Privacy Policy and Processing of Personal Data

This document (hereinafter, the "Policy") governs the processing of personal data collected through the irene platform (hereinafter, the "Platform"), in accordance with Law No. 172-13 on the Comprehensive Protection of Personal Data of the Dominican Republic, its supplementary regulations, and the medical confidentiality duties established under applicable health legislation. Use of the Platform implies knowledge and acceptance of the terms set forth herein.

1. Definitions

For the purposes of this Policy, the following terms shall have the meaning indicated below:

• Personal Data: any information concerning an identified or identifiable natural person.
• Sensitive Data: Personal Data relating to health, as well as any other data warranting special protection under the law.
• Data Subject: the natural person to whom the Personal Data pertains (the patient).
• Controller: the attending physician or health establishment that determines the purposes and means of the processing of Personal Data through the Platform.
• Processor: the third party that processes Personal Data on behalf of the Controller.
• Processing: any operation performed on Personal Data, including its collection, storage, use, retention, transmission, or deletion.

2. Controller

The Controller is the attending physician or health establishment that uses the Platform as a support tool. irene acts as the provider of the technological solution (Processor). Any request relating to this Policy may be directed to privacidad@irenemed.com.

3. Categories of Data Subject to Processing

The Platform processes the following categories of Personal Data:

1. Identification and contact data: name, age, sex, identity document, telephone number, and email address.
2. Sensitive health data: diagnoses, clinical alerts, medical notes, pharmacological treatments, laboratory results, studies, and diagnostic images uploaded to the Platform.
3. Body composition and biometric metrics: bioimpedance reports (InBody/DEXA) and anthropometric measurements.
4. Monitoring device data (optional): metrics from wearables (for example, Whoop, Oura, Ultrahuman, or Apple Health), solely when the Data Subject voluntarily links such accounts.
5. Authentication and log data: access credentials, whose password is stored encrypted (by means of a cryptographic derivation function) and never in plain text, and an audit log of accesses and operations.

4. Purposes of Processing

Personal Data is processed for the exclusive purpose of supporting the medical care of the Data Subject, including the organization of the clinical record, the generation of dashboards and analyses, and assistance to the clinical reasoning of the Controller. The Platform constitutes a clinical decision support tool and in no case replaces professional medical judgment. The Data shall not be subject to commercialization or to processing for advertising purposes.

5. Legal Basis and Consent

Processing is based on the doctor-patient relationship and on the free, informed, prior, and unequivocal consent of the Data Subject, in accordance with Law No. 172-13. In the case of Sensitive Data, Processing observes the reinforced protection provided by law, as well as the principles of lawfulness, purpose, proportionality, quality, transparency, and security.

6. Processors, Disclosures, and International Transfers

The Controller does not assign or disclose Personal Data to third parties, except to the Processors strictly necessary for the operation of the Platform, which act under instructions and confidentiality obligations:

• Anthropic, PBC (processing by means of artificial intelligence): certain clinical documents and data are processed through its services for assisted analysis. Under its terms of use for the application programming interface (API), the data is not used to train its models and is subject to its retention policies.
• DigitalOcean, LLC (hosting infrastructure): information is stored on its server infrastructure.
• EmailJS (email delivery): used to send transactional emails (invitations and consent receipts), which may include the name and email address of the Data Subject.
• Third-party wearables (Whoop, Oura, Ultrahuman, Apple Health): solely when the Data Subject voluntarily links such services.

The Data Subject acknowledges and consents that certain Processors process or store information outside the territory of the Dominican Republic (among others, in the United States of America), subjecting such international transfer to the security measures described in Clause 7.

7. Security Measures

The Controller implements appropriate technical and organizational measures to preserve the confidentiality, integrity, and availability of Personal Data, including:

• Encryption in transit: all communications are transmitted using secure protocols (HTTPS/TLS).
• Encryption at rest: the database, documents, and backups are stored on an encrypted volume.
• Role-based access control: each user (administrator, doctor, or patient) accesses only the information that corresponds to them; the patient accesses only their own information.
• Credential protection through encryption and secure session management.
• Audit logging of accesses and operations, for the purposes of traceability and detection of improper use.

8. Data Retention

Personal Data shall be retained for as long as the medical care relationship subsists and, in any case, for the periods imposed by the regulations applicable to clinical records and registries. Once such periods have elapsed, the Data shall be securely deleted or anonymized.

9. Rights of the Data Subject

In accordance with Law No. 172-13, the Data Subject may exercise the rights of access, rectification, cancellation (deletion), and objection with respect to their Personal Data. These rights may be exercised through the Controller or by communication to privacidad@irenemed.com, with the request being addressed within the legally established time frames.

10. Confidentiality and Professional Secrecy

All clinical information is protected by medical professional secrecy and by the duty of confidentiality. Access to it is restricted to duly authorized personnel and to the Data Subject themselves.

11. Minors

Where the Data Subject is a minor, the Processing of their Personal Data shall require the consent granted by their father, mother, guardian, or legal representative, without prejudice to the special provisions applicable in the health domain.

12. Security Incidents

In the event that a security breach affecting Personal Data is detected, the Controller shall adopt the relevant corrective measures and shall inform the affected Data Subjects and, where appropriate, the competent authorities, in accordance with applicable regulations.

13. Amendments to the Policy

The Controller may amend this Policy to adapt it to regulatory, technical, or operational changes. The current version, indicating its effective date, shall remain published at this same address.

14. Applicable Law and Jurisdiction

This Policy is governed by the laws of the Dominican Republic. Any dispute arising from its interpretation or application shall be submitted to the competent courts of the Dominican Republic.

15. Contact

For any inquiry, request, or claim regarding privacy and the protection of personal data, you may contact privacidad@irenemed.com.