In accordance with Article 2 of the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), "Personal Data" means any information relating to an identified or identifiable natural person; likewise, "Sensitive Personal Data" means those personal data that affect the data subject's most intimate sphere, or whose improper use may give rise to discrimination or entail a serious risk to the data subject.

In compliance with Article 8 of the LFPDPPP, the data subject's consent for the processing of personal data is requested through this Privacy Notice:

DATA CONTROLLER

For purposes of the Personal Data and Sensitive Personal Data that you have provided or may provide through various means and/or forms, including social media and digital communication media, and in connection with the relationship or potential relationship arising from the provision of medical services, TUYO HEALTH MÉXICO, S.C. (hereinafter, the "Controller"), with address at the consulting room identified as "Consultorio A608", located on the sixth level, belonging to the Subcondominium identified as "CMC 2", of the Condominium denominated "CMC", which in turn forms part of the Condominium Complex identified as Revolución 1225, on the property marked with number one thousand two hundred twenty-five of Revolución Avenue, Los Alpes, Álvaro Obregón, Mexico City, Mexico, ZIP Code 01010, is the data controller responsible for the processing of your personal data under this Privacy Notice.

PURPOSES OF PROCESSING PERSONAL DATA

The Personal Data collected by the Controller will be used for the following purposes:

Purposes necessary to maintain the relationship with the data subject:

• Integration and clinical follow-up in your electronic medical record;
• Provision of specialized medical services, in particular, care related to weight loss with medication, improvement of sexual performance, and treatment of hair loss;
• Preparation, integration, study, analysis, maintenance and archiving of the clinical record.
• Maintaining records for follow-up in the provision of services;
• Verify, confirm and validate your identity;
• Contact you to schedule, confirm, modify or follow up on medical appointments;
• Evaluate the quality of our medical services;
• Compliance with legal obligations in health, accounting and tax matters; and,
• Invoicing and collection of fees for the services provided.

Secondary purposes:

• Health information studies, records and analysis;
• Sending information about products, services and promotions related to your treatment;
• Preparation of internal statistical reports to improve services;
• Maintaining a record for the provision of services in the future;
• Statistical analysis.

If you do not wish your personal data to be processed for these secondary purposes, you may submit a request through the procedure indicated below.

DATA COLLECTED

To fulfill the purposes provided in this Privacy Notice, the Controller will collect, directly or in person, the following data:

Identification and contact data

The contact and/or identification personal data that the Controller will collect are: full name of the service user, age, date of birth, sex, occupation, address, email, telephone (mobile and/or landline), and Federal Taxpayers Registry; as well as identification data of the responsible person: full name, address, employment information, telephone number, relationship to the user, and email, to contact them in case of emergency.

Financial and tax data

The Controller will collect the financial data necessary to pay for the services, as well as the tax data of the user or of the person who pays for the services received by the user. Likewise, it will collect the financial and tax data necessary to issue invoices for the provision of the services.

Sensitive Personal Data

The Controller will collect and process sensitive data related to health status, background, medical history, and lifestyle information (habits, customs and beliefs), necessary or convenient for the preparation of the clinical record and the purposes stated above. Likewise, it will collect copies of identification documents of the user or the user's representatives.

Confidential personal data

The Controller will collect the ID and the handwritten signature of the user for the preparation of the clinical record.

TRANSFERS

Personal data may be shared with treating physicians duly accredited by the Controller, as well as with competent health authorities when required by applicable law. Data transfers will be carried out only in the cases provided for by the LFPDPPP, in compliance with the principles of lawfulness, purpose, proportionality, and accountability.

Additionally, solely for storage purposes, the data may be transferred for such purpose to Amazon Web Services, Inc. or its affiliated companies.

'ARCO' RIGHTS

All personal data are processed in accordance with applicable and current law; therefore, you have at all times the right to access (Access) the personal data that the Controller holds about you and the details of their processing, as well as to rectify them (Rectification) if they are inaccurate or incomplete; to cancel them (Cancellation) when you wish your data to be deleted from files, records, and medical files; and to oppose (Opposition) their processing when you do not wish them to be processed for a specific purpose; collectively, 'ARCO' Rights.

REQUEST TO EXERCISE RIGHTS OF ACCESS, RECTIFICATION, CANCELLATION AND OPPOSITION TO THE PROCESSING OF PERSONAL DATA (ARCO)

To initiate an ARCO Request, you must submit a request addressed to support@tuyohealth.com, who will be responsible for processing data subjects' requests, at the email address support@tuyohealth.com said request must contain the following information:

• Data subject's name.
• Email address to communicate the response to the request.
• Valid official photo identification to prove your identity.
• If the request is not initiated by the data subject, the requester must submit the document evidencing the representation.
• In the case of minors, the documents to prove legal representation will be: birth certificate and valid official photo identification of the parents or guardians.
• In the case of persons under interdiction, the documents to prove legal representation will be: interdiction record and valid official photo identification of the representative.
• Notarial power of attorney with annexes and valid official photo identification of the representative.
• Clear and precise description of the personal data with respect to which you intend to exercise any ARCO right, as well as the 'ARCO' right you intend to exercise.
• Any other element that allows the location of the personal data and attention to the request.
• If you request Rectification of data, in addition to the foregoing, please indicate the modifications to be made, providing the documentation supporting your request.

LIMITATION ON THE USE AND DISCLOSURE OF INFORMATION

You may limit the use or disclosure of your personal data by sending a request to the email mentioned above. Likewise, you may register in the Public Registry to Avoid Advertising (Registro Público Para Evitar Publicidad, REPEP), available at https://repep.profeco.gob.mx/.

USE OF COOKIES AND TRACKING TECHNOLOGIES

Our platform may use cookies to improve the user experience. These cookies do not collect sensitive personal data, and you can disable them directly from your browser.

MEANS OF REPRODUCING PERSONAL DATA REQUESTED THROUGH 'ARCO' RIGHTS

If you request Access to your Personal Data, because the requested information contains sensitive data, the Controller will only deliver the information in a simple copy and in person, upon proof of identity.

MEANS AND OPTIONS OFFERED TO LIMIT THE USE OR DISCLOSURE OF PERSONAL DATA

As the data subject, you have the possibility to limit the use or disclosure of your personal data by sending a request to the email address support@tuyohealth.com stating the desired limitation on the use or disclosure of your personal data.

MEASURES TO PROTECT PERSONAL DATA

To prevent unauthorized access to personal data and in order to ensure that the information is used solely in accordance with the purposes established in this Privacy Notice, the Controller has implemented physical, electronic and administrative procedures to prevent the use or disclosure of personal data, enabling it to be processed securely.

NOTICE OF CHANGES TO THE PRIVACY NOTICE

This Privacy Notice may be modified at any time to comply with legislative updates, case law, internal policies, new requirements for the provision of services, or any other cause at the sole discretion of the Controller. In such case, the modifications will be available at the consulting room identified as "Consultorio A608", located on the sixth level, belonging to the Subcondominium identified as "CMC 2", of the Condominium denominated "CMC", which in turn forms part of the Condominium Complex identified as Revolución 1225, on the property marked with number one thousand two hundred twenty-five of Revolución Avenue, Los Alpes, Álvaro Obregón, Mexico City, Mexico, ZIP Code 01010, as well as in any other verbal, printed or electronic communication medium that the Controller determines for such purpose and makes publicly known via social media, digital communication media, or physically at the address indicated above.

ASSISTANCE FROM AUTHORITIES

If the Controller does not timely or properly address your 'ARCO' rights request, or if you consider that your right to the protection of personal data has been violated, you may approach the government body TRANSPARENCIA PARA EL PUEBLO (TRANSPARENCY FOR THE PEOPLE) or the Authority that, at the relevant time, assumes the functions in the area of personal data protection, pursuant to the constitutional and legal reforms that replace the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI).

The foregoing, in accordance with the provisions of the transitory articles of the Decree reforming Article 6 of the Political Constitution of the United Mexican States, published in the Official Gazette of the Federation (Diario Oficial de la Federación) on December 20, 2024; and the provisions of the transitory articles of the New Federal Law on the Protection of Personal Data Held by Private Parties.

Until such authority is formally installed, you may submit your objections or complaints to the competent judicial instances in accordance with applicable law.

CONSENT

By providing your personal data by any means, you accept their processing in accordance with the terms and conditions of this Privacy Notice. For sensitive personal data, we will request your express and written consent, or through reliable and verifiable electronic means.

Likewise, you grant your authorization through the digital means by which this Privacy Notice is made available to you.