INFORMATION SECURITY POLICY

In a technological environment where information technology and communications are enabling a new paradigm of productivity, the Spanish Society of Electromedicine and Quality, S.A. and its subsidiaries in Spain (hereinafter “SEDECAL” or the “Organization”) are strongly committed to providing competitive offerings through their range of electromedicine and ozone therapy products and services, where increasing digitalization makes it essential to implement best practices in security to achieve the objectives of confidentiality, integrity, and availability, established as part of its Information Security Management System (ISMS) and aligned with the identified risks, weaknesses, and opportunities, as well as with established legal, regulatory, and contractual requirements. These objectives will be defined and reviewed annually by management.

Consequently, the Organization maintains the following guidelines to be taken into account within the framework of the ISMS:

• Confidentiality: The information processed by SEDECAL will be disclosed exclusively to authorized individuals, upon verification of their identity, at the designated time and through the authorized channels.
• Integrity: The information processed by SEDECAL will be complete, accurate, and valid, and its content will be that provided by the data subjects
  without any manipulation whatsoever.
• Availability: The information processed by SEDECAL will be accessible and usable by authorized and identified users at all times, and its continued availability is guaranteed in the event of any foreseeable contingency.

In addition, SEDECAL will promote the implementation of measures that demonstrate compliance with the ISMS requirements and serve as justification for monitoring and tracking these requirements, including the processes for monitoring, measuring, analyzing, and continuously improving the ISMS.

 

Through this policy, the General Directorate assumes responsibility for supporting and promoting the implementation of the organizational,
technical, and control measures necessary to comply with the security guidelines described herein.

The General Directorate of SEDECAL is committed to continuously improving the suitability, adequacy, and effectiveness of the Information Security Management System. This commitment is realized through the planning and execution of periodic reviews of the ISMS, the systematic handling of nonconformities and corrective actions, the conduct of internal audits, and the ongoing assessment of the risks and opportunities affecting information security. The results of these activities will serve as the basis for making
decisions aimed at improving the organization’s security level.

Furthermore, all policies and procedures included in the ISMS will be reviewed, approved, and implemented by SEDECAL’s General Management.
This Security Policy will be maintained, updated, and adapted to the organization’s objectives, aligning with the organization’s strategic
risk management context. To this end, it will be reviewed at planned intervals or whenever significant changes occur, in order to
ensure that it remains appropriate, adequate, and effective. Furthermore, to manage the risks faced by SEDECAL, there is a formally defined risk assessment procedure in place.

Signed : MANUEL MARTÍNEZ ÁLVAREZ -CEO

 

Rev.02. 15/06/2026