PRIVACY AND PERSONAL DATA PROCESSING POLICY

1.1. This Privacy and Personal Data Processing Policy (hereinafter — the "Policy") defines the procedure for collecting, storing, processing, using, transferring, and protecting personal data of users of the ODOS AI digital platform (hereinafter — the "Platform"). 1.2. The Policy has been developed in accordance with: • the Civil Code of the Republic of Kazakhstan; • the Law of the Republic of Kazakhstan "On Personal Data and Their Protection"; • the Code of the Republic of Kazakhstan "On the Health of the People and the Healthcare System"; • other regulatory legal acts of the Republic of Kazakhstan. 1.3. Use of the Platform means that the User has read this Policy and consents to the processing of personal data in the manner established by law. 1.4. This Policy applies to all websites, software, mobile applications, and other digital services operating under the ODOS AI brand.

User — an individual using the Platform. Platform — the ODOS AI hardware and software complex intended for vision screening, data processing, and generation of analytical results. Personal data — information relating to an identified or identifiable personal data subject. Medical data — information about the User's health obtained in the course of using the Platform. Processing of personal data — actions aimed at collecting, recording, accumulating, storing, modifying, using, transferring, depersonalizing, blocking, and destroying personal data. Medical organization — a healthcare organization that uses the Platform to examine patients.

3.1. Depending on the model of medical service delivery, the operator of personal data may be the medical organization that examines the User. 3.2. ODOS Group LLP processes personal data to the extent necessary for the operation of the Platform and the provision of relevant digital services. 3.3. ODOS Group LLP takes the necessary organizational and technical measures to ensure the security of personal data.

The Platform may process the following categories of data: 4.1. Identification data: • surname, first name, patronymic; • date of birth; • individual identification number (if available); • internal patient identifier; • sex. 4.2. Contact data: • telephone number; • email address; • other contact details (if available). 4.3. Medical data: • vision screening results; • examination indicators; • images obtained during examination; • data analysis results; • preliminary disease risk assessment; • information on referral to a specialist. 4.4. Technical data: • IP address; • device and browser information; • cookie data; • user activity logs; • information on time of access to the Platform.

Personal data are processed for the following purposes: • conducting vision screening; • automated processing of medical data; • generating examination results; • providing results to healthcare professionals; • routing the patient to an appropriate specialist; • ensuring the operation of the Platform; • improving the quality of medical services; • maintaining statistical and analytical reporting; • ensuring information security; • compliance with the requirements of the legislation of the Republic of Kazakhstan.

6.1. Artificial intelligence technologies and machine learning algorithms are used in the operation of the Platform. 6.2. Results generated by the Platform: • are an automated analytical assessment; • are informational and auxiliary in nature; • are not a medical diagnosis; • do not replace a physician's consultation. 6.3. The final medical conclusion, diagnosis, and treatment decision are made exclusively by a healthcare professional. 6.4. The User is aware of the limitations of artificial intelligence technologies and agrees that automated results may require additional medical evaluation.

Personal data are processed on the basis of: • consent of the personal data subject; • the need to provide medical care; • fulfillment of obligations of medical organizations; • requirements of the legislation of the Republic of Kazakhstan; • other lawful grounds provided for by the legislation of the Republic of Kazakhstan.

8.1. Personal data may be transferred to: • healthcare professionals; • medical organizations; • government bodies of the Republic of Kazakhstan in cases provided for by law; • infrastructure service providers that ensure the operation of the Platform. 8.2. Personal data are not transferred to third parties for marketing or advertising purposes. 8.3. Data are transferred only to the extent necessary to achieve the purposes of processing.

9.1. Personal data are stored for the period necessary to achieve the purposes of processing, as well as for the periods established by the legislation of the Republic of Kazakhstan. 9.2. After the purposes of processing have been achieved or when grounds for processing cease to exist, personal data shall be destroyed or depersonalized, unless otherwise provided by law.

10.1. Organizational and technical security measures are applied to protect personal data, including: • access rights segregation; • user authentication; • activity logging; • backup; • encryption of data transmission channels; • protection of server infrastructure; • monitoring of information security incidents. 10.2. Access to personal data is granted only to authorized persons within the scope of their official duties.

11.1. Depersonalized data may be used for analytical, scientific, and statistical purposes. 11.2. Depersonalized data do not allow identification of a specific User.

The User has the right to: • receive information about the processing of their personal data; • request clarification or correction of data; • withdraw consent to the processing of personal data in cases provided for by law; • request deletion or blocking of data; • lodge complaints with authorized government bodies.

13.1. The parties bear liability in accordance with the legislation of the Republic of Kazakhstan. 13.2. The Platform is not liable for: • medical decisions made by physicians; • actions of third parties who gained access to data as a result of the User's violation of security rules; • interruptions in the operation of communication networks and other systems not controlled by ODOS Group LLP.

14.1. ODOS Group LLP may amend this Policy. 14.2. A new version of the Policy takes effect from the moment it is posted on the website, unless another date is specified additionally.

ODOS Group LLP Address: Shymkent, Dostyk microdistrict 2535 BIN: 250540013971 IIK: KZ04722S000048573587 BIC: CASPKZKA Bank: Kaspi Bank Phone: 8707 764 34 42 Email: info@odos.kz For questions regarding the processing of personal data, the User may contact us using the contact details above.