CoreDoc data processing addendum

• Core Suite: Core Suite S.A.S., RFC CSU260324P42, with its address at Calle 72C número 499, Cerrada Lluvia de Oro, entre Calle 13J, Colonia Gran Santa Fe, Mérida, Yucatán, C.P. 97314, Mexico. It develops and operates CoreDoc. In this addendum it acts as a processor: it processes patient data on your behalf.
• You: the person who creates the practice in CoreDoc, or receives it through a transfer, and accepts this addendum. You act as the controller of your patients' data: you decide what data is collected, for what purposes and how it is used. If you create the practice on behalf of a clinic or a company, you represent that you have authority to bind it; in that case, the controller is that legal entity.
• Practice: the workspace you create in CoreDoc, with its locations, its settings and its information.
• Practice staff: the people you invite to CoreDoc to work in your practice, such as healthcare professionals or front desk staff.
• Patient data: the personal data of your patients, of their representatives and of any other people recorded in CoreDoc in connection with their care.
• Sub-processors: the providers Core Suite engages that process patient data for the operation of CoreDoc.
• Breach: the unauthorized loss, theft, misplacement, copying, use, access, damage, alteration or destruction of patient data.
• Law: the Federal Law on the Protection of Personal Data Held by Private Parties published in the Official Gazette of the Federation on March 20, 2025, its regulations and other applicable provisions.

The data of your CoreSuite account and of the practice staff as users (name, email, mobile number, access records) are not covered by this addendum. For that data, Core Suite is the controller and processes it under the Core Suite privacy notice and the CoreDoc privacy notice.

Core Suite processes patient data solely to provide CoreDoc and the services related to it:

• the schedule, appointments, waiting list and waiting room;
• the electronic medical record, with its notes, prescriptions, instructions, studies and files;
• notices and reminders to patients by WhatsApp, SMS or email, and the delivery of their instructions;
• recording payments and issuing invoices (CFDI) to patients, including the portal where they request their invoice;
• importing patients, exporting data, backups and Support.

This addendum is in force from its acceptance until Core Suite deletes the patient data or delivers it to you under section 16. Confidentiality obligations survive its termination.

Data subjects: your patients; their parents, guardians or representatives; their emergency contacts; the people who pay for the care or receive the invoice; and the practice staff, to the extent they appear in clinical records (for example, who provided care or who edited a note).

Data that may be processed, depending on what you and your staff enter:

• identification and contact: name, date of birth, age, sex, CURP, address, mobile number and email, and insurer and policy number if there is health insurance;
• health data, which is sensitive data: history, conditions, allergies, vital signs, clinical notes, diagnoses, treatments, prescriptions, instructions, test results, images and clinical files;
• appointments, attendance, no-shows and responses to notices;
• consents, contact preferences by channel (WhatsApp, SMS or email) and opt-outs;
• recorded payments and tax data for invoicing: RFC, name or company name, tax regime, postal code, CFDI use and email.

You decide what data you collect. Core Suite does not request patient data that CoreDoc does not require in order to operate.

Core Suite processes patient data solely in accordance with your instructions. The following constitute instructions:

• this addendum;
• the settings and use that you and the practice staff make of CoreDoc (for example, registering a patient, choosing the channel for notices or requesting an export);
• requests you send in writing from your account email to privacidad@coresuite.mx.

If an instruction appears to be contrary to the Law, Core Suite informs you and may refrain from applying it until it is clarified. If you request something CoreDoc does not do, Core Suite informs you whether it is possible, within what period and whether it has a cost.

• Privacy notice. You provide your patients with your privacy notice before collecting their data. Core Suite publishes a patient privacy notice template that you may use or adapt. The content of the notice you provide is your responsibility.
• Consent. You obtain your patients' express written consent to process their health data, and their authorization for each channel through which they receive notices. CoreDoc facilitates requesting them and keeps the evidence (date, time, channel and notice version).
• Necessary and accurate data. You enter only the data necessary for care and keep it up to date.
• Staff. You invite only those who require access, assign the appropriate role and deactivate anyone who stops working with the practice. Your staff's actions in CoreDoc are deemed to be your instructions.
• Access. You safeguard your passwords and devices and do not share your account. Core Suite recommends that you enable two-step verification.
• Patient requests. You handle requests for access, rectification, cancellation and objection (ARCO rights), and withdrawals of consent, within the periods set by the Law.
• Breaches. You inform your patients when a breach significantly affects their rights.
• Retention. You comply with NOM-004-SSA3-2012 regarding the creation and retention of medical records. Section 16 describes Core Suite's support.
• Downloaded information. Data you export, download or print leaves Core Suite's custody; safeguarding it is your responsibility.

Core Suite may not:

• use patient data for its own purposes, such as advertising, marketing or profiling;
• sell, rent or assign patient data;
• disclose it to third parties, except on your instruction, to the sub-processors in section 9, or in response to an order from an authority under section 13;
• access the content of medical records, except to provide the service, handle a request from you, resolve an incident or comply with the Law. In those cases only essential staff access it, and the access is logged.

Core Suite may count records without identifying any person (for example, the number of patients, appointments or messages of the practice) solely to apply the limits of the Plan and send you your summary. Those counts do not contain patient data.

If Core Suite used the data for another purpose or disclosed it against your instructions, it would be liable as controller of that processing.

Core Suite keeps patient data confidential. Its staff and its sub-processors are contractually bound to do so, including after their relationship with Core Suite ends. Only staff who require access for their duties have it, with the corresponding training.

Core Suite applies administrative, technical and physical measures suited to the sensitivity of health data, and no less protective than those it uses for its own information. They include:

• servers, database, files and backups in the Microsoft Azure Mexico Central region;
• encryption of information in transit (HTTPS) and at rest (database, files and backups);
• access with one CoreSuite account per person, strong passwords, available two-step verification and sign-out after inactivity;
• roles and permissions within the practice, managed by you;
• separation of each practice's data from that of others;
• an audit log of access to medical records and of changes;
• keys and secrets in a secure vault, outside the code;
• automatic backups that allow information to be restored;
• network protection against attacks and automated access;
• minimal, logged access by Core Suite staff, and exclusive use of fictitious data, never real patient data, in test environments.

CoreDoc is designed in accordance with NOM-004-SSA3-2012, on medical records, and NOM-024-SSA3-2012, on electronic health record information systems. Core Suite reviews its measures at least once a year and updates them when risks or technology change, without lowering the level of protection.

You authorize Core Suite to rely on the sub-processors in this list. Each one processes the data only for the stated purpose, with confidentiality and security obligations equivalent to those in this addendum, and Core Suite is liable to you for their acts.

Changes to the list. To add or change a sub-processor, Core Suite publishes a new version of this addendum and notifies you by email at least 30 calendar days before it takes effect. If a provider must be replaced urgently for security reasons or for service continuity, Core Suite notifies you as soon as possible, with an explanation of the reason.

Objection. You may state your disagreement, with your reasons, to privacidad@coresuite.mx within those 30 days. Core Suite will seek a reasonable alternative. If there is none, you may request an export of your data and cancel your Plan or close your practice under the Terms.

CoreDoc's medical records, files and database are stored in Mexico. Patient data leaves Mexico only in the following cases:

• encrypted traffic between devices and CoreDoc passes through Cloudflare's network, which may be outside Mexico;
• to send a notice, the WhatsApp, SMS or email provider receives only the patient's name and number or email and the content of the notice: the practice's name (or its name for notices), the date, time and place and, when required, a link. The notice does not include the name of the person providing care or data that reveals the specialty, unless the practice decides otherwise;
• when the instructions from a visit are sent as a document by WhatsApp, Meta receives that document; by SMS and email only a protected link is sent;
• for invoicing, Facturapi receives tax data and line items without clinical information.

Notices and reminders do not contain health data. The instructions document does not include the diagnosis unless the person who provided care selects it.

These disclosures to sub-processors are remissions: they do not require patients' consent, but Core Suite discloses them so that your privacy notice can describe them. Core Suite requires each sub-processor located outside Mexico to meet the same obligations as this addendum.

Your patients exercise their ARCO rights and withdraw their consent with you. So that you can handle them on time:

• CoreDoc allows you to view and correct each patient's data, record their contact preferences and opt-outs, deactivate their record and request an export of your practice's information.
• In read-only mode you can view all information and request an export from My account, but you cannot register or change data, except to handle appointments already scheduled for the next 30 days, in accordance with the Terms. If, in read-only mode or after the practice is closed, you need to handle a request that requires changing data, you may write to privacidad@coresuite.mx and Core Suite will support you in meeting it within the periods set by the Law.
• If a patient contacts Core Suite about their data, Core Suite informs them that their practice is the controller and forwards the request to your account email within 3 business days. Core Suite does not respond on its own to the substance of the request.
• If you require information you cannot obtain from CoreDoc, Support will assist you in obtaining it.
• When you record a correction, an opt-out or a withdrawal, CoreDoc applies it across the service, including the messages sent by sub-processors.

If Core Suite confirms a breach affecting your practice's data:

• it notifies you without delay and no later than 72 hours after confirming it, at your account email;
• it informs you of the nature of the incident, the data compromised, the corrective actions taken, the recommendations for your patients and the contact for further information;
• it keeps you informed as the review progresses;
• it cooperates with you so that you can inform affected patients immediately, as the Law requires, and, at your request, supports you in sending them the notice through CoreDoc's channels.

Core Suite keeps a record of each breach and of the measures adopted.

If an authority requests your patients' data from Core Suite, Core Suite verifies that the request is lawful, informs you before delivering any information (unless the law or the authority prohibits it) and delivers only what the request requires. When possible, it asks the authority to address you directly.

The medical record belongs to the healthcare provider that creates it, and patients keep their rights over their information, in accordance with NOM-004-SSA3-2012. Core Suite does not acquire any ownership or right over patient data by processing it.

You may transfer your practice to another person from My account. The transfer takes effect when that person accepts it and accepts this addendum. From that moment:

• the person who receives the practice becomes the controller of the patient data and is the one who gives instructions;
• you cease to be responsible for the subsequent processing of that data and no longer have access to the practice's payments, invoices and tax data;
• you may remain part of the staff, unless the person who receives the practice deactivates you.

Before transferring, it is your responsibility to have what is needed to hand the medical records over to the new controller, under the Law and NOM-004-SSA3-2012. CoreDoc facilitates informing patients of the change: it emails the notice of the new controller to those who authorized that channel and leaves a note in the record of the others so it can be given to them at their next visit.

If the person who created the practice dies or cannot be located, Core Suite may transfer or close the practice at the request of whoever proves their right to do so, with the documentation Core Suite requires.

Export. You may request an export of your practice's data from My account at any time and in any status of your Plan. Core Suite delivers it within 5 business days: an Excel file with one sheet per type of information and a compressed file with the attachments, through a secure, time-limited link sent to your account email.

Cancellation or non-payment. Cancelling the Plan or non-payment does not entail the deletion of patient data. The actions available in each case are described in the Terms.

Closing the practice. Before you confirm the closure, CoreDoc offers you the export. Once the closure takes effect, no one can access the practice. Core Suite keeps the patient data blocked, at no cost to you, for at least 5 years from the closure, which covers the 5 years from the last medical act required by NOM-004-SSA3-2012. During that time, Core Suite only accesses it to deliver an export to the practice owner, or to whoever proves their right, once their identity has been verified, or to comply with a legal obligation.

Deletion. Core Suite does not delete the medical record before that period ends, even at your request, unless you show that the law allows it. When the period ends, Core Suite notifies you at your account email at least 30 calendar days in advance so that, if you wish, you can request an export. It then deletes the data securely, including backups in their normal cycle, unless a law requires keeping it longer. At your request, it provides a certificate of deletion.

• Once a year, or when a breach occurs, you may request in writing information about the measures in this addendum. Core Suite responds within 30 calendar days with a completed questionnaire and a summary of its security measures.
• If you require a direct review, it must be agreed with Core Suite with at least 30 calendar days' notice, at your cost, under a confidentiality obligation and without access to information from other practices.
• Core Suite cooperates with you before the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno), the Ministry of Health or any authority reviewing the processing of your patients' data.

• You are liable for the lawful collection of your patients' data, for your privacy notice, for the consents, for the information you and your staff enter and for your instructions.
• Core Suite is liable for processing the data in accordance with this addendum and the Law. If it uses the data for another purpose or discloses it against your instructions, it is liable as controller of that processing.
• Each party is liable for the damage it causes by breaching this addendum. The limitations in the Terms apply, except for willful misconduct, gross negligence, data breaches attributable to Core Suite or where the law does not allow liability to be limited.

Core Suite publishes each version of this addendum with its number and effective date at coresuite.mx/legal. If an amendment requires new acceptance, Core Suite notifies you by email at least 30 calendar days in advance, with a summary of the changes. From its effective date, CoreDoc requests your acceptance in order to continue using the service. If you do not accept it, you may request an export of your data, cancel your Plan or close your practice from My account.

This addendum is governed by the federal laws of the United Mexican States, in particular the Law, the General Health Law, NOM-004-SSA3-2012 and NOM-024-SSA3-2012. For any dispute, the parties submit to the competent courts of Mérida, Yucatán, and waive any other jurisdiction that may apply to them.

Core Suite Personal Data Department (Departamento de Datos Personales de Core Suite)

• Email: privacidad@coresuite.mx
• Phone: +52 999 102 0534
• Address: Calle 72C número 499, Cerrada Lluvia de Oro, entre Calle 13J, Colonia Gran Santa Fe, Mérida, Yucatán, C.P. 97314, Mexico

For inquiries about the use of CoreDoc: soporte@coresuite.mx.