TERMS AND CONDITIONS OF USE AND REGISTRATION – APP MI CEMDOE

By registering for and using the Mi CEMDOE mobile application (hereinafter referred to as the “Application”), the user declares that they have read, understood, and accepted these Terms and Conditions.

For the purposes of these Terms and Conditions, the term “CEMDOE Network” shall mean the group of healthcare centers operating under the CEMDOE brand whose operations are administered by Centro Médico de Diabetes, Obesidad y Especialidades (CEMDOE), S.A., even when each constitutes a separate legal entity. The user may request information regarding the centers that make up the CEMDOE Network from CEMDOE through its official channels.

1. Processing of Personal Data

By registering with the Application, the user authorizes CEMDOE to collect, store, organize, consult, and use their personal data in accordance with applicable legislation, including, but not limited to: first and last name, identity card (cédula) or passport, address, telephone numbers, email address, medical examination results, findings, and data, diagnostic imaging, laboratory reports, and information related to biological samples, pursuant to Law No. 172-13 on the Protection of Personal Data and other applicable regulations.

Furthermore, the user authorizes their personal data, including clinical information, to be communicated among and accessed by the centers comprising the CEMDOE Network, so that the user may access their appointments, test results, and other services across any of said centers via the Application, and to guarantee continuity of care. This authorization is strictly limited to clinical, administrative, and billing purposes inherent to healthcare delivery, and does not include access to said information by partners or investors of the CEMDOE Network centers.

Clinical information available in the Application corresponds to studies, analyses, and services performed by CEMDOE and is intended exclusively for the patient’s informational purposes. Consequently, such information is subject to the interpretation of a healthcare professional and does not substitute for a medical consultation, evaluation, diagnosis, or treatment.

Study and test results are published in the Application once validated within CEMDOE’s information system; therefore, the patient may gain access to them before their treating physician has reviewed or discussed them with the patient. Accordingly, the patient is advised to consult their treating physician regarding the interpretation of their results, particularly regarding anatomical pathology reports or results presenting values outside reference ranges.

Critical values will be managed by CEMDOE pursuant to its clinical care protocols, regardless of their publication within the Application.

The Application is intended exclusively for personal access by the patient—or their duly accredited legal representative pursuant to Section 5 of these Terms and Conditions—to their medical information and other digital services provided by CEMDOE.

2. Use of Data for Research Purposes

On a voluntary basis and independently from the acceptance of these Terms and Conditions, the user may authorize CEMDOE to process and use their data for scientific and medical research purposes, ensuring that their identity remains protected through anonymization or data coding so that direct or indirect identification of the patient is impossible.

Coded data may be shared with academic centers, research institutions, and/or entities engaged in scientific endeavors whenever necessary for research purposes and provided that the shared information does not permit patient identification.

Likewise, the user acknowledges and agrees that they shall not be entitled to receive any economic compensation or benefit, direct or indirect, arising from research, publications, scientific developments, or any other findings obtained by CEMDOE or third parties utilizing such anonymized data.

Granting this authorization is not a requirement to use the Application or receive medical care at CEMDOE, and the user’s refusal to grant it will not affect the availability of services.

The user may revoke this authorization at any time through the mechanisms established by CEMDOE, without such revocation affecting data processing conducted prior to it. CEMDOE will retain audit records of authorizations granted or revoked, including date and time stamps.

By selecting the option “I agree to the use of my data for research purposes,” the user acknowledges having read this section and grants the authorization described herein.

3. Patient Rights

Patients shall have access to their personal data in a standardized electronic format utilized by CEMDOE or by the information system provider supporting the Application, in accordance with applicable legal provisions.

This consent is given freely and voluntarily and shall remain in effect until expressly revoked by the data subject, without prejudice to information whose preservation is mandatory under applicable legislation, including General Health Law No. 42-01 and other regulations governing medical records and healthcare service provision.

4. Registration, Access, and Account Security

Application accounts cannot be created by the user from within the Application. Registration must be completed in person at any of the centers comprising the CEMDOE Network, subject to patient identity verification through presentation of an official identity document.

Only individuals aged eighteen (18) or older may hold an account, a condition verified against the date of birth recorded in the patient’s medical file.

Access to the Application is performed via username, password, and a one-time verification code (OTP). Optionally, the user may enable login via native biometric mechanisms on their mobile device (fingerprint or facial recognition). In this scenario, biometric validation is conducted exclusively on the user’s device via operating system security features, and the Application only receives the validation outcome; CEMDOE does not receive, transmit, or store fingerprints, facial images, or any other biometric data. The use of biometrics is optional, and the user may access the platform at any time using their password and verification code without restriction to available services.

The user acknowledges that any fingerprint or facial record stored on their mobile device may grant access to the Application when biometric login is enabled; therefore, this feature should only be enabled if the user is the sole person with registered biometrics on the device.

The user is responsible for maintaining the confidentiality of their access credentials, including username, password, verification codes, and other authentication mechanisms implemented by CEMDOE.

Additionally, the user is responsible for restricting access to mobile devices on which the Application is installed and taking reasonable measures to protect their information. All activity conducted through the user’s account will be presumed to have been carried out by the user.

In the event of suspected loss, theft, unauthorized access, or compromise of credentials, the user must immediately notify CEMDOE and proceed to update their password or use the available account recovery mechanisms, managed via email or WhatsApp through one-time password (OTP) verification.

The user must refrain from using the Application on devices whose operating systems have been modified or altered (e.g., via root or jailbreak processes) and must log out after use, particularly when using shared devices.

The Application allows users to download and share their results. Any documents downloaded, shared, or forwarded by the user, as well as screenshots captured from within the Application, remain under the user’s sole custody and responsibility, outside the security safeguards of the Application.

5. Managing Represented Patient Information

The Application may permit a user to schedule appointments and view test results for an individual under their legal representation, such as minor children, parents, or individuals under guardianship. Kinship or representation must be proven in person at any center of the CEMDOE Network using required documentation, which will be recorded in CEMDOE’s information systems. When the represented person is an adult of legal age, their authorization or proof of legal representation will be required.

The legal representative warrants that the information provided to prove kinship or representation is accurate and agrees to use the represented party’s data solely in that party’s best interest. When a represented minor reaches the age of majority (18), the representative’s access to manage their information via the Application shall cease.

The data subject may revoke access granted to a third party at any time by appearing in person at any center comprising the CEMDOE Network.

6. Payments Through the Application

The Application may enable payment of co-payments and out-of-pocket differences for services rendered by CEMDOE Network centers. Payments are processed via payment links provided by an authorized payment processor, with the specific CEMDOE Network center rendering the service acting as the merchant of record. Payment card details are entered by the user directly into the processor’s platform; CEMDOE does not store or access full payment card numbers or CVV/CVC security codes and does not offer options to store cards for future payments.

For each payment completed, the servicing CEMDOE Network center will issue the corresponding electronic tax invoice (comprobante fiscal electrónico – e-CF), delivered physically on-site or sent to the user’s registered email address.

Requests for refunds or payment reversals, including those resulting from appointment cancellations initiated by the center, will be processed in accordance with CEMDOE’s internal policies applicable across other payment channels, handled via service supervisors and its telephone customer care center (call center).

7. Availability of the Application

CEMDOE will make reasonable efforts to maintain Application availability; however, it does not guarantee continuous, uninterrupted, or error-free access.

Application availability may be affected by scheduled maintenance, updates, telecommunication network failures, internet connectivity issues, mobile operating system discrepancies, third-party services, acts of God, force majeure, or other circumstances outside CEMDOE’s control.

8. Limitation of Liability

CEMDOE, the centers comprising the CEMDOE Network, their affiliates, officers, directors, employees, representatives, and agents shall not be liable for damages resulting from:

• Misuse of the Application by the user.
• User negligence in safeguarding access credentials or mobile devices.
• Unauthorized access arising from causes attributable to the user.
• Electronic equipment, mobile device, operating system, telecommunication network, internet service, or third-party technology provider failures, or any other circumstance beyond CEMDOE’s reasonable control.
• Operation of the Application on altered or modified operating systems (rooted or jailbroken devices).
• The download, capture, transmission, forwarding, or disclosure of information carried out by the user from their device or to third parties.
• Acts of God or force majeure events.

9. Updates to the Application and to these Terms and Conditions

CEMDOE may implement updates, enhancements, or modifications to the Application to optimize operation, strengthen security, or incorporate new services.

Additionally, CEMDOE may amend these Terms and Conditions whenever required due to legal, regulatory, technological, or operational changes. Such modifications will be posted within the Application and will take effect upon posting or on the date expressly stated. When a new version of these Terms and Conditions is released, CEMDOE will require the user’s express acceptance through the Application as a condition for continued use. CEMDOE will maintain audit records of each user’s accepted version, alongside the date, time, device identifier, and IP address of acceptance.

10. Acceptance

By selecting the option “I accept the Terms and Conditions,” activating their account, and using the Mi CEMDOE Application, the user acknowledges that they have read this document in its entirety, understood its contents, and expressly agreed to all its terms—with the exception of the research authorization outlined in Section 2, which requires independent opt-in consent—constituting a legally binding agreement between the user and CEMDOE for the use of the Application.

PRIVACY POLICY – APP MI CEMDOE

1. Introduction

Centro Médico de Diabetes, Obesidad y Especialidades (CEMDOE), S.A. (hereinafter referred to as “CEMDOE”) recognizes the importance of protecting the privacy and confidentiality of its patients’ and users’ information.

The purpose of this Privacy Policy is to inform how CEMDOE collects, uses, stores, protects, and, where applicable, shares personal data processed through the App Mi CEMDOE (hereinafter referred to as the “Application”), in compliance with Law No. 172-13 on the Protection of Personal Data, General Health Law No. 42-01, other applicable regulations of the Dominican Republic, and CEMDOE’s internal information security policies.

Use of the Application implies that the user has read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for processing personal data is: Centro Médico de Diabetes, Obesidad y Especialidades (CEMDOE), S.A.

Address: Avenida Luperón S/N, corner of Calle Clara María Pardo, San Gerónimo, Santo Domingo de Guzmán, Distrito Nacional, Dominican Republic.

The Application is operated by CEMDOE for all healthcare centers comprising the CEMDOE Network, understood as the group of health centers operating under the CEMDOE brand whose operations are administered by CEMDOE, even when each constitutes a separate legal entity. Each center within the CEMDOE Network is responsible for the personal data it processes in connection with healthcare services provided to the patient, and CEMDOE is responsible for the processing carried out through the Application. The user may request information regarding the centers that make up the CEMDOE Network through CEMDOE’s official channels.

3. Personal Data We Collect

Depending on the services utilized, the Application may collect and process the following categories of data:

a) Identification Data

• First and last name.
• Identity card (cédula) or passport.
• Date of birth.
• Sex.
• Nationality.

b) Contact Data

• Address.
• Telephone number.
• Email address.

c) Health Data

The Application may provide access to information contained within the patient’s medical record, including, but not limited to:

• Laboratory results.
• Diagnostic studies.
• Medical imaging.
• Medical reports.
• Diagnoses.
• Consultation history.
• Medical prescriptions.
• Information related to biological samples.
• Medical appointments and procedures.

This data constitutes sensitive personal information and receives heightened protection under applicable legislation.

Clinical information is not stored locally on the user’s device; it is accessed online from CEMDOE’s information system each time the user requests it. Test results displayed in the Application are published once validated in said system.

d) Technical Data

During the use of the Application, the following may be collected automatically:

• Mobile device type.
• Operating system.
• Application version.
• Device language settings.
• IP address.
• Access date and time.
• Activity logs.
• Identifiers necessary for sending push notifications (device token, subscription identifier, and alphanumeric account identifier, which does not contain the user’s name or email).
• Notification preferences and subscription status.
• Records of the version of the Terms and Conditions and of this Privacy Policy accepted by the user, including the date, time, device, and IP address of acceptance.

The Application only stores the user’s email address and session token locally on the device. The Application does not integrate usage analytics, crash reporting, mapping, marketing, social media, or advertising tools, nor does it request access to the device’s camera, location, contacts, microphone, photos, or local storage. Permissions requested by the Application are strictly limited to push notifications (which the user may decline) and the use of the device’s biometric authentication (which is optional).

e) Biometric Data

The Application does not collect biometric data. When the user chooses to enable login via fingerprint or facial recognition, authentication is performed exclusively on their mobile device through operating system security features, and the Application only receives the validation result. CEMDOE and its providers do not receive, transmit, or store fingerprints, facial images, templates, or any other biometric data.

f) Payment Data

Payments made through the Application are handled by an authorized payment processor via payment links. CEMDOE does not store or have access to full credit/debit card numbers or security codes (CVV/CVC), retaining only transaction information necessary for billing, reconciliation, and tax compliance purposes.

g) Data of Represented Patients

When a user manages appointments or clinical results for a minor child or another represented person, CEMDOE will process identification data for both the representative and the represented individual, as well as documentation verifying legal representation or kinship. This documentation must be verified in person at any CEMDOE Network facility. Only individuals aged eighteen (18) or older may create an account in the Application.

4. Purposes of Processing

Personal data will be processed for the following purposes:

• Managing user registration.
• Verifying user identity.
• Enabling secure access to medical records.
• Providing access to appointments, medical results, and services across all centers in the CEMDOE Network to ensure continuity of care.
• Displaying diagnostic and laboratory results.
• Managing medical appointments.
• Processing co-payments and out-of-pocket differences paid via the Application and issuing corresponding tax receipts.
• Allowing management of appointments and results for represented patients according to duly accredited representation.
• Facilitating communication between the patient and CEMDOE.
• Delivering notifications concerning appointments, test results, services, or operational aspects of the Application.
• Improving the functionality, security, and performance of the Application.
• Complying with legal and regulatory obligations.
• Handling requests, inquiries, and complaints.
• Retaining audit trails of acceptance of the Terms and Conditions and this Privacy Policy.
• Compiling institutional statistics using anonymized data.
• Conducting scientific research in accordance with voluntary, independent patient authorization and under strict anonymization standards.

Under no circumstances will CEMDOE sell or commercialize patients’ personal data.

5. Legal Basis for Processing

The legal basis for processing personal data rests upon:

• The patient’s explicit consent.
• The performance and execution of the healthcare relationship between the patient and CEMDOE.
• Compliance with applicable legal obligations.
• Protection of the patient’s vital health interests.
• CEMDOE’s legitimate interest in maintaining Application security and improving service quality, respecting at all times the rights of data subjects.

6. Disclosure of Information

CEMDOE will only disclose personal data under the following circumstances:

• When required by a competent authority in accordance with the law.
• When necessary for the provision of technology services essential to Application operation.
• With express patient authorization.
• When required for scientific research using previously anonymized or pseudonymized data.
• When necessary for patient care across any center within the CEMDOE Network, subject to granted authorization.

Technology vendors with access to personal data are contractually obligated to maintain strict confidentiality and apply appropriate security safeguards.

Personal data shared among CEMDOE Network centers will be utilized exclusively for clinical, administrative, and billing purposes inherent to healthcare delivery. Partners or investors of CEMDOE Network entities will not have access to patients’ clinical data.

To operate the Application, CEMDOE relies on the following categories of technology providers acting as data processors on CEMDOE’s behalf:

• Hospital Information System (HIS) provider: In whose cloud-hosted infrastructure patient data resides. The Application does not store patient clinical data.
• Push notification delivery provider: Receives the account’s alphanumeric identifier, device token, device model and OS, language, Application version, subscription status, and notification content.
• Payment processor: For processing transactions executed through the Application.
• Application font provider: Receives the IP address and technical request data (user-agent) on first use, without access to clinical or browsing details.
• Email and messaging service providers (WhatsApp): For sending one-time verification codes and facilitating account recovery.

Given that certain providers may process or host data on servers located outside the Dominican Republic, CEMDOE ensures that international data transfers meet adequate contractual and security safeguards pursuant to Law No. 172-13.

7. Information Security

CEMDOE applies reasonable technical, administrative, and organizational measures to safeguard personal data against:

• Unauthorized access.
• Alteration.
• Unauthorized disclosure.
• Loss.
• Accidental destruction.
• Misuse.

These security measures may include:

• Secure authentication via password and one-time password (OTP) verification, with an optional biometric login validated strictly on the user’s device.
• Encryption of data in transit and at rest.
• Role-based access controls.
• Audit logs.
• Security incident monitoring.
• Periodic penetration testing and vulnerability assessments on the Application and related infrastructure.
• Documented incident response protocols.
• Prohibition of real patient data in development and testing environments.

However, no technological platform can guarantee absolute security.

8. User Responsibilities

The user agrees to:

• Maintain the confidentiality of their login credentials.
• Refrain from sharing passwords with third parties.
• Protect access to their mobile device.
• Notify CEMDOE immediately of any unauthorized access or suspected account breach.
• Keep contact details accurate and up to date.
• Refrain from running the Application on rooted or jailbroken devices.
• Log out after each session, particularly when using shared devices.
• Activate biometric login only if they are the sole individual with registered biometrics on the device.
• Safely safeguard all records, results, and documents downloaded, captured, or shared from the Application, which remain under their exclusive custody and responsibility.

9. Data Retention

Personal data will be retained for the period necessary to fulfill the purposes set out in this Policy and in accordance with statutory retention terms mandated by law.

Deleting an account within the Application does not delete the patient’s medical records or information whose preservation is mandatory under General Health Law No. 42-01, sanitary regulations, and other applicable legal provisions.

10. Data Subject Rights

Patients may exercise the rights granted to them under Law No. 172-13, including:

• Accessing their personal data.
• Requesting rectification of inaccurate or incomplete records.
• Requesting updates to their information.
• Objecting to data processing where legally applicable.
• Revoking granted consent, where processing relies solely on consent.
• Requesting information regarding processing activities carried out by CEMDOE.

The exercise of these rights is subject to limitations established by applicable law, particularly requirements governing mandatory medical record preservation. Requests may be submitted through CEMDOE’s official channels.

Additionally, users may download their test results directly from the Application, revoke third-party data management access in person at any CEMDOE Network facility, or request account deactivation within the Application.

11. Push Notifications

The Application may deliver notifications regarding:

• Appointment scheduling, cancellations, or modifications (including date, time, or assigned physician changes).
• Availability of test results for review.
• Appointment pre-billing reminders.
• Queue calling alerts in admissions or medical consultations.
• Communications regarding contracted services.
• Important Application updates.
• Account-related security notices.

Users may manage notification preferences via the Application settings or device settings. Healthcare-related notices are technically differentiated from promotional materials; users may opt out of promotional messages without affecting clinical communications.

Notifications are transmitted via a specialized push notification provider and do not reveal clinical content on the device’s lock screen. Promotional messages will only be sent where the user has provided prior consent in accordance with the Advertising Notice.

12. Policy Updates

CEMDOE reserves the right to amend this Privacy Policy whenever necessary to adapt to regulatory, legal, technical, or functional developments.

Changes will be published within the Application and take effect upon posting or on the date expressly stated.

Whenever a revised version is released, CEMDOE will prompt the user to review and accept it through the Application, keeping records of the accepted version, timestamp, device identifier, and IP address.

13. Contact Information

For any inquiries regarding this Privacy Policy or personal data processing, users may contact CEMDOE via its official communication channels.

14. Acceptance

By registering for and using the App Mi CEMDOE, the user confirms that they have read and understood this Privacy Policy and consents to the processing of their personal data in accordance with the terms and conditions described herein and the applicable laws of the Dominican Republic.