Privacy Notice

This English version is provided for reference purposes only. In the event of any discrepancy in interpretation, the Spanish-language version ("Aviso de Privacidad") shall prevail.

In compliance with the Federal Law on Protection of Personal Data Held by Private Parties (the "Law"), published in the Official Gazette of the Federation on July 5, 2010, BIOSEP, S.A. DE C.V. (hereinafter "BIOSEP," "the Company," or "we"), with domicile at Mexicaltzingo number 2154, Colonia Americana-Obrera, Guadalajara, Jalisco, C.P. 44140, makes available this Comprehensive Privacy Notice regarding the processing of personal data of its data subjects.

BIOSEP is a boutique consultancy specialized in the private healthcare sector, active in health technology assessment (HTA), health program development, organization of healthcare-sector events, biostatistical and pharmacoeconomic modeling, commercial brokerage, and other trade activities in the health, energy, petrochemical, and related sectors. The Company develops proprietary methodologies applied to health value analysis.

BIOSEP respects the privacy of all individuals whose information is processed in the course of its professional and business activities. This Notice explains how BIOSEP collects, retains, uses, and, where applicable, discloses the personal data of its personnel, clients, suppliers, collaborators, and business partners.

I. Definitions

For the proper understanding of this Notice, the following definitions apply:

• Data Subject: The individual who owns the personal data.
• Personal Data: Any information concerning an identified or identifiable individual, including name, address, contact details, tax identifiers, and employment and financial information, among others.
• Sensitive Personal Data: Data affecting the data subject's most intimate sphere, or whose misuse could give rise to discrimination or represent a serious risk, such as health information, and genetic, biometric, religious, political, or sexual-preference data.
• Processing: The collection, use, disclosure, or storage of personal data by any means.
• Data Controller: BIOSEP, S.A. DE C.V., as the party responsible for the processing of the personal data collected.
• Agent or Data Processor: Any third party that processes personal data on behalf of and under the instructions of BIOSEP.
• Website: The set of web pages available at www.biosep.mx.

II. Scope

This Notice applies to all personal data, in electronic or physical format, received or collected by BIOSEP from its data subjects, including:

• Collaborators, employees, and job applicants
• Clients and prospects in the private healthcare sector
• Suppliers and business partners
• Exhibitors, sponsors, and attendees of events organized by BIOSEP
• Healthcare professionals and institutional executives with whom BIOSEP maintains a professional relationship
• Business and institutional contacts

III. Purposes of Processing

3.1 Primary Purposes

BIOSEP processes the personal data of its data subjects for the following purposes, which give rise to and are necessary for the legal or business relationship:

• Providing consulting services in health technology assessment (HTA) and health value analysis
• Developing health programs and strategies for private-sector institutions
• Organizing, coordinating, and operating healthcare-sector events
• Preparing biostatistical and pharmacoeconomic models
• Managing the contractual relationship with clients, suppliers, and collaborators
• Human resources management, including recruitment, administration, and staff development
• Invoicing, collections, and compliance with tax and legal obligations
• Operational communication with clients, suppliers, and collaborators

3.2 Secondary Purposes

With your consent, or where the law permits, BIOSEP may process your data for:

• Sending information about new services, methodologies, and events organized by BIOSEP
• Invitations to participate in market studies or satisfaction surveys
• Preparing commercial references for third parties, using contact details only

If the data subject does not wish their data to be processed for secondary purposes, they may state so through the means indicated in Section VI of this Notice.

IV. Personal Data Collected

Depending on the type of relationship with the data subject, BIOSEP may collect the following categories of data:

4.1 Identification and Contact Data

Including, on a non-exhaustive basis:

• Full name, address, email, telephone number
• RFC (tax ID), CURP (national ID), social security number (for collaborators)
• Position, company, or institution to which the individual belongs

4.2 Employment and Professional Data

Including, on a non-exhaustive basis:

• Professional history, employment references, certifications, and academic degrees (for selection processes and professional collaboration)
• Performance information for active collaborators

4.3 Financial and Tax Data

Including, on a non-exhaustive basis:

• Banking and tax data necessary for invoicing, payments, and collections
• Contractual and credit information

4.4 Sensitive Data

In exceptional cases, and when the provision of a service so requires — for example, to manage life or medical expense insurance as an employment benefit — BIOSEP may collect a collaborator's health data, only with their express consent. BIOSEP does not collect patient health data nor administer individual clinical records.

V. Transfer of Personal Data

BIOSEP may transfer personal data to third parties in the following cases, without requiring the data subject's consent where the Law so permits:

• Mexican tax, labor, or judicial authorities, when required by law or court order
• Technology, accounting, or legal service providers acting as data processors under BIOSEP's instructions, subject to a contractual confidentiality obligation
• Financial institutions for payment processing

In cases requiring consent, BIOSEP will request it expressly and separately.

BIOSEP does not sell, assign, or transfer personal data to third parties for their own commercial purposes, except with the data subject's express consent or as required by applicable law.

VI. Data Subject Rights and Means to Exercise Them

Data subjects have the right to Access, Rectify, Cancel, or Object (ARCO rights) to the processing of their data, as well as to Revoke any consent given, under the terms of the Law.

To exercise any of these rights, the data subject may contact BIOSEP through the following means:

• Email: encargado.privacidad@biosep.com.mx
• In writing, at BIOSEP's domicile: Mexicaltzingo 2154, Col. Americana-Obrera, Guadalajara, Jalisco, C.P. 44140

The request must contain: (i) the data subject's name and a means of contact to receive a response; (ii) documents proving identity or legal representation; (iii) a clear description of the data and the right sought to be exercised; and (iv) any element that facilitates locating the data.

BIOSEP will respond within a maximum of 20 business days from receipt of the request. If the request is granted, it will be made effective within the following 15 business days.

VII. Security Measures

BIOSEP implements administrative, technical, and physical security measures designed to protect personal data against damage, loss, alteration, destruction, or unauthorized access.

Measures adopted include: access control over systems and databases, internal confidentiality policies for collaborators, and the use of encrypted channels for transmitting sensitive information.

Should the data subject become aware of a possible security incident related to their data, they may report it to encargado.privacidad@biosep.com.mx for immediate attention.

VIII. Data Retention

BIOSEP will retain personal data for as long as necessary to fulfill the purposes for which it was collected, to comply with contractual, legal, or tax obligations, or to defend the Company's legitimate interests before any authority.

Once these purposes have been fulfilled, the data will be deleted or dissociated in accordance with BIOSEP's internal procedures and applicable regulations.

IX. Use of Cookies and Tracking Technologies

BIOSEP's Website may use cookies and similar technologies to improve the browsing experience, analyze site usage, and offer relevant content. Information collected through these technologies is statistical in nature and does not individually identify users.

Users may disable the use of cookies through their browser settings, although this may affect the functionality of the Website.

X. Changes to this Privacy Notice

BIOSEP reserves the right to modify this Notice at any time. Updates will be published at www.biosep.mx/legal/en/aviso-de-privacidad. Data subjects are encouraged to review it periodically.

Continued use of the Website or of BIOSEP's services after changes are published constitutes acceptance of those changes.

XI. Applicable Law and Jurisdiction

This Privacy Notice is governed by the Federal Law on Protection of Personal Data Held by Private Parties and its Regulations, as well as by the laws in force in the United Mexican States. For any dispute arising from this Notice, the parties submit to the jurisdiction of the competent courts in the city of Guadalajara, Jalisco, Mexico, waiving any other jurisdiction that may correspond to them by reason of present or future domicile.

Where versions of this Notice exist in languages other than Spanish, the Spanish-language version shall always prevail.

Date of Preparation: January 2017
Last Updated: May 2026