1. Data controller

2. Data we collect

2.1 Data provided by the user

• Identity data: full name, identification number or professional credential.
• Contact data: email address, phone number.
• Professional data: specialty, institution name, position, professional registration.
• Access data: login credentials (password stored with secure encryption).
• Shipping data: delivery addresses, recipient's name, delivery instructions.
• Application data: documentation attached in the access request process (licenses, health registrations, official identifications).

2.2 Data generated by platform usage

• Activity data: order history, products consulted, presentations selected.
• Technical data: IP address, browser type, operating system, date and time of access.
• Audit logs: login attempts (successful and failed), selected operating country.

3. Purpose and legal basis of processing

4. Data retention

Personal data will be retained for the time necessary to fulfill the purpose for which it was collected, and in any case:

• Active account data: during the entire duration of the commercial relationship.
• Order data: minimum 5 years due to tax and traceability obligations.
• Credentialing documents: minimum 5 years from the application.
• Audit logs: 2 years.
• Rejected applications: 1 year from resolution.
• Inactive accounts: deleted or anonymized after 3 years without activity, upon prior notification.

5. Recipients and international transfers

LMG Bio Research may share personal data with:

• Stripe, Inc. (United States): payment processing and payment links, under its Privacy Policy.
• Uptime Fulfillment / Warehance (United States): logistics management, storage and information necessary for order dispatch (FOB Miami).
• Technology service providers: hosting, databases, email services, under confidentiality and data processing agreements.
• Logistics and courier companies: exclusively the data necessary to manage order delivery (FedEx and equivalents).
• Competent authorities: when there is a legal obligation, judicial request or need to prevent illegal activities.
• External auditors: in the framework of quality verifications or applicable certifications.

Given that we operate in the United States and in 10 Latin American countries, some data may be transferred and processed in jurisdictions different from that of the user (mainly the United States, where Stripe and Uptime Fulfillment are located). In such cases, LMG Bio Research guarantees that such transfers are carried out under appropriate protection mechanisms (transfer contracts, standard clauses or applicable adequacy frameworks).

6. Your rights

Depending on the applicable legislation in your country, you have the right to:

• Access: request confirmation of whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request the deletion of your data when it is no longer necessary, unless there is a legal obligation to retain it.
• Restriction: request that we suspend processing under certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: when processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, send your request to [email protected], duly identifying yourself. We will respond within a maximum of 30 business days.

7. Data security

LMG Bio Research implements appropriate technical and organizational measures to protect personal information against unauthorized access, loss, alteration or disclosure, which include:

• Password encryption with secure algorithms (bcrypt with salt).
• Data transmission under HTTPS/TLS protocol.
• Role-based access control and secure session authentication.
• Audit log of accesses and authentication attempts.
• Automatic account lockout after repeated failed access attempts.
• Product catalog segmentation by authorized operating country.
• Document storage on a protected server, accessible only to authorized personnel.
• Payment processing delegated to Stripe (PCI-DSS Level 1); LMG Bio Research never sees or stores card data.

8. Cookies and similar technologies

The LMG Bio Research B2B platform uses only session cookies strictly necessary for the functioning of authentication. We do not use advertising tracking cookies, third-party analytics or fingerprinting.

Additionally, when the user completes a payment (on the Platform or via a payment link by email), Stripe may set its own cookies on the Stripe domain in accordance with its own privacy policy.

9. Patient data

LMG Bio Research does not hold or process patient records. Custody of any patient health information remains solely with the treating professional. The Platform does not collect, store, transmit or have access to individual patient health data at any time.

10. Minors

The platform is directed exclusively to licensed professionals, medical institutions and authorized distributors. It is not intended for persons under 18 years of age or individual consumers. If we detect that we have collected data from a minor without parental consent, we will proceed to delete it immediately.

11. Changes to this Policy

LMG Bio Research reserves the right to update this Privacy Policy to reflect changes in our practices, in applicable legislation or in the services offered. When material changes are made, we will notify registered users by email at least 15 days in advance. The date of last update is indicated at the beginning of the document.

12. Contact and complaints

For any query, request or complaint related to the processing of your personal data, you can contact us through:

• Email: [email protected]
• Phone: +503 2501-5943
• Address: LMG Bio Research — 89 Avenida Norte, San Salvador, El Salvador

If you consider that the processing of your data does not comply with current regulations, you have the right to file a complaint with the competent data protection authority in your country.