Privacy and Personal Data Protection Notice

CLAUSE 1 — CONTROLLER AND ROLES

Legal name

BIOMEV SAÚDE E TECNOLOGIA LTDA

Platform

BioArmor

Brazilian company ID

69.156.250/0001-11

Address

SGAS 915, Conjunto N, salas 254, 255 e 256, Asa Sul, Brasília/DF, CEP 70390-150

1.1. Depending on the operation, BioMev may act as the data controller or as a processor on behalf of a clinic or health professional. When another organization is the controller, BioMev may route the request to the appropriate responsible party.

CLAUSE 2 — DATA PROTECTION OFFICER (DPO)

Name

Plácido Flaviano Curvo Netto

Contact

dpo@bioarmor.com.br

Designated

October 12, 2026

CLAUSE 3 — PERSONAL DATA PROCESSED

1. 3.1. Identification, contact, registration, authentication, and profile data.
2. 3.2. Relationships with clinics, professionals, and organizations, including roles and permissions.
3. 3.3. Health data and clinical information provided by the data subject or authorized professionals.
4. 3.4. Appointment, event, enrollment, consent, and terms-acceptance data.
5. 3.5. Technical and security logs, such as IP address, device, date, time, access, and audit trails.
6. 3.6. Support communications and data required to handle requests.

CLAUSE 4 — PURPOSES OF PROCESSING

1. 4.1. Create and protect accounts, authenticate users, and enforce role- and organization-based access controls.
2. 4.2. Provide contracted features and support the delivery and continuity of healthcare.
3. 4.3. Manage appointments, events, enrollments, consents, and service-related communications.
4. 4.4. Prevent incidents, fraud, and unauthorized access, maintain audit records, and investigate events.
5. 4.5. Comply with legal, regulatory, and contractual obligations and exercise legal rights.
6. 4.6. Provide support and improve the service, using data minimization and anonymization where applicable.

CLAUSE 5 — LEGAL BASES

5.1. Processing is tied to its purpose and may rely on the performance of a contract or preliminary procedures, compliance with legal or regulatory obligations, the regular exercise of rights, protection of life or physical safety and, for health data, healthcare protection by healthcare professionals, services, or health authorities. Consent is used when required or appropriate and may be withdrawn without affecting prior processing or processing supported by another legal basis.

CLAUSE 6 — DATA SHARING

6.1. BioMev does not sell personal data. Sharing is limited to what is necessary for each purpose.

1. 6.2. Authorized clinics, professionals, and teams, subject to the relationship, purpose, consent where applicable, and access permissions.
2. 6.3. Vendors supporting hosting, authentication, communications, support, security, and platform operations, subject to data-protection obligations.
3. 6.4. Public authorities, regulators, or third parties when disclosure is required by law or necessary for the regular exercise of rights.

CLAUSE 7 — RETENTION AND DELETION

7.1. Data is retained for as long as necessary for the stated purposes and applicable legal, regulatory, contractual, and legal-claims periods. When it is no longer needed, data is deleted or anonymized unless retention is permitted or required.

CLAUSE 8 — SECURITY AND CONFIDENTIALITY

8.1. We adopt technical and administrative measures proportionate to the risks, including access controls, authentication, organization segregation, audit logging, and incident management. No system is completely invulnerable; relevant incidents will be handled and reported as required by applicable law.

CLAUSE 9 — DATA RESIDENCY

9.1. Data processed by the BioArmor platform is stored in Brazil in accordance with the LGPD.

CLAUSE 10 — CHILDREN'S AND ADOLESCENTS' DATA

10.1. The processing of children's and adolescents' data observes their best interests and applicable legal requirements, including the involvement of a legal representative where required.

CLAUSE 11 — AUTOMATED DECISIONS

11.1. If a decision based solely on automated processing affects your interests, you may request information about the criteria used and a review of the decision under the LGPD, subject to trade and industrial secrets.

CLAUSE 12 — DATA SUBJECT RIGHTS

12.1. Within the limits of the LGPD and the applicable legal basis, you may request:

1. 12.2. Confirmation of processing and access to the data.
2. 12.3. Correction of incomplete, inaccurate, or outdated data.
3. 12.4. Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data.
4. 12.5. Data portability, subject to regulations and trade and industrial secrets.
5. 12.6. Deletion of data processed based on consent, where applicable.
6. 12.7. Information about public and private entities with which data was shared.
7. 12.8. Information about the option not to consent and the consequences of refusal.
8. 12.9. Withdrawal of consent, objection to unlawful processing, and review of automated decisions.

CLAUSE 13 — EXERCISE OF RIGHTS

13.1. Send your request to the DPO using the contact above and describe the right you wish to exercise. If possible, use the email address registered with the platform.

13.2. To protect the data subject, we may request additional information to confirm identity and the relationship with the data. Do not send medical records, test results, or other health data in the first message unless strictly necessary. Responses will follow applicable legal and regulatory deadlines.

CLAUSE 14 — COMPLAINTS

14.1. If the request is not resolved, you may also petition Brazil's National Data Protection Agency (ANPD) and consumer-protection authorities, where applicable.

CLAUSE 15 — EFFECTIVE DATE AND UPDATES

15.1. This Notice may be updated to reflect legal, regulatory, or operational changes. The current version will remain available on this page together with the update date.

15.2. Last updated: October 19, 2026