Privacy and Personal Data Processing Policy

TERAL website, platforms, applications and integrations

1. Identification and channels

TERAL S.A.S., Tax ID (NIT) 901.616.741-2, with its principal domicile in Medellín, Antioquia, Colombia, acts as controller when it determines the purposes and essential means of processing. Address for notices: Cra 43F #10-38, Manila, El Poblado, Medellín, Antioquia, Colombia. For inquiries, complaints and the exercise of rights: Primary: alan@teral.ai. Alternate: teralai@teralmed.co. Contact phone: +57 300 467 8602. The officer responsible for handling data protection requests is David Alberto Calderón Duarte, with intake and coordination through the channels indicated.

Where TERAL processes information on behalf of a healthcare provider, insurer, clinic, hospital, health professional or other client that determines the clinical or institutional purpose, TERAL will act as processor under the terms of the applicable agreement, data transmission agreement or DPA. This classification depends on the actual flow and not on the name the parties give the document.

2. Scope and supplementary documents

This Policy applies to the teral.ai/es website, forms, commercial and support channels, user accounts, web and mobile applications, administrative modules, demonstrations, pilots, integrations with information systems, artificial intelligence services, APIs and any other TERAL operation involving personal data.

For processing carried out on behalf of an institutional client, the controller's lawful and documented instructions, the DPA, the security annex and the corresponding agreement will prevail for that flow. This Policy does not replace the data subject's authorization, clinical informed consent, the client's privacy notice or the obligations of the custodian of the medical record.

3. Key definitions

• Personal data: information linked to or capable of being associated with a specific or identifiable natural person.
• Sensitive data and health data: information whose misuse may affect privacy or lead to discrimination; it includes history, diagnoses, treatments, images, notes, results and other clinical information.
• Controller: the party that decides on the purpose and essential means of processing. Processor: the party that processes data on behalf of and under the instructions of the controller.
• Transfer: delivery of data to another controller. Transmission: communication of data to a processor so that it processes them on behalf of the controller.
• Pseudonymization: separation of identifiers under additional controls, without removing the data's status as personal data. Anonymization: transformation that reasonably prevents identification on an irreversible basis.
• Sub-processor: a provider engaged by a processor to support authorized processing.
• Platform: the set of applications, modules, infrastructure, integrations, interfaces and technology services operated or provided by TERAL.

4. Processing principles

TERAL will apply the principles of lawfulness, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality. It will also apply criteria of minimization, necessity, proportionality, privacy by design and demonstrated accountability according to the sensitivity and risk of each flow.

5. Data subjects and categories of data

Data subjects may be health professionals, institutional administrators, patients, client representatives, website visitors, commercial contacts, employees, candidates, contractors, suppliers and other persons connected with TERAL's operation.

• Identification and contact: name, identity document, signature or signature image, email, telephone, city, country, position and institution.
• Professional credentials: profession, specialty, RETHUS registry, professional license, diplomas, experience and supporting evidence of competence.
• Account and security: protected credentials, roles, permissions, IP address, device, browser, tokens, access logs and audit records.
• Use and support: modules used, cases, comments, messages, events, timings, tickets, technical evidence and communications.
• Contractual, commercial, tax, employment and supplier data necessary for the corresponding relationship.
• Clinical information: history, diagnoses, photographs, medical images, videos, audio, PDFs, notes, consults, opinions and results where the flow is authorized.
• Browsing: identifiers, preferences, analytics, approximate location, pages visited and traffic source, according to the inventory of cookies and similar technologies.

6. Sources and methods of collecting information

TERAL may receive data directly from the data subject; from an authorized client or user; from permitted public sources; or through integrations activated and documented for a project. The identified methods are set out below; their inclusion does not mean that all of them are deployed for every client:

• Medical Bridge or browser extension: solution available for configuration on a per-project basis, with no active clinical integration as of this version. On deployment, the fields must be validated, the de-identification rules provided in the browser must be applied before transmitting information, and the actual outcome of the flow must be tested.
• Native integration with an electronic health record system: solution that can be enabled, subject to adaptation, on a per-project basis through a signed payload, patient and case identifiers, encoded files, client credentials, API key/secret or JWT, webhooks and UUID traceability. There is no active clinical integration as of this version; the technical document is a specification and does not evidence production deployment.
• Desktop application: may process screenshots or clipboard content under the user's action and permissions. Screenshots and images may contain identifiers. TERAL reported that detection and removal of embedded text through OCR is not implemented; it must not be assumed that the control applied to text covers those images.
• Corporate integration through API, GraphQL, VPN or other authenticated channels agreed with the client.

The existence of redaction, pseudonymization or visual masking does not mean that all data are anonymous. Images, documents and screenshots may contain visible or embedded identifiers, metadata or text. The client and TERAL must validate the actual flow, the fields processed, the permissions, the logs and the exact point at which each control operates.

Clinical integrations are activated per project, subject to validation of their fields, permissions, authentication, logs, retention, incidents and testing. For the text flow described, AWS Comprehend and internal rules operate before inference in Bedrock/Claude or Vertex/Gemini. This sequence does not automatically cover images: images may reach Gemini with identifiable text as long as no effective prior control exists. No anonymization or prior control of that flow is presumed.

7. Sensitive data, health data and authorization

The data subject is not required to authorize the processing of sensitive data and will be informed that doing so is optional, except where a legal exception applies. Where TERAL acts as controller and the processing requires authorization, it will obtain prior, express, informed and verifiable authorization, specific to the corresponding purposes and sensitive categories.

Where it must obtain authorization, TERAL will use physical or electronic forms or other verifiable means that evidence the data subject's will; silence does not constitute authorization. It will retain evidence of the text accepted, the identity and the date of acceptance, with restricted access, for as long as the authorized processing and the applicable legal or defense obligations subsist. The data subject may request a copy through the channels in section 1.

Where a client or professional uploads clinical information and TERAL acts as processor, the controller must evidence the authorization or the applicable legal exception, inform the data subject and document its instructions. Acceptance of this Policy or of the Terms of Service does not by itself replace express authorization to process health data or clinical informed consent.

TERAL has no proprietary models and conducts internal comparative AI testing solely with synthetic or effectively anonymous data. Neither this Policy nor the processing mandate authorizes reusing clinical personal data for TERAL's own purposes. Any change will require prior legal review, information and applicable legal basis, as well as documented controls.

8. TERAL's role by flow

Allocation is made by purpose and actual flow. TERAL may be Controller of its administrative operations and, at the same time, Processor of clinical information handled on behalf of a client or professional. Where Teral Incorporated engages technology providers, this must be documented in the contractual chain, but that function does not automatically make it Controller of the clinical purpose.

9. Purposes

• Create, administer, authenticate, verify and protect accounts, roles and permissions.
• Operate the contracted functions of communication, case management, consults, traceability, administration, integration and support.
• Verify identity and professional credentials where applicable, without turning that review into a guarantee of clinical competence.
• Provide support; handle requests, incidents, security, audit, fraud prevention and continuity.
• Administer contractual, commercial, billing, tax, supplier, human resources and legal compliance relationships.
• Generate operational metrics and analytics with minimized, aggregated, anonymized or pseudonymized data according to the risk and applicable role.
• Send operational, legal, security and service communications; and commercial communications where authorization or a legal basis exists.
• Comply with the controller's lawful instructions where TERAL acts as processor.

TERAL will not sell personal data and will not use clinical information for behavioral advertising. Nor does it authorize its providers to train or fine-tune models with service data. Inference to provide the service and internal testing are distinct purposes; the latter are subject to the rule in section 7.

10. Artificial intelligence, analytics and decision support

The Platform may offer classification, search, summarization, draft generation, consistency auditing, conversational assistance or information retrieval through artificial intelligence models. These functions support the operation and do not replace clinical judgment, human review or the responsibility of the professional or care entity.

• Outputs may contain errors, omissions, bias or inadequate inferences and must be verified before being incorporated into a decision or record.
• TERAL will apply minimization, access control, traceability, risk assessment and redaction or pseudonymization measures appropriate to the flow.
• TERAL reports logical separation between clients and admission to RAG only of approved sources. Documents, corpora, vectors and indexes will retain the purpose, access, retention and deletion rules of their sources. This separation is not an absolute guarantee and does not authorize sharing information between clients.
• Processing for inference does not by itself imply anonymization. In particular, an image may transmit identifiable text to Gemini as long as no effective prior control exists. That use of identifiable images must not be enabled without the appropriate technical measures and legal basis.
• TERAL will document material changes of provider, model, region, purpose or data category and will assess whether they require updating notices, agreements or authorizations.

10.1. AI-assisted auditing

TERAL may classify, organize and cross-check information using rules and criteria defined for each service, and generate observations, alerts or recommendations for human review. These functions may support the review of documentation, billing, procedures or medical prescriptions. Their outputs do not by themselves constitute a finding of fraud or a final decision on care, dispensing, coverage or payment. Recommendations are not binding. The final decision rests with the competent person, who must review the output and may accept or disregard it according to their professional judgment and the applicable rules. The scope, the authorized data, the rules and the responsibilities will be established for each project.

11. Children and adolescents

TERAL does not direct its services to minors. If an authorized care flow includes a minor's data, the controller must verify the legal basis, the corresponding representation and respect for the minor's best interests and prevailing rights. TERAL will apply restricted access and enhanced security measures.

12. Recipients, sub-processors and international flows

TERAL may grant access to authorized personnel, clients, professionals, technology providers, advisors and authorities, solely according to purpose, role and need. Where a provider processes data on behalf of TERAL or of a client, it must be bound by obligations of confidentiality, security, instructions, deletion, audit and incidents.

As of this version, the services reported as active in production are Amazon Web Services —including Comprehend and Bedrock with Claude Haiku/Sonnet models— in United States regions; Google Cloud Vertex AI/Gemini, mainly in us-central1 or global scope; and MongoDB Atlas hosted in the United States. Direct connections with Anthropic and OpenAI are configured but not active in production. The TERAL entity that procures certain services is Teral Incorporated; this does not replace the contractual identification of the provider nor does it by itself define each participant's role.

TERAL may carry out international transmissions to infrastructure, database and artificial intelligence providers located in the United States. For each flow, the controller, TERAL S.A.S., Teral Incorporated and each provider or sub-processor must be documented, together with the instructions, DPA, region and applicable measures. If a third party determines its own purposes and receives data as a controller, the flow will be treated as a transfer and the applicable legal mechanism will be verified before sending. Agreements or model clauses do not replace the legal requirements of a transfer.

13. Security, confidentiality and incidents

TERAL will adopt technical, human, administrative and contractual measures that are reasonable and proportionate to the risk, including identity and access management, encryption where applicable, segmentation, logging, monitoring, backup, testing and vulnerability management. No measure completely eliminates risk, and this Policy does not constitute an unconditional guarantee of security, availability or absence of incidents.

In the event of an actual or suspected incident, TERAL will activate its procedure for analysis, containment, preservation of evidence, remediation and notification. Where it acts as processor, it will inform the controller without undue delay in accordance with the agreement. Notifications to data subjects or authorities will be made by the party under the obligation, within the applicable deadlines and conditions.

14. Retention, deletion and backup copies

TERAL will retain data for as long as necessary for the purposes reported, the controller's lawful instructions and the applicable legal or defense obligations. The term of the agreement does not justify retaining unnecessary data nor does it prevent processing a well-founded deletion request.

• TERAL currently retains client documents for the term of the agreement, with no automatic purge by age and no per-institution retention configuration deployed. This describes the technical status reported; it does not authorize unlimited retention and does not replace the applicable purposes, lawful instructions and legal duties. The earlier reference to two years in high availability describes a storage tier, not an implemented deletion period or the legal term for medical records.
• Administrative categories —accounts, support, billing, security and audit— will be retained for as long as necessary for their purposes and to comply with the applicable legal, contractual or defense obligations. At the end of that period, they will be effectively deleted or anonymized, except where justified legal retention applies. The data subject may consult the criteria applicable to their data through the channels in section 1.
• Where applicable and where deletion of a case is carried out, TERAL reports that it is removed from active environments and does not remain embedded in RAG indexes. Deletion or unlinking of derivatives, caches and other active copies must be verified. This capability is not equivalent to a periodic purge by age.
• After deletion from the active environment, emergency copies may persist until the next backup cycle, of thirty (30) days. They must be kept restricted, outside ordinary use and subject to the measures needed to avoid reintroducing deleted information upon restoration.
• On termination of the service, the controller and TERAL must carry out the return, export, legal retention and deletion that apply. The custodian's obligation to retain the medical record is not to be confused with TERAL's retention of a technical copy. Pseudonymization does not extinguish the data subject's rights.

15. Data subject rights

• Access, update and rectify their data.
• Request evidence of the authorization, except where a legal exception applies.
• Be informed about the use made of their data.
• File complaints with the Superintendence of Industry and Commerce once the inquiry or complaint procedure has been exhausted.
• Revoke the authorization or request deletion where applicable and where no legal or contractual duty to retain exists.
• Access free of charge the data processed, on the terms provided by law.
• Request understandable information about the use of artificial intelligence that materially affects their processing, within the applicable technical, legal and security limits.

16. Inquiries and complaints

Requests may be submitted through the email addresses or the address for notices in section 1. They must identify the data subject or their representative, describe the request and the relevant facts, indicate a channel for a response and attach the documents the requester wishes to rely on. Inquiries will be addressed within a maximum of ten (10) business days from receipt; if this is not possible, the reason and the new date will be communicated, which will not exceed five (5) business days after expiry of the initial term.

Complaints will be addressed within a maximum of fifteen (15) business days from the day following receipt. If the complaint is incomplete, a request to cure will be issued within five (5) days of receipt; if two (2) months elapse from the date of that request without the information being provided, the complaint will be deemed withdrawn. Where it is not possible to resolve within the initial term, the reason and the new date will be communicated, which will not exceed eight (8) business days after expiry of that term.

TERAL will verify the identity and, where applicable, the representation of the requester, requiring only the information necessary to process the request. It will record the request, forward it to the competent area and respond through the channel indicated. Upon receipt of a complete complaint, it will add to the database the annotation «complaint in process» and its reason within the following two (2) business days, maintaining it until resolution. Extensions will be communicated before expiry of the initial term.

If the request concerns data processed exclusively as processor, TERAL will forward it to the competent controller and will cooperate in accordance with the DPA. Where it is not competent to resolve a complaint, it will refer it to the appropriate party within a maximum of two (2) business days and will inform the requester.

17. Cookies and similar technologies

The website and the applications use or may enable functional, preference, analytics and marketing technologies. Google Analytics has been identified on public pages, and Meta Pixel and Microsoft Clarity on the application sign-in page. Non-necessary technologies require a valid choice by the user before being activated, together with mechanisms to reject or withdraw that choice. Where those controls are not in place, such technologies must remain disabled. Publication of this Policy does not by itself constitute consent to those technologies. The inventory and applicable options will be detailed in the Cookie Policy and in the website's configuration mechanisms; they may also be consulted through the channels in section 1.

18. Duties of users and clients

• Upload only lawful, relevant and necessary data, with sufficient authorization or legal basis.
• Administer users, roles, permissions and access terminations; protect credentials and report incidents.
• Do not include unnecessary identifiers in text, images, screenshots or documents, and do not assume that an image has been anonymized because a face has been masked.
• Maintain the care relationship, act as custodian of the medical record and make the clinical decision where those functions correspond to the client or professional.
• Do not reuse data or outputs for incompatible purposes, re-identification, advertising or external AI training.

19. Changes, versions and evidence

TERAL will publish the version and effective date of this Policy and will retain evidence of previous versions. It will inform data subjects of substantial changes in a timely manner before applying them and will obtain a new authorization where applicable. This includes material changes in purposes, sensitive categories, providers, regions, roles or AI uses.

Evidence of acceptance or acknowledgment may include the version or hash of the text, the identity or account, the date, time and time zone, the IP address or session, the channel and the acceptance event. That evidence does not turn a general acceptance into a valid authorization for sensitive purposes that were not disclosed.

20. Effective date

This version 2.7, dated October 1, 2026, takes effect upon its publication on TERAL's website and supersedes the previous policy, without retroactive effect. The effective date of publication will be indicated alongside the text on the website. The validity of the databases and the retention of each category are governed by the criteria in section 14 and the applicable obligations. TERAL will retain evidence of the published version.