For the correct interpretation, application, and compliance of this Privacy Policy, and in strict accordance with Colombian regulations and international standards, the following definitions shall apply:

• Authorization: Prior, express, and informed consent granted by the Data Subject to carry out the Processing of their personal data.
• Privacy Notice: Physical, electronic, or any other format document generated by the controller that is made available to the data subject for the processing of their personal data. In the privacy notice, the data subject is informed about the existence of the applicable information processing policies, how to access them, and the intended purpose of the processing of personal data.
• Database: Organized set of personal data that is subject to Processing, regardless of the medium or format in which it is found.
• Personal Data: Any information linked to or that can be associated with one or more determined or determinable natural persons.
• Sensitive Personal Data: That data which affects the privacy of the data subject or whose improper use can generate their discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social or human rights organizations, or that promotes the interests of any political party or guarantees the rights of opposition political parties, as well as data related to health, sexual life, and biometric data.
• Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, data related to the civil status of people, their profession or trade, and their status as a merchant or public servant.
• Data Subject: Natural person whose personal data is subject to Processing (e.g., the client, passenger, or Beneficiary of the assistance service).
• Habeas Data: Fundamental right that every person has to know, update, and rectify the information that has been collected about them in databases and in the files of public and private entities.
• Data Controller: Natural or legal person, public or private, who by themselves or in association with others, decides on the database and/or the processing of data. EG ASSIST acts as the data controller regarding all personal data over which it directly decides, in compliance with its legally recognized functions.
• Data Protection Officer: The person or area (Customer Service Department) designated by the Controller to assume the function of personal data protection, attend to the requests of the Data Subjects, and ensure compliance with this policy.
• Data Processor: Natural or legal person, public or private, who by themselves or in association with others, performs the Processing of personal data on behalf of the Data Controller. (For the purposes of medical provision, MOK and its network of allied providers).
• Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, transmission, transfer, or deletion.
• Transmission: Processing of personal data that implies the communication of the same within or outside the resident territory, when its purpose is the realization of Processing by the Processor on behalf of the Controller.
• Transfer: Data transfer takes place when the Controller and/or Processor of personal data sends the information or personal data to a receiver, who in turn assumes the status of Data Controller and is located within or outside the country.
• Assistance Policy (or Policy): For the purposes of this policy, it refers to the international assistance services contract. The Data Subject accepts that this term is used for immigration terminological harmonization purposes and does not imply the existence of an insurance contract, but a service coordinated by the Controller and executed by the Processors.

For all legal, administrative, and compliance purposes, the digital platform and the commercial brand EG ASSIST are operated and represented by the US company EGASSIST, LLC, with tax identification number (EIN) 38-4394059, domiciled at 131 Continental Dr, Suite 305, Newark, Delaware 19713, USA, which assumes the legal status of Data Controller of the databases. To guarantee the rights of the Data Subjects, The Company has established the following institutional service channels:

• Email: LLC@egassist.com
• Phone / WhatsApp: +19256054656
• Website: https://egassist.com/

EG ASSIST, as the data controller, may sign alliances or agreements for the development of its corporate purpose and entrust other entities or persons with the processing of personal data for which it is responsible, for which it will obtain the prior, informed, and express consent of the data subjects, thus guaranteeing the rights to data protection.

3.1 Designation of the Data Protection Officer EG ASSIST LLC has designated its Customer Service Department as the office in charge of ensuring the protection of personal data and attending to the requirements of the Data Subjects (Habeas Data). This department will act under the supervision of the Legal Management to ensure compliance with Law 1581 of 2012, as well as current legal regulations and international treaties and practices.

By interacting with our platform, EG ASSIST collects two categories of information:

4.1 Non-Personal Information (Navigation and Interaction Data) Includes data that cannot be used to identify you personally, such as anonymous usage information, referring/exit URLs, the type of browser you use, the device from which you connected, your general IP address, and the number of clicks. This information is collected automatically in order to administer the Site, analyze traffic metrics, and improve the user experience.

4.2 Personal Information EG ASSIST collects identifiable information that is strictly necessary for the provision of its services and commercial management. Depending on the type of user, the data collected includes:

• General and Identification Data: Names, surnames, type and document number (passport or national identification), nationality, date of birth, gender, and country of residence.
• Contact Data: Email, phone number, postal address, and emergency contacts.
• Financial and Transactional Data: Information required to process payments for services or liquidate commissions to our commercial allies (Partners).
• Sensitive Data (Health): Medical information, clinical history, or diagnoses that are strictly necessary for the coordination and effective provision of medical assistance services.
• Data of Minors: The processing of data of children and adolescents will be carried out always observing their fundamental rights and respecting their best interests. In the case of the acquisition of family or group assistance plans, the provision of personal information and/or identity documents (passports) of minors by the father, mother, guardian, or legal representative during the purchase process or assistance request, as well as the acceptance of this Policy, will constitute the prior, express, and informed authorization required by law for the processing of such data, with the exclusive purpose of issuing the policies and coordinating the pertinent medical care.

4.3 Processing of Sensitive Data EG ASSIST will strictly observe the legal limitations on the processing of sensitive data, which you are not obligated to authorize for processing. The processing of sensitive data is prohibited, except when:

• The data subject has given their explicit authorization to such processing, except in cases where the law does not require the granting of such authorization.
• The processing is necessary to safeguard the vital interest of the data subject and they are physically or legally incapacitated. In these events, the legal representatives must grant their authorization.
• The processing refers to data that is necessary for the recognition, exercise, or defense of a right in a judicial process.
• The processing has a historical, statistical, or scientific purpose. In this event, measures conducive to the suppression of the identity of the data subjects must be adopted.

In the case of processing data relating to health, EG ASSIST will implement the necessary measures to protect the confidentiality, security, and sensitivity of the information. The biometric sensitive data processed is intended for the identification of people, security, compliance with legal obligations, and the proper provision of products. For the collection of this data, it must be guaranteed that prior and written authorization is obtained from the third party.

4.4 Processing of Personal Data of Children and Adolescents Said processing is intended to safeguard an essential public interest, which is evaluated in accordance with international human rights standards, and as a minimum, must meet the criteria of legality, proportionality, and necessity, safeguarding the fundamental rights of the interested parties. It must be taken into account that although Law 1581 of 2012 prohibits the processing of personal data of children and adolescents, except for those that are public by their nature, the Constitutional Court specified that regardless of the nature of the data, the processing of these can be carried out “as long as the purpose pursued with said processing responds to the best interests of children and adolescents and the respect for their prevailing rights is unconditionally ensured”. In this way, in case information concerning children or adolescents must be obtained, the data and authorization will be processed or expressly collected through the data subject and their legal representative, granting processing that responds to and respects the best interests of children and adolescents and their fundamental rights. Once the aforementioned requirements are met, the legal representative of the child or adolescent will grant the authorization after the minor has exercised their right to be heard, an opinion that will be evaluated taking into account maturity, autonomy, and capacity to understand the matter. This information will be stored in the databases generated for the purposes that its collection requires, and its processing will be maintained while the purposes of its collection and knowledge are maintained, or in which case their data will be kept until they show their opposition.

The collected information will be processed with the following purposes:

• Service Management: Process the issuance of assistance plans, billing, and operational management of the contracted services. As well as, perform all activities necessary to fulfill the different contractual stages in the relationship with clients.
• Assistance Provision (Transmission to Third Parties): EG ASSIST acts as a marketer and intermediary. To guarantee the provision of medical and logistical services internationally, the Data Subject expressly and unequivocally authorizes the transmission and/or transfer of their personal and sensitive data (health) to allied international assistance centers, third-party providers, and their global network of medical providers. These entities will legally act as Data Processors, using the data solely and exclusively to coordinate the emergency, evaluate coverage, and execute the assistance.
• Legal Compliance and Fraud Prevention: For the purposes of compliance with legal or regulatory duties established by competent authorities. As well as for the collection, consultation, and processing in due diligence processes in the linking, updating of clients, and monitoring, in accordance with the company’s internal policies and for the prevention of money laundering, terrorist financing, proliferation of weapons of mass destruction, bribery, fraud, and corruption. In this sense, the company may directly consult the information before the State Security Agencies and other restrictive lists, as well as verify national and international judicial backgrounds, exclusively for compliance with legal provisions and internal policies related to the prevention of money laundering, terrorist financing, proliferation of weapons of mass destruction, bribery, fraud, and corruption.
• Communications and Marketing: Send information about new products, promotions, newsletters, and satisfaction surveys through email, text message (SMS), or WhatsApp. The user may request to unsubscribe from these communications at any time by following the unsubscribe instructions included in each communication or by contacting us through our official channels.
• Partners Management: Manage the relationship with commercial allies, sales tracking, and commission settlement.
• AI Management: Process customers’ personal data using artificial intelligence platforms in order to optimize the provision of services, improve user experience, perform predictive consumer behavior analysis, personalize commercial offers, automate customer service processes (including chatbots and virtual assistants), evaluate commercial risks, and strengthen security and fraud prevention mechanisms.
• Video Surveillance System: In the case of biometric data captured through video surveillance or CCTV systems, its processing will be for the purpose of identification, security, and the prevention of internal and external fraud.
• Electronic Signature: The biometric data collected in the electronic signature process implemented in EG ASSIST will have as its main purpose the subscription of legal documents with the Company, compliance with legal obligations derived from the subscribed commercial relationship, and to serve as evidentiary element or legal support in the event of a claim, lawsuit, or judicial requirement.

Given the global nature of the assistance services and that EG ASSIST is located in the United States, the personal data of the Data Subject (including sensitive data) may be transferred and transmitted to servers, providers, assistance centers, and medical providers located in third countries. By accepting this policy, the Data Subject grants their express consent for such international transfers, under the guarantee that EG ASSIST will implement the necessary contractual and technical safeguards to maintain an adequate level of protection.

6.1 Commercial Transactions. In the event that we undergo a business transaction, such as a merger, acquisition by another company, or sale of all or a portion of our assets, your Personal Information may be among the assets transferred. You acknowledge and agree that such transfers may occur, and that any acquirer of our assets may continue to process your Personal Information as set forth in this policy.

7.1 Duties of the Controllers. EG ASSIST as the data controller, must fulfill the following duties, without prejudice to the other provisions provided by law and others that govern its activity:

• Guarantee the data subject, at all times, the full and effective exercise of the right to habeas data.
• Request and keep, under the conditions provided in the Law, a copy of the respective authorization granted by the data subject.
• Properly inform the data subject about the purpose of the collection and the rights that correspond to them by virtue of the authorization granted.
• Guarantee that the information supplied to the data processor is truthful, complete, accurate, updated, verifiable, and understandable.
• Update the information, timely communicating to the data processor all novelties regarding the data previously supplied and adopt the other necessary measures so that the information supplied to them is kept updated.
• Rectify the information when it is incorrect and communicate the pertinent to the data processor.
• Supply the data processor, as the case may be, only with data whose processing is previously authorized in accordance with the provisions of the Law.
• Require the data processor at all times, respect for the security and privacy conditions of the data subject’s information.
• Process queries and claims formulated in the terms set forth in the Law.
• Inform the data processor when certain information is under discussion by the data subject, once the claim has been submitted and the respective process has not ended.
• Inform at the request of the data subject about the use of their data.
• Inform the data protection authority when there are violations of security codes and risks exist in the administration of the data subjects’ information.
• Ensure that AI systems respect data protection principles (purpose, data protection, restricted circulation, security, transparency).
• Previously evaluate the risks of using AI on personal data and implement controls.
• Guarantee data security in AI processes (anonymization or pseudonymization when possible, access controls to models and datasets, traceability of queries and results).

7.2 Duties of the Processors. The processors of personal data must comply with the following, in accordance with the provisions of the current regulations:

• Timely perform the update, rectification, or deletion of data under the terms of this law.
• Process personal data only on behalf of the personal data controller according to the policies and guidelines issued by the controller.
• Subscribe to the corresponding personal data transfer or transmission contracts.
• Guarantee the data subject, at all times, the full and effective exercise of the right to habeas data.
• Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use, or unauthorized or fraudulent access. The processors must comply with the minimum security conditions defined by Law 1581 of 2012 and other current regulations.
• Process queries and claims formulated by the data subjects under the terms indicated in this policy.
• Refrain from circulating information that is being disputed by the data subject and whose blocking has been ordered by the Superintendence of Industry and Commerce.
• Allow access to the information only to people who can have access to it.
• Verify that the data controller has the authorization for the processing of the data subject’s personal data.
• Implement specific technical controls for AI.
• Inform the controller about failures, incidents, or anomalous behaviors of the AI system that may generate leaks, erroneous decisions, or misuse of information.

The Company may use artificial intelligence tools for the analysis, study, and projection of information, as well as to support decision-making related to corporate goals and objectives, guaranteeing in any case that said processing is carried out according to the purposes authorized by the data subjects, under human control, with reinforced security measures and without the personal information being used for purposes other than those defined by the Company.

EG ASSIST protects personal data through the implementation of reasonable technical and administrative measures aimed at preventing its loss, alteration, disclosure, or unauthorized access. This includes the use of encryption protocols and secure navigation (SSL/TLS), certified payment gateways, CAPTCHA verification systems, and internal access controls with the principle of least privilege. Although EG ASSIST implements strict industry standards to protect your personal information, the user must understand that no method of transmission over the Internet or electronic storage system is 100% secure or infallible. Therefore, although we strive to protect your data, we cannot guarantee absolute security against cyberattacks by third parties outside of our operation.

In accordance with applicable regulations, you as the Data Subject have the right to:

• Know, update, and rectify your personal data that is inaccurate, incomplete, or outdated.
• Request proof of the authorization granted for the processing of your data.
• Be informed regarding the use that has been given to your personal information.
• Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual duty that requires its conservation (for example, an ongoing medical assistance or accounting requirements).
• Access free of charge to your personal data that have been subject to Processing.

To exercise their rights, the Data Subject, their successors, or their legal representative must send a formal request to the email: LLC@egassist.com.

10.1 Inquiries. They will be answered within a maximum term of ten (10) business days from their receipt. If it is not possible to respond within this period, the interested party will be informed, and the term will be extended for an additional five (5) business days.

10.2 Claims (Update, correction, deletion). They will be addressed within a maximum term of fifteen (15) business days. If the request requires more time for resolution, the data subject will be notified indicating the reasons for the delay, and a response will be given within no more than eight (8) additional business days.

The EG ASSIST website uses “cookies” and tracking technologies to improve user experience, remember preferences, process logins, and analyze traffic metrics (e.g., Google Analytics). The user can configure their browser to block or be alerted about these cookies.

Our website may contain links to third-party websites. EG ASSIST is not responsible for the content, security, or privacy practices of such sites outside our operation.

The Company has a video surveillance system and biometric systems that aim to comply with physical security policies, complying with the parameters established by the Superintendence of Industry and Commerce (SIC), as a control authority. Images or biometric data must be kept for the maximum defined time of 30 days. In the event that the respective image is the object or support of a claim, complaint, or any judicial process, until the moment it is resolved. Images or biometric data of determined or determinable persons, operations such as capture, recording, transmission, storage, conservation, or reproduction in real-time or later, among others, are considered as personal data processing, and consequently, are subject to the general personal data protection system adopted by the company.

The collection and processing of personal data are governed by the current laws of the Republic of Colombia. This policy becomes effective upon its publication on the EG ASSIST website. The databases will have a validity equal to the time the information is maintained and used for the described purposes, or for the period dictated by the applicable legal, accounting, and tax obligations. EG ASSIST reserves the right to modify this Privacy Policy at any time. We will notify you of significant changes to our policy by sending a notice to the primary email address associated with your account or by posting a prominent announcement on our website. Significant changes will take effect thirty (30) days after such notification. Non-material changes or clarifications will take effect immediately. You are advised to review the website periodically to stay aware of updates.