Privacy Policy

HEURISTIK TECHNOLOGIES, S.L. · CIF B95977351

Version 2.0 · August 21, 2026

At HEURISTIK TECHNOLOGIES, S.L. (hereinafter, "Heuristik"), we take special care with privacy, security, and transparency. This Privacy Policy describes, by processing activity and in a structured manner, the personal data we process, why we process it, with what safeguards, for how long, and what rights you have. This policy applies to Heuristik's activities in the European Union, Mexico, and the United States, and is issued in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD), the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) of Mexico, HIPAA federal regulations, and Massachusetts legislation (M.G.L. c. 93H, c. 93I and 201 CMR 17.00) for the United States, and Regulation (EU) 2024/1689 (AI Act).

Scope of this policy

This Privacy Policy governs the processing of personal data carried out by Heuristik as controller or joint controller in the following public activities: (i) provision of the main biometric patient identification service using fingerprints and an artificial intelligence model; (ii) provision of the biometric identification service for deceased persons in the funeral sector; (iii) participation in clinical research studies; (iv) management of the corporate website, contact forms, newsletter subscription and event organization; (v) receipt of unsolicited applications and applications for jobs published through the corporate website.

The processing of personal data arising from a specific contractual, commercial or employment relationship with Heuristik (including, among others, employees and internal collaborators, contact persons of clients and potential clients, and contact persons of suppliers) is NOT governed by this public policy: it is specifically regulated in the corresponding contract or form and in the attached information clause that Heuristik provides to the interested party at the time of data collection.

Data Controller

Identification of the responsible party:

• Corporate name: HEURISTIK TECHNOLOGIES, S.L.
• CIF: B95977351
• Registered office: Calle Buensuceso, 40 — 18002 Granada (Spain)
• Corporate domain: heuristik.com
• General contact email: info@heuristik.com

Data Protection Officer (DPO)

Heuristik's Data Protection Officer is EUROPEAN DATA PROTECTION OFFICERS, S.L. (Tax ID B88047220), with registered office at Carretera de Húmera 8, 1ºA, 28023 Madrid, and contact person Mr. Carlos Mateo Enseñat. Contact channels:

• Main public channel: dpo@heuristik.com
• Alternative channel: contacto@delegadopd.com
• Postal address: Carretera de Húmera 8, 1ºA, 28023 Madrid (Spain)

1. BIOMETRIC IDENTIFICATION OF PATIENTS USING FINGERPRINT AND AI MODEL (MAIN TREATMENT)

This is Heuristik's main treatment. The solution “Heuristik Health” allows for the unique identification of patients in healthcare facilities (hospitals and clinics) using a fingerprint that is converted into a mathematical vector and compared using an artificial intelligence model owned by Heuristik. The ultimate goal is to improve clinical safety, prevent healthcare risks, mitigate the inherent risk of identification errors, and link healthcare actions with the center's electronic health record. The AI model is an inherent component of the service: without it, identification is not possible.

BASIC INFORMATION

Controllers (joint controllers Art. 26 GDPR): HEURISTIK TECHNOLOGIES, S.L. and the contracting healthcare center, act as JOINT CONTROLLERS OF THE PROCESSING. Category of joint controllers: hospitals, clinics, nursing homes and healthcare centers, public or private entities that have contracted Heuristik's SaaS service, with activity in the European Union, Mexico or the United States.

Purpose: Unique administrative biometric identification of the patient and healthcare personnel; linking with the center's medical record; access control to restricted areas; tracking of the patient's movement through the center's areas (for user information and hospital management); and sending SMS messages to authorized family members with the scanning points, entrances, and exits; training, validation, and improvement of the underlying AI model when the patient granularly consents; collection of various variables, including demographic and phenotypic (skin color, validated scale) during clinical pilots for aggregate metrics and model bias mitigation training.

Legitimation: LEGITIMACY OF THE PROCESSING

The legal basis for the processing depends on the specific purpose.

1) Biometric identification of the patient. It is legitimized according to your situation, without the assumptions overlapping:

(i) If you can decide — your explicit consent (Art. 9.2.a GDPR), obtained with the scope and guarantees of informed health consent provided for in Arts. 2.2, 2.4 and 8.1 of Law 41/2002. If you do not provide it or you withdraw it, you will be identified by the center's usual procedure, without any consequence to your attendance.

(ii) If you are not in a position to decide — consent by representation of your legal representative or, failing that, of persons linked to you by family or de facto reasons (Art. 9.3.a of Law 41/2002), the processing being based on the provision of health care and the management of health services (Art. 9.2.h GDPR in relation to Art. 6.1.e), which is carried out by a professional subject to secrecy or under their responsibility (Art. 9.3 GDPR).

(iii) If you are in a life-threatening emergency and cannot give consent, and it is not possible to obtain consent by proxy with the immediacy the situation requires—protection of your vital interests or those of another natural person (Articles 9.2.c and 6.1.d GDPR, in conjunction with Article 9.2.b of Law 41/2002). Properly identifying you is precisely what allows us to know your allergies, your medication, and your medical history. This basis only covers that specific event and ceases as soon as you regain the capacity to decide, at which point you will be informed and may object.

2) System quality and safety: continuous model training. Maintaining and improving the system's accuracy—reducing misidentifications and associated healthcare risks—is not a business decision for Heuristik but a regulatory obligation: Article 83 of Regulation (EU) 2017/745 on medical devices and Article 72 of Regulation (EU) 2024/1689 on artificial intelligence require it to maintain a post-market surveillance system that actively collects and analyzes product performance data throughout its lifespan. This processing is therefore legitimized by compliance with a legal obligation (Article 6.1.c GDPR) and the need to guarantee high levels of quality and safety in healthcare and medical devices (Article 9.2.i GDPR). When carried out within the framework of a research project, it will also be subject to Article 9.2.j and the safeguards of Article 89.1 GDPR. The detection and correction of biases is expressly authorized in Article 10.5 of Regulation (EU) 2024/1689.

The processing is carried out on pseudonymized data and is limited to what is strictly necessary for that purpose. Although the law does not require it when the processing is in response to a legal obligation, you can request that your data no longer be used to train the model, without this affecting your identity or the support you receive.

3) Preservation of the original fingerprint image or phenotypic variables beyond what is necessary for the above. When the original image of your fingerprint, or phenotypic variables, is preserved beyond what is essential for the quality and security of the system, the processing is based on your explicit, specific, and granular consent (Articles 6.1.a and 9.2.a GDPR), which you can freely grant or withdraw at any time without any consequence for your care.

Recipients: Health center: as a general rule to act as co-responsible for Heuristik's data processors are contracted in accordance with Article 28 of the GDPR to provide necessary technical services; competent authorities are also involved when legally required. Data is not transferred to third parties other than the joint controller or without their documented instruction.

Rights: Access, rectification, erasure, objection, restriction, portability, and withdrawal of consent. Specific withdrawal of granular authorizations (raw image/skin color) without impact on the identification service.

Additional information: Full details are provided in the ADDITIONAL INFORMATION section below and in the co-responsibility agreement signed between Heuristik and each healthcare center.

Origin: From the interested party (biometric capture in person at the health center at the time of registration or care) and from the hospital co-responsible (opaque patient identifier in the hospital information system).

ADDITIONAL INFORMATION

1.1. Joint responsibility regime (Art. 26 GDPR)

The co-responsibility agreement regulated in the specific contract with each center distributes the functions as follows: the health center maintains the relationship with the patient, collects and documents their informed consent, manages access to the electronic medical record and safeguards the "key" which links the opaque identifier of the biometric system with the patient's identity in the hospital information system; Heuristik, for its part, digitizes the fingerprint, generates the irreversible mathematical vector, safeguards the vector with the described guarantees, performs the comparison using its own AI model, and if the patient consents granularly train the model with the raw image of the fingerprint and Heuristik will be able to notify family members/companions of the traceability of their transit in the center.

1.2. Purposes and retention periods

Heuristik processes biometric and accessory data of the patient and healthcare personnel for the following purposes:

• Unique administrative identification of the patient at the time of registration and healthcare.
• Linking the opaque biometric identifier with the center's electronic medical record.
• Control of access of healthcare personnel to restricted clinical areas and resources.
• Biometric matching using Heuristik's own AI model, an inherent component of the service.
• With optional granular consent: encrypted preservation of the raw fingerprint image to train and improve the AI model.
• System accuracy and bias correction. Regulation (EU) 2024/1689 requires providers of high-risk artificial intelligence systems to achieve an adequate level of accuracy and to examine and correct any potential biases that could affect the health, safety, or fundamental rights of individuals. A biometric identification system that operated with varying accuracy depending on phenotypic characteristics would lead to unequal treatment, with direct consequences for the safety of those affected. To verify that this does not occur and to correct it when detected, Heuristik needs to measure the system's performance by population subgroups, which requires knowledge of certain demographic and phenotypic variables, including skin tone coded on a validated scale. This measurement also allows for increasing the system's accuracy where it is lower, until a homogeneous level is reached for all individuals. The Regulation itself expressly authorizes the processing of these data categories when strictly necessary to detect and correct biases. This processing is performed on pseudonymized data, with access restricted to designated technical personnel, and for the sole purpose of calculating aggregate performance metrics by subgroup and rebalancing training sets. The variable is not incorporated as an operating criterion of the identification system, is not used to personalize the service or to create profiles, is not shared with third parties, and is deleted once the bias has been corrected or the study has concluded.
• Notification of serious incidents pursuant to Art. 73 of the AI Act and Art. 33-34 of the GDPR.

Use cases explicitly EXCLUDED by design and by contractual clause:

• Medical diagnosis, clinical monitoring, or treatment of diseases — Although Heuristik is in the process of self-certification as a Class I Medical Device under Regulation (EU) 2017/745 (MDR), its intended purpose is strictly limited to ensuring the correct identification of the patient to mitigate risks in healthcare processes, not performing clinical, diagnostic or therapeutic evaluations.
• Real-time remote biometric identification in public spaces for police purposes (category prohibited by Art. 5 AI Act).
• Biometric categorization to infer race, political opinions, sexual orientation, or other characteristics (category prohibited by Art. 5 AI Act), except for the precision of the system and correction of racial biases, in accordance with the provisions of Article 10 of Regulation (EU) 2024/1689 on Artificial Intelligence.
• Automated decisions with significant legal effects on the patient without human supervision. Furthermore, the identifications proposed by Heuristik Health are always validated by the hospital's healthcare staff, the data subject retains the full right not to be subject to a decision based solely on automated processing (Art. 22 GDPR).

Storage periods:

• Opaque biometric vector: for as long as the care relationship between the co-responsible party and the interested party lasts; technical deletion within 72 hours after instruction from the co-responsible party or after withdrawal of consent.
• Raw image of the fingerprint (opt-in): until the withdrawal of consent by the interested party or during the useful life of the model trained with it (annual review).
• Demographic and phenotypic variables: 5 years from the last update of the trained model or until completion of the pilot.
• Technical logs of capture and comparison: minimum preservation in accordance with Art. 12 of the AI Act, in immutable format.
• Documentation of consent and exercise of rights: 5 years (Art. 32 LOPDGDD).

1.3. Legitimization and single consent ID + AI

The processing of the patient's biometric data is covered by Article 9.2.h of the GDPR (purposes of preventive medicine, medical diagnosis, provision of healthcare or treatment, and management of healthcare systems and services) when the joint controller is a healthcare facility and the processing serves healthcare purposes; subsidiarily, and as reinforcement, by Article 9.2.a of the GDPR (explicit consent). In accordance with the legitimacy of informed consent, Heuristik manages the service through independent granular consents that allow the patient to decide on the following purposes:

• (a) The main purpose of administrative biometric identification through Artificial Intelligence, including the use of the AI model as an inherent component of the identification service.
• (b) Separate and uncheckable granular opt-in, without affecting (a): encrypted storage of the raw image for model retraining. Legal basis: Art. 6.1.a + 9.2.a GDPR.
• (c) Notice to family members: Optional authorization for sending notifications (SMS) to family members or companions about the patient's transit in the center.

Note on clinical pilots: In cases where the healthcare center conducts clinical research pilots, participation involves the collection of study variables (including phenotypic variables such as skin color) according to the protocol approved by the center's Ethics Committee. This collection does not constitute independent granular consent within the App, but rather forms an integral part of the research protocol, for which consent is obtained by the healthcare center. Heuristik uses these variables exclusively for the purpose of generating aggregated metrics for the validation and bias mitigation of the AI model, in compliance with Regulation (EU) 2024/1689 (AI Act).

Withdrawal of the single consent form results in the cessation of service and the technical deletion of the opaque biometric vector within a maximum of 72 hours. Withdrawal of granular authorizations (raw image or phenotypic variable) does NOT affect the identification service. Withdrawal of optional authorizations (b) or (c) does NOT affect the provision of the identification service.

Minors. Heuristik is a service intended exclusively for adults. However, when the patient is under 14 years of age, consent is obtained from their parents or legal guardians in accordance with Article 7 of the LOPDGDD and the applicable regulations of the healthcare center. In jurisdictions other than Spain, the corresponding age of digital consent or the parental consent required by local legislation applies.

1.4. Categories of data processed

Categories of data processed (special category — Art. 9 GDPR):

• Raw fingerprint image (processed in volatile memory by default; stored encrypted only with granular consent).
• Mathematical vector derived from the footprint.
• Technical capture metadata (device, timestamp, sample quality).
• Match result (match/no match and confidence score).
• Identifier of the operator performing the capture, for traceability in accordance with Art. 12 AI Act.
• Opaque patient identifier in the hospital information system (held by the hospital). No other category of clinical data is processed by Heuristik. The data is obtained from the data subject themselves (in-person biometric capture and signed informed consent) and from the hospital co-responsible party (opaque patient identifier).

1.5. Recipients

The data is communicated exclusively to the following recipients:

• The healthcare center is always jointly responsible within the framework of the identification operation and the link to the hospital information system.
• Heuristik's data processors, contracted in accordance with Art. 28 GDPR, for the provision of the necessary technical services (e.g., cloud infrastructure and logging).
• Competent supervisory authorities (AEPD, INAI, HHS-OCR and AI Act monitoring authorities — AESIA in Spain) when there is a legal requirement.

Heuristik does not transfer data to third parties other than the joint controller, nor without documented instructions from the joint controller or an express legal requirement. There is no data monetization, no sale of data, and no transfer for advertising or marketing purposes.

1.6. Technical and organizational security measures

Heuristik implements a comprehensive set of technical and organizational security measures in accordance with Article 32 of the GDPR, Regulation (EU) 2024/1689 (AI Act), and, where applicable, the HIPAA compliance program and Massachusetts law. These measures are reviewed periodically by the Data Protection Officer and the Heuristik security team, are subject to external audits where appropriate, and ensure the confidentiality, integrity, availability, and ongoing resilience of the processing systems and services. For security reasons, the technical details of these measures are not published in this policy; they are made available to the competent supervisory authorities upon request, as well as to the joint controllers within the framework of the joint controllership agreement.

1.7. Hosting and transfers:

Heuristik uses hosting infrastructure on servers located in both the European Economic Area (EEA) and the United States, depending on the geographic location of the healthcare provider and applicable contractual requirements. Patient data for those treated by providers in the European Union or the EEA is hosted entirely on cloud infrastructure within the EEA. For Heuristik users located outside the EEA, your data may be hosted on servers located outside the EEA, such as in Mexico or the United States, applying in such cases the enhanced safeguards required by Chapter V of the GDPR (Standard Contractual Clauses, EU-US Data Privacy Framework and appropriate supplementary measures)

2. BIOMETRIC IDENTIFICATION OF DECEASED PERSONS IN FUNERAL SERVICES

Heuristik, together with funeral service providers, offers, within the framework of contracts with companies in the funeral sector, a service of capture, digitization, custody, downloading and reconstruction of the fingerprints of deceased individuals for integration into digital biographies and memorial products produced by these companies. This processing is governed by a specific legal framework that combines Recital 27 of the GDPR (no general application to data of deceased persons), Article 3 of the LOPDGDD (powers of related parties), and Organic Law 1/1982 on honor, privacy, and image.

BASIC INFORMATION

Those responsible: Bipartite model documented in the contract with each funeral company: (a) HEURISTIK TECHNOLOGIES, S.L. is independently responsible for Processing A (custody of the fingerprint and vector, model training); (b) the contracting funeral company is responsible for Processing B (use in digital biographies, downloading and reconstruction) fingerprinting for memorial products).

Purpose: Capture, digitization, storage, custody, downloading, reconstruction, and identification of fingerprints of deceased persons (Treatment A). Incorporation into digital biography and creation of memorial products (Treatment B).

Legitimation: GDPR not applicable in general The rights of deceased persons (Cdo. 27). LOPDGDD Art. 3 — rights of persons related to the deceased. Organic Law 1/1982 — honor, privacy and image. Specific contractual arrangements with each funeral home.

Recipients: Funeral home contracting in Treatment B, at the request of a legitimate user; Heuristik data processors contracted pursuant to Art. 28 GDPR for the provision of necessary technical services. No other transfers.

Rights: Powers under Article 3 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) for persons related to the deceased, channeled through the funeral home. Heuristik collaborates with the technical execution of the requests.

Additional information: Details in the collaboration agreement signed between Heuristik and each funeral company.

Origin: From the contracting funeral company and from the deceased himself (fingerprint collected at the funeral home).

ADDITIONAL INFORMATION

2.1. Accommodation and transfers

Heuristik has hosting infrastructure on servers located in both the European Economic Area (EEA) and the United States. The specific server location where the data is hosted is determined based on the client's geographic location and applicable contractual requirements. In the case of hosting on servers located in the United States, the international transfer is subject to the enhanced safeguards required by Chapter V of the GDPR: (i) Standard Contractual Clauses of Decision (EU) 2021/914; (ii) the EU-US Data Privacy Framework (Decision (EU) 2023/1795) when the provider is certified; and (iii) appropriate supplementary technical, organizational, and contractual measures.

2.2. Conservation

Indefinite in Treatment A, except for withdrawal of authorization or exercise of rights by the legitimate person or contractual termination between Heuristik and the company; periodic review of the need for storage.

2.3. Exercise of powers under Art. 3 LOPDGDD

Persons linked to the deceased (relatives, heirs and persons designated in accordance with Art. 3 LOPDGDD) may exercise the legally provided powers by contacting the funeral company or, subsidiarily, the DPO of Heuristik (dpo@heuristik.com).

3. CLINICAL RESEARCH (SPONSOR / CO-INVESTIGATOR)

Heuristik participates, where applicable, as a Sponsor or Co-Investigator in clinical studies that validate its biometric identification solution in hospital settings. These studies are conducted under a Clinical Trial Agreement (CTA) signed with the healthcare institution and with the approval of the corresponding Ethics Committee/Institutional Review Board (IRB).

BASIC INFORMATION

Those responsible: Heuristik as Sponsor and the Health Institution as Institution/Investigator.

Purpose: Participation in clinical studies in accordance with the protocol approved by the Ethics Committee / IRB.

Legitimation: Art. 9.2.j GDPR (scientific research with the guarantees of Art. 89 GDPR) and informed consent of the subject in accordance with Common Rule 45 CFR Part 46 and HIPAA Authorization 45 CFR §164.508 obtained by the Institution.

Recipients: Academic co-authors according to protocol; competent health authorities; ethics committees. Heuristik data processors contracted in accordance with Art. 28 GDPR for the provision of necessary technical services.

Rights: Those under the GDPR and those provided for in the Common Rule/HIPAA. Complaint to the IRB of the relevant healthcare institution and to the HHS-OCR.

Additional information: Details are provided in the study protocol, in the Clinical Trial Agreement signed with each healthcare institution, and in the subject information sheet (SIS).

Origin: From the subject of the study (pseudonymized by the Institution before sharing with Heuristik).

ADDITIONAL INFORMATION

3.1. Conservation

Data are retained in accordance with the study protocol and clinical research archiving regulations (typically 15 years or more, depending on applicable local regulations). However, in cases where the healthcare center acts as the Data Controller, and expressly request the deletion of the data once the clinical pilot has ended, Heuristik will proceed with said deletion, unless there are mandatory legal obligations or requirements of the study protocol that require a minimum indispensable archiving period.

3.2. International Transfers

When the healthcare institution is established outside the European Economic Area, the existence of an international transfer depends on the actual direction of the data flow. If Heuristik provides the institution with personal data originating from the European Union, the transfer is subject to the Standard Contractual Clauses of Decision (EU) 2021/914, the corresponding supplementary measures, and, for the United States, the EU-US Data Privacy Framework when the recipient is certified. If, on the other hand, the study data is collected, stored, and processed entirely within the institution's region without Heuristik transferring data of European origin, no transfer occurs within the meaning of Chapter V of the GDPR, and the agreement signed with the institution instead governs Heuristik's commitment to compliance and mutual assistance between the parties. In both cases, if Heuristik were to receive protected health information from a US Covered Entity, it would enter into the corresponding Business Associate Agreement in accordance with HIPAA.

4. WEBSITE VISITORS, CONTACT FORMS, NEWSLETTER AND EVENTS

BASIC INFORMATION

Responsible: HEURISTIK TECHNOLOGIES, S.L. — CIF B95977351 — Calle Buensuceso 40, 18002 Granada.

Purpose: Responding to contact or demo requests; managing newsletter subscriptions and sending corporate communications; analyzing website usage to improve service; organizing events, webinars, and professional workshops.

Legitimation: Consent (Art. 6.1.a GDPR) for newsletter, non-essential cookies, events and promotional communications; legitimate interest (Art. 6.1.f GDPR) to respond to requests; legal obligation to retain proof of consent.

Recipients: Data processors specializing in web hosting, analytics, marketing automation, CDN, and event management, operating under a contract in accordance with Article 28 of the GDPR. No data is transferred to third parties.

Rights: Access, rectification, erasure, opposition, limitation, portability and withdrawal of consent.

Additional information: The use of cookies and similar technologies is detailed in the Cookie Policy (see section 6 of this policy).

Origin: From the interested party through the forms on the corporate website or through their interaction with our corporate channels.

ADDITIONAL INFORMATION

4.1. Conservation

Specific contact requests: 5 years (statute of limitations under Article 1964 of the Civil Code). Newsletter: until consent is withdrawn. Events: 2 years from their conclusion. Cookies: in accordance with the Cookie Policy.

4.2. International Transfers

Yes. Some data processors may process data in the United States. These transfers are subject to Standard Contractual Clauses (Decision (EU) 2021/914) + EU-US Data Privacy Framework (Decision (EU) 2023/1795) + supplementary technical, organizational and contractual measures.

5. JOB APPLICATIONS RECEIVED THROUGH THE WEB

When an applicant submits their application through the "Join us" form or equivalent channels published on the corporate website, Heuristik processes their data as follows. Applications received through channels other than the website (internal referrals, third-party portals, private processes) are governed by the specific information clause that the applicant accepts at the time of submission.

BASIC INFORMATION

Responsible: HEURISTIK TECHNOLOGIES, S.L.

Purpose: Manage the personnel selection processes (receiving applications, interviews, technical tests) and, if the candidate expressly consents, keep the CV in the job bank for future processes.

Legitimation: Pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR). Data subject's consent (Art. 6.1.a GDPR) for retention in the job bank.

Recipients: Data processors specializing in professional recruitment platforms and productivity tools, under contract in accordance with Art. 28 GDPR.

Rights: Access, rectification, erasure, opposition, limitation, portability and withdrawal of consent.

Additional information: Details are provided in the ADDITIONAL INFORMATION section below and in the specific information clause published next to the web form.

Origin: From the interested party through the "Work with us" form or equivalent channels on the corporate website.

ADDITIONAL INFORMATION

5.1. Conservation

The CV is deleted at the end of the selection process or, where applicable, after a period of 2 years if the interested party has expressly consented to its retention in the job bank.

5.2. International Transfers

Yes. Some data processors may process data in the United States — Standard Contractual Clauses + EU-US Data Privacy Framework + supplementary measures.

6. MULTI-JURISDICTIONAL LEGAL REGIME, TRANSFERS AND EXERCISE OF RIGHTS

6.1. General framework

Heuristik operates in the European Union, Mexico, and the United States. Consequently, its data processing activities are subject to the obligations applicable based on the jurisdiction of the data subject and the service provided. The relevant details are outlined below.

6.2. European Union — GDPR, LOPDGDD and AI Act

The processing of personal data is governed entirely by Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD). For processing related to the website, Law 34/2002 (LSSI-CE) and the current guidelines on cookies issued by the Spanish Data Protection Agency (AEPD) also apply.

In the area of artificial intelligence, Heuristik's biometric identification system is classified as a HIGH-RISK AI system according to Annex III, paragraph 1 (biometric systems) and paragraph 5 (private essential services — healthcare) of Regulation (EU) 2024/1689 (AI Act). Heuristik acts as the PROVIDER (Articles 16 to 25 AI Act) and the contracting healthcare facilities as the DEPLOYERS (Article 26 AI Act).

Additionally, the AI Act provides a specific legal basis for the exceptional processing of special categories of personal data when strictly necessary to detect and correct bias in AI systems. This authorization covers, along with the explicit consent of the data subject, the limited collection of "skin color" data that Heuristik performs during clinical pilots exclusively for aggregated bias mitigation metrics. The system's technical documentation, risk management system, data governance, and human oversight measures are made available to the competent supervisory authorities upon request.

6.3. Mexico — LFPDPPP

In accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and the Privacy Notice Guidelines issued by the INAI, Heuristik informs data subjects that:

• The personal data collected may include sensitive data (biometric and identification) when the holder is a patient of a healthcare client in Mexico.
• The primary purposes are the provision of the SaaS biometric identification service, the execution of the contract with the co-responsible party, and compliance with legal and tax obligations.
• Secondary purposes (analytics, product improvement, newsletter, AI training) require express written consent from the data subject, obtained by the joint controller.
• ARCO rights (Arts. 22-32 LFPDPPP) can be exercised by requesting the DPO (dpo@heuristik.com) — response in 20 business days, extendable by an additional 20 days.
• Transfers: Data may be transferred to processors with a presence in the United States and the European Union, with sufficient contractual guarantees (SCCs + EU-US Data Privacy Framework).
• Competent authority: National Institute for Transparency, Access to Information and Protection of Personal Data (INAI) — www.inai.org.mx.

6.4. United States — HIPAA and Massachusetts

When Heuristik provides SaaS services to a U.S. Covered Entity, it acts as a Business Associate and enters into the corresponding Business Associate Agreement (BAA). The safeguards of the Security Rule (45 CFR §§164.302-164.318) and the obligations of the Privacy Rule (minimum necessary use) and the Breach Notification Rule (§§164.400-414) apply. Additionally, for Massachusetts residents, Heuristik maintains a Written Information Security Program (WISP) pursuant to 201 CMR 17.00, implements the breach notification required by M.G.L. c. 93H (Massachusetts Attorney General + Office of Consumer Affairs and Business Regulation + residents), and secure data destruction pursuant to M.G.L. c. 93I. The rights of the data subject include the HIPAA Right of Access (45 CFR §164.524), rectification (§164.526), audit of communications (§164.528), and confidential communications (§164.522). Complaints may be directed to the Department of Health and Human Services Office for Civil Rights (HHS-OCR) and the Massachusetts Attorney General.

Other U.S. state laws (CCPA/CPRA, BIPA, CUBI, RCW 19.375, VCDPA, CTDPA, UCPA, TDPSA, Colorado AI Act, among others) are outside the current scope of Heuristik's compliance program and will be evaluated on a case-by-case basis when Heuristik enters those markets.

6.5. International transfers — common framework

The biometric identification data of patients treated by joint controllers in the European Union or the European Economic Area is hosted entirely on cloud infrastructure in the European region, with backups also located in the European Economic Area or in countries with a valid adequacy decision. Consequently, there is NO international transfer outside the EEA for these patients. The biometric identification data of patients treated by joint controllers in Mexico and the United States may be processed on cloud infrastructure outside the European Economic Area. These international transfers are subject to the enhanced safeguards required by Chapter V of the GDPR: (i) Standard Contractual Clauses of Decision (EU) 2021/914; (ii) EU-US Data Privacy Framework (Decision (EU) 2023/1795) for certified recipients; (iii) Transfer Impact Assessment (TIA) documented by the Data Protection Officer (DPO); (iv) additional technical, organizational, and contractual measures appropriate to the risk.

6.6. Exercising rights — DPO's single channel

Regardless of the data subject's jurisdiction, all requests relating to this policy may be directed to the Data Protection Officer through the channels indicated in the introductory section (dpo@heuristik.com as the primary channel, contacto@delegadopd.com as an alternative channel, and the postal address of EUROPEAN DATA PROTECTION OFFICERS, S.L.). The rights to which the data subject is entitled are, with the specificities of each jurisdiction: access, rectification, erasure, objection, restriction of processing, data portability, and withdrawal of consent; in Mexico, additionally, the ARCO rights under the LFPDPPP; in the United States, additionally, the rights recognized by HIPAA (Right of Access, Amendment, Accounting) and by applicable Massachusetts law.

The general response time is one month from receipt of the request, extendable by two additional months in cases of particular complexity (AEPD rule, applied by default in all jurisdictions). The interested party may, in any case, file a complaint with the competent supervisory authority: AEPD (www.aepd.es), INAI (www.inai.org.mx) or HHS-OCR (www.hhs.gov/hipaa/filing-a-complaint), depending on the jurisdiction.

7. COOKIES AND SIMILAR TECHNOLOGIES

Heuristik uses cookies and similar technologies on its websites. Full details—types of cookies used, purpose, duration, provider, and granular consent and opt-out mechanisms—can be found in the Cookie Policy, accessible at https://heuristik.com/en/cookies-policy. You can change your settings at any time via the "Configure cookies" link in the website footer.

Changes to this policy. Substantial modifications to this Privacy Policy will be published at https://heuristik.com/en/privacy-policy and, where appropriate, communicated to the interested party through the usual channels.