Comprehensive Privacy Notice for Patients

Data Controller
In compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and for the purposes of any personal data you may have provided or may provide through various means and/or channels, including our websites, social media, digital platforms, and instant messaging, and in connection with your relationship or potential relationship regarding the use of our services, CENTRO MEDICO CULIACAN, S.A. DE C.V. (Hospital Angeles System”), located at Boulevard Alfonso G. Calderón No. 2193 Poniente, Colonia Desarrollo Urbano Tres Ríos, Postal Code 80020, Culiacán, Sinaloa; with website https://hospitalangeles.com/culiacan is responsible for processing your personal data in accordance with this Privacy Notice.

Purpose of the Processing of Personal Data
The personal data held byHospital Angeles System” will be used for the following purposes:

• a. Purposes necessary for maintaining the relationship with the data subject:
  • Provision of medical and hospital services, hospitalization, surgical treatment, clinical care, pharmaceutical services, laboratory tests, radiology and imaging, pathological studies and analyses, therapy, rehabilitation, diet, and nutrition.
  • Preparation, integration, review, analysis, maintenance, and archiving of medical records.
  • Provide access to electronic systems for viewing results of laboratory tests, imaging studies, pathology reports, and other diagnostic tests.
  • Maintenance of records for monitoring service delivery.
  • Verify, confirm, and validate your identity.
  • Billing and collection for services provided
  • Studies, records, and statistical analysis of health data.
• b. Secondary purposes:
  • Record-keeping for future service provision
  • Suggest medical facilities closest to your location.
  • Promotion and marketing of products and services offered byHospital Angeles System” and other companies within the same corporate group, which may be conducted via instant messaging and social media.

Request to Object to the Processing of Personal Data for Secondary Purposes
If you do not wish for your personal data to be processed for these secondary purposes, as mentioned in section “b)”, you have 5 (five) days to notify us. You may do so by sending an email to the address datospersonales@saludangeles.mx, addressed to the Personal Data Department. If we do not receive your objection within that timeframe, we will assume that you have consented to the use of your information. In addition, you may request that we stop processing your data at any time.

Data to Be Collected
To fulfill the purposes set forth in this privacy notice,Hospital Angeles System” will collect, directly, indirectly, or in person, the following categories of personal data:

Identification information

Contact Information

Employment data

Academic Information

Asset and/or financial data

Information on administrative procedures

Passenger traffic data

Geolocation data

Sensitive data. In addition,Hospital Angeles System” will collect the following sensitive personal data:

Health data, information regarding religion and current, past, and future physical and/or mental health status, including medical history, conditions, illnesses, allergies, family history, genetic information, clinical studies, diagnoses, treatments, and medical or surgical procedures, as well as data on vulnerable individuals.

Biometric data, facial and fingerprint data for the purpose of unique identification.


Video surveillance. In compliance with the LFPDPPP, we hereby inform you that, as part of our physical security measures, we have a video surveillance system in place at our facilities to safeguard the safety of individuals, the security of the premises, and the protection of information.

Transfer
In order to provide our services,Hospital Angeles System” may transfer the personal data in its possession to third parties, both within and outside the country, solely for the purposes set forth in this Privacy Notice. The third parties to whom such data will be transferred include laboratories, clinics, hospitals, research centers, insurance companies, private companies with existing agreements, government entities with existing agreements, as well as companies belonging to the same corporate group, and, where applicable, competent authorities.

Consent from the data subjects will not be required when transfers are made to companies belonging to the same corporate group asHospital Angeles System,” or when such transfers are necessary for the provision of services or for updating medical records.

The user and/or service recipient expressly agrees thatHospital Angeles System” may, when appropriate, transfer sensitive personal data and/or financial information contained in the medical record to their insurance company or, where applicable, to a private company with a current agreement or a government entity with a current agreement; for the sole purpose of determining the eligibility for payment for the services. Accordingly, the user and/or service recipient authorizesHospital Angeles System” to provide such information to the appropriate entity, in accordance with the provisions of this Privacy Notice and as indicated on the cover page of the service agreement entered into with the user and/or service recipient.

Authorization to Transfer Personal Data to Your Insurance Company

If data subjects do not wish forHospital Angeles System” to transfer their personal data, they have 5 (five) days to object by sending a notice to the Personal Data Department ofHospital Angeles System” via email to the following address: datospersonales.hcu@saludangeles.mx. Follow the same procedure outlined for exercising your ARCO rights.

Request and Procedures for Exercising the Rights of Access, Rectification, Cancellation, and Objection Regarding Personal Data (ARCO)

To initiate an ARCO request, please submit a request to the following email address datospersonales.hcu@saludangeles.mx or a written request submitted to Camino a Santa Teresa No. 1055, 14th floor, Torre de Especialidades Quirúrgicas, Colonia Héroes de Padierna, La Magdalena Contreras Borough, ZIP Code 10700, México City; addressed to the Legal Department, Personal Data Division; Monday through Friday from 9:00 a.m. to 3:00 p.m. and from 5:00 p.m. to 7:00 p.m.; said request must contain the following information:

• Account holder's name.
• The account holder's mailing address and/or email address for communicating the response to the request.
• A valid government-issued photo ID that verifies your identity.
• If the application is not filed by the account holder, the applicant must submit a document proving the existence of a power of attorney.
• Description of the personal data regarding which you wish to exercise your ARCO rights.
• Date of visit and name of theHospital Angeles System” branch where you received care.
• Any other information that enables the identification of personal data and the processing of the request.
• If you request a correction to your data, in addition to the above, please specify the changes to be made and provide supporting documentation for your request.

Formats for Providing Personal Data Requested Through ARCO Rights

Hospital Angeles System” is committed to protecting your personal data and ensuring its security. In response to your request to access your information, we have determined that, because the requested information contains sensitive data, it will only be provided in person after your identity has been verified.

Exercising your ARCO rights is free of charge; you will only be charged for the cost of making simple copies.

Ways to Withdraw Consent
At any time, as the owner of your personal information, you may revoke your consent forHospital Angeles System” to process your personal data so that we may cease to use it. You may revoke your consent to the processing of your personal data by sending a request to the email address datospersonales.hcu@saludangeles.mx or a written request submitted to Camino a Santa Teresa No. 1055, 14th Floor, Torre de Especialidades Quirúrgicas, Colonia Héroes de Padierna, La Magdalena Contreras Borough, Zip Code 10700, México City, addressed to the Legal Department, Personal Data Division, Monday through Friday from 9:00 a.m. to 3:00 p.m. and from 5:00 p.m. to 7:00 p.m.; clearly detailing the data for which you are revoking your consent. To exercise your right of revocation, follow the same process outlined for exercising ARCO rights.

Measures and Options Offered byHospital Angeles System” to Limit the Use or Disclosure of Personal Data
As the data subject, you have the right to restrict the use or disclosure of the information you have provided to us for advertising, marketing, and/or sales prospecting purposes.

You may request that the use of your data for the aforementioned purposes be restricted by sending a request to the following email address: datospersonales.hcu@saludangeles.mx or by submitting a written request to Camino a Santa Teresa No. 1055, 14th Floor, Torre de Especialidades Quirúrgicas, Colonia Héroes de Padierna, La Magdalena Contreras District, ZIP Code 10700, México City, addressed to the Legal Department, Personal Data Division; Monday through Friday from 9:00 a.m. to 3:00 p.m. and from 5:00 p.m. to 7:00 p.m. In the request, clearly specify the desired restriction regarding the use of your personal data. Follow the same detailed process for exercising your ARCO rights.

Terms and Conditions Governing the Processing of Your Personal Data
The general terms and conditions for the processing of personal data include several key aspects designed to ensure the security, protection, and privacy of your information. We obtain your consent before collecting, using, or sharing your personal data, ensuring that you are informed about how your information will be handled. The processing of your personal data is limited to the purposes mentioned above, which relate to medical and hospital care and/or medical research.

AtHospital Angeles System, we have implemented a comprehensive management system covering information security, privacy, and personal data protection to prevent unauthorized access, loss, destruction, or improper disclosure. This includes the use of encryption technologies and restricted access control systems, ensuring that only authorized personnel have access to patients’ personal data.

We comply with various local and international standards, laws, and regulations designed to protect the security and privacy of your information. We will retain your information for as long as necessary to comply with current health regulations. This process allows us to provide high-quality medical care, as quick and accurate access to your medical history enables healthcare professionals to make informed decisions about your treatment. Once the retention period has ended, your information will be securely deleted to ensure the protection of our patients’ information. The technological platforms, digital tools, and automated information analysis processes used to provide and improve our services operate under human supervision and validation to ensure quality, security, and reliability in information management. Information Obtained Through Remote or Local Electronic and Optical Communication Media
Hospital Angeles System” collects and stores information when visitors access its website, including the visitor’s IP address/domain name, referring websites, behavior and time spent on the website, pages viewed, tools used, ZIP code, browser type, and operating system, among other details.

This information is collected and stored for the purpose of measuring website activity and identifying browsing trends that cannot be attributed to any specific individual.

The information described above is collected through “cookies” as well as other technological means and mechanisms, such as pixel tags, web bugs, links in emails, and web beacons (Internet tags, pixel tags, and clear GIFs), among others.

Most browsers allow you to disable cookies, block cookies, or receive a warning before cookies are stored. We recommend that you consult your browser’s instructions for managing cookies.

Notice of Changes to the Privacy Notice
This Privacy Notice may be amended at any time to comply with changes in legislation, case law, internal policies, new requirements for the provision of services byHospital Angeles ,” or for any other reason at the sole discretion ofHospital Angeles System.” In such cases, the amendments will be available on our website. http://hospitalangeles.com/culiacan, or any other verbal, printed, or electronic means of communication thatHospital Angeles System” designates for this purpose.

Information on the Secretariat for Anti-Corruption and Good Governance/Transparency for the People
If you believe that your right to the protection of your personal data has been violated by any action or omission on the part ofHospital Angeles ,” or if you suspect a violation of the provisions of the Federal Law on the Protection of Personal Data Held by Private Parties, its Regulations, and other applicable regulations, you may file a complaint or report with the Secretariat for Anti-Corruption and Good Governance through its Transparency for the People office, the institution designated for this purpose. For more information, we suggest you visit their website at https://www.transparencia.gob.mx/https://www.transparencia.gob.mx/.

Express written consent for the processing of your personal data
I hereby declare, under penalty of perjury, that I have read this Privacy Notice in its entirety and understand its scope and content. I hereby state that I grant my express written consent toHospital Angeles System” to process my personal, sensitive, and financial data as set forth herein, in accordance with the purposes, limitations, and possible data transfers outlined in this Privacy Notice.

Date of update and revision of the privacy notice: May 6, 2026.