Personal Data Protection Policy

Smile On Smile Free SAS · NIT 902.063.657-0 · Medellín, Colombia

1. PURPOSE

The purpose of this Policy is to establish the guidelines, directives, and procedures that guarantee the constitutional right of all individuals to know, update, rectify, and delete the information collected in the databases of SMILE ON SMILE FREE SAS, identified with Tax Identification Number (NIT) No. 902.063.657-0.

Likewise, the accuracy, confidentiality, transparency, integrity, and security of information shall be protected in compliance with the applicable legal provisions currently in force, particularly Law 1266 of 2008, Law 1581 of 2012, and any other regulations that amend, regulate, or govern the respective guidelines regarding Habeas Data.

SMILE ON SMILE FREE SAS expressly states that it does not share personal information with third parties, except in cases that are strictly necessary for the proper execution of the agreements entered into, for purposes duly authorized by the data subject, or in circumstances permitted by law. To guarantee transparency and awareness of this Policy, evidence thereof shall be provided through electronic mail, publication on the physical bulletin board of the dental center, and direct delivery to each client, employee, and contractor at the commencement of the contractual relationship.

2. SCOPE

This Personal Data Protection Policies and Procedures Manual is based on the provisions established in Law 1581 of 2012 and Decree 1377 of 2013, which partially regulates said law.

This Policy shall apply to all levels of the organization and constitutes a formal and responsible commitment to facilitate the implementation and compliance with Law 1581 of 2012 concerning the regulation of aspects related to the authorization granted by the data subject for the processing of personal data, the processing policies of controllers and processors, the exercise of the rights of data subjects, and the transfer of personal data.

3. DATA CONTROLLER

Corporate Name: SMILE ON SMILE FREE SAS

Registered Office: Medellín, Colombia

Business Address: CL 2 #20 50 OF 1203, Medellín, Colombia.

4. TO WHOM THIS DATA PROCESSING POLICY IS ADDRESSED

This Personal Data Processing Policy is directed to all individuals and entities having any relationship with SMILE ON SMILE FREE SAS, including clients, employees, contractors, suppliers, business partners, in general, any individual or entity that establishes a relationship with the Company.

5. PURPOSES OF DATA PROCESSING

Personal data shall be used for the following basic and necessary purposes and/or for any other purposes that may be required according to the relationship that a third party maintains with SMILE ON SMILE FREE SAS:

a) Pre-Contractual Management and Selection

Evaluation and Selection. Conduct selection processes, evaluate commercial proposals, and verify suitability, experience, and compliance with minimum technical requirements.

Background Verification. Carry out consultations and validations of judicial, tax, and disciplinary records and conduct restrictive screening procedures regarding Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT).

Security Reviews. Verify the authenticity of submitted documents, including bank certifications, Tax Registration Certificates (RUT), identification documents, professional licenses, and any other documentation submitted by any individual in connection with SMILE ON SMILE FREE SAS.

b) Contractual and Operational Management

Formalization of the Contractual Relationship. Carry out the administrative procedures necessary for the execution of civil, employment, commercial, or service agreements.

Contract Performance. Monitor, control, and evaluate compliance with contractual obligations, including the delivery of dental supplies, prosthetic delivery schedules, and any other contractual commitments.

Communication Channels. Establish and maintain efficient communication channels for the sending and receipt of correspondence, purchase orders, service requests, and technical support.

c) Financial and Accounting Management

Payment Management. Accrue and pay fees, invoices, or collection accounts arising from the provision of services or the supply of goods.

Accounting Records. Comply with the clinic's tax and accounting obligations, including the issuance of withholding tax certificates, submission of exogenous information reports to the National Tax and Customs Directorate of Colombia (DIAN), financial audits, and any other information required by legally authorized institutions domiciled in Colombia.

Banking Verification. Manage bank account information and verify that such accounts are effectively maintained in favor of SMILE ON SMILE FREE SAS.

d) Occupational Health and Safety

Affiliations to the Social Security System. Verify compliance with current legal regulations concerning social security matters (health, pension, and occupational risk insurance) applicable to contractors and/or employees who perform work within the clinic, in accordance with the Occupational Health and Safety Management System (SG-SST). Likewise, maintain consolidated information related to the social security system of employees hired under employment agreements.

Access Control. Register the entry and exit of contractors, their dependents, and any other individual who has an employment relationship or who is receiving services within the physical facilities of SMILE ON SMILE FREE SAS, in order to guarantee the security of assets and personnel.

Video Surveillance. Process images captured by the clinic's closed-circuit television system for infrastructure security purposes and internal process control.

e) Legal and Administrative Purposes

Audit Support. Information shall serve as documentary support for internal and external audits or requirements issued by inspection, surveillance, and control authorities, including the Superintendence of Industry and Commerce and the Health Secretariat, among others.

Legal Defense. Use data and documents as evidentiary material in the event of claims, litigation, contractual disputes, or civil liability proceedings.

Corporate Records of SMILE ON SMILE FREE SAS. Retain contractual records after the termination of the relationship in accordance with the legal retention periods and document preservation requirements established under Colombian commercial law.

6. DEFINITIONS

For the purposes of the proper application of the provisions set forth in this Personal Data Protection Policy and in accordance with Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013, and/or any other regulations that amend or govern them, the following terms shall be understood as follows:

a) AUTHORIZATION: Refers to the prior, express, and informed consent granted by the data subject for the processing of personal data. Such authorization must be obtained beforehand through any means that may subsequently be consulted.

b) DATABASE: Refers to the organized set of personal data that is subject to processing.

c) PERSONAL DATA: Any information linked to or capable of being associated with one or more natural and/or legal persons.

d) DATA PROCESSOR: A natural or legal person, public or private, who, either independently or jointly with others, processes personal data on behalf of the Data Controller.

e) DATA CONTROLLER: A natural or legal person, public or private, who, either independently or jointly with others, decides on the database and/or the processing of data.

f) DATA SUBJECT: A natural person whose personal data is subject to processing.

g) PROCESSING: Any operation or set of operations performed on personal data, including collection, storage, use, circulation, or deletion when requested.

h) SENSITIVE DATA: Data that affects the privacy of the data subject or whose improper use may result in discrimination, including information revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions, social organizations, or human rights organizations, or organizations promoting the interests of any political party, as well as data relating to health, sexual life, and biometric information.

i) PUBLIC DATA: Data that is not classified as semi-private, private, or sensitive. Public data includes, among others, information relating to marital status, profession or occupation, and status as a merchant or public servant.

j) PRIVACY NOTICE: The verbal or written communication generated by the Data Controller and addressed to the data subject for the processing of personal data. Through this notice, the data subject is informed of the existence of the applicable data processing policies, the manner in which such policies may be accessed, and the purposes for which personal data will be processed.

At a minimum, the Privacy Notice shall contain the following information:

The identity, address, and contact information of the Data Controller.

The type of processing to which the data will be subject and its purposes.

The general mechanisms established by the Data Controller that enable the data subject to become aware of the Data Processing Policy and any substantial amendments thereto. In all cases, the data subject must be informed of how to access or consult the Data Processing Policy.

7. PRINCIPLES

The following principles establish the general parameters that shall be adopted by SMILE ON SMILE FREE SAS for the various processes of collection, use, and processing of personal data:

a) PRINCIPLE OF PURPOSE: The purpose of data processing must correspond to a legitimate purpose and be consistent with Section 5 of this document and with constitutional and legal provisions. The purpose must be communicated to the data subject.

b) PRINCIPLE OF FREEDOM: Processing may only be carried out with the prior, express, and informed consent of the data subject. Personal data may not be obtained or disclosed without prior authorization or in the absence of a legal or judicial mandate evidencing consent, and such data may be deleted from the database if so requested by the data subject.

c) PRINCIPLE OF ACCURACY OR QUALITY: Information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading information is prohibited.

d) PRINCIPLE OF TRANSPARENCY: In the processing of personal data, the right of the data subject to obtain information from SMILE ON SMILE FREE SAS, at any time and without restriction, concerning the existence of data relating to him or her shall be guaranteed.

e) PRINCIPLE OF RESTRICTED ACCESS AND CIRCULATION: Personal data, except for public information, shall not be available on the Internet or through other means of mass disclosure or communication unless access is technically controllable so as to provide restricted knowledge solely to data subjects or authorized third parties.

f) PRINCIPLE OF SECURITY: Information subject to processing by SMILE ON SMILE FREE SAS shall be protected through the use of technical, human, and administrative measures necessary to provide security to the records and prevent their alteration, loss, consultation, use, unauthorized access, or fraudulent access.

g) PRINCIPLE OF CONFIDENTIALITY: All persons involved in the processing of personal data are required to guarantee the confidentiality of the information, including after the termination of their relationship with any activities involving such processing.

8. PROCESSING OF PATIENTS' PERSONAL DATA

SMILE ON SMILE FREE SAS, in its capacity as a provider of oral healthcare services, may collect, store, use, update, transmit, transfer, and delete patients' personal data for the purpose of carrying out activities related to the promotion, prevention, diagnosis, treatment, rehabilitation, monitoring, and control of oral health.

These purposes include, among others: the creation and management of medical records, the scheduling and confirmation of appointments, the preparation of diagnoses, the formulation of treatment plans, payment and billing management, referrals to specialists, compliance with requests from healthcare authorities, claims management, the execution of quality assurance and audit processes, and compliance with legal and regulatory obligations applicable to the healthcare sector.

9. PROCESSING OF SENSITIVE DATA

SMILE ON SMILE FREE SAS may process sensitive data whenever such processing is necessary for the proper provision of healthcare services, in accordance with the exceptions established in Law 1581 of 2012.

Sensitive data includes, among others, information related to the patient's physical or mental health condition, medical history, diagnoses, treatments, dental procedures, diagnostic images, radiographs, clinical photographs, biometric information and any other information that may affect the privacy of the data subject.

The data subject shall not be obligated to authorize the processing of sensitive data, except where such processing is indispensable for the provision of healthcare services or where a legal obligation permits such processing.

10. PROCESSING OF PERSONAL DATA OF CHILDREN AND ADOLESCENTS

The processing of personal data of minors shall be carried out in accordance with the best interests of children and adolescents and with full respect for their fundamental rights.

Authorization for the processing of such data shall be granted by the individual exercising legal representation of the minor, without prejudice to obtaining the minor's opinion whenever appropriate according to his or her level of maturity and capacity for understanding.

11. CLINICAL PHOTOGRAPHS, VIDEOS, AND DIAGNOSTIC IMAGES

SMILE ON SMILE FREE SAS may capture, collect, store, use, and process clinical photographs, audiovisual recordings, radiographs, intraoral scans, tomographic images, and any other diagnostic images associated with the dental services provided.

Such images and recordings may be used for purposes related to: healthcare services, clinical diagnosis and treatment, scientific and academic activities, quality assurance and audit processes, monitoring and follow-up of treatments, administrative and documentary support activities; and compliance with legal obligations applicable to healthcare service providers.

Whenever clinical photographs, videos, or diagnostic images are intended for advertising, promotional, commercial, educational, or marketing purposes, prior, express, specific, and independent authorization from the data subject shall be required.

12. TRANSFER AND TRANSMISSION OF PERSONAL DATA

SMILE ON SMILE FREE SAS may transfer and/or transmit personal data to third parties whenever such actions are necessary for the adequate provision of services and the fulfillment of legal or contractual obligations.

Personal data may be transferred or transmitted, among others, to: dental laboratories, technology service providers, providers of legal, accounting, and administrative services, electronic medical record management platforms, insurance companies, healthcare entities, specialists and healthcare professionals, financial institutions, judicial and administrative authorities, and any other person or entity expressly authorized by law or by the data subject.

In all cases, SMILE ON SMILE FREE SAS shall require the implementation of appropriate security and confidentiality measures to ensure the protection of personal information.

13. DATA RETENTION

Personal data shall be retained for the period necessary to fulfill the purposes described in this Policy and to comply with the legal obligations applicable to SMILE ON SMILE FREE SAS.

Medical records and all healthcare-related documents shall be retained in accordance with the terms established by current healthcare regulations.

Likewise, personal data relating to employees, contractors, suppliers, and third parties shall be retained during the term of the contractual relationship and thereafter for the period necessary to comply with legal, tax, accounting, administrative, judicial, and documentary retention obligations.

Upon expiration of the legal retention periods and provided there is no legal or contractual obligation requiring their preservation, personal data shall be deleted or destroyed through secure mechanisms that prevent its recovery.

14. AUTHORIZATION

The collection, storage, use, circulation, transmission, transfer, and deletion of personal data by SMILE ON SMILE FREE SAS require the free, prior, express, and informed consent of the data subject, except in those cases expressly authorized by law.

14.1. Means for granting authorization: The authorization must be recorded in a physical or electronic document, or in any other format that ensures it can be consulted subsequently; it must be issued by SMILE ON SMILE FREE SAS and made available to the data subject prior to the processing of their personal data, in accordance with the provisions of Law 1581 of 2012.

An annex to this document sets forth the notification template established by SMILE ON SMILE FREE SAS for the proper obtaining of authorization from data subjects regarding the collection, use, and processing of their personal data; this template informs the data subject of the data processing policies that will apply to them. Conduct that unequivocally demonstrates the data subject's intention to authorize the processing of personal data; or Any other mechanism that allows subsequent consultation and verification.

14.2. Proof of Authorization: The records will be kept in the client, supplier or employee's file when and how authorization was obtained from the data subjects for the processing of their data, and the documents related to the processing of personal data will be kept for as long as the obligations arising from this remain in effect.

14.3. Revocation of Authorization and Deletion of Data: Data subjects may at any time request the controller or processor to delete their personal data and/or revoke the authorization granted for the processing thereof, by filing a complaint, in accordance with the provisions of Law 1581 of 2012, provided that it is not prevented by a legal or contractual provision.

15. RIGHTS AND OBLIGATIONS

15.1 Rights of Data Subjects. Article 8 of Law 1581 of 2012 explicitly sets out the rights that the owner of personal data will have:

a) To know, update and rectify your personal data before SMILE ON SMILE FREE SAS. This right may be exercised, among others, with respect to partial, inaccurate, incomplete, fragmented, misleading data, or those whose processing is expressly prohibited or has not been authorized.

b) Request proof of the authorization granted to SMILE ON SMILE FREE SAS.

c) Be informed by SMILE ON SMILE FREE SAS, upon request, regarding the use of your personal data.

d) File complaints with the Superintendency of Industry and Commerce for violations of Law 1581 of 2012, once you have exhausted the consultation or claim process with SMILE ON SMILE FREE SAS.

e) Revoke the authorization and/or request the deletion of your data when the processing respects constitutional and legal principles, rights, and guarantees.

f) Access your personal data that has been processed, free of charge.

15.2. LEGAL STANDING TO EXERCISE THE RIGHTS OF THE DATA SUBJECT: The rights of data subjects established in the Law may be exercised by the following persons:

a) By the data subject, who must sufficiently prove their identity through the various means made available by SMILE ON SMILE FREE SAS.

b) By their successors in interest, who must prove such status.

c) By the data subject's representative and/or attorney-in-fact, upon prior accreditation of the representation or power of attorney authenticated before a Notary Public.

d) By stipulation in favor of or for another.

e) The rights of children or adolescents shall be exercised by the persons authorized to represent them.

15.3. OBLIGATIONS OF SMILE ON SMILE FREE SAS regarding the processing of personal data: SMILE ON SMILE FREE SAS shall bear in mind at all times that personal data belongs to the individuals to whom it refers and only they can decide how it is used. Therefore, this information will be used for the purposes established in section 5 of this document, respecting in all cases the provisions of Law 1581 of 2012 on the protection of personal data.

Furthermore, SMILE ON SMILE FREE SAS undertakes to comply with the obligations established in Article 17 of Law 1581 of 2012, which stipulates:

a) To guarantee the data subject, at all times, the full and effective exercise of their right to habeas data.

b) To request and retain, under the conditions established by Law 1581 of 2012, a copy of the respective authorization granted by the data subject.

c) Properly inform the data subject about the purpose of the data collection and their rights under the authorization granted.

d) Store the information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent access, use, or disclosure.

e) Ensure that the information provided to the Data Processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.

f) Promptly update, rectify, or delete personal data, as well as process inquiries and complaints submitted by data subjects, in accordance with the terms established in Articles 14 and 15 of Law 1581 of 2012.

g) Provide the Data Processor, as applicable, only with data whose processing has been previously authorized.

h) Require the Data Processor at all times to respect the security and privacy conditions of the data subject's information.

i) Report to the Superintendency of Industry and Commerce any violations of security codes and any risks in the management of data subjects' information.

j) Comply with the instructions issued by the Superintendency of Industry and Commerce.

15.4. RIGHT OF ACCESS: SMILE ON SMILE FREE SAS will establish and maintain simple and efficient mechanisms that allow data subjects to access and know whether their data is being processed, as well as the scope, conditions, and general aspects of such processing.

15.5. CONSULTATION: Data subjects may consult their personal data free of charge, whenever they so request, especially when there are substantial modifications to the Data Processing Policies that warrant new consultations.

To address personal data inquiries, SMILE ON SMILE FREE SAS guarantees the availability of electronic or other means it deems appropriate and the use of customer service through the staff assigned for this purpose.

In any case, regardless of the mechanism implemented for handling consultation requests, SMILE ON SMILE FREE SAS will address them in accordance with the terms established by current regulations for this procedure.

15.6. RIGHT TO UPDATE, RECTIFY, AND DELETE:

COMPLAINTS: Data subjects who believe that the information contained in a database should be "Corrected, Updated, or Deleted," or who suspect a breach of any of the obligations contained in Law 1581 of 2012, have the right to file a complaint with the data controller, complying with the requirements set forth in the sections of Article 15 of Law 1581 of 2012.

16. IMPLEMENTATION OF PROCEDURES TO GUARANTEE THE RIGHT TO FILE COMPLAINTS:

The data subject may, at any time and free of charge, request SMILE ON SMILE FREE SAS to rectify, update, or delete their personal data, upon proof of identity.

This right, as well as the right to request information, may only be exercised by:

a) The data subject, upon proof of identity, their successors, or their legal representatives, upon proof of representation. In this case, if the requirement of proof of representation is not met, the request will be considered not submitted.

b) Public or administrative entities in the exercise of their legal functions or by court order.

c) Third parties authorized by the data subject or by law.

The request for rectification, updating, or deletion of data must contain at least the following information:

Full name of the data subject.

Contact information, such as address or any other means to receive the response.

Contact phone number (landline or mobile).

Documents proving the identity of the data subject and their representative, where applicable.

Clear and precise description of the personal data regarding which the data subject intends to exercise any of their rights.

If necessary, other documents or supporting materials that facilitate the processing of the request.

In requests for rectification or updating of personal data, the data subject must indicate the corrections to be made and provide the documentation that supports their request.

It is important to note that deletion implies the total or partial elimination of personal information as requested by the data subject. However, the data controller may deny the request in the following cases:

a) The data subject has a legal obligation to remain in the database.

b) The deletion of the data hinders judicial or administrative proceedings related to tax obligations.

c) The data is necessary to comply with a legally acquired obligation of the data subject.

In cases where the deletion of personal data is warranted, SMILE ON SMILE FREE SAS will operationally delete the information in such a way that its recovery is not possible.

SMILE ON SMILE FREE SAS has full discretion to implement mechanisms that facilitate the exercise of this right, always seeking to benefit the data subject. To this end, it may enable electronic or other means it deems appropriate, which will be communicated to interested parties in a timely manner.

To process the requests received, SMILE ON SMILE FREE SAS may use its existing customer service channels, ensuring compliance with the response times defined in Article 15 of Law 1581 of 2012.

17. INFORMATION SECURITY

In accordance with the security principle established in Law 1581 of 2012, SMILE ON SMILE FREE SAS will adopt the necessary technical, human, and administrative measures to ensure the security of records, preventing their alteration, loss, unauthorized or fraudulent access, use, or disclosure.

Accordingly, SMILE ON SMILE FREE SAS will maintain mandatory security protocols for personnel with access to personal data and information systems.

The regulations governing the use of personal cell phones or other personal electronic devices during work hours, and the use of data collection devices on equipment, will be established by management to comply with the Habeas Data Law, guarantee the confidentiality of personal data of associates, employees, clients, suppliers, and third parties in general, and prevent the leakage of data that, by law, must be kept confidential.

18. HABEAS DATA COMMUNICATION CHANNELS

Data subjects may exercise their rights to access, update, rectify, delete, and revoke authorization through the following channels:

a) Email: contact@smileonsmiles.com

b) Physical address: CL 2 #20 50 OF 1203, Medellín, Colombia.

c) Telephone: +573021007725

d) Person responsible for handling requests: Legal Representative or their designee.

All requests will be processed in accordance with the procedures and terms established in Law 1581 of 2012 and any amendments, supplements, or regulations thereto.

19. MANAGEMENT OF SECURITY INCIDENTS

In the event of unauthorized access, loss, alteration, leakage or any incident that compromises the security of personal data, SMILE ON SMILE FREE SAS will take the necessary measures to contain the incident, mitigate its effects, document the facts and make the corresponding reports to the competent authorities when required by law.

20. FINAL PROVISIONS

The legal representative of SMILE ON SMILE FREE SAS is designated as responsible for the adoption and implementation of the obligations provided for in Law 1581 of 2012.

21. VALIDITY

This Policy is effective from the date of its publication and dissemination.