Privacy and Personal Data Processing Policy

The controller of the personal data described in this Policy is:

Legal name

RIACS TECH PANAMÁ, S.A.

Tax ID (RUC)

155745823-2-2023 DV 70

Registered address

Calle 79 Este, P.H. Firenze, Apartment 8B, Urbanización San Francisco, San Francisco, Panama District and Province, Republic of Panama

Phone

+507 6433-6118

Website

riacs.tech

Privacy email

privacy@riacs.tech

Business activity

Technology solutions for healthcare and radiology: RIACS PACS, RIS, portals, patient notifications and WhatsApp support

RIACS TECH PANAMÁ, S.A. is part of the RIACS Health Imaging group, together with RIACS TECH CHILE SpA (owner and operator of the RIS, PACS, portal and service platforms) and RIACS TECH HONDURAS, S. de R.L. In this Policy, “RIACS”, “we”, “us” and “our” refer to RIACS TECH PANAMÁ, S.A.

This Policy applies to the personal data we process through the following channels:

• The RIACS website (riacs.tech) and its contact, quote, demo and support forms.

• RIACS web portals (Patient Portal, Referring Physician Portal and user consoles for client centers).

• The WhatsApp channel, for notifications about your care, study or report, and for answering inquiries.

• Email, phone and technical support.

• Business relationships with clients, suppliers, partners and distributors.

This Policy does not apply to third-party websites, applications or services, even when accessed through links on our channels. It does not replace or modify the terms and policies of Meta Platforms / WhatsApp.

RIACS provides radiology and medical imaging technology services to clinics, hospitals and diagnostic imaging centers (the “Centers”). Depending on the case, we act in one of two capacities:

If you are a patient, or a patient’s representative, and wish to exercise your rights over the medical record, you may contact the Center that treated you directly. You may also write to us and we will forward your request to the Center.

We only collect the data needed for each purpose. Depending on the channel, we may process:

We do not knowingly collect personal data that is not needed for these purposes. If you send us additional unsolicited information (for example, medical documents by WhatsApp or email), we will treat it with the same confidentiality and use it only to handle your request.

RIACS TECH PANAMÁ, S.A. uses the WhatsApp Business Platform (WhatsApp Business API / Cloud API), provided by Meta Platforms, Inc. and WhatsApp LLC, for two purposes: sending service notifications about appointments, radiology studies and reports, and providing support through human agents. This section explains how we comply with the WhatsApp Business Messaging Policy and Panamanian data protection law.

5.1 Account identification

• Messages are sent from the official WhatsApp Business account of RIACS TECH PANAMÁ, S.A., linked to its verified business account on Meta.

• The account profile shows the trade name RIACS and our contact details: email privacy@riacs.tech, website riacs.tech and phone +507 6433-6118.

• When we send a notification on behalf of a healthcare Center, the message clearly names that Center. We do not impersonate other businesses or people.

5.2 Message categories

Outside the 24-hour customer service window, we only start conversations using Meta-approved message templates. Each template belongs to a single category and includes opt-out instructions.

5.3 How we obtain your consent (opt-in)

• We only message phone numbers that you provided yourself, either directly or to the Center that treats you, and only after you expressly agreed to receive WhatsApp messages.

• Consent is obtained by one of these means:

• a checkbox or statement during registration or admission at the Center;
• an unticked checkbox on our website forms;
• your written confirmation in the WhatsApp conversation itself.

In every case, RIACS and the Center are named, the WhatsApp number is stated, and the types of messages you will receive are described.

• Reference consent text: “I agree to receive WhatsApp notifications about my appointments, studies and reports from [Center] at the number provided, sent through the RIACS platform. I can unsubscribe at any time by replying STOP.”

• Consent for service notifications and consent for marketing communications are requested separately.

• We record the date, time, number, channel, category and text accepted, as proof of consent.

• We do not buy, rent or exchange phone number lists. We do not collect numbers from public sources, social media or other sources without consent.

5.4 How to stop receiving messages (opt-out)

• Reply “STOP” or “BAJA” to any message. The opt-out is recorded immediately and you will not receive further messages in that category.

• You can also ask the Center to unsubscribe you, write to privacy@riacs.tech, or block our account in WhatsApp. We honor every opt-out request, whether made on or off WhatsApp.

• You can opt out of a single category (for example, marketing) and keep receiving service notifications.

• Opting out does not affect your care. The Center will inform you through other channels: phone, email or the Patient Portal.

5.5 Support by human agents

• Conversations you start are handled by trained RIACS staff bound by confidentiality.

• Outside business hours, an automated message tells you our hours and alternative channels. You can type “AGENT” at any time to have your request handled by a person.

• You can also reach us through other channels: email privacy@riacs.tech, phone +507 6433-6118, or the Center that treats you.

5.6 Health information: what we send and what we don’t

These are available only in the portal, with authentication.

We do not use WhatsApp for telemedicine, medical consultations, diagnoses, prescriptions or emergencies. In an emergency, call 911 or go to the nearest emergency department.

We will never ask you via WhatsApp for ID or passport numbers, payment card numbers, bank account numbers, passwords or verification codes. If you receive such a request in RIACS’s name, do not reply and report it to privacy@riacs.tech.

5.7 Data we process on WhatsApp and limits on its use

• Data processed:
• phone number and WhatsApp ID;
• profile name;
• content of the messages and attachments you send;
• date and time of each message;
• delivery and read statuses;
• message category;

• consent and opt-out records.

• We use this data only to manage our communication with you and provide the requested service. We do not use it for advertising, profiling or sale. We do not share it with third parties for commercial purposes.

• We never forward the content of your conversation to other users or customers.

• Messages travel encrypted and are processed on Meta’s infrastructure, which may be located outside Panama (mainly in the United States). For the WhatsApp Business API, Meta acts as a service provider to RIACS. It also processes certain data under its own terms and privacy policy.

• Only authorized staff can access the messaging console, using individual credentials with activity logging. API credentials and tokens are protected by security controls.

• Retention periods are listed in section 11. You can request deletion as described in section 14.

5.8 Minors

For patients who are minors, notifications are sent only to the number of the parent or legal guardian who gave consent. We do not message minors directly, and we do not send marketing communications to anyone under 18.

We process personal data only for the following purposes, each supported by a lawful basis under Law 81 of 2019:

We do not use data for purposes incompatible with those described. If we need to use it for a new purpose in the future, we will inform you and, where applicable, ask for your consent.

7.1 Sensitive data

Health data, such as studies, images, reports, diagnoses and medical history, is sensitive data under Law 81 of 2019. We process it with enhanced confidentiality and security measures, only to provide the healthcare service and according to the Center’s instructions. Its processing is based on the prior, express and informed consent of the data subject, or on the other exceptions provided by law. We do not transfer sensitive data to third parties except where the law permits it.

7.2 Minors and persons with limited capacity

Data of patients who are minors is processed with the consent of their parent or legal guardian, who receives the notifications and exercises the rights on their behalf. The same applies to persons who require legal representation. The website and its forms are not directed at minors.

Our website may use cookies and similar technologies:

You can accept, reject or configure non-essential cookies through the site’s cookie banner or your browser settings. If you block essential cookies, some features, such as portal access, may stop working.

We do not sell, rent or trade personal data. We share it only to the extent necessary with:

• The healthcare Center that treated you and is responsible for your medical record.

• RIACS group companies, in particular RIACS TECH CHILE SpA, which operates the platforms’ technology infrastructure, under confidentiality obligations equivalent to this Policy.

• Referring physicians and reporting professionals authorized by the Center to access the study or report.

• Service providers (processors): hosting and cloud, messaging (Meta / WhatsApp Business), email, web analytics and support. All are contractually bound to use the data only to provide their service to RIACS and to protect it appropriately.

• Competent authorities, when there is a legal obligation or a formal request from a judicial or administrative authority.

• Professional advisors (legal, accounting or auditors), under a duty of confidentiality.

Due to the nature of our services, your data may be stored or processed outside the Republic of Panama, in particular in:

• Chile, where RIACS TECH CHILE SpA operates the RIS, PACS and portal platforms.

• The United States or other countries where the servers of Meta / WhatsApp and of our cloud and email providers are located.

In these cases, we apply the safeguards required by Law 81 of 2019 and its regulations, such as data protection contractual clauses, confidentiality obligations and security measures, to ensure an adequate level of protection. Where the law requires it, the transfer will be made with your consent.

We keep data only for as long as necessary to fulfill the purpose for which it was collected and for the applicable legal limitation periods. After that, we securely delete or anonymize it.

We apply technical, administrative and organizational measures proportionate to the risk and sensitivity of the data, including:

• Encryption of communications in transit (HTTPS/TLS) and password storage using cryptographic algorithms.

• Role-based access control under the principle of least privilege, with user authentication.

• Audit logs of access to studies and reports.

• Regular backups and service continuity procedures.

• Confidentiality agreements with staff and providers, and data protection training.

If a security breach occurs that poses a significant risk to your data, we will notify the National Authority for Transparency and Access to Information (ANTAI), the responsible Center and the affected data subjects, in accordance with applicable regulations. We will also take measures to mitigate its effects.

Under Law 81 of 2019 and Executive Decree 285 of 2021, you have the right to:

How to exercise them

1. Send an email to privacy@riacs.tech with the subject “Data protection – [right you are exercising]”.
2. Include your full name, ID document, associated WhatsApp number or email, the Center that treated you (if applicable) and a clear description of your request.
3. Attach by email (never via WhatsApp) a copy of your ID document, or the document proving representation if you are acting on behalf of another person.

Exercising these rights is free of charge. We will respond within the periods set by Panamanian regulations: up to 10 business days for access requests and up to 5 business days for rectification and cancellation, counted from when the request is complete. When the request concerns medical record data, we will coordinate it with the responsible Center.

If you believe we have not properly handled your request, you may file a complaint with the Personal Data Protection Directorate of the National Authority for Transparency and Access to Information (ANTAI) of the Republic of Panama (antai.gob.pa).

To request deletion of personal data linked to WhatsApp notifications or any other RIACS channel:

1. Write to privacy@riacs.tech with the subject “Data deletion”.
2. Include your name, the associated WhatsApp number or email and, if possible, the Center that treated you.
3. We may ask for additional information to verify your identity and protect your data. This verification is done by email, never via WhatsApp.

Once the request is approved, we delete from our systems your WhatsApp conversation history, your number and the associated contact details. We keep only a minimal opt-out record, to make sure you are not messaged again. We will acknowledge receipt and proceed within the legal periods stated in section 13. Deletion will not apply to information we must keep by law or that is part of the medical record held by the Center. In that case, we will inform you and coordinate the request with the Center. To stop receiving notifications immediately, simply reply “STOP” or “BAJA” on WhatsApp.

We may update this Policy to reflect regulatory, technological or service changes. We will publish the current version on this page with its update date. If the changes are significant, we will notify you through the usual channels and, where the law requires it, ask for your consent again.

This Policy is governed by the laws of the Republic of Panama, in particular Law 81 of March 26, 2019 on Personal Data Protection and Executive Decree 285 of May 28, 2021, which implements it. Where data is processed in other jurisdictions, applicable local regulations will also be observed. In case of discrepancy between language versions, the Spanish version shall prevail.

Controller

RIACS TECH PANAMÁ, S.A. · RUC 155745823-2-2023 DV 70

Address

Calle 79 Este, P.H. Firenze, Apt. 8B, San Francisco, Panama

Email

privacy@riacs.tech

Phone

+507 6433-6118

Website

riacs.tech