1. Preliminary Note
In compliance with the provisions of Ministerial Agreement number 012-2019 issued by the Ministry of Telecommunications and the Information Society, published in Official Gazette 74 on November 6, 2019; as well as the Organic Law on Personal Data Protection, published in Official Gazette 459, 5th Supplement of May 26, 2021, which contains policies and regulations regarding the treatment and protection of personal data, this document sets forth the Policy for the Treatment of personal data of natural persons (hereinafter "data subjects") at Grupofarma del Ecuador S.A. The main purpose of this Treatment Policy is to inform data subjects of the personal data processed by Grupofarma del Ecuador S.A. about their rights, the procedures adopted by Grupofarma del Ecuador S.A. to enforce those rights, and the purpose for which their data will
be processed if they provide express, prior, and informed consent.

2. Data Controller
Grupofarma del Ecuador S.A. is the Data Controller for the personal data of data subjects for which it obtains authorization, and it will decide directly and autonomously on such data. The contact information is as follows:
Address: Quito – Ecuador
Address: Av. Amazonas 1014 and AV. NNUU – Tower A – 9th Floor
Email: informacion.ecuador@gfe.com.ec
Phone: (+593-2) 381976

3. Data Processing
The processing of personal data of data subjects by Grupofarma del Ecuador S.A. involves the collection, storage, organization, use, circulation, transmission, transfer, update, rectification, deletion, and, in general, any operation on such data, in accordance with the purposes outlined in this Policy and for which authorization has been obtained. Grupofarma del Ecuador S.A. will apply legal limitations to the processing of sensitive data,
ensuring that:

The data subject has given their free, specific, informed, unequivocal, and explicit consent for such processing, except in cases where such consent is not required by law.

The processing is necessary to safeguard the vital interests of the data subject who is physically or legally incapable, in which case the legal representatives must provide their consent.

The processing is carried out in the course of legitimate activities with the appropriate safeguards by a foundation, NGO, association, or any other non-profit organization with political, philosophical, religious, or union purposes, provided that it exclusively concerns its members or individuals with regular contact due to its purpose. In such cases, data cannot be provided to third parties without the data subject´s authorization.

The processing relates to data necessary for the recognition, exercise, or defense of a right in a judicial process.

The processing has a historical, statistical, or scientific purpose.

4. 4. Purposes
Grupofarma del Ecuador S.A. will process pharmacovigilance data for the following purposes, depending on the data subject´s role:

The data will be processed to address and respond to requests, inquiries, concerns, and, in general, all messages sent by any means to Grupofarma del Ecuador S.A., for direct or indirect contact and provision of commercial or other health-related information. In addition to the
purposes described, Grupofarma del Ecuador S.A. will process the personal data of data subjects for statistical purposes, compliance with legal and regulatory obligations to which the company is subject, and for other purposes for which data subjects provide their authorization during the data collection process. Data processors or third parties with access to personal data by law or contract will only process the data for the mentioned purposes.

5. Data Processing Duration
The processing of personal data will last as long as necessary to fulfill the purpose or purposes for which the information was collected, or as specified by law, contract, or court order, as applicable.

6. Authorization
When Grupofarma del Ecuador S.A. needs to process information, it will request the data subject´s authorization at the time of data collection.

This authorization must be explicit, whether oral, written, or through unequivocal action, and must include the specific purposes for which consent is sought. Authorization will be obtained through a means that can be consulted later.

7. Data Subject Rights
Under the law, data subjects have the following rights:

Know, update, and rectify their personal data in the possession of Grupofarma del Ecuador S.A., as the Data Controller, and with the Processors designated by Grupofarma del Ecuador S.A. for personal data processing. The rights of updating and rectification may be exercised, among others, in relation to partial, inaccurate, incomplete, misleading, or data that is expressly prohibited or has not been authorized under the terms of the Law.

Be informed by Grupofarma del Ecuador S.A. or the Data Processor, upon request, regarding the use that has been given to their personal data.

Revoke the authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights, and guarantees.

8. Procedures for Exercising Data Subject Rights In accordance with the purpose of this Policy, data subject rights include knowledge, access,
rectification, update, revocation, and deletion of their personal data (unless there is a legal, jurisprudential, or contractual mandate that allows Grupofarma del Ecuador S.A. to continue processing).

Data subjects can exercise their rights through an inquiry or a claim sent to the email informacion.ecuador@gfe.com.ec.

8.1. Inquiry Procedure
Data subjects may submit an inquiry to the email informacion.ecuador@gfe.com.ec when they wish to access or consult their personal information stored in Grupofarma del Ecuador S.A´s databases. They must attach a copy of their identification document. If the inquiry is made by a legal representative and/or agent of the data subject, they must also attach a copy of their identification document and the document proving their role (power of attorney).

The inquiry, as indicated above, will be addressed within a maximum term of ten (10) business days from the date of receipt. If it is not possible to address the inquiry within that period, the interested party will be informed of the situation, stating the reasons for the delay and indicating the date on which the inquiry will be addressed, which in no case can exceed five (5) business days from the expiration of the initial term.

8.2. Complaint Procedure

Data subjects may submit a complaint to the email informacion.ecuador@gfe.com.ec when they believe that their information contained in a database of Grupofarma del Ecuador S.A. needs to be corrected, updated, or deleted, or when they observe a presumed breach of any of the duties outlined in the Law.

The complaint must include the identification of the data subject, a description of the facts that give rise to the complaint, and the address, and it must be accompanied by a copy of the identification document. If the person making the complaint is a legal representative and/or agent of the data subject, they must also attach the document that certifies the capacity in which they are acting (power of attorney). Additionally, the complaint must be accompanied by any other documents that the complainant wishes to submit.

If the complaint is found to be incomplete, the interested party will be required to rectify the deficiencies within five (5) days following the receipt of the complaint. If two (2) months have passed since the date of the request without the applicant providing the requested information, it will be assumed that the complaint has been withdrawn. If the recipient of the complaint is not competent to resolve it, they will forward it to the appropriate authority within a maximum period of two (2) business days and inform the interested party of thesituation.

Upon receipt of the complete complaint, a notation will be added to the database stating «complaint in process» along with the reason, within a period not exceeding two (2) business days. This notation shall be maintained until the complaint is resolved. The maximum period for addressing the complaint will be fifteen (15) business days, starting from the day following the date of receipt. If it is not possible to address the complaint within this period, the interested party will be informed of the reasons for the delay and the date on which their complaint will be addressed, which, in no case, shall exceed eight (8) business days from the expiration of the initial term.

9. Database Security Measures

The information subject to processing by Grupofarma del Ecuador S.A. will be subject to technical, human, and administrative measures that are necessary to provide security to the records, preventing their adulteration, loss, consultation, use, or unauthorized or fraudulent access.

10. Policy Validity
This Personal Data Treatment Policy shall be in effect from June 1, 2023.