Comprehensive Privacy Notice

1. Identity and address of the Data Controller

[FULL NAME OF DATA CONTROLLER], an individual acting under the commercial brand TrazaLab (hereinafter, "the Data Controller"), with address at [ADDRESS TO BE DEFINED — CITY, STATE, ZIP], is responsible for the processing of your personal data in accordance with the provisions of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and its Regulations.

For any matter related to this Privacy Notice or to the exercise of your ARCO rights (Access, Rectification, Cancellation, Opposition), you may contact us at: [email protected]

2. Personal data we collect

For the purposes described in this Notice, we collect and process the following categories of personal data:

Ordinary personal data Ordinary

Data that may be considered sensitive Sensitive

TrazaLab is an order management platform between dental laboratories and clinicians. Although we do not collect patient data directly, the files that users upload to the platform may contain clinical information related to patients, such as:

Important: TrazaLab acts as a communication and management platform between dental health professionals. Professional users are responsible for obtaining their patients' consent for the processing of clinical data before uploading it to the platform. By using TrazaLab to share clinical files, the user represents that they have the corresponding authorizations.

For the processing of any data that may be considered sensitive, we obtain the user's express consent at the time of registration through an explicit opt-in mechanism (checkbox).

3. Purposes of processing

Necessary purposes Necessary

The following purposes are necessary for the provision of the contracted service and do not require your additional consent beyond the acceptance of this Notice:

1. Create and manage your user account on the platform.
2. Manage work orders between dental laboratories and clinicians.
3. Facilitate real-time communication between users through TrazaChat.
4. Store, organize, and version files related to work orders.
5. Send operational system notifications (email, WhatsApp Business API).
6. Verify your identity and validate your registration.
7. Manage the invitation and connection system between laboratories and clinicians.
8. Comply with applicable legal obligations.

Voluntary purposes Voluntary — require consent

The following purposes are not essential for the provision of the service. Your refusal will not affect your use of the platform:

1. Send promotional or informational communications about new features.
2. Conduct aggregated statistical analysis to improve the product.
3. Contact you for satisfaction surveys or feedback.

If you do not wish your data to be processed for voluntary purposes, you may communicate this at any time at [email protected] with the subject line "Revoke voluntary purposes".

4. Mechanisms to limit the use or disclosure of your data

You may limit the use or disclosure of your personal data by sending a request to [email protected] indicating your full name, registered email address, and a clear description of the requested limitation. We will respond within a maximum of 20 (twenty) business days.

You may also revoke your consent for voluntary purposes at any time without affecting the use of the essential functions of the platform.

5. ARCO Rights (Access, Rectification, Cancellation, Opposition)

You have the right to exercise at any time your rights of Access, Rectification, Cancellation, and Opposition regarding your personal data ("ARCO" rights), in accordance with articles 22 to 27 of the LFPDPPP in force.

• Access: Know what personal data we hold about you and how we process it.
• Rectification: Request the correction of your data when it is inaccurate, incomplete, or not up to date.
• Cancellation: Request the deletion of your data from our files, records, systems, and archives when you consider that it is not being processed in accordance with the law.
• Opposition: Object to the processing of your data for one or more specific purposes, including automated processing.

To exercise any of these rights, you may use our ARCO request form or send an email to [email protected] with the subject line "ARCO Request" including:

1. Your full name and email address registered on the platform.
2. The specific ARCO right you wish to exercise.
3. A clear and precise description of your request.
4. Any document or information that facilitates the location of your data.

We will respond within a maximum of 20 (twenty) business days counted from the receipt of your complete request. This period may be extended by an additional 20 business days when justified by the case, with prior notification.

ARCO Request Form →

6. Transfers of personal data

Although the LFPDPPP in force no longer requires the disclosure of transfers in the Privacy Notice, at TrazaLab we choose transparency. Your data may be shared with the following third parties solely for the necessary purposes described in this Notice:

These transfers are made under the exceptions provided in article 36 of the LFPDPPP, as they are necessary to fulfill the legal relationship between you and the Data Controller. We do not share, sell, or rent your personal data to third parties for commercial or advertising purposes.

7. Use of cookies and tracking technologies

TrazaLab uses cookies and similar technologies for the following purposes:

Essential and functional cookies are necessary for the proper operation of the platform. Analytics cookies are optional and are only installed with your consent, which you may manage through our cookie banner visible upon entering the site.

You may disable all cookies through your browser settings; however, this may affect the operation of the platform.

8. Security measures

The Data Controller has implemented technical, administrative, and physical security measures to protect your personal data against damage, loss, alteration, destruction, unauthorized access, or improper processing, including:

• Encrypted communications via HTTPS/TLS protocol.
• Passwords stored with secure hashing algorithms.
• Role-based access control (laboratory, clinician, administrator).
• Platform activity audit logs.
• Email verification for account activation.
• Invitation-based connection system (restricted access between authorized users).

9. Data retention and deletion

Personal data will be retained for as long as necessary to fulfill the purposes described in this Notice and the applicable legal obligations. Once those purposes have been fulfilled, the data will be blocked and subsequently deleted in accordance with the internal timeframes and procedures of the Data Controller.

Clinical files associated with work orders will be retained for the period during which the professional user maintains their account active, plus an additional retention period in accordance with the applicable legal provisions in health matters.

10. Changes to this Privacy Notice

The Data Controller reserves the right to modify this Privacy Notice at any time. Any changes will be communicated through the following means:

• Publication of the updated version on this same page: trazalab.com/privacy-notice.html
• Notification within the TrazaLab platform upon login.
• Email to the registered address, when the changes are substantial.

We recommend that you review this Notice periodically to stay informed about how we protect your personal data.

11. Competent authority

If you consider that your right to the protection of personal data has been violated, you may turn to the Secretaría Anticorrupción y Buen Gobierno (Mexico's Anti-Corruption and Good Governance Secretariat), the competent authority for the protection of personal data held by private parties under the LFPDPPP in force.

Website: www.gob.mx/anticorrupcion