data Protection Impact Assessment (DPIA): a systematic analysis of the risks that a processing operation may pose to the rights and freedoms of Data Subjects, including measures to mitigate such risks. Also known as EIPD (Evaluación de Impacto en Protección de Datos) or RIPD (Relatório de Impacto à Proteção de Dados).

5.11 Security Incident: any event that compromises the confidentiality, integrity, or availability of personal data, including unauthorized access, loss, destruction, alteration, or improper disclosure.

5.12 Controller: a natural or legal person who determines the purposes and means of the processing of personal data. In Eden's context, the Controller varies depending on the legal relationship and applicable jurisdiction, as described in Clause 2 of this Notice.

5.13 High-Risk AI System: a system meeting the classification criteria under applicable law. Under Regulation (EU) 2024/1689 (AI Act), assessment depends on intended purpose and the conditions in Article 6 and the applicable annexes; processing health data alone does not determine that classification.

5.14 Data Subject: the natural person to whom the personal data being processed corresponds.

5.15 Processing: any operation or set of operations performed on personal data, by any means, including collection, recording, organization, structuring, storage, adaptation, modification, extraction, consultation, use, communication by transmission, dissemination, comparison, interconnection, restriction, erasure, and destruction.

5.16 User: a natural person who uses Eden Suite through an Eden Client, without a direct contractual relationship with Eden. The User includes patients, medical staff, and administrative staff of the Client.

6. GUIDING PRINCIPLES

All personal data processing carried out by Eden is governed by the following principles, which constitute binding obligations for all entities of the Eden Group and prevail over any restrictive interpretation:

6.1 Lawfulness, fairness, and transparency. All processing will have a valid legal basis, be carried out in good faith, and be communicated to the Data Subject in a clear, accessible, and comprehensible manner.

6.2 Purpose limitation. Personal data will be collected for specified, explicit, and legitimate purposes, and will not be further processed in a manner incompatible with those purposes.

6.3 Data minimization. Only personal data that is adequate, relevant, and strictly necessary for the purposes of the processing will be collected.

6.4 Accuracy. Personal data will be accurate and, where necessary, kept up to date. Reasonable measures will be taken to erase or rectify inaccurate data without delay.

6.5 Storage limitation. Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, unless a legal obligation requires a longer retention period.

6.6 Integrity and confidentiality. Personal data will be processed in a manner that ensures its security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

6.7 Accountability. Eden will be able to demonstrate compliance with all the foregoing principles and with the obligations arising from this Notice and applicable law.

6.8 Privacy by design and by default. Personal data protection will be integrated into the design of all Eden products, services, and processes. The default configuration will always be the most protective of the Data Subject's privacy. In the development of software and information systems that process personal data, Eden will adopt DevPrivOps and DevSecOps practices, integrating privacy and security risk management from the earliest stages of the development lifecycle.

6.9 Non-discrimination. No Data Subject will suffer adverse consequences for exercising their personal data protection rights.

6.10 Surviving confidentiality. The duty of secrecy and confidentiality over the Data Subject's personal data subsists even after the relationship between Eden and the Data Subject, or between Eden and the Client, has ended.

7. CATEGORIES OF DATA SUBJECTS, PERSONAL DATA, AND PURPOSES

Eden processes personal data of the categories of Data Subjects described in this clause. For each category, the types of data collected, the primary purposes (necessary for the legal relationship), and the secondary purposes (not necessary; subject to objection or withdrawal of consent) are detailed. The categories are: (A) Browsing Users; (B) Clients; (B.1) Client Responsibilities; (C) Eden Suite Users; (D) Candidates; (E) Employees; (F) Subscribers; and (G) Suppliers and Potential Suppliers.

7.1 Browsing Users. These are Data Subjects who browse the website edenmed.com without maintaining a contractual relationship with Eden.

7.1.1 Data collected: (a) IP address (anonymized for analytics purposes); (b) browsing data: pages visited, time spent, navigation sequence, and clicks made; (c) technical device data: browser type, operating system, screen resolution, and language; and (d) data obtained through cookies, web beacons, and JavaScript, subject to the Data Subject's preferences (see Clause 13).

7.1.2 Primary purposes: (a) to ensure the technical functioning and security of the website; and (b) to detect and prevent fraudulent activity or threats to the portal.

7.1.3 Secondary purposes: (a) statistical and geolocation analysis to improve the browsing experience; and (b) content personalization.

7.2 Clients. These are Data Subjects (natural persons or representatives of legal entities) who contract Eden's products or services through a service agreement.

7.2.1 Data collected: (a) identification data: full name, date and place of birth, age, gender, nationality, telephone number, email, copy of official identification (passport or other document), and proof of address; (b) for legal entities: incorporation deed, tax identification (RFC, CNPJ, NIT, or equivalent), and details of the legal representative; (c) financial data: bank accounts, CLABE, or other financial data necessary for the commercial relationship; and (d) location data: tax and commercial address.

7.2.2 Primary purposes: (a) to verify the identity and existence of the Client; (b) to enter into, perform, and develop the services agreement and its accessory instruments; (c) to comply with legal, tax, and regulatory obligations; and (d) to create and manage the databases necessary to provide the service.

7.2.3 Secondary purposes: (a) to send information about Eden's products, services, promotions, or events; and (b) to conduct satisfaction surveys, market analysis, and statistical studies.

7.3 Client responsibilities. To provide the services, Eden receives data managed by the Client, including data about patients, healthcare professionals and people authorized to receive medical information. Responsibilities are allocated according to each party’s purpose and actual role:

7.3.1 The Client will establish and document the legal basis for collecting and processing data, inform the Data Subject, and obtain and retain consent or authorization in the required form where that is the applicable basis. Any exception must meet local legal requirements, including those for sensitive data.

7.3.2 The Client undertakes to establish the necessary legal documentation with the Data Subject (including employment contracts, service agreements, its own privacy notices, and informed consents, as applicable).

7.3.3 The Client undertakes to implement its own administrative, technical, and physical security measures to protect the personal data it manages.

7.3.4 The Client is Controller of clinical data processed through Eden Suite on its behalf. Sending data to Eden, accessing it or receiving it back does not make the Client a joint controller or Processor. Joint controllership arises only where the facts and applicable law establish joint determination of purposes and means; the corresponding responsibilities will then be documented.

7.3.5 The contracting Eden entity acts as Processor of the Client’s clinical data under documented instructions, the contract and applicable law. Eden may act as an independent Controller for data relating to its own employment, commercial and supplier relationships, or other lawful purposes of its own described in this Notice. Storing data on Eden infrastructure does not itself change these roles or remove either party’s own legal obligations.

7.4 Eden Suite Users. These are Data Subjects (natural persons) who use Eden Suite through Eden's Clients, without a direct contractual relationship with Eden. This category includes patients, medical staff, radiologists, and administrative staff of the Client.

7.4.1 Data collected: (a) of patients: identification number (hospital record or other), name, sex, date of birth, marital status, nationality, contact details, medical history, information on diagnoses and procedures, DICOM radiological images and associated reports, and results of examinations and laboratory tests; (b) of health professionals: identification data, professional registration data (professional license, CRM, or equivalent), training and specialization data, and system access credentials; (c) of system use: access logs, records of transactions performed, and usage preferences and settings; and (d) of security: electronic security records, access attempts, and authentication data.

7.4.2 Primary purposes: (a) provide the contracted software infrastructure and functionality, including storage, management and viewing of images and reports; (b) support the Client’s record management and clinical workflows; (c) facilitate communication among healthcare professionals; (d) protect information security, integrity and traceability; and (e) meet legal obligations applicable to each party’s role. Medical care is provided by the patient’s healthcare provider.

7.4.3 Improvement and research. Eden may improve its services and develop its own technology and models using information first anonymized under Clause 17 and applicable contractual rights. Using personal data for an additional purpose requires the legal basis, notice and authorizations applicable to that purpose, including explicit consent where required, and must comply with applicable instructions and restrictions.

7.4.4 Ownership and rights. Contracting for Eden Suite does not transfer the Client’s contractual ownership of its information or patients’ personal data rights to Eden. The Client retains its rights over the information provided and its responsibilities as Controller; Data Subjects retain their rights under applicable law and this Notice. The healthcare provider’s notice complements this document for clinical processing.

7.4.5 AI data and metadata. Results, drafts and metadata generated by Eden AI or AI Report are sensitive personal data where linked or linkable to a patient. AI Report transforms dictation or text into structured drafts; it does not interpret images. Data Subjects may learn how AI is used with their data and obtain meaningful information about the processing under applicable law and this Notice.

7.5 Candidates. These are Data Subjects who participate in Eden's selection and recruitment processes.

7.5.1 Data collected: (a) identification data: name, address, contact details, and identity document; (b) location data: address; and (c) professional and academic data: educational background, work experience, personal and professional references, and certifications.

7.5.2 Primary purposes: (a) to verify the Candidate's identity; (b) to assess their professional profile and suitability for the position; (c) to establish contact during the selection process; and (d) to create and maintain internal candidate databases.

7.6 Employees. These are Data Subjects who perform personal, subordinate, and remunerated work for Eden, in any jurisdiction.

7.6.1 Data collected: (a) identification data: name, address, telephone, personal and institutional email, marital status, signature, photograph, tax identification, social security number or equivalent, and data of family members and beneficiaries; (b) financial data: bank account and information necessary for payroll and tax compliance; (c) employment data: employment contract, incidents, evaluations, training, and payroll data; (d) academic data: degrees, professional licenses, and certifications; (e) biometric data: fingerprint for access control to facilities (where applicable, with explicit consent); and (f) voice data: recording of calls made through corporate applications, for quality purposes (where applicable, with prior notice).

7.6.2 Primary purposes: (a) to enter into and perform the employment contract and its accessory instruments; (b) to comply with labor, tax, and social security obligations; (c) to manage the employment relationship, including payroll, benefits, training, and evaluation; and (d) to ensure the security of facilities and information systems.

7.7 Subscribers. These are Data Subjects who voluntarily subscribe to Eden's communications (newsletters, commercial information, events).

7.7.1 Data collected: name, position, company, industry, email, and telephone number.

7.7.2 Purposes: (a) sending commercial communications, news, events, and promotions related to Eden; and (b) conducting satisfaction surveys and market studies.

7.7.3 The Subscriber may withdraw their consent and unsubscribe at any time through the unsubscribe link included in each communication or by contacting legal@edenmed.com.

7.8 Suppliers and Potential Suppliers.

7.8.1 Data collected: (a) identification of the company and its representatives; (b) internet and social media presence; and (c) corporate background, reputation, permits, licenses, and certifications.

7.8.2 Primary purposes: (a) to verify the identity and existence of the supplier; (b) to assess the viability of the commercial relationship; and (c) to enter into and perform service agreements.

8. LEGAL BASES FOR PROCESSING

8.1 Eden bases each processing operation on at least one of the following legal bases, in accordance with the applicable law in each jurisdiction:

8.1.1 Consent. A free, specific, informed, and unambiguous expression of the Data Subject's will; explicit for sensitive data. Example: newsletter subscription; processing of employees' biometric data.

8.1.2 Contractual relationship. Where permitted by law, processing necessary to enter into or perform a legal relationship with the Data Subject, such as administering their account or commercial relationship. A contract between Eden and an institutional Client is not, by itself, a legal basis for every use of its patients’ sensitive data.

8.1.3 Legal obligation. Processing is required by an applicable legal rule. Example: retention of tax records; reporting to health authorities.

8.1.4 Legitimate interests. This basis is used only in jurisdictions and processing activities that recognize it, after documenting necessity and balancing against the Data Subject’s rights. It does not replace special conditions for sensitive data; in Brazil, processing such data must rely on Article 11 of the LGPD.

8.1.5 Vital interest. Processing is necessary to protect the life of the Data Subject or another natural person. Example: medical emergencies in the context of Eden Suite.

8.1.6 Public interest or exercise of authority. Processing is necessary for the performance of a task carried out in the public interest. Example: reporting of communicable diseases to health authorities.

8.1.7 Protection of health. This basis applies within the conditions and safeguards set by each law. In Brazil, Articles 7(VIII) and 11(II)(f) of the LGPD restrict it to procedures performed by healthcare professionals, healthcare services or a health authority. Protection of life or physical safety is a separate basis under Articles 7(VII) and 11(II)(e).

8.1.8 Sector-specific rules. Healthcare and confidentiality requirements apply alongside the relevant legal basis and processing conditions. A HIPAA BAA, a medical-record rule or a professional duty does not provide blanket permission for secondary uses or remove purpose restrictions.

8.2 Before processing, Eden will identify and document the basis appropriate to its role, purpose, data category and jurisdiction. When acting as Processor, it will process data within the Controller’s lawful instructions. Consent will be requested where it is a valid and required basis; it will not be used to bypass mandatory requirements or cure an unauthorized purpose.

9. RIGHTS OF THE DATA SUBJECT

Eden recognizes and guarantees to every Data Subject, regardless of jurisdiction, the exercise of the following rights. This catalog constitutes the union of all rights recognized by the applicable laws and, by virtue of the Automatic Maximum Protection Clause, extends equally to all Data Subjects:

9.1 Access. To obtain confirmation of whether Eden processes their personal data and, where applicable, to access it, including information about the purposes of the processing, the categories of data, the recipients, the retention periods, and the source of the data.

9.2 Rectification. To request the correction of inaccurate or incomplete personal data.

9.3 Erasure. Request deletion where data are no longer needed, consent is withdrawn without another valid basis, an objection is upheld or processing is unlawful. Legal retention periods and exceptions, including healthcare obligations and the defense of rights, will be respected; Eden will explain any retention that remains necessary.

9.4 Objection. To object to the processing of their personal data at any time, on grounds relating to their particular situation. Eden will cease the processing unless it demonstrates compelling legitimate grounds.

9.5 Restriction of processing (blocking). To request that Eden restrict the processing of their personal data while the accuracy of the data, the lawfulness of the processing, or the balancing of legitimate interests is verified.

9.6 Portability. To receive their personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance.

9.7 Not to be subject to automated decisions. Not to be subject to a decision based solely on the automated processing of their data, including profiling, that produces legal effects or significantly affects them. Eden AI and AI Report generate results that always require review and validation by a medical professional; in no case is a clinical decision adopted on an exclusively automated basis.

9.8 Withdrawal of consent. To withdraw their consent at any time, without affecting the lawfulness of the prior processing. Withdrawal will be as simple as granting consent.

9.9 Information on transfers. To know to which third parties their personal data has been transferred and the applicable safeguards.

9.10 Non-discrimination. Not to suffer retaliation, penalty, or degradation of service for exercising any of the rights recognized herein.

9.11 Complaint before an authority. To file a complaint with the competent Data Protection Authority in their jurisdiction, without prejudice to any other administrative or judicial remedy.

9.12 Confirmation of the existence of processing. To obtain confirmation of whether or not Eden processes their personal data (autonomous right recognized by Brazil's LGPD).

9.13 Information on the possibility of not consenting. To be informed about the possibility of not granting their consent and about the consequences of refusal (autonomous right recognized by Brazil's LGPD).

9.14 Deletion of data processed with consent. Request deletion of data processed on the basis of consent, even where the processing was lawful, subject to statutory retention exceptions; in Brazil, under Articles 18(VI) and 16 of the LGPD.

9.15 Free consultation. To consult their personal data free of charge at least once each calendar month and whenever there are substantial modifications to the processing policies (recognized by Colombia's Law 1581 of 2012 and analogous rules).

9.16 Compensation. A Data Subject who is harmed as a result of non-compliance with applicable law or this Notice has the right to obtain the corresponding compensation in accordance with the law (recognized by Article 25 of Peru's Law 29733; extensible to all jurisdictions where local law permits).

9.17 Prevention of disclosure. The Data Subject has the right to prevent their personal data from being supplied to third parties, especially when this affects their fundamental rights (recognized by Article 21 of Peru's Law 29733).

9.18 Habeas data. In jurisdictions where a constitutional habeas data action exists (Ecuador, Peru, Brazil, Colombia, among others), the Data Subject may resort directly to the constitutional remedy for the protection of their personal data, independently of the administrative route. Eden recognizes and respects this right and will cooperate with the judicial authorities hearing such actions.

9.19 Procedure for exercising rights.

9.19.1 Requests may be sent to legal@edenmed.com and should include: (a) name and a reply contact; (b) necessary and proportionate information to verify identity and, where relevant, authority to act; (c) the right to be exercised and the data involved; and (d) information useful for locating the data. Eden will use verification appropriate to the risk and avoid collecting excessive documents or data.

9.19.2 Eden maintains a response commitment of up to ten (10) business days and, in Peru, up to eight (8) business days, without extending any shorter statutory deadline or duty to respond immediately. These are service commitments: statutory periods vary by right and jurisdiction; in Peru, Article 69 of Supreme Decree 016-2024-JUS distinguishes information, access and other rights. Time calculation and requests to complete information follow applicable law. Any extension will be no more than ten (10) business days and is available only where legally permitted, within the statutory limit and with timely notice of the reasons to the Data Subject.

9.19.3 Clients’ Users. The Client, as Controller of clinical data, handles requests relating to that processing. Data Subjects may contact the Client or Eden’s DPO; when Eden receives a request for the Client to handle, it will route the request and cooperate promptly, keeping the Data Subject informed. This coordination does not restrict the direct exercise of rights or Eden’s own obligations.

10. PROCESSING OF SENSITIVE PERSONAL DATA

10.1 Depending on the service and relationship, Eden processes: (a) health data, including medical history, diagnoses, procedures, DICOM images, results and reports; (b) biometric data for employee access control where applicable; (c) information revealing racial or ethnic origin in clinical records; and (d) AI outputs, drafts and metadata linked or linkable to a patient. Eden AI processes studies according to its function; AI Report structures dictation or text and does not interpret images.

10.2 Sensitive data processing requires a specific legal condition in addition to general obligations. Eden will apply explicit consent with the required formalities or an exception recognized for the particular purpose. Relevant provisions include Articles 8 and 9 of Mexico’s LFPDPPP, Article 11 of Brazil’s LGPD, Articles 6 and 10 of Colombia’s Law 1581 of 2012 and, where applicable, Article 9 of the GDPR. Healthcare, protection of life, research or the public nature of data are not universal exemptions: each regime’s conditions, limits and confidentiality duties must be met.

10.3 In any case, Eden will apply reinforced security measures for the processing of sensitive personal data, including encryption in transit and at rest, role-based access controls, and detailed audit logs.

11. PROCESSING OF DATA OF CHILDREN AND ADOLESCENTS

Eden recognizes that, in the context of health services, it may be necessary to process the personal data of minors. The processing of such data will be governed by the following rules:

11.1 Processing will always be carried out in the best interests of the minor.

11.2 The consent of the minor's parent, guardian, or legal representative will be required, unless a legal exception permits otherwise.

11.3 Eden will consider as a minor any person under eighteen (18) years of age, applying the most protective threshold among the laws of the jurisdictions where it operates.

11.4 The data of minors will only be collected when strictly necessary for the provision of health services.

11.5 Eden will not direct advertising or commercial communications to minors.

11.6 The website edenmed.com is intended for persons over eighteen (18) years of age. Minors should not use it without the supervision of a legal representative.

12. INTERNATIONAL DATA TRANSFERS

Eden operates through entities in several jurisdictions and uses cloud infrastructure. When data are communicated internationally, each flow will have the legal mechanism and safeguards appropriate to its origin, destination, purpose and the parties’ roles:

12.1 Applicable mechanisms. Each international flow must have both a lawful basis for processing and the transfer mechanism required by the law of origin. Mexico distinguishes communications to processors from transfers to third parties; Colombia distinguishes transmissions to Processors from transfers to Controllers under Article 26 of Law 1581 and Decree 1074 of 2015; Brazil applies Articles 33–36 of the LGPD and Resolution CD/ANPD 19/2024. GDPR-regulated data are subject to its Chapter V. A commercial contract or internal policies do not replace these requirements.

12.1.1 Standard contractual clauses. Where this is the applicable mechanism, Eden will incorporate clauses approved or recognized by the competent authority, completing the required modules, annexes, information and formalities before the transfer and applying necessary supplementary measures. One authority’s clauses are not automatically valid in another jurisdiction.

12.1.2 Intragroup transfers. Eden entities will be bound by data protection agreements and obligations appropriate to the flow. Internal policies alone are not Binding Corporate Rules (BCRs). That mechanism will be used only with the approval or recognition required from the competent authority.

12.1.3 Adequacy decisions. Where the competent authority has recognized that the destination country offers an adequate level of protection, the transfer will be carried out on the basis of that decision.

12.1.4 Statutory exceptions. Consent to a transfer or another exception will be used only where permitted by applicable law and all conditions are met, including information on risks and specific, explicit agreement where required. It is not a general substitute for safeguards required for routine transfers.

12.2 Sub-processors. Eden may use sub-processors (including cloud infrastructure providers such as Amazon Web Services, Inc.) for the storage and processing of data. Eden guarantees that every sub-processor will be subject to contractual obligations equivalent to those contained in this Notice, will undergo a prior risk assessment, and will maintain an up-to-date register of sub-processors available for consultation.

12.3 European Union representative. Appointment, functions and publication of contact details follow Clause 2.4 and Article 27 of the GDPR. Where required, the representative provides an additional contact for Data Subjects and authorities; it does not replace the DPO or the relevant Eden entity’s responsibilities.

12.4 HIPAA in the United States. When Eden creates, receives, maintains or transmits protected health information (PHI) as a business associate of a covered entity, or as a subcontractor of another business associate, it will enter into the required BAA under 45 CFR §§ 164.502(e) and 164.504(e) and applicable security rules. PHI use and disclosure are limited by that agreement and HIPAA. PHI de-identification must satisfy the methods and conditions of 45 CFR § 164.514; a BAA alone does not authorize model training with PHI for Eden’s own purposes.

13. COOKIES, WEB BEACONS, AND TRACKING TECHNOLOGIES

13.1 Eden uses cookies and similar technologies on its website and applications for the following purposes:

13.1.1 Strictly necessary cookies. Purpose: technical functioning of the site, security, and authentication. Duration: session. Legal basis: legitimate interest or technical necessity.

13.1.2 Performance or analytics cookies. Purpose: usage analysis, aggregate statistics, and service improvement. Duration: up to 24 months. Legal basis: consent.

13.1.3 Functionality cookies. Purpose: to remember the Data Subject's preferences (language, settings). Duration: up to 12 months. Legal basis: consent.

13.1.4 Advertising or marketing cookies. Purpose: content and advertising personalization. Duration: up to 12 months. Legal basis: consent.

13.2 Upon accessing Eden's website, the Data Subject will be informed through a visible banner about the use of cookies and will be able to manage their preferences. Only strictly necessary cookies will be activated without prior consent. The Data Subject may modify their preferences at any time through their browser settings or Eden's cookie preferences panel.

13.3 Disabling cookies may affect the functionality of the website.

14. SECURITY MEASURES

Eden implements administrative, technical, and physical security measures designed to protect personal data against unauthorized access, loss, alteration, destruction, or misuse. The measures include, by way of illustration but not limitation:

14.1 Technical measures: (a) encryption of data in transit (TLS/SSL) and at rest (AES-256 or equivalent); (b) multi-factor authentication (MFA) for access to critical systems; (c) role-based access control (RBAC) with the principle of least privilege; (d) continuous monitoring and analysis of access and activity logs; (e) periodic security testing, including penetration testing and vulnerability assessments; (f) timely management of patches and security updates; and (g) segmented network architecture with firewalls and intrusion detection and prevention systems (IDS/IPS).

14.2 Administrative measures: (a) formal information security policies and procedures; (b) periodic security and privacy training for all staff; (c) Data Protection Impact Assessments (DPIAs) for new projects or significant changes in processing; (d) a security incident response plan; and (e) Service Level Agreements (SLAs) with providers that include security and privacy commitments.

14.3 Physical measures: (a) physical access control to the facilities where personal data is processed; and (b) geographic redundancy of backups across multiple locations.

14.4 Certification. Higia, Inc. (Eden)’s Information Security Management System is certified to ISO/IEC 27001:2022 for the certified Eden Suite scope: radiological image management (PACS), radiology patient data management (RIS) and digital delivery of reports. The certification applies to that management system and scope, and Eden maintains a process of continuous security improvement.

14.5 Privacy by design. Eden integrates data protection into the development of Eden Suite and its modules through minimization, privacy risk analysis, application security testing and documentation of design decisions. Article 25 of the GDPR and Ecuadorian rules and guidance apply according to their scope and legal status. In Chile, readiness work incorporates Article 14 quater of Law 19.628, introduced by Law 21.719, scheduled to take effect on December 1, 2026.

15. SECURITY INCIDENT NOTIFICATION

In the event of a Security Incident that may pose a relevant risk or harm to the rights and freedoms of Data Subjects, Eden undertakes to:

15.1 When Eden acts as Controller and notification to an authority is required, it applies a commitment of up to forty-eight (48) hours from awareness of the incident, without extending shorter mandatory deadlines. Each regime’s triggers, content and calculation of time will be respected, including phased reporting where permitted. Article 34 of Peru’s Supreme Decree 016-2024-JUS establishes specific reporting triggers; it does not make that period a universal statutory rule.

15.2 Notify the affected Data Subjects without undue delay when the incident may entail a high risk to their rights and freedoms.

15.3 Document all security incidents, including their effects and the corrective measures adopted.

15.4 Where Eden acts as a processor, notify the controller (Client) without delay so that the controller can comply with its notification obligations.

15.5 In Peru, incidents in digital environments will also be reported to the National Digital Security Center where the conditions in Article 34 of Supreme Decree 016-2024-JUS are met, according to Eden’s role and applicable requirements.

16. RETENTION PERIODS

16.1 Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, in accordance with the following criteria: (a) for as long as the legal relationship giving rise to the processing subsists; (b) during the limitation period for legal or contractual actions arising from that relationship; (c) during the period required by applicable regulations (tax, labor, health, among others); and (d) when judicial, administrative, or arbitral proceedings are pending.

16.2 Once the applicable retention periods have elapsed, personal data will be securely deleted or irreversibly anonymized.

16.3 Blocking period. During the period between the fulfillment of the purpose and the definitive deletion, personal data will be blocked and may only be accessed to determine legal or contractual liabilities.

17. ANONYMIZATION AND USE OF DISSOCIATED DATA

17.1 Eden may generate anonymized information for research, technology development, statistics, metrics, service improvement and training, fine-tuning or evaluation of its own models. Collection of personal data and the preceding anonymization process must have a valid legal basis and comply with applicable instructions, contractual permissions and sector-specific restrictions. Permission to use the anonymous output does not waive those preceding requirements.

17.2 Information ceases to be treated as personal data only while it meets the applicable legal anonymization standard. Eden will not attempt re-identification and will contractually prohibit authorized providers from doing so. Security, confidentiality and permitted-use obligations continue; if the standard is no longer met, the information will be treated as personal data with the corresponding controls. Brazil’s LGPD Article 12 and, for US PHI, 45 CFR § 164.514 will be observed.

17.3 Eden documents the anonymization methods used and periodically assesses the risk of re-identification.

18. AUTOMATED DECISIONS AND ARTIFICIAL INTELLIGENCE

Eden uses artificial intelligence models in the Eden AI and AI Report modules of Eden Suite. It is essential that the Data Subject understands the following:

18.1 No autonomous diagnosis. Eden AI provides diagnostic support; it does not replace the physician's clinical judgment. Every result generated by Eden AI is a suggestion that must be evaluated, validated, or discarded by a qualified medical professional.

18.2 AI Report requires a physician's signature. AI Report transforms medical dictation into structured drafts. No draft is released as a final report without the review and signature of the responsible physician.

18.3 Eden Creator does not generate diagnoses. Eden Creator assists in drafting medical conclusions but does not produce clinical diagnoses.

18.4 Guaranteed human intervention. In no case will a clinical or medical decision be adopted on an exclusively automated basis. The Data Subject has the right to request human intervention, to express their point of view, and to contest the decision.

18.5 Algorithmic transparency. The Data Subject has the right to obtain meaningful information about the logic applied in the automated processing of their data, as well as about the significance and the envisaged consequences of such processing.

18.6 AI governance and the AI Act. Eden assesses each module according to intended purpose, functions, market and legal role. Classification under Regulation (EU) 2024/1689 depends on Article 6 and its applicable annexes, alongside relevant medical-device rules; it does not arise solely from processing health data. Eden will apply mandatory requirements according to their scope and effective dates and develop the following governance measures:

18.6.1 Risk management system: implementation of a continuous system for identifying, analyzing, estimating, and evaluating the risks associated with the use of Eden AI.

18.6.2 Data governance: assessment of the quality and representativeness of training, validation and test datasets, together with identification, measurement and mitigation of bias relevant to intended purpose and applicable requirements.

18.6.3 Technical documentation: Eden will maintain up-to-date technical documentation that allows competent authorities to assess compliance with the applicable requirements.

18.6.4 Record-keeping and traceability: the AI systems will generate automatic records (logs) that allow the functioning of the system to be traced throughout its lifecycle.

18.6.5 Human oversight. Eden AI diagnostic-support outputs require assessment by a qualified medical professional. AI Report produces drafts that are released as final reports only after medical review and signature. These controls apply according to each module’s documented function.

18.6.6 Accuracy, robustness, and cybersecurity: Eden will apply measures to ensure adequate levels of accuracy, robustness, and cybersecurity of the AI models, including periodic testing and post-deployment monitoring.

18.7 These obligations will apply regardless of the Data Subject's jurisdiction, as part of Eden's commitment to the highest global standards. In jurisdictions where no specific AI legislation exists, Eden will adopt these measures as a voluntary best practice.

19. DATA PROTECTION OFFICER (DPO)

19.1 Eden has designated a Data Protection Officer (DPO) as the point of contact for all matters related to the processing of personal data. The DPO is accessible in Spanish, Portuguese, and English through the following means: (a) email: legal@edenmed.com; and (b) postal address: Higia, Inc. — Attn: Data Protection Officer — 300 Delaware Ave., Suite 210 #215, Wilmington, DE 19801, USA.

19.2 The DPO has the following functions: (a) to oversee compliance with this Notice and applicable law; (b) to advise Eden on Data Protection Impact Assessments; (c) to serve as a point of contact for Data Subjects and Data Protection Authorities; and (d) to cooperate with Data Protection Authorities in the exercise of their functions.

19.3 In Ecuador, Eden's DPO must be registered with the SPDP in accordance with Resolution SPDP-SPD-2025-0028-R. In Brazil, they will act as Encarregado in accordance with Article 41 of the LGPD. In Peru, they will act as Personal Data Officer in accordance with D.S. 016-2024-JUS. Eden may designate a single DPO for the corporate group, as permitted by applicable laws, provided they can carry out their functions in each jurisdiction.

20. ACCEPTANCE OF THE PRIVACY NOTICE

Acceptance of this Notice is governed by the following principles:

20.1 Affirmative consent. Eden does not presume the Data Subject's consent from the mere use of the website or services. Where consent is the legal basis for the processing, Eden will request a clear affirmative action from the Data Subject (opt-in).

20.2 Granularity. The Data Subject may grant their consent in a differentiated manner for each purpose of the processing, where the applicable law so requires.

20.3 Revocability. Consent may be withdrawn at any time, as simply as it was granted.

21. UPDATES TO THE PRIVACY NOTICE

21.1 Eden reserves the right to modify this Notice at any time to adapt it to regulatory, jurisprudential, technological, or operational changes. Any substantial modification will be communicated to the Data Subject through: (a) publication on the website legal.edenmed.com, with a clear indication of the date of last update; (b) notification by email to Data Subjects whose address Eden holds, when the modification affects previously granted rights; and (c) notice within the Eden Suite platform, when the modification affects platform Users.

21.2 Where the modification requires new consent from the Data Subject, Eden will request it explicitly before the modification takes effect.

22. DATA PROTECTION AUTHORITIES AND COMPLAINTS

22.1 Without prejudice to the Data Subject's right to contact Eden directly, the Data Subject has the right to file a complaint with the competent Data Protection Authority in their jurisdiction. The main authorities in Eden's jurisdictions of operation are listed below:

22.1.1 Mexico — Secretaría Anticorrupción y Buen Gobierno, for personal data held by private parties. Principal framework: the LFPDPPP enacted in 2025, as amended, and applicable implementing rules.

22.1.2 Brazil — Agência Nacional de Proteção de Dados (ANPD). Principal framework: LGPD, Law 13.709/2018, as amended, and applicable ANPD regulations.

22.1.3 Colombia — Superintendencia de Industria y Comercio (SIC). Principal framework: Law 1581 of 2012 and implementing provisions compiled in Decree 1074 of 2015. Inquiries and complaints follow the applicable requirements and deadlines, without limiting more favorable commitments in this Notice.

22.1.4 Peru — Autoridad Nacional de Protección de Datos Personales (ANPDP). Principal framework: Law 29733 and its Regulations approved by Supreme Decree 016-2024-JUS.

22.1.5 Ecuador — SPDP (Superintendencia de Protección de Datos Personales). Main legal framework: LOPDP (Organic Law on Personal Data Protection).

22.1.6 Chile — Law 19.628 in force and the currently applicable remedies. Law 21.719, which reforms the regime and creates the Personal Data Protection Agency, takes effect on December 1, 2026. Eden will apply the new regime from the date its requirements become enforceable.

22.1.7 European Union — Supervisory authority of the relevant member state. Main legal framework: GDPR (Regulation (EU) 2016/679).

22.1.8 United States — HHS Office for Civil Rights (OCR) for HIPAA; the Federal Trade Commission (FTC), state authorities and, where applicable, the California Privacy Protection Agency (CPPA) within their respective jurisdictions. HIPAA, CCPA/CPRA and other laws apply according to the entity, data type, processing activity and relevant exemptions.

22.2 Eden reaffirms its willingness to resolve any dispute promptly and amicably through its DPO, without prejudice to the Data Subject's right to approach the competent authorities.

23. APPLICABLE LAW AND JURISDICTION

23.1 This Notice is interpreted under the law in force governing each processing activity, including mandatory territorial-scope and conflict-of-laws rules. Automatic Maximum Protection supplements that law with the safeguards expressly undertaken; it does not displace mandatory rules or confer jurisdiction on an authority that lacks it.

23.2 For any dispute arising from the processing of personal data, the courts of the jurisdiction of the Data Subject's domicile will have jurisdiction, unless the applicable law establishes a different rule.

24. CONTACT

24.1 Contact for questions, requests and complaints: legal@edenmed.com. Postal address: Higia, Inc. — Attn: Data Protection Officer — 300 Delaware Ave., Suite 210 #215, Wilmington, DE 19801, United States of America. Service languages: Spanish, Portuguese and English. Where a local representative is required, its details will be published under Clause 2.4 and applicable law; the DPO will help route inquiries.