NEARMEDIC PLUS, Ltd.

Personal Data Processing

Policy

NEARMEDIC PLUS, Ltd. (hereinafter — the Company) respects the privacy of citizens and protects personal information it receives from them and processes. The purpose of this document is to familiarize citizens with the principles providing the basis for the Company’s personal data processing policy.

1. The company collects personal data of the following categories of persons:

- employees of the Company;

- close relatives of employees (spouses, children);

- candidates for employment;

- clients and patients of the Company;

- persons involved in civil contracts;

- end users of medical products (medicines and medical products) of the Company;

- medical researchers and external consultants involved in the preparation and conduct of clinical trials.

2. The Company collects personal information to achieve the following objectives:

- keeping records of the personnel of the Company in accordance with the Labor Code of the Russian Federation;

- performance of obligations under employment contracts;

- professional development of employees;

- verification of professional suitability of candidates for employment and employees of the Company;

- health insurance for employees;

- occupational health and safety;

- sending employees on business trips;

- performance of obligations under contracts with counterparties;

- calculation, allocation, and payment of wages, bonuses, compensations, insurance premiums and other types of payments;

- financial and economic activities;

- implementation of social policy of the Company;

- provision of medical services to the population, including high-tech, specialized, and emergency medical aid;

- interaction with medical insurance organizations;

- formulation of information messages to patients;

- maintenance of dispensary records;

- registration of temporary disability sheets, prescriptions, and other medical documents;

- issuance of assignments to citizens for medical and social examination;

- provision of monitoring of safe circulation of medicines and medical products;

- clinical and/or non-interventional studies;

- provision of paid medical services;

- expert activity of the Company (quality control of diagnostics and treatment);

- scientific activity of the Company;

- international activities of the Company;

- registration of applications for licenses for certain types of activities;

- ensuring compliance with Federal laws of the Russian Federation and other regulatory legal acts.

3. The company, depending on the purposes of processing, collects the following information related to personal data:

- name, surname;

- year of birth, month of birth, date of birth, place of birth;

- address (registration, actual);

- nationality;

- family composition;

- passport details;

- personal photo;

- sample signature;

- contact information;

- military registration information;

- information about the position, work experience, previously held positions, income, salary, vacations, sick leave, business trips, working hours of the Company’s employees;

- data on the labor activity of workers prior to admission to the organization, series and number of the work book;

- information about education (number of the document on education, specialty, academic degree, rank);

- individual taxpayer identification number (INN);

- insurance number of individual personal account (SNILS);

- information required to work with financial institutions and perform banking operations in the interests of employees of the Company and other persons subject to such banking operations;

- information on the state of health of the worker (degree of disability, data from sick-lists);

- information on the state of health, disability, medical history, laboratory data, examinations, diagnosis and prescribed treatment.

In all cases, when the Company receives and processes personal data of citizens, this is done only after obtaining their consent and permission or, in some cases, on the basis of the legislation of the Russian Federation.

4. The Company uses the obtained personal data as follows:

In all cases of processing of personal data of citizens, the Company is guided by the provisions of this policy and the legislation on the protection of human and civil rights. Any actions with the personal data received, whether it is processing of paper documents or processing with the use of automated systems, are performed by the Company’s personnel to achieve the goals described above.

The processed personal data may be transferred to the territory of other countries in cases involving Company’s employees on business trips or providing medical services to the Company’s clients in the territory of other States. Cross-border transfer of personal data is carried out with the consent of citizens in writing and in accordance with the requirements of the legislation of the Russian Federation on personal data, as well as legislation on the protection of personal information of the country to which the transfer is carried out, within the framework of this policy.

The state administration bodies of the Russian Federation, ministries, departments and territorial bodies may obtain access to the processed personal data only to the extent and for the purposes described in the legislation.

Should the Company need to entrust any third-party organizations with the processing of personal data, it shall be carried out only with the consent of citizens for such operation.

5. The Company protects the processed personal data in the following way:

The Company, with all gravity and responsibility, strives to address the issue of the protection of personal data processed. A responsible officer is appointed for that purpose, who oversees all issues related to the processing of personal data and the protection of citizens’ rights. The Company has developed a set of internal instructions describing all aspects of personal data processing and protection.

In order to protect personal data processed with the use of automated systems, measures are taken to exclude access of unauthorized persons to personal data, as well as their leakage, theft, or destruction, in accordance with the requirements of article 19 of the Federal Law «On Personal Data», as well as the requirements of by-laws describing the protective mechanisms in more detail.

The Company constantly monitors the security status of the processed personal data and improves the existing protection system.

6. Rights of citizens whose personal data are processed in the Company:

Citizens, whose personal data are processed by the Company, have the right (upon their personal appeal or upon sending a written request) to receive information concerning the processing of their personal data and containing as follows:

1) confirmation of the fact of personal data processing;

2) legal grounds and purposes of personal data processing;

3) purposes and methods of personal data processing;

4) the name and location of the Company, information about persons (except for employees of the Company) who have access to their personal data or to whom personal data may be disclosed;

5) specific types of personal data processed, the source of obtaining such data;

6) duration of processing, including the length of personal data storage;

7) information on the carried out or intended cross-border data transfer;

8) the name or surname, name, patronymic, and the address of the person/entity processing personal data on behalf of the Company, if the processing is or will be entrusted to such person/entity.

Citizens also have the right to demand from the Company renewal of the personal data being processed, their blocking or destruction if, in their opinion, they are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing.

Also, citizens can withdraw this consent to the processing of personal data. However, in some cases, the Company has all legal grounds to continue processing without violating the legal rights of citizens.

7. Citizens whose personal data is being processed at the Company, may turn for clarification or implementation of their rights to the following representatives of the Company:

1) On issues regarding protection of personal data of the clients and patients of the NEARMEDIC PLUS medical centers:

Head of the Medical Directorate

Nenyukov Alexander Kirillovich