Core Suite privacy notice

Core Suite S.A.S. ("Core Suite"), tax ID (RFC) CSU260324P42, is the controller of your personal data.

Its address for notices is Calle 72C número 499, Cerrada Lluvia de Oro, entre Calle 13J, Colonia Gran Santa Fe, Mérida, Yucatán, C.P. 97314, Mexico.

The Core Suite Personal Data Department (Departamento de Datos Personales de Core Suite) handles all matters related to your data and your rights:

• Email: privacidad@coresuite.mx
• Phone: +52 999 102 0534
• Address: as stated in the preceding paragraph.

Inquiries about the service should be sent to soporte@coresuite.mx.

This notice describes the processing of your personal data when you:

• visit the coresuite.mx website (the "Site") or the status page at status.coresuite.mx;
• create and use your CoreSuite account (the "Account") at account.coresuite.mx (CoreAccount): sign-up, sign-in, email and mobile verification, two-step verification and My account;
• use your Account to access a Core Suite application, such as CoreDoc;
• subscribe to a Plan, make payments, purchase Packages or set up Automatic top-up, and when Core Suite issues your invoices (CFDI);
• contact Support or receive emails from Core Suite.

This notice does not apply to patient data that a practice records in CoreDoc. The practice is the controller of that data, and Core Suite only processes it on the practice's behalf, as a processor. That processing is described in the CoreDoc privacy notice and in each practice's privacy notice.

Data you provide

• Identification and contact: name, email address and mobile number.
• Access: your password, which is stored only in irreversible form (no one can read it); and, if you enable two-step verification, the key of your authenticator app (encrypted) and your recovery codes (only in irreversible form).
• Preferences: language and theme (Light or Graphite).
• Tax details, only if you require an itemized invoice: RFC, name or company name, tax regime, tax postal code and CFDI use for each Practice.
• Payment data: your card details are captured and stored by Stripe, Core Suite's payment provider. Core Suite never receives or has access to your full card number or its security code. It only receives the card brand, the last 4 digits, the expiration date and the result of each charge.
• Practices: the name of each Practice that belongs to you, its Plan and its status.
• Communications: what you write to Support or to privacidad@coresuite.mx, and Core Suite's replies.
• Site forms, if you use them: name, email, mobile number, specialty, city, preferred time, clinic name, number of healthcare professionals and of locations, and your message, depending on the form (contact, demo, quote or newsletter).

Data generated through use of the service

• Sign-in and security: date and time of each sign-in, IP address, browser and operating system, approximate city and state of the connection (calculated by Cloudflare from the IP), failed attempts and blocks.
• Audit log: a record of the relevant actions on your Account, with date, time, IP and author: changes to your email, password or two-step verification; subscriptions, cancellations, transfers and closures; and acceptances of legal documents.
• Acceptances: the version of each legal document you accept, the date and time, the IP, the language in which it was displayed and the moment of acceptance (sign-up, creation of a Practice, first payment or other).
• Billing: payments, Packages, Balance, Automatic top-ups and CFDI issued.
• Memberships: the Practices and applications you have access to and with what role.
• Site usage: visits counted in aggregate and without cookies (section 9) and, if you arrive from a campaign link, the source of that first contact.

Data provided by other people or services

• Google: if you choose "Continue with Google", Google provides your Google account identifier, your email (verified by Google) and your name.
• Invitations: when someone invites you to a Practice, the application sends your email and the assigned role.
• Practice transfers: if the owner of a Practice wishes to transfer it to you, they provide your email.
• Stripe: the result of each charge and of its fraud checks.
• SAT (Mexican tax authority), through Core Suite's invoicing provider: whether your RFC, name and postal code match its registry.

Data not requested

Core Suite does not request sensitive personal data, such as health data, ethnic origin or beliefs. The Account does not request a professional license number or specialty either: if an application uses them, its notice describes it. Please do not send patient data to Support.

Core Suite's services are intended for adults. They are not directed at persons under 18.

Core Suite uses your data for the following purposes, which are necessary to provide the service:

1. Create your Account, identify you and allow you to sign in with email and password or with Google.
2. Verify your email through a link and your mobile number through a code by SMS, or by WhatsApp when that option becomes available.
3. Protect your Account: two-step verification, attempt limits, temporary blocks from the place of the failed attempts, bot checks and security alerts by email.
4. Provide single sign-on access to the Core Suite applications in which you have a Membership, and share with them your identifier, email, name, language and theme.
5. Create your Practices and manage their Plans, the Trial, the Free Plan, Memberships, invitations, transfers and closures.
6. Charge your card, through Stripe, for Plans, Extra Physician seats, Packages and Automatic top-ups, and manage your Balance.
7. Issue the CFDI for your payments (itemized or within the global invoice), validate your tax details and meet Core Suite's tax obligations.
8. Send you service emails: verifications, receipts, CFDI, renewal reminders, payments not approved, price changes, Balance alerts, scheduled maintenance and new versions of legal documents. These emails cannot be turned off while your Account exists.
9. Record which version of each legal document you accepted and when.
10. Handle your Support, data export and ARCO requests.
11. Prevent fraud and abuse: verify that the same mobile number does not have more than one Trial or Free Plan, detect automated access and review suspicious charges together with Stripe.
12. Keep the audit log and technical logs to diagnose failures, investigate security incidents and evidence what occurred.
13. Respond to the contact, demo or quote requests you submit through a Site form.
14. Comply with legal obligations and respond to requests from competent authorities.

Automated reviews. Some decisions are made by the system: the temporary block after several failed attempts from the same place, the bot check, the one-mobile-number-per-Trial-or-Free-Plan rule and Stripe's fraud checks. If any of them affects you, you may write to soporte@coresuite.mx or privacidad@coresuite.mx so that a person can review it.

The following purposes are not necessary for the service:

1. Sending you the newsletter with news about Core Suite and its applications. You only receive it if you subscribe and confirm your email.
2. If you have a Practice on the Free Plan, sending you a weekly email with a summary of its usage and the features of the next Plan with its price.
3. Identifying the campaign or source from which the person who created an Account came, to measure Core Suite's advertising.

Opting out does not affect your Account or the service. You may do so as follows:

• Newsletter and weekly email: through the unsubscribe link included in each email. The weekly email can also be turned off and back on from My account.
• Any of the three: by email to privacidad@coresuite.mx with the subject "No acepto finalidades no necesarias" (I do not accept non-essential purposes).

If this notice was not made available to you in person, you have 5 business days from the day you provided your data to opt out of these purposes before your data is used for them. After that period, you may opt out at any time.

When you create your Account, you tick the "I accept" box for this notice, whether you sign up with email, with Google or from an invitation. In doing so, you give your express consent, which includes the financial and property data (billing and tax data) processed for charging and invoicing. That processing is also necessary to perform the contract you enter into with Core Suite.

On Site forms, the notice is accepted when they are submitted, through the statement shown next to the button.

If your consent is required for any change, Core Suite will request it before applying it (section 15).

To provide the service, Core Suite engages providers that process data solely on its behalf, in accordance with its instructions and under contract. This is known as a "remission" (LFPDPPP Regulations) and is not considered a transfer. Some of these providers are located outside Mexico. The production database and files of the service are located in Mexico.

Service monitoring and the status page are operated by Core Suite, without third parties.

Core Suite's test environment is located in the United States (Microsoft Azure, East US 2 region) and is not used with customer data.

A transfer is the disclosure of data to a third party that uses it for its own purposes. Core Suite only makes the following, which the law allows without your consent (article 36 of the LFPDPPP):

• Tax Administration Service (SAT): your tax details and those of each payment are included in the CFDI, as required by tax law.
• Stripe: in addition to charging on Core Suite's behalf, Stripe uses payment data for its own purposes of fraud prevention, risk management and compliance with its legal obligations. This is necessary for the payment contract you enter into with Core Suite. Stripe does so under its own privacy notice.
• Cloudflare: when you complete the bot check (Turnstile), Cloudflare also uses the technical data of your connection (IP, browser and characteristics of the secure connection) to improve its bot detection.
• Competent authorities: when they require it under the law, or when necessary for the recognition, exercise or defense of a right in legal proceedings.

If you choose to sign in with Google, Google is aware that you use your Google account to access Core Suite. Google carries out that processing under its own privacy policy.

If you transfer a Practice, the person who receives it learns its name, its Plan and its status. Your payments, CFDI, tax details and card are not transferred.

Core Suite does not sell or rent your data and does not share it with advertisers. It does not make transfers that require your consent. Should one become necessary, Core Suite will request it in advance, through an unticked checkbox.

Core Suite only uses the cookies and browser storage that the service requires to operate securely and to remember the chosen language and theme. Because they are necessary, their acceptance is not requested in a pop-up.

Core Suite does not use advertising cookies, social media pixels, session recorders or cross-site tracking.

In addition:

• Cloudflare Web Analytics counts Site visits in aggregate. It does not use cookies or browser storage and does not identify any person.
• Turnstile, Cloudflare's bot check, reviews the IP, the browser and the characteristics of the secure connection.
• To measure how many people complete sign-up, Core Suite records its own events, without cookies. Only the source of the first contact is linked to the Account (section 5).

Cookies can be deleted or blocked in the browser settings. Without the session cookies it is not possible to sign in to CoreAccount.

• Account: for as long as it exists. It can be closed in My account once you no longer own any Practice. Upon closure, sign-in is no longer possible and your data is blocked: it is kept only to comply with legal obligations or for the defense of rights, until the actions arising from the relationship expire. It is then deleted.
• Payments and CFDI: 5 years, in accordance with the Federal Tax Code (Código Fiscal de la Federación).
• Security audit log: 5 years from each event.
• Record of acceptances of legal documents: 10 years from each acceptance, in accordance with article 49 of the Commercial Code.
• Data on an unpaid charge: at most 72 months from the default.
• Technical logs: for short periods, except what is needed to investigate an incident.
• Correspondence with Support: while the Account exists and during the blocking period.
• Newsletter: until unsubscription. An unconfirmed email is deleted after 30 days.
• Site forms: the time needed to handle the request and up to 24 months after the last contact.
• Single-use codes and links: they expire in minutes or hours, and only their irreversible form is kept.

Backups are overwritten automatically in their normal cycle.

Core Suite protects your data with administrative, technical and physical measures, including:

• encrypted connections (HTTPS) on the Site, in CoreAccount and in its services;
• data encrypted at rest in Microsoft Azure;
• passwords and codes stored only in irreversible form;
• signing keys kept in a managed key vault, from which they never leave;
• two-step verification available for the Account;
• servers that cannot be reached directly from the internet, only through Cloudflare;
• staff access limited to what is necessary for their role, with logging;
• automatic backups.

If a security breach occurs that significantly affects your property or moral rights, Core Suite will inform you immediately by email of the nature of the incident, the data affected, the measures adopted and the actions you can take to protect yourself.

You have the right to access your data, rectify it, cancel it and object to its processing.

Various data can be changed directly in My account: name, mobile number, email, password, language, theme, two-step verification and tax details. The Account can also be closed there.

To exercise your rights, send an email to privacidad@coresuite.mx with:

1. Your name and the email address at which you wish to receive the reply.
2. A means of proving your identity. If you write from your Account's email, you may be asked to confirm it by signing in. Otherwise, you must send a valid official ID. If you act on behalf of another person, you must also send your ID and the document proving the representation.
3. The right you wish to exercise and a clear description of the data.
4. Any element that helps locate your data, such as your account ID, shown in the avatar menu in CoreAccount.
5. For a rectification: the requested change and, where applicable, the supporting document.

If any requirement is missing, it will be requested through the same channel.

Deadlines. Core Suite replies within 20 business days at most from receipt of the request. If it is granted, it is carried out within the following 15 business days after the reply. Each deadline may be extended once for an equal period when circumstances justify it, in which case you will be informed.

Reply. The reply is sent by email. For access requests, the data is delivered in an electronic document.

Cost. The process is free of charge. Only reproduction or shipping costs may apply if you request something in physical form. If you repeat the same request within 12 months, the cost will not exceed 3 Units of Measure and Update (UMA), unless the notice changes substantially.

Limits. If the request does not proceed, you will be informed of the reason. Data that the law requires to be kept, such as CFDI, cannot be cancelled. Cancelled data first goes through the blocking period described in section 10.

If you disagree with the reply, or do not receive one, you may go to the authority (section 16).

You may withdraw your consent at any time, without retroactive effect, by email to privacidad@coresuite.mx with the same details as in section 12, or through the same means by which you gave it: the unsubscribe link in each email or My account.

Core Suite replies within the same deadlines as an ARCO request. At your request, it confirms that it has stopped using your data for that purpose. It also informs the providers that process the data on its behalf.

Withdrawing consent for a necessary purpose prevents Core Suite from continuing to provide the service and requires the closure of the Account. Core Suite will keep what the law requires to be retained, such as CFDI.

• Unsubscribe from the newsletter or the weekly email through the link in each email or from My account.
• Ask privacidad@coresuite.mx to add your email to Core Suite's exclusion list. You will then not receive non-essential communications, even if you provide your data again.
• Core Suite does not make calls or send SMS or WhatsApp messages for commercial purposes. You may also register your number with PROFECO's Public Registry to Avoid Advertising (REPEP).
• Set your browser to block cookies (section 9).

Core Suite publishes each version of this notice at coresuite.mx/legal, with its number, effective date and a summary. Each version has a permanent address. Earlier versions remain available and indicate that they are no longer in effect.

When a change is relevant, Core Suite will give notice by email at least 30 days before it takes effect. The following are always considered relevant: a change in the identity of the controller, new sensitive, financial or property data, new purposes or new transfers that require your consent. The new version will state whether acceptance is required. In that case, from its effective date you will be asked to accept it when accessing CoreAccount or an application. Until you accept it, you may access My account to pay, cancel, request an export of your data or close your Account.

Minor corrections are published without requiring new acceptance.

If you believe your right to the protection of your personal data has been violated, you may go to the Ministry of Anti-Corruption and Good Government (Secretaría Anticorrupción y Buen Gobierno, SABG), which took over the functions of the former INAI in this area:

• Personal Data Protection Unit, General Directorate of Personal Data in the Private Sector.
• Avenida Insurgentes Sur 1735, Colonia Guadalupe Inn, Alcaldía Álvaro Obregón, C.P. 01020, Mexico City. Monday to Friday, from 9:00 to 18:00.
• Email: updp.privado@buengobierno.gob.mx. Phone: 55 2000 3000.

The request for protection of rights may be filed within the 15 business days following Core Suite's reply, or following the expiry of the deadline to reply.