Duty to Inform on Data Processing BEST MERIDIAN INSURANCE COMPANY (hereinafter «BMI«), legal entity ID 3-012-622635, domiciled in San José, San Rafael de Escazú, Edificio BMI, across from Hospital CIMA (hereinafter «BMI», «we», «us» or «our»), is committed to protecting your privacy and ensuring a positive experience on our website and when using our products and services. This DATA USE AND PROTECTION POLICY describes our approach to privacy in order to comply with our obligations under applicable laws and regulations. By using our Site, you accept the terms of this DATA USE AND PROTECTION POLICY. BMI is responsible for processing the data collected from Users through this website at the time of the User's initial registration on the website, as well as any data subsequently provided by the User in connection with the development, fulfillment and monitoring of the use of this website. Accordingly, in accordance with the Law on the Protection of Individuals with Regard to the Processing of their Personal Data (Law No. 8968), BMI informs Users of the following regarding the handling of their Personal Data:

1. General Aspects

This consent to the processing of your personal data covers all personal data provided to BMI through this website. Your data will become part of BMI's database, will be safeguarded with the necessary security measures and will be used for the purposes detailed in this document. The database will be stored and processed by BMI through its Information Technology Department, inside or outside Costa Rica. Acceptance of this DATA USE AND PROTECTION POLICY is not mandatory, but failure to accept it would mean that BMI is unable to provide services through this website.

2. Information We Collect

In order to provide our services and run our website efficiently, we may collect, use, store and transfer a variety of personal information about you. This information is classified into several categories:

• Identity Information: This may include your first name, last name, username or other similar identifier, marital status, title, date of birth and gender. If required by the nature of the insurance product or service, we may also collect sensitive identity information such as health information or biometric data.
• Contact Information: This involves your physical address, which may include both billing and delivery addresses, email address and contact phone numbers. We use this information to communicate with you about your insurance policies, to send you notices or updates, and to provide customer service and support.
• Financial Information: We collect financial information such as your bank account details, payment card details and your insurance policy payment history. This information is necessary to manage your policy payments, process claims and reimbursements, and protect against fraudulent activity.
• Transaction Information: We keep records of your transactions with us, including details of the insurance products and services you have purchased from us, your payment history, claims history and any other interactions you have had with our products and services.
• Technical Information: This includes information such as your internet protocol (IP) address, your login credentials, your browser type and version, your time zone setting and location, the types and versions of browser plugins you use, your operating system and platform, and other technology on the devices you use to access our website. This information helps us ensure that our website works properly on different devices and systems and allows us to secure our site.
• Profile Information: This encompasses information related to your account with us, such as your username and password, purchases or orders you have made, your personal preferences, feedback you have provided to us and responses to surveys we have conducted. This information helps us understand your needs and preferences, improve our offerings and personalize our communications with you.
• Usage Information: We collect information about how you use our website, products and services, which helps us understand usage patterns, improve our website and develop new products and services.
• Marketing and Communications Information: This includes information about your preferences for receiving marketing communications from us and from our third-party partners, as well as your communication preferences. We use this information to personalize our marketing messages, measure the effectiveness of our promotional campaigns and ensure that you receive information that is relevant and interesting to you.

3. How We Use Your Information

We use the information we collect about you for a variety of purposes. Specifically, we use your information for:

• Provision of Services: We use your personal data to provide you with the insurance products and services you request or purchase from us. This includes using your data to process your insurance policy, manage your account, process claims and renewals, and manage your relationship with us. This processing is necessary for the performance of the contract to which you are a party or to take steps at your request before entering into a contract.
• Risk Assessment and Management: We use your personal data to assess your insurance needs, understand the risk associated with providing you with insurance, set appropriate premiums, and manage and mitigate risk. This processing is necessary for the performance of the contract to which you are a party or to take steps at your request before entering into a contract.
• Customer Support: We use your personal data to provide customer service and support, handle inquiries and complaints, and facilitate communication between you and us. This processing is based on our legitimate interest in providing quality customer service.
• Compliance and Legal Obligations: We use your personal data to comply with applicable legal obligations, including responding to legal processes or requests for information issued by government authorities or other third parties, fraud prevention, audits, compliance with regulatory reporting requirements, and data protection rights requests. This processing is necessary to comply with a legal obligation to which we are subject.
• Marketing: With your explicit consent or where we have a legitimate interest for business development purposes, we may use your contact details to provide you with information about our products and services, where permitted by law. This includes using your data to personalize and improve the relevance of our marketing messages, measure the effectiveness of our advertising, and send you survey and feedback requests. You have the right to opt out of the use of your personal data for marketing purposes at any time.

Please note that the specific purposes for which we process your personal data may vary depending on the legal basis for the processing. Before collecting your personal data, we will inform you whether the provision of your personal data is mandatory or voluntary and of the possible consequences, if any, of not providing your personal data.

4. Database Users and Transfer of Your Personal Data

DATABASE USERS: The database may be consulted by duly authorized BMI employees, BMI's providers, affiliates, subsidiaries or parent company, and the members of the Group to which BMI belongs (BMI Financial Group, INC), to whom the information may be transmitted or transferred and who are obligated to comply with the confidentiality and data protection policies. Additionally, the data may be shared, transmitted, delivered, transferred or disclosed, for the aforementioned purposes, to: i) The operators necessary for the fulfillment of rights and obligations arising from the contracts entered into with BMI, such as call centers, investigators, assistance companies, external attorneys and external physicians, among others; ii) The insurance intermediaries involved in the process of entering into, performing and terminating the insurance contract; and iii) The persons with whom BMI carries out dealings for the purpose of entering into Coinsurance or Reinsurance contracts. We may have to share your personal data with internal third parties, external third parties and specific third parties. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specific purposes and in accordance with our instructions.

5. International Transfers

In the course of our operations, we may need to transfer your personal information beyond the borders of Costa Rica in order to fulfill the purposes for which this data is processed. This may occur when our servers, suppliers or service providers are located in different countries. When we make international transfers of your personal information, we ensure that these transfers are subject to adequate protections and take all necessary measures to ensure that your personal information is treated securely and in accordance with this DATA USE AND PROTECTION POLICY and applicable data protection laws. By using our services and submitting your personal information, you consent to the transfer, storage and processing of your personal information in accordance with this DATA USE AND PROTECTION POLICY.

6. Data Security

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized manner, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

7. Rights of revocation, rectification, deletion and informational self-determination

To exercise your rights of revocation, rectification, deletion and informational self-determination, you may use the email address recepcionbmicr@bmicos.com, the phone number 2228-6069, or go directly to the BMI – Costa Rica Offices located in San José, Escazú, San Rafael, Edificio BMI. In cases where the data subject requests the deletion of all or part of their personal information and such information is essential for the proper operation of the services provided through the website, BMI will process the request on the understanding that the website's features will stop working for the User.

8. Data Retention

Our retention of your personal information is determined by the need for its use and the fulfillment of the purposes described in this policy. Therefore, we will retain your personal information for as long as your account remains active, or for as long as necessary to provide you with our services. In addition to the provision of services, there may be legal, contractual or legitimate business requirements that necessitate the long-term retention of your personal information. For example, laws or regulations may require us to retain certain types of information for a set period in order to comply with legal or regulatory requirements, prevent illegal activities, resolve disputes or enforce our terms and conditions. When the aforementioned requirements cease, we will take appropriate measures to delete, anonymize or de-identify your personal information, unless there is a legal requirement or legitimate business reason for us to retain it in an identifiable format. Please note that if you request that your information be deleted, we may still need to retain some necessary information for a period of time in order to comply with any legal obligations we may have and to resolve disputes. In all cases, our retention of your personal information will be carried out in compliance with our data retention policies and applicable laws.

9. Changes to this DATA USE AND PROTECTION POLICY

We may update this DATA USE AND PROTECTION POLICY from time to time in response to legal, technical or business changes. When we update our DATA USE AND PROTECTION POLICY, we will take appropriate measures to inform you, in accordance with the significance of the changes we make.

10. Consent to the management and use of your personal data

In view of the above, whoever freely accepts this DATA USE AND PROTECTION POLICY declares that they authorize BMI and BMI Financial Group, INC to:

1. Store and process the personal data provided through the Website in their national or international personal database, as provided for by Law No. 8968, especially data relating to health and biomedical data.
2. Verify their personal data in public or private, national and international information sources, and store such data in a database.
3. Transfer the data collected in their databases to their Providers for the provision of the services described on this website. This transfer may be made to both their national and international databases.
4. I further declare that, in accordance with the Law on the Protection of Individuals with Regard to the Processing of their Personal Data (Law No. 8968), I have been informed of what is set forth herein regarding the handling of my Personal Data.
5. Accordingly, by accepting this DATA USE AND PROTECTION POLICY, I authorize BMI to access, process and collect my personal data under the terms indicated.
6. Contact Information

If you have any questions or concerns about this DATA USE AND PROTECTION POLICY, please contact us using the following details: Address: San José, San Rafael de Escazú, Edificio BMI, frente al Hospital CIMA Phone: 2228-6069 Email: recepcionbmicr@bmicos.com By using our site, you confirm that you accept the terms of this DATA USE AND PROTECTION POLICY and agree to comply with them. If you do not agree with this DATA USE AND PROTECTION POLICY, you must not use our Site.