PRIVACY POLICY AND TELEMEDICINE POLICIES OF CDOCTORSTEAMS

CDoctorsTeams is a health social network that connects Professionals, Suppliers and the general public — it does not provide health services. This Policy governs the processing of the personal data of those who use the Platform, not the medical care that Professionals provide independently.

(In data protection law, "processing" means the handling of personal data: collecting, storing, using or sharing it. It has nothing to do with medical treatment, which is the sole responsibility of each Professional.)

The controller is CDoctorsTeams LLC (Florida, U.S.). In the countries where there is a Local Entity of the CDoctorsTeams group, that entity is a joint controller of the processing of the data of the Users in its country, pursuant to the agreement entered into between both. Users may exercise their rights before either of them.

Privacy contact: support@cdoctorsteams.com · WhatsApp +1 (813) 338-5011

We process personal data in accordance with the applicable laws in each country where we operate, including HIPAA (U.S., when the Clinical Features are active), PIPEDA and provincial laws (Canada), the Ley Federal de Protección de Datos Personales en Posesión de los Particulares of 2025 (Mexico), Ley 1581/2012 (Colombia), Ley 29733 (Peru), Ley 19.628 and —from its entry into force— Ley 21.719 (Chile), Ley 25.326 (Argentina), the LGPD (Brazil), the applicable laws in Bolivia and El Salvador, Ley 18.331 (Uruguay), Ley 81 de 2019 (Panama), Ley 8968 (Costa Rica), Ley 7.593/2025 —once in force— (Paraguay), and the RGPD (GDPR) (Spain/EU).

Identification and contact: name, email, telephone number, country, date of birth (to verify legal age).

Account and professional profile: résumé, credentials, licenses, photograph (Professionals and Suppliers).

Health data (only when using the Clinical Features):

• The reason for consultation that the Patient indicates when booking.
• The clinical information that the Patient chooses to provide —personal and family history, medication, vaccines, allergies—. All of these fields are optional: the Patient decides what to share.
• The Professional's consultation notes and the clinical record (EMR).
• The consultation chat.
• With express consent and on a per-consultation basis, the audio transcription and the AI-generated draft note.
• The health data of a minor are provided by their Responsible Adult and are recorded under the latter's account.

Scheduling and logistics data: consultation modality and, for home visit consultations, the address indicated by the Patient, which is shared with the assigned Professional solely for the purpose of providing care.

Payment data: for card payments, the data are processed by our payment gateway; CDoctorsTeams does not store full card numbers. For memberships, we keep the billing history. For External Payments (cash and transfer) we do not process the transaction, because it takes place outside the Platform; we only record the chosen method, the selected transfer means and the status declared by the parties. To receive transfers, the Professional stores in their profile their payout details (alias, account number, key or associated mobile number), which are only displayed to the Patient of an accepted appointment, never on the public profile or in notifications, and access to which is logged.

AI assistant: the conversations that the User voluntarily holds with the AI assistant and their consumption of AI Credits. These conversations may include health information if the User chooses to write it.

Purchases: history of purchases of AI Credits and Diamond Packages (date, amount, method and status). For Diamond Packages paid by transfer or in cash, we only record the chosen method and the status declared by the parties.

Technical and usage data: IP, device, cookies, access logs.

Communications: messages and files exchanged on the Platform.

The Platform does not manage prescriptions, and therefore does not collect prescription data.

We process data to: provide and improve the Platform; manage registrations, memberships, scheduling, payments and consultations; verify identities and credentials; comply with legal, accounting and tax obligations; ensure security; and communicate with you.

The legal bases include performance of the contract, compliance with legal obligations, legitimate interest (security and service improvement) and express consent for health data and for the AI features, as required by each jurisdiction. The AI assistant is used voluntarily; by using it, the User consents to the processing of their conversations in order to respond to them.

We apply:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Role-based access control under the principle of least privilege: only the treating Professional and the Patient access the consultation data, unless legally required.
• Audit logs of access to clinical data.
• Notifications without clinical content: the notifications we send to your phone do not include the reason for consultation or health information, to prevent them from being visible on the lock screen. Details are only displayed within the application, after authentication.
• Access keys to third-party services managed exclusively on servers, never in client applications.

We are working to progressively align our measures with recognized standards (such as SOC 2 and ISO 27001) and will communicate certifications as they are obtained.

The main infrastructure is hosted on servers located in the United States, so your data may be transferred there and to the countries where our Local Entities and providers operate. Where the law of your country requires safeguards for international transfers (RGPD (GDPR), LGPD, Ley 21.719, among others), we apply the permitted mechanisms —standard contractual clauses, informed consent or others— and inform you thereof when collecting your data.

Account data are retained while the account is active and for the subsequent legal periods. Clinical records (EMR) are not deleted upon request while the legal retention period for medical records of the Patient's country is running, because Professionals are legally required to retain them. Indicative minimum periods (to be validated with local counsel):

Upon closure of an account, the EMRs are archived with restricted access until the legal period is fulfilled and are then securely deleted. The Patient retains the right to obtain a copy of their record.

Depending on the applicable law, you may request access, rectification, erasure, restriction, portability and objection, as well as withdraw your consent. The Platform allows you to download your data, rectify the data you provided and delete your account from your profile.

Exception: erasure does not apply to clinical records within the legal retention period (clause 6); in that case, the record remains archived with restricted access. Notes written by the Professional are not editable by the Patient; the Patient may request a clarification from the Professional.

To exercise your rights: support@cdoctorsteams.com. You may also file a complaint with the data protection authority of your country.

We have an internal incident management procedure that includes containment, assessment, internal logging and notification to the competent authority and to affected individuals when required by law, within the applicable deadlines: 72 hours under the RGPD (GDPR) (Spain), LGPD (Brazil) and Ley 21.719 (Chile, from its entry into force); without unreasonable delay and no later than 60 days under HIPAA (U.S., when the Clinical Features are active); and the deadlines of the other local laws.

We share data only with providers necessary to operate, under contract:

In the countries where local payment methods are enabled, the corresponding provider will be disclosed in this policy and on the payment receipt. Where the jurisdiction so requires (for example, HIPAA in the U.S.), such processing will operate under the corresponding BAA/DPA agreements before the Clinical Features are activated in that country.

We use cookies for functionality, security and aggregate analytics. You may manage them from your browser or from the available cookie notices.

The Platform is not directed to persons under 18 years of age and we do not collect data directly from them. The health data of a minor are only processed when their Responsible Adult provides them to manage a consultation, with the latter's consent and in accordance with the T&C.

Where the Clinical Features are enabled, the Platform allows booking four modalities: 24-hour consultation, scheduled online consultation, in-office consultation and home visit consultation. They are enabled on a country-by-country basis; the list of active countries is published on the Platform.

The Platform does not issue or manage prescriptions of any kind.

Limitations: telemedicine does not replace in-person care in emergencies, urgent situations or when a physical examination is required. In case of emergency, contact local emergency services (911 in the U.S., Canada, Mexico, Ecuador, El Salvador, Panama, Costa Rica, Paraguay and Uruguay; 123 in Colombia; 106/116 in Peru; 131 in Chile; 107 in Argentina; 192 in Brazil; 112 in Spain) and do not rely on the Platform.

Before each consultation, the Patient —or the Responsible Adult, if it is for a minor— grants their electronic informed consent, which explains the purpose of the consultation, the benefits and limitations of the chosen modality and the in-person alternatives. It is recorded and may be revoked at any time.

3.1. The transcription of the consultation and the AI draft note are optional and require the Patient's express consent for each consultation. Without such consent, the consultation is conducted without recording or transcription.

3.2. The AI-generated draft is always reviewed and edited by the Professional before being saved to the EMR. The AI does not diagnose or make decisions.

• Be duly licensed or registered in the jurisdiction where they provide care. In the U.S., the Professional must be licensed in the state where the Patient is located.
• Keep their credentials current and uploaded to the Platform.
• Comply with the ethical codes of their profession and local laws.
• Have an adequate connection and equipment for the online modalities.
• Not provide personalized clinical advice in public spaces of the Platform.

• Be over 18 years of age (minors, only through a Responsible Adult).
• Provide truthful information. The clinical information fields are optional: the Patient decides what to share, understanding that more information allows for better guidance.
• For online consultations: a compatible device, a stable connection (5 Mbps or more is recommended) and a private location.

In the in-office and home visit modalities, the Platform serves a scheduling and contact function. CDoctorsTeams does not participate in travel, does not supervise the place of care and is not liable for the safety of persons during the consultation. The address that the Patient indicates for a home visit consultation is shared only with the assigned Professional and solely for the purpose of providing care.

Appointments are booked on the Platform by indicating the reason for consultation, the modality and the payment method available for the Patient's country and that modality. The clinical data generated are stored in the EMR with the measures of Part I (clause 4) and the periods of Part I (clause 6). The payment and cancellation regime is governed by the T&C (clauses 9 and 10); in External Payments, the Platform does not intervene in the transaction.

CDoctorsTeams acts as a technology intermediary: it does not provide health services or guarantee uninterrupted availability. Professionals are responsible for the quality, suitability and legality of their services, and for indicating to the Patient when the chosen modality is not appropriate for their case. Patients are responsible for following the recommendations and seeking in-person care when so instructed.

• HIPAA/HITECH: when operating Clinical Features, CDoctorsTeams acts as a Business Associate of the Professionals and Clinics: it will enter into BAAs with them and will maintain BAAs with its subprocessors. The Clinical Features will only be activated in the U.S. once the BAA chain is complete.
• Telemedicine: state laws (in Florida, F.S. 456.47). The Professional must be licensed in the Patient's state.
• Electronic informed consent prior to each consultation.
• Since there is no prescription module, the restrictions on remote prescribing of controlled substances do not apply.

• Federal PIPEDA and provincial health data laws (PHIPA in Ontario, HIA in Alberta, among others). Quebec (Law 25) imposes additional requirements; the Clinical Features in Quebec will be activated at a later phase.
• The Professional must be licensed in the Patient's province.

• Ley Federal de Protección de Datos Personales en Posesión de los Particulares (2025), supervised by the Secretaría Anticorrupción y Buen Gobierno. Privacy notice in accordance with the new legal text.
• NOM-024-SSA3-2012 for electronic medical records and the Ley General de Salud.
• Verification of the professional license (cédula profesional).
• There is a Local Entity incorporated in Mexico, a joint controller of the processing and responsible for the verification of the country's professional Users.

• Ley 1581/2012 and implementing decrees: prior and express authorization for sensitive data; registration of databases with the SIC where applicable.
• Resolución 2654 de 2019 (telehealth); registration of Professionals in ReTHUS.
• Medical records in accordance with Resolución 839 de 2017.

• Ley 29733 de Protección de Datos Personales: express consent for sensitive data; registration of data banks with the ANPD where applicable.
• Ley 30421 (Ley Marco de Telesalud); Professionals registered with and authorized by their professional association.

See Chile Annex (Part IV).

• Ley 25.326 de Protección de los Datos Personales: express consent for health data; registration of databases with the AAIP.
• Telemedicine in accordance with current regulations; Professionals with a current license (matrícula) according to the Patient's jurisdiction. The electronic prescription regime does not apply: the Platform does not manage prescriptions.

• LGPD (Ley 13.709/2018): specific legal basis for sensitive data, appointment of an encarregado before activating Clinical Features, notification of incidents to the ANPD.
• Resolución CFM 2.314/2022: CRM registration of physicians and rules on first consultation and follow-up, which the Platform will reflect upon activating Brazil.
• Retention in accordance with Ley 13.787/2018.

• Ley Orgánica de Protección de Datos Personales (2021): express consent for sensitive data and appointment of a data protection delegate where applicable.
• Ley Orgánica de Salud and regulations of the Ministerio de Salud Pública: Professionals registered with the MSP; telemedicine oriented toward consultation, follow-up and education, not urgent care.

• Bolivia does not yet have a general personal data protection law (there are draft bills that have not been approved) nor a specific supervisory authority. Therefore, CDoctorsTeams applies in Bolivia the same standard of protection as in the other countries: express consent for health data, encryption in transit and at rest, access control and retention of medical records. If Bolivia enacts a data law, CDoctorsTeams will adapt its operations to it.
• Ley 3131 de ejercicio profesional médico: medical confidentiality and patient rights. Professionals must be registered with the Colegio Médico de Bolivia, which is verified by the Local Entity or the country partner.

• Ley de Protección de Datos Personales and local health regulations: Professionals registered with the Junta de Vigilancia de la Profesión Médica. To be confirmed with local counsel before activating the country.

• Ley 18.331 de Protección de Datos Personales (2008): a mature framework, with an active supervisory authority (URCDP) and recognition of an adequate level of protection by the European Union. Data transmitted and stored through telemedicine are expressly considered sensitive data under this law.
• Professionals must be authorized by the Ministerio de Salud Pública (MSP).
• Among the countries under evaluation for expansion, it has the most consolidated legal framework for telemedicine.

• Ley 81 de Protección de Datos Personales (2019), implemented by Decreto Ejecutivo 285 de 2021.
• Ley 203 de Telesalud (2021): requires confidential treatment of information in accordance with Ley 81; that is, it already expressly contemplates telemedicine within the data protection framework.
• Professionals must be qualified (idóneos) and registered with the Ministerio de Salud and the corresponding professional association.

• Ley 8968 de Protección de la Persona frente al Tratamiento de sus Datos Personales (2011), supervised by PRODHAB (Agencia de Protección de Datos de los Habitantes). It requires express, written informed consent for sensitive data, including health data.
• No specific telehealth law has been identified; the general personal data framework applies together with the health regulations of the Ministerio de Salud and the Colegio de Médicos y Cirujanos de Costa Rica.

• Ley 7.593/2025 de Protección de Datos Personales, enacted in November 2025 — the country's first comprehensive data protection law. It does not enter into force until November 2027, and the supervisory authority is being established during 2026. CDoctorsTeams will postpone the activation of Clinical Features in Paraguay until the law is in force and the supervisory authority is operational; in the meantime, if the country is enabled only as a social network and marketplace, it will apply the same data protection standard as in the rest of its operations.

• RGPD (GDPR) and LOPDGDD: before activating Spain, CDoctorsTeams will appoint a Data Protection Officer. If there is a Local Entity in the European Union, it will satisfy the representative requirement under article 27 of the RGPD (GDPR).
• Ley 41/2002 (patient autonomy): detailed informed consent and retention of medical records for at least 5 years.
• Professionals registered with the corresponding professional association (Colegio).

Until November 30, 2026, Ley 19.628 sobre Protección de la Vida Privada is in force. In accordance therewith:

• Health data are sensitive data and are only processed with the express consent of the data subject, which the Platform obtains separately and specifically when the Patient registers and before each consultation.
• The Patient is informed that their data are hosted on servers located in the United States and consents to such international transfer.
• Professionals who provide care in Chile must be registered in the Registro Nacional de Prestadores Individuales de Salud of the Superintendencia de Salud, which is verified upon their registration.
• Ley 20.584 (patients' rights and duties) and the MINSAL telemedicine standards apply: documented informed consent, a warning of unsuitability for emergencies and Patient access to their clinical file.
• The clinical file is retained in accordance with D.S. 41/2012 (15 years), in a secure archive with restricted access.

CDoctorsTeams will implement before that date:

• Procedure for breach notification within 72 hours to the Agencia de Protección de Datos Personales and to affected data subjects where applicable, with an internal incident log.
• Appointment of a data protection officer for the Chilean operation.
• Record of processing activities (data inventory, purposes, access, periods and international flows).
• Data subject rights workflows with the deadlines of the new law, applying the clinical file retention exception.
• Review of the lawful bases and update of the consent for sensitive data in accordance with the new standard.
• Review of the international transfer mechanisms in accordance with the new regime.

During the first 12 months that Ley 21.719 is in force, the sanctions regime provides for prior warnings for smaller companies on first infringements; this does not exempt them from compliance, and CDoctorsTeams maintains as its goal full compliance before the entry into force.