PRIVACY POLICY: MEDIKTOR

Teckel Medical, S.L. is aware of the importance of the privacy of personal data and, for this reason, has implemented a data processing policy aimed at providing maximum security in the use and collection thereof, ensuring compliance with the regulations in force on the matter. This policy applies to (i) our website and its respective applications (hereinafter, jointly referred to as the “Website”), (ii) the "MyMediktor" https://my.mediktor.com/ application (hereinafter, “the Application”) and, (iii) in general, to all commercial relationships between its customers and users, being configured as one of the basic pillars in the entity's lines of action. In this document we explain how TECKEL MEDICAL S.L., (hereinafter, “TM” or “we”) registered in the Commercial Registry of Barcelona in Volume 46,461, Sheet 190, Page B-413,671, uses the personal data of users.

PLEASE TAKE A FEW MINUTES TO READ OUR PRIVACY POLICY. WITH IT WE WANT TO EXPLAIN IN A SIMPLE, CLEAR AND TRANSPARENT WAY HOW WE PROCESS AND PROTECT PERSONAL INFORMATION AND THE ASSOCIATED RIGHTS. THE SECURITY OF PERSONAL DATA IS FUNDAMENTAL FOR TM.

1.- WHO IS THIS POLICY ADDRESSED TO AND WHO DOES IT APPLY TO?

2.- IF YOU BROWSE OR USE OUR PLATFORM, WHO IS THE CONTROLLER OF THE PROCESSING OF PERSONAL DATA?

3.- WHO IS THE DATA PROTECTION OFFICER (DPO) OF TM?

4.- DATA PROCESSING CARRIED OUT THROUGH THE PLATFORM

5.- WHAT CONSEQUENCES ARE THERE IF YOU DO NOT PROVIDE US WITH THE DATA?

6.- DO WE SHARE PERSONAL DATA WITH THIRD PARTIES?

7.- ARE INTERNATIONAL TRANSFERS OF PERSONAL DATA MADE?

8.- WHAT RIGHTS DOES THE USER HAVE, WHAT DO THEY MEAN AND HOW CAN THEY BE EXERCISED?

9.- ARE SECURITY AND PERSONAL DATA PROTECTION MEASURES APPLIED?

10.- VALIDITY AND MODIFICATION OF THE PRIVACY POLICY

11.- CONTACTS

1.- WHO IS THIS POLICY ADDRESSED TO AND WHO DOES IT APPLY TO?

This policy applies to all users of the Platform, whether or not they are customers of TM (hereinafter, indistinctly, “the user” or “the users”) who are considered natural persons. Indeed, by personal data, we mean any information about an identified or identifiable natural person.

2.- IF YOU BROWSE OR USE OUR PLATFORM, WHO IS THE CONTROLLER OF THE PROCESSING OF PERSONAL DATA?

We are the controller of the processing of personal data:

TECKEL MEDICAL, S.L., as controller of this Website and in accordance with the provisions of the regulations in force on personal data protection, Regulation (EU) 2016/679 of 27 April 2016 (GDPR) relating to the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD) and Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSICE), has implemented all the security measures, of a technical and organisational nature, to guarantee and protect the confidentiality, integrity and availability of the data processed.

3.- WHO IS THE DATA PROTECTION OFFICER (DPO) OF TM?

TM has appointed a DATA PROTECTION OFFICER (DPO), whom users may contact regarding all matters relating to the processing of their personal data and for the exercise of their rights in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR). You may contact our DPO through the following contact details:

Postal address: Calle Sant Antoni Maria Claret 167, 08025 Barcelona, Spain

Contact email address: dpo@mediktor.com

4.- DATA PROCESSING CARRIED OUT THROUGH THE PLATFORM

When the legitimate basis for the processing of personal data is the user's consent, we remind the user that they have the right to revoke it at any time in a simple and free manner by notifying it to dpo@mediktor.com.

As regards the retention period, as a general rule, when the personal data are no longer necessary for the purposes of processing for which they were collected, they will be blocked, remaining available only to the competent authorities for the possible clearing of legal liabilities during the processing thereof, always in accordance with the applicable regulations, and being unable to be used for purposes other than these. Once the corresponding legal periods have elapsed in the case of blocking, the data will be deleted as provided by the applicable regulations, and may also, if applicable, be securely anonymised by TM (anonymised/non-personal data).

With respect to the processing of anonymous data, that is, those with which the user cannot be identified, we inform you that they may be used for merely statistical and/or medical purposes.

In accordance with articles 13.2.f) and 22 of the GDPR, TM informs users that the symptom checker available in the Application uses automated algorithms to generate a list of possible illnesses related to the information provided by the user. However, said results are merely indicative in nature and in no case constitute a medical diagnosis nor do they produce binding legal effects for the user. TM does not make decisions based solely on automated processing that produce significant legal effects on the data subjects within the meaning of article 22 of the GDPR.

Likewise, we inform you that in no case will TM use the personal data for purposes other than those mentioned above, unless we have informed you in advance and granted a reasonable period to allow the user to object to said processing.

5.- WHAT CONSEQUENCES ARE THERE IF YOU DO NOT PROVIDE US WITH THE DATA?

We endeavour to request or apply the minimum and essential data to carry out the processing of personal data that we perform in the development of our services. All this, in line with the principles contained in the applicable regulations.

However, the failure to provide personal data could result in the impossibility for the user to access certain content or services. For example: if the data to receive our newsletter are not provided, it cannot be sent, nor can the information or content associated with it; or process a specific request or application (given the failure or insufficient completion of the corresponding form or application); or, for example, if the data necessary to assess the symptoms are not provided, said assessment cannot be carried out.

In any case, the information and personal data that the user provides us, according to each case, must in any case be:

- Sufficient, although adjusted, limited and proportionate to the legitimate purposes of processing reported in each case, with the utmost respect for the principles of purpose limitation and minimisation of personal data.

- Accurate, up to date and truthful, in order to be able to appropriately verify the identity, capacity and, where appropriate, representation, as well as to be able to adjust, in each case, the data processing carried out. All this in view of the principle of accuracy of personal data.

In any case, users will be fully responsible for the personal data and information they provide to TM within the framework of the Platform.

The Platform is not aimed at children under fourteen (14) years of age, in accordance with the provisions of article 8 of the GDPR and article 7 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD). TM will not knowingly collect or process personal data of children under said age without the prior consent of their parents, guardians or legal representatives. In the event that TM becomes aware that personal data of a child under fourteen (14) years of age have been collected without due authorisation, it will proceed to delete said data as soon as possible.

6.- DO WE SHARE PERSONAL DATA WITH THIRD PARTIES?

As a general rule, we do not share data with third parties. However, personal data may be shared with the Public Administrations in the cases provided for by Law; the State Security Forces and Bodies, and with the Courts and Tribunals for the following purposes:

- Enforce or apply the General Terms and Conditions of Use.

- Protect the rights, property or safety of TM, its users and/or third parties.

- Protection against fraud and the reduction of credit risk.

- Attend to the requirement of requests for information relating to criminal investigations and alleged illegal activities.

In addition, the data may also be communicated to those collaborating entities that act as processors in view of the purposes detailed below:

These processors of personal data will only process the data to the extent that it is strictly necessary for the provision of the services contracted with them. Such processors operate under a services contract in the terms, with the conditions and guarantees contained in article 28 of the GDPR, with TM carrying out the corresponding controls, inspections and audits in this area to verify that such processors strictly comply with the contracts signed for this purpose and the applicable regulations. All the information provided directly by users to said providers, outside the control of TM, will not be covered by this Policy.

Similarly, the data will be shared with Google Analytics, Google Tag Manager or Amazon for advertising or metric purposes in relation to the use of the Platform, in line with what is indicated in our Cookies Policy.

As of 2 April 2026, Google acts exclusively as a Processor for the reCAPTCHA service under the instructions of TM. The data collected by this tool for fraud prevention are governed by this Privacy Policy and not by Google's general terms.

7.- ARE INTERNATIONAL TRANSFERS OF PERSONAL DATA MADE?

We inform you that, as a general rule, no international transfers of personal data are envisaged, with the necessary measures and guarantees being adopted by TM in this area in accordance with the regulations in force on personal data protection.

In the event that in the future any of our providers is located outside the European Economic Area and the transfer of personal data to said third country is necessary, before carrying out any transfer, TM will review the decisions of the EU Commission relating to the countries that have an adequate level of protection of personal data and will only transfer the personal data to said countries. Otherwise, TM will sign standard contractual clauses with the provider to apply the appropriate technical and organisational measures that guarantee that the processing of the data will comply with the requirement of the GDPR and will guarantee the protection of the users' rights.

Likewise, notwithstanding the foregoing, our cookies policy informs about the use of Cookies by third parties that could carry out international transfers of personal data. You can consult the privacy information of the third parties that serve cookies on the Platform through our Cookies Policy.

8.- WHAT RIGHTS DOES THE USER HAVE, WHAT DO THEY MEAN, AND HOW CAN THEY BE EXERCISED?

The user may exercise the rights of access, rectification, deletion, portability, limitation of processing and objection by letter addressed to the company's registered office (Calle Sant Antoni Maria Claret 167, 08025 Barcelona, Spain), or by email addressed to dpo@mediktor.com, accompanied, if it is necessary to prove identification, by a copy of the national identity document or equivalent identifying document (passport, N.I.E…).

Likewise, we inform you that in the event of not considering the personal rights to have been duly attended to, the user may lodge a complaint with the supervisory authority that is competent in each case.

In any case, we recommend that the user, before lodging any complaint or claim with the competent supervisory authority, contacts us, and especially the DPO of TM dpo@mediktor.com in order to analyse the specific situation that corresponds, and to try, where appropriate, to find an effective and amicable solution.

9.- ARE SECURITY AND PERSONAL DATA PROTECTION MEASURES APPLIED?

We are committed to protecting the personal information of our users and customers through the application of the strictest security measures and in line with the level of risk presented by the processing of the data. Taking into account the nature, scope, context and the indicated purposes of the processing, as well as the risks of varying likelihood and severity for rights and freedoms. TM applies (and will apply) appropriate technical and organisational measures in order to guarantee the due security and protection of personal data in accordance with privacy by design and by default criteria, as well as applying a system of approach to the concurrent risk that will be reviewed and updated by TM when necessary. The use of the Hyper-Text Transfer Protocol (HTTPS) on our Platform is a reinforced guarantee for the security of personal data.

These measures are reviewed and updated regularly to ensure their effectiveness and suitability to the changing threat environment, guaranteeing the maximum protection of the personal data we manage and always respecting the principles of confidentiality, integrity and availability of the information.

Notwithstanding the foregoing, it is the responsibility of users to duly safeguard the keys and passwords they supply for their access as registered users on the Platform, preventing the misuse thereof by third parties. TM is not responsible for the misuse of access keys and passwords carried out by users.

10.- VALIDITY AND MODIFICATION OF THE PRIVACY POLICY

This policy is in force from 23 June 2026.

TM reserves the right to modify this policy, in order to adapt it to future legislative, doctrinal or jurisprudential developments that are applicable, or for technical, operational, commercial, corporate and business reasons, informing in advance and reasonably of the changes that occur when this is possible. In any case, it is recommended that, each time the user accesses the Platform, both on the Website www.mediktor.com and on the "MyMediktor" application, they read this policy in detail, since any modification will be published through it.