Privacy Notice

NOTICE IN ACCORDANCE WITH THE PROVISIONS OF THE FEDERAL LAW ON

PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES AND ITS REGULATIONS, THIS COMPREHENSIVE PRIVACY NOTICE IS ISSUED UNDER THE FOLLOWING TERMS.

Benjamín Aréchiga Arias, operating under the trade name “Molar House,” who hereinafter and for all purposes of this Comprehensive Privacy Notice shall be referred to as the “DENTAL CLINIC,” is responsible for collecting and protecting your personal data, as well as for the use given thereto.

Personal Data Protection Department

The domicile of the “DENTAL CLINIC,” which is also the domicile of the “CONTROLLER” under the Federal Law on Protection of Personal Data Held by Private Parties, for receiving and hearing notices, is as follows:

1.- Address: Av. Paseo del Centenario 9580, Suite 2402 and 2403, Zona Río

2.- Municipality: Tijuana, Baja California

3.- ZIP Code: 22010

4.- Office hours: Monday through Saturday from 8:30 a.m. to 4:30 p.m.

5.- Telephone: 664 905 65 61

6.- Email: [email protected]

I. What purposes do we collect and use your personal data for?

Your personal data will be used for the following purposes:

1.- Identification, contact, and integration of files with Patients and, in general, with any person with whom there is a commercial or legal relationship, who shall be referred to as the “DATA SUBJECT.”

2.- The data you provide to us personally is for the purpose of supplying you with the goods or services offered by the “DENTAL CLINIC.”

3.- In order to provide you with better service and ensure a response to requests made by the “DATA SUBJECT,” as well as requirements or questions submitted to the “CONTROLLER” regarding the processing of your data or related to the service provided by the “DENTAL CLINIC.”

4.- To send advertising regarding treatments and/or services provided or that may be provided by the “DENTAL CLINIC” and, in general, any communication containing important information that the “DENTAL CLINIC” must or deems necessary to make known to you. Such communications may be sent by mail, private courier, email, telephone, or any other available communication method, with or without acknowledgment of receipt, even after the contractual relationship has ended.

5.- In the case of goods suppliers or service providers, to establish and maintain a commercial relationship that allows, among other things, the supply, distribution, payment, and documentation of the goods and services requested and/or acquired by the “DENTAL CLINIC.”

6.- To comply with the terms and conditions of the legal relationship that exists or may come to exist with you, and with the obligations arising therefrom.

7.- The “DENTAL CLINIC” has video surveillance cameras that record images which will or may be used for security and/or service quality purposes.

8.- In relation to processing whose purpose is to fulfill an obligation arising from a legal relationship, personal data, including sensitive data, which may include photographic and documentary evidence, will be used to carry out all procedures and transactions deriving from such relationship, including access to the facilities of the “DENTAL CLINIC” and the transfer of such data to third parties, such as financial institutions, public institutions, notaries public, legal and accounting firms, auditors, service providers, insurance companies, related parties, among others.

Photographic evidence may include personal images.

9.- To keep information safeguards in compliance with obligations.

10.- The “DATA SUBJECT” understands and accepts that the “DENTAL CLINIC” may obtain images, including personal images, at exhibitions, fairs, offices, and in general at any promotional or institutional celebration event, for the purpose of documenting them.

II. What personal data do we obtain and from where?

For the purposes indicated in this Comprehensive Privacy Notice, we may collect your personal data in different ways:

1.- Personal data collected directly: When you yourself provide them to us or have them delivered through our employees, representatives, or third parties who manage the delivery of documents for any of the purposes indicated in Section I of this Comprehensive Privacy Notice. The data we obtain through this means may include, among others:

General personal data: Name or business name, address, state, email address; telephone number, landline or mobile; signature or initials; Federal Taxpayer Registry (RFC).
Sensitive personal data: Place of birth; nationality; gender; marital status; Unique Population Registry Code (CURP); commercial and personal references; data contained in the voter identification card issued by the National

Electoral Institute; history and/or background of credit behavior; type of occupancy of the current residence (owned, rented, borrowed, or with relatives); serial number of the Advanced Electronic Signature (FIEL); proof of registration with the Tax Administration Service (SAT); workplace and/or economic activity; position held and length of employment; information on income, expenses, savings, and investments, as well as proof of payment capacity, which may include tax information where applicable; banking institution, bank account number, and CLABE; images of the Data Subject, fingerprint, photographs and videos of the face and oral cavity, videos and audios captured by surveillance cameras, dental scans, dental X-rays, and head CT scans.

2.- Personal data collected when you visit our website or use our online services: Name, email address, and telephone number, landline or mobile.

3.- Personal data collected through other sources: We may obtain information about you from other public sources permitted by law, such as the internet, telephone or employment directories, information in public property records or their equivalents in the states, as well as information originating from public institutions. The data we obtain through these means may include, among others: name; home or work address; landline number; mobile number; email address; property information.

III. What processing do we give your sensitive personal data?

We undertake that such data will be processed under security measures and guaranteeing confidentiality, in compliance with the conditions established in the Federal Law on Protection of Personal Data Held by Private Parties, its Regulations, and applicable provisions.

IV. How can the use or disclosure of your personal data be limited?

The “DENTAL CLINIC” guarantees that the use or disclosure of the personal data provided by the “DATA SUBJECT” will not be used for purposes other than those indicated in this Comprehensive Privacy Notice. However, for the purpose of limiting the use or disclosure of personal data, the “DATA SUBJECT” may request it in writing, in free form, stating that this is their wish and specifying which data will be subject to such limitation in use or disclosure.

Such written request may be delivered to the “DENTAL CLINIC” by:

1.- Personal delivery: At the offices of the “DENTAL CLINIC” at the address and during the office hours indicated in this Comprehensive Privacy Notice;

2.- Postal mail: Sending a written request by postal mail to the address and during the office hours indicated in the previous subsection; and

3.- Email: Sending an email to the address indicated in this Comprehensive Privacy Notice.

In addition, the “DATA SUBJECT” may go to the Federal Consumer Protection Agency (“PROFECO”) to register in the Public Registry to Avoid Advertising (REPEP), a tool that allows the registration of telephone numbers of those consumers who do not wish to receive advertising or have their information used for marketing or advertising purposes. This may be done through the website http://repep.profeco.gob.mx/index.jsp or at the offices of such agency.

V. What means do you have to exercise your ARCO Rights?

ARCO Rights are your rights to Access, Rectify, Cancel, or Oppose the processing of your personal data. The

“DENTAL CLINIC” guarantees the “DATA SUBJECT” the right to access personal data in our possession and the details of its processing, as well as to rectify it if it is inaccurate or incomplete; cancel it when you consider that it is not required for any of the purposes indicated in this Comprehensive Privacy Notice, is being used for nonconsented purposes, or the contractual or service relationship has ended; or oppose the processing thereof for specific purposes or for any other purpose provided for or permitted by law and/or its regulations.

For compliance with the exercise of ARCO Rights by the “DATA SUBJECT,” the “DENTAL CLINIC” has established the following:

1.- Requirements:

Submit a written request indicating the minimum information necessary so that your data may be searched and found in the files and records held by the “DENTAL CLINIC,” thereby fully identifying the applicant as the “DATA

SUBJECT” of such personal data;

State in such request, specifically and clearly, which personal data held by the “DENTAL CLINIC” you wish to exercise ARCO Rights over and the reasons for doing so;
To facilitate preparation of the request, the “DENTAL CLINIC” makes available to the “DATA SUBJECT” the form referred to in the section “Forms, systems, or other simplified methods enabled to facilitate the exercise of rights by Data Subjects” of this Comprehensive Privacy Notice, or it may be requested at the offices of the “DENTAL CLINIC.”

2.- Means to prove the identity of the Data Subject or their Legal Representative:

If the applicant exercising ARCO Rights is the “DATA SUBJECT”: Submit a copy of the voter identification card with photograph issued by the National Electoral Institute, and present the original for comparison; submit the application on the “ARCO Rights Exercise Request” form, duly completed and initialed by the “DATA SUBJECT,” or alternatively a free-form letter making the request in compliance with the requirements indicated in this Privacy Notice and signed by the Data Subject.
If the request is submitted through a Legal Representative: Submit the original of a special power of attorney granted by the “DATA SUBJECT” of the ARCO Rights before a Notary Public; submit a copy of the voter identification card with photograph issued by the National Electoral Institute of the Data Subject and their Legal Representative, and present the originals for comparison; submit the application on the “ARCO Rights Exercise Request” form, duly completed and initialed by the Legal Representative, where applicable, or alternatively a free-form letter making the request in compliance with the requirements indicated in this Comprehensive Privacy Notice, signed by the Data Subject or the Legal Representative, where applicable.

3.- Information or documentation that must accompany the request:

Application on the “ARCO Rights Exercise Request” form, duly completed and initialed by the Legal

Representative, where applicable, or alternatively a free-form letter making the request in compliance with the requirements indicated in this Comprehensive Privacy Notice, signed by the “DATA SUBJECT” or the Legal

Representative, where applicable;

Name or business name, address, email address, age and date of birth, telephone number, landline or mobile, signature or initials, RFC, CURP, voter identification card with photograph issued by the National Electoral Institute in original and copy for comparison of the “DATA SUBJECT” and of the Legal Representative, where applicable;
If the request is made by a Legal Representative, special power of attorney granted by the “DATA SUBJECT” of the ARCO Rights before a Notary Public.

4.- Time periods

The “CONTROLLER” or, where applicable, any of the officers appointed as persons in charge under the Federal Law on Protection of Personal Data Held by Private Parties, shall communicate to the “DATA SUBJECT” or to their Legal Representative, where applicable, within a maximum period of 20 days counted from the date on which the request was received, the determination adopted;
If admissible, it shall become effective within 15 days following the date on which the response was communicated;
The periods may be extended when the cases or circumstances justify it.

5.- Means of response:

a) The “CONTROLLER” or, where applicable, any of the officers appointed as persons in charge under the Federal Law on Protection of Personal Data Held by Private Parties, shall deliver the data or, where applicable, issue a written resolution addressed to the “DATA SUBJECT” of the ARCO Rights or to their Legal Representative, where applicable, containing the determination adopted, which may be sent by email or postal mail, as the case may be; b) Likewise, the determination may be delivered in person if the “DATA SUBJECT” or their Legal Representative, where applicable, appears at the offices of the “DENTAL CLINIC.” – Means in which the requested information may be reproduced:
The “CONTROLLER” or, where applicable, any of the officers appointed as persons in charge under the Federal Law on Protection of Personal Data Held by Private Parties, shall deliver the requested information held by the “DENTAL CLINIC” in digital “pdf” format, or, where applicable, issue a written resolution addressed to the holder of the ARCO Rights or their Legal Representative;
Forms, systems, or other simplified methods enabled to facilitate the exercise of rights by Data Subjects: The “DENTAL CLINIC” makes available to the “DATA SUBJECT” an “ARCO Rights Exercise Request,” which may be obtained on our website or requested at our offices.

VI. Can your personal data be disclosed or shared with third parties or travel to another country?

Your personal data may be transferred and processed within and outside the country by persons other than the “CONTROLLER.” In that regard, your information may be shared for the purpose of complying with legal obligations before competent authorities, legal and accounting firms, auditors, advertising agencies, insurance companies, as well as in compliance with resolutions issued by judicial authorities. Likewise, the “CONTROLLER” may hire information hosting services within and/or outside the national territory, without this implying transmission to a third party. Similarly, the “DATA SUBJECT” of the personal data knows, understands, and accepts that the “DENTAL CLINIC” may transfer personal data to third parties. In addition, transfers may occur without the consent of the Data Subject in terms of Article 37 of the Federal Law on Protection of Personal Data Held by Private Parties.

VII. What are the ways or procedures to revoke consent for the processing of your personal data?

At any time, the “DATA SUBJECT” may revoke the consent granted to us for the processing of personal data so that we cease using it. To do so, it is necessary to submit your request to the Personal Data Protection Department indicated in this Comprehensive Privacy Notice. Your request must be accompanied by the following information:

1.- Means to prove the identity of the Data Subject or their Legal Representative:

If the applicant for revocation of consent is the “DATA SUBJECT”: Submit a copy of the voter identification card with photograph issued by the National Electoral Institute, and present the original for comparison; submit a freeform letter making the request for revocation of consent.
If the request is submitted through a Legal Representative: Submit the original of a special power of attorney granted by the Data Subject before a Notary Public; submit a copy of the voter identification card with photograph issued by the National Electoral Institute of the Data Subject and their Legal Representative, and present the originals for comparison; submit a free-form letter making the request for revocation of consent.

2.- Information or documentation that must accompany the request for revocation of consent:

Free-form letter making the request for revocation of consent;
Name, address, email address;
Age and date of birth;
Telephone number, landline or mobile;
Signature or initials;
RFC;
CURP;
Voter identification card with photograph issued by the National Electoral Institute in original and copy for comparison of the “DATA SUBJECT” and of the Legal Representative, where applicable;
If the request is made by a Legal Representative, special power of attorney granted by the “DATA SUBJECT” before a Notary Public;
The name of the “DATA SUBJECT” and address and another means by which the response to the request may be communicated;
The documents proving the identity or, where applicable, the legal representation of the “DATA SUBJECT.”

3.- Time periods:

The “CONTROLLER” or, where applicable, any of the officers appointed as persons in charge under the Federal Law on Protection of Personal Data Held by Private Parties, shall communicate to the “DATA SUBJECT” or their Legal Representative, where applicable, within a maximum period of 20 days counted from the date on which the request was received, the determination adopted;
If admissible, it shall become effective within 15 days following the date on which the response was communicated;
The periods may be extended when the cases or circumstances justify it.

4.- Means of response:

The “CONTROLLER” or, where applicable, any of the officers appointed as persons in charge under the Federal Law on Protection of Personal Data Held by Private Parties, shall deliver the data or, where applicable, issue a written resolution addressed to the “DATA SUBJECT” or their Legal Representative, containing the determination adopted, which may be sent by email or postal mail, as the case may be;
Likewise, the determination may be delivered in person if the “DATA SUBJECT” or their Legal Representative, where applicable, appears at the offices of the “DENTAL CLINIC.” To address your request, we will inform you of its admissibility through

5.- Means to consult the procedure for revocation of consent: The “DATA SUBJECT” may consult the procedure for revocation of consent at our offices.

VIII. How are modifications made to this Privacy Notice?

We reserve the right to make, at any time and for any reason, modifications or updates to this Comprehensive Privacy Notice.

1.- Procedure for making modifications to the Comprehensive Privacy Notice: The “DENTAL CLINIC” may make the modifications to the Comprehensive Privacy Notice that it deems necessary or that respond to legal provisions, and shall inform the “DATA SUBJECT” of the personal data that the Comprehensive Privacy Notice has changed and is now available for consultation and the corresponding legal effects at the offices of the “DENTAL CLINIC,” without prejudice to the compensatory measures indicated in the applicable law.

The modifications made to the Comprehensive Privacy Notice shall be made known to Data Subjects through any of the means described below:

2.- Means to inform of modifications to the Privacy Notice: At the choice of the Controller, through one of the following:

a) Notice sent by email;
c) Notice published in a newspaper of local, regional, or national circulation; d) Website;
e) By visible posting in our offices.

IX. Are cookies and web beacons used to obtain personal data?

Cookies are text files that are automatically downloaded and stored on the hard drive of the user’s computer when browsing a specific internet page, which allow the internet server to remember certain data about this user, including preferences for viewing pages on that server, username, and password. Web beacons, on the other hand, are images inserted in an internet page or email that may be used to monitor the behavior of a visitor, such as storing information on the user’s IP address, duration of interaction time on that page, and the type of browser used. These cookies and other technologies may be disabled directly by the user through their own internet browser, without requiring assistance from the “DENTAL CLINIC.” We inform you that the “DENTAL CLINIC” may use cookies or web beacons to obtain personal data.

X. When are your personal data destroyed or deleted?

The “DATA SUBJECT” of the personal data understands and accepts that the “DENTAL CLINIC” shall keep in its possession the documentation and information related to personal data, including sensitive data, while a commercial or legal relationship is maintained and for the purposes indicated in numeral I of this notice, and even after the relationship has ended, all without detriment to the rights of the “DATA SUBJECT.” Once the indicated purposes have been fulfilled, the “DENTAL CLINIC” shall proceed to block and subsequently cancel the personal data, both general and sensitive. You have the right to access the personal data we hold and the details of its processing, as well as to rectify it if it is inaccurate or instruct us to cancel it when you consider that it is unnecessary for the purposes that justified its collection, or to oppose the processing thereof for specific purposes.

XI. Before whom may you appear to exercise the personal data protection procedure and/or file complaints and claims for the improper processing of your personal data?

If you consider that your right to protection of personal data has been affected by any conduct of our employees or by our actions or responses, or you presume that in the processing of your personal data there is a violation of the provisions set forth in the Federal Law on Protection of Personal Data Held by Private Parties, you may file the corresponding complaint or claim before the INAI, located at Av. Insurgentes Sur #3211, Col. Insurgentes Cuicuilco, Delegación Coyoacán, C.P. 04530, Distrito Federal; Telephone 01-800-TELIFAI (01-800-835-4324), Monday through Friday from 9:00 a.m. to 7:00 p.m. For more information, visit www.ifai.org.mx.

XII. What are the costs of the procedures described in this Privacy Notice?

The “DENTAL CLINIC” informs the “DATA SUBJECT” of the personal data that all procedures indicated in this Comprehensive Privacy Notice are free of charge.

I state that I have read this Comprehensive Privacy Notice in full, that I acknowledge, understand, and accept its scope, and therefore I express my full conformity and acceptance with the transfer, processing, and use that the “DENTAL CLINIC” makes or may make of my personal data, including those considered sensitive personal data, in accordance with this Comprehensive Privacy Notice. I state that I have freely provided the “DENTAL CLINIC” with information regarding the persons whom I have indicated in my credit application, or in other documents, as personal, commercial, and/or employment references, and I am aware and accept that such persons may eventually be contacted by the “DENTAL CLINIC” in order to perform the verifications it deems necessary.

The Federal Law on Protection of Personal Data Held by Private Parties and its Regulations are available on the website http://www.diputados.gob.mx/LeyesBiblio/

On the _______ day of the month of __________________ of the year ______.

I sign as acknowledgment of receipt, as well as to express my explicit consent for the use, processing, and transfer of my personal data, including sensitive data, under the terms of this Comprehensive Privacy Notice.

_________________________________ ______________________________________

FULL NAME SIGNATURE

of the Data Subject or their Legal Representative of the Data Subject or their Legal Representative