Privacy Notice

1. Who we are

Aivital Health Capital Inc. ("Aivital," "we," "us") is a corporation incorporated in the State of Delaware, United States. We are responsible for the personal information collected through aivitalhealthcapital.com (the "Site"). For purposes of Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), Aivital is the party responsible (responsable) for your personal data.

2. Scope

This Privacy Notice explains how we handle personal information collected through the Site, including the investor information request form, and through emails you send to addresses shown on the Site. It does not cover the identity verification (KYC/AML) or subscription process for any investment. If you move forward with that process, you will receive a separate privacy notice that describes the additional information collected at that stage.

3. Personal information we collect

Information you give us

When you submit the information request form, we collect:

• Full name
• Email address
• Country
• Investor profile (for example, accredited or qualified investor, family office, institutional investor or financial advisor)
• Investment range of interest
• Your message, if you write one
• Your confirmation that you are, or are inquiring on behalf of, an accredited or qualified investor

If you email us directly, we receive your email address, name and whatever you choose to include in your message.

Information collected automatically

When you visit the Site, our hosting and security provider processes technical information needed to deliver the Site and protect it from abuse: your IP address, browser and device type, the pages you request and the date and time of the request. When you submit the form, we also record the submission time and the country associated with your IP address.

The Site does not use analytics tools, advertising or tracking pixels, social media plugins or fingerprinting, and it does not set cookies of its own. See our Cookie Notice.

Sensitive information

We do not ask for sensitive personal information through the Site, such as health information, government identification numbers or bank account details. Please do not include this kind of information in the form or in your emails.

4. How we use it

We use your personal information for the following primary purposes, which are necessary to respond to you:

• To answer your request for information about Aivital and its Series B offering.
• To confirm whether you may be eligible to receive offering materials as an accredited or qualified investor.
• To send offering documentation and continue the conversation with eligible investors.
• To keep a record of our communications with you.
• To protect the Site, detect spam and prevent fraud.
• To comply with legal and regulatory obligations and respond to lawful requests from authorities.

We may also use your contact information for the following secondary purpose, which is not necessary to respond to your request:

• To send you updates about Aivital, its portfolio and future investment opportunities.

5. Opting out of secondary purposes

If you do not want us to use your information for the secondary purpose above, email [email protected] with the subject line "Opt-out". You can do this at any time, including before you submit the form. Opting out will not affect our ability to respond to your request.

6. How we share it

We do not sell your personal information, and we do not share it for targeted or cross-context behavioral advertising. We share it only as follows:

• Service providers that process data on our behalf (encargados), under contract and only to provide their services to us:
  • Cloudflare, Inc. (United States): website hosting, content delivery, security and processing of form submissions.
  • Purelymail (United States): email hosting, where form submissions and your emails to us are stored.
• Professional advisors such as legal counsel, accountants, auditors and compliance or identity verification providers, who are bound by confidentiality obligations.
• Authorities, when required by law, regulation, court order or other legal process, or when necessary to protect our rights or the safety of others.
• A successor entity, in connection with a merger, acquisition, reorganization or sale of assets, subject to this Privacy Notice.

Under Mexican law, sharing data with service providers acting on our behalf, and transfers required by law or to competent authorities, do not require your consent. We do not make other transfers that would require your consent.

7. International transfers

Aivital and its service providers are located in the United States, and your personal information is stored and processed there. If you access the Site from Mexico or another country, your information will be transferred to the United States, where data protection laws may differ from those in your country. We apply the protections described in this notice wherever your information is processed.

8. How long we keep it

We keep your personal information only as long as necessary for the purposes described in this notice:

• If your inquiry does not lead to an investment relationship, we delete it within 24 months of our last communication with you.
• If you become an investor, we keep records for as long as required by applicable securities, tax and anti-money-laundering recordkeeping rules.
• Technical data processed by Cloudflare is kept according to Cloudflare's own retention practices.

We may keep information longer when required by law or to establish, exercise or defend legal claims.

9. Security

We use administrative, technical and physical safeguards appropriate to the nature of the information. Connections to the Site and to our email provider are encrypted with TLS, and access to investor inquiries is limited to personnel who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security breach significantly affects your rights, we will notify you as required by applicable law.

10. Your rights if you are in Mexico (ARCO rights)

You have the right to Access your personal data, Rectify it if it is inaccurate or incomplete, Cancel it and Oppose its use for specific purposes (together, "ARCO rights"). You may also revoke your consent and ask us to limit the use or disclosure of your data.

To exercise these rights, email [email protected] with the subject line "ARCO request" and include:

1. Your full name and an email address or other means for us to reply.
2. A copy of an official identification document or, if a legal representative files the request, documents proving that representation.
3. A clear description of the personal data involved and the right you want to exercise.
4. Any other information that helps us locate your data. For rectification requests, include the changes you want and supporting documentation.

We will respond within 20 business days of receiving a complete request. If your request is granted, we will carry it out within 15 business days after our response. These periods may be extended once for an equal period when justified. Exercising your rights is free of charge, although we may charge reasonable costs for shipping or certified copies. Revoking your consent will not have retroactive effect, and we may be unable to revoke consent where the law requires us to keep certain data.

If you believe your rights have not been respected, you may file a complaint with the Mexican data protection authority.

11. Your rights if you are in the United States

Depending on your state of residence, you may have the right to know what personal information we hold about you, to access it, to correct it, to delete it and to opt out of its sale or use for targeted advertising. We do not sell personal information or use it for targeted advertising. To make a request, email [email protected] with the subject line "Privacy request". We will verify your identity before responding and will not discriminate against you for exercising your rights. You may use an authorized agent, who must provide proof of your authorization.

California residents: we do not disclose personal information to third parties for their own direct marketing purposes.

12. Do Not Track and Global Privacy Control

The Site does not track visitors over time or across third-party websites, so it does not change its behavior in response to browser "Do Not Track" signals. Where applicable law requires, we treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of personal information. We do not sell or share personal information in any case.

13. Children

The Site is intended for adult investors and is not directed to anyone under 18. We do not knowingly collect personal information from children under 13 or from minors. If you believe a minor has sent us personal information, contact us and we will delete it.

14. Changes to this notice

We may update this Privacy Notice from time to time. The current version will always be available on this page with its effective date. If we make material changes, we will post a notice on the Site before they take effect.

15. Contact us

For any question about this Privacy Notice or to exercise your rights, contact us at: