1. Introduction and scope

Ki Connect is a product operated by Ki Planner S.A.S. (hereinafter, “Ki” or “the Company”), a Colombian company identified with tax ID (NIT) 901.753.233-9, domiciled at Carrera 17 No. 2 sur – 10, Medellín, Antioquia, Colombia.

Ki Connect is a cloud software platform that allows clinics, offices, spas, gyms, beauty centers and similar businesses (hereinafter, each, the “Client”) to manage their schedule, their end users, their billing and their operational communications. When the Client provides health services, Ki Connect also allows managing exams and results. Ki processes the personal data of end users on behalf of and under the instructions of each Client, and in the exams module it processes data that the end user manages and controls directly.

This Policy applies specifically to Ki Connect and is independent from the policies of other Ki products, including Ki Medicamentos (price comparison) and Ki Conversations (appointment confirmation via WhatsApp).

By using Ki Connect —as a contracting establishment, as an administrative user of an establishment, or as an end user managing their exams— you acknowledge that this Policy constitutes a binding framework for the processing of personal data within the platform.

2. Applicable legal framework

Ki Connect complies with the Colombian regulations in force regarding the protection of personal data, including:

• The Political Constitution of Colombia of 1991, articles 15 and 20.
• Law 1581 of 2012 and its implementing decrees (Decrees 1377 of 2013, 886 of 2014 and 1074 of 2015), and the rules that amend, add to or replace them.
• Law 1266 of 2008, on habeas data.
• Statutory Law 1751 of 2015 and other sector-specific provisions applicable to the handling of health information, when the Client provides health services.

3. Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

• Data Subject: a natural person whose personal data is subject to processing. In Ki Connect, Data Subjects are mainly the end users of the Client establishments, and also the staff of such establishments.
• Client: a clinic, office, spa, gym, beauty center, independent professional or similar business that contracts Ki Connect and acts as Data Controller with respect to the data of its end users.
• End User: a natural person served by the Client (patient, customer or member, depending on the establishment’s activity), or a user of the Ki Connect exams module.
• Client’s Staff: administrators, coordinators, receptionists, specialists and professionals of the Client who use the platform.
• Data Controller: the party that decides on the database and the processing. In Ki Connect, each Client is the Controller with respect to the data of its end users, except in the exams module where Ki acts as Controller.
• Data Processor: the party that processes personal data on behalf of the Controller. Ki acts as Processor with respect to the data managed by the Client.
• Sub-processor: a third party to which Ki delegates part of the processing (for example, technology infrastructure providers).
• Sensitive Data: data related to racial or ethnic origin, political or religious beliefs, sexual life, biometric data or health data.
• Health Data: a subcategory of Sensitive Data that includes exams, laboratory results and other information relating to the Data Subject’s health status, processed when the Client provides health services.

4. Ki’s role in the processing

Ki’s role depends on the type of data and on who decides on its processing:

4.1. Ki as Processor (data managed by the Client)

With respect to the end-user data that the Client records and administers on the platform (identification, contact, appointments and communications), the Client is the Controller and Ki acts as Processor. Ki processes this data following the Client’s instructions and only for the contracted purposes. In this capacity, Ki:

• Processes the data solely in accordance with the Client’s instructions and, in any case, respecting the data-processing policy the Client has implemented.
• Maintains the confidentiality, integrity and availability of the data through appropriate technical and organizational measures.
• Does not use end-user data for purposes other than providing the service.
• Does not transfer, assign or commercialize end-user data to third parties, except for the sub-processors identified in this Policy.
• Cooperates with the Client in handling Data Subjects’ rights requests.
• Notifies the Client of any security incident that compromises its end users’ data.
• Returns or deletes the data upon termination of the contractual relationship, in accordance with the retention section.

4.2. Ki as Controller (exams module controlled by the end user)

In the exams module, available when the Client provides health services, the end user may create their own account, upload their exams, own them and decide with which professionals or establishments to share them. In that flow the end user directly accepts this Policy and expressly grants Ki their consent to process their data. With respect to that data, Ki acts as Data Controller and maintains a direct relationship with the end user as the data subject. Exams may be uploaded by the end user themselves or by the Client’s staff; in all cases, the end user owns their exams and controls with whom they are shared.

5. Personal data processed

Ki Connect processes the following categories of personal data, depending on the contracted module and the Client’s activity:

• End-user identification and contact: name, identity document, date of birth, gender, phone, email, address and insurance where applicable, as well as the authorized notification channels.
• Appointment or session data: date, location, service, specialist, notes, appointment status and payment status.
• Clinical data (only in health establishments): exam files and laboratory results, records of whom the end user shares them with and, when the user so authorizes.
• Client’s Staff data: identification and contact, encrypted password, role, locations and access logs.
• Client (establishment) data: identification and contact, type of business, owner and active modules.
• Financial and billing data: plan and subscription, payment methods tokenized by the payment gateway (Ki does not store the full card number) and transaction records.
• Consent and audit: records of the consents granted and an audit log of sensitive actions.
• Technical metadata: internal identifiers, timestamps and error traces, without identifiable end-user data.

6. Purposes of the processing

The personal data processed by Ki Connect is used for the following purposes:

• Manage the Client’s schedule and appointments and uniquely identify each end user.
• Send confirmations, reminders and operational communications to end users through the authorized channels.
• Store and organize the end user’s exams and results, where applicable.
• Allow the end user to share their exams in a controlled manner with the professionals or establishments they previously authorize.
• Automatically download the end user’s exams from third-party portals, when the user so authorizes and provides their credentials.
• Manage the billing and collection of the Client’s subscription.
• Generate operational statistics for the Client (occupancy, communication effectiveness, among others).
• Comply with legal, contractual and regulatory obligations, including those specific to the Client’s field of activity.
• Handle inquiries, complaints and claims related to data processing.

Ki does not use end-user data for its own advertising, commercial or marketing purposes. Ki does not sell, rent or commercialize personal data under any circumstances.

7. Consent and traceability

Consent is obtained and recorded according to the type of data:

• For data managed by the Client, the Client obtains authorization from its end users and warrants its existence to Ki.
• For the exams module, the end user grants their consent directly to Ki upon creating their account and accepting this Policy, and again each time they share an exam or authorize the storage of credentials.

Each consent is associated with the version of the Policy in force at that time. When the Policy changes materially, Ki may request consent again for the new version.

8. Sub-processors and international transfers

8.1. Sub-processors

Ki relies on technology providers acting as sub-processors, according to their function: cloud compute and application infrastructure, managed database, secure file storage, messaging (WhatsApp Business, when the Client uses this channel), payment gateway and transactional email. Each provider operates under its own terms of service and data-processing agreement, which offer guarantees equivalent to those required by Colombian law. The list of current providers is available upon request.

Ki only selects sub-processors that offer contractual and technical guarantees equivalent to those required by Colombian law and that adopt internationally recognized information-security standards. If sub-processors change in the future, the new ones will meet the same confidentiality characteristics.

8.2. International transfers

Some personal data is processed outside Colombia, mainly in the United States of America. These transfers are carried out under:

• The contractual terms and data-processing agreements (DPAs) of each provider, which offer levels of protection equivalent to those required by Law 1581 of 2012.
• The authorization granted by the Client in the data agreement, and by the end user where applicable.
• Technical security measures that protect the data during transfer and storage.

9. Information security

Ki implements technical, administrative and organizational measures to protect the data against alteration, loss, and unauthorized or fraudulent access, use or consultation. These include:

• Encryption of data in transit using TLS protocols.
• Encryption at rest of credentials and sensitive data.
• Logical data isolation per Client: each user accesses only the data of their own establishment.
• Role-based access controls.
• Granular access control over exams: the end user decides who can view them and may revoke access.
• An immutable audit log of sensitive actions.
• Security incident response procedures.
• Training of the Ki team on the responsible handling of personal data.

No system can guarantee absolute security. If Ki becomes aware of an incident affecting data managed by a Client, it will notify the relevant Client without undue delay; the Client, as Controller, will assess notification to Data Subjects and to the Superintendence of Industry and Commerce.

10. Data retention

Ki applies the following retention periods, unless a legal, contractual or competent-authority requirement demands a different term:

• Exams and clinical results: retained while the end user maintains their account or the Client maintains its relationship with Ki; deleted upon account closure or at the Data Subject’s request, unless a legal obligation provides otherwise.
• Appointment data: for the term of the contract with the Client, plus five (5) years after its termination.
• Content and metadata of communications (WhatsApp, SMS, email): twenty-four (24) months from the last interaction, after which they are deleted or anonymized.
• Client’s Staff data: for the term of the relationship, plus one (1) year after account deactivation.
• Financial and billing data: for the term required by Colombian tax and commercial obligations.
• Third-party portal credentials: deleted when the end user revokes them or closes their account.
• Audit log: retained for an extended period given its role as legal traceability.
• Aggregated or anonymized data: no retention limit, as it does not constitute personal data.

Upon termination of the relationship with a Client, Ki will deliver the end-user data it requests in a structured format and, once delivery is confirmed, will proceed to delete it from active systems within the periods indicated.

11. Rights of Data Subjects

Data Subjects have the following rights, in accordance with Law 1581 of 2012:

• Know, update and rectify their personal data.
• Request proof of the authorization granted.
• Be informed about the use given to their data.
• File complaints before the Superintendence of Industry and Commerce.
• Revoke the authorization and request deletion of their data, where applicable.
• Access their personal data free of charge.

11.1. How to exercise your rights

• For data managed by the Client, the request should preferably be addressed to the establishment where the end user is served, as it is the Data Controller.
• For the exams module, the end user may contact Ki directly.
• In any case, Data Subjects may write to soporte@kiplanner.com. Ki will handle or route the request to the relevant Client.

Requests must include the Data Subject’s full name, an identity-verification mechanism, the establishment where they are or were served (if applicable), a description of the request, and contact details for the response. The timelines are those of Law 1581 of 2012: up to ten (10) business days for inquiries and up to fifteen (15) business days for claims, extendable once for an equal period.

12. Processing of sensitive health data

When the Client provides health services, Ki Connect processes health data through the exams module. This data includes exam files and laboratory results, and receives reinforced protection:

• Its processing is based on the prior, express and informed consent of the end user.
• Access is restricted and controlled by the end user, who decides with which professionals or establishments to share each exam and may revoke access at any time.
• Every action on this data is recorded in an immutable audit log.
• The end user may refrain from providing sensitive data; it is noted that providing it is optional.

Outside the exams module, the only health-related information Ki processes is the specialty or type of service associated with an appointment, necessary for its management. In establishments that do not provide health services (for example, spas, gyms or beauty centers), Ki does not process health data, unless the Client decides to record it on its own in the custom fields, in which case the Client is responsible for having the corresponding prior authorization.

13. Minors

Ki recognizes and respects the prevailing rights of children and adolescents. When an end user is a minor:

• Authorization to process their data must be granted by their legal representatives.
• The Client, as Controller, warrants that this authorization was previously obtained.
• In the exams module, the account and sharing decisions correspond to the minor’s legal representative.

14. Cookies and similar technologies

The Ki Connect web platform uses technical and session cookies strictly necessary for its operation, including user authentication and session persistence. Ki does not use advertising or profiling cookies for commercial purposes in Ki Connect.

15. Changes to this Policy

Ki reserves the right to modify this Policy at any time. Material changes will be communicated to Clients at least fifteen (15) business days before they take effect, through the usual channels and by publication on the Ki Connect legal pages. When a material change affects end users who manage their exams, Ki may request their consent again. Clients are responsible for communicating to their end users the relevant changes that affect the processing of their data.

16. Contact and handling of requests

For any inquiry, request, complaint or claim related to the processing of personal data in Ki Connect, Data Subjects, Clients and interested third parties may contact:

17. Term and governing law

This Policy takes effect as of July 30, 2026. The databases containing Data Subjects’ information have the term determined by the retention periods in section 10, extendable while a legal or contractual obligation subsists.

This Policy is governed by the laws of the Republic of Colombia. In the event of any dispute related to its interpretation, performance or termination, the parties shall first exhaust a direct-settlement stage for a term of thirty (30) calendar days, counted from the date on which one party notifies the other in writing of the existence of the dispute. During this period, they may resort to dispute-resolution mechanisms provided by law, such as conciliation. If no agreement is reached upon expiration of that term, either party may submit the dispute to the courts of the Republic of Colombia.