PRIVACY NOTICE AND TERMS & CONDITIONS OF USE OF ACT CATALYST PLATFORM & AI WELLNESS SCREENING SERVICES

Effective Date: July 1, 2026 • Version 1.0

Published at alliancecaretech.com/privacyactcatalyst — this page is the authoritative current version

The short version

Your wellness screening results are yours. Your employer, your broker and their HR teams never see your individual results; not your scores, not your risk flags. They receive only group statistics, and only where at least 5 people are in the group. We also keep a de-identified copy of screening data (with your name and contact details permanently removed) to improve our AI models and produce population-level insights. We message you about your screening and your report; anything promotional is opt-in only. You can withdraw at any time.

The long version

PART 1 — PRIVACY NOTICE

1. Who we are

Alliance Care Technologies International Limited (“ACT”, “we”, “us”) is a company incorporated in the Abu Dhabi Global Market (ADGM registration no. 000006776), whose registered office is at Al Khatem Tower, 16th Floor, 118-19, Abu Dhabi Global Markets Square, Al Maryah Island, Abu Dhabi, United Arab Emirates.

ACT operates the ACT Catalyst platform (the “Platform”) and delivers on-site AI wellness screening events (each an “Event”). This notice explains what we do with your information when you take part in an Event.

Data Protection Officer: data_privacy@alliancecaretech.com

2. Scope and how this notice fits together with your employer

An Event is usually arranged for you by your employer, your insurer, or an insurance broker (the “Sponsor”), who has contracted with ACT to make screening available to you as a wellbeing benefit. The Sponsor pays for the Event.

Paying for the Event does not give the Sponsor access to your results. ACT determines how your individual wellness data is handled and acts as the controller of that data. The Sponsor receives only the de-identified aggregate reporting described in section 6.

Taking part is entirely voluntary. Choosing not to take part, or withdrawing after you start, has no effect on your employment, your insurance cover, or any benefit you are entitled to.

3. Information we collect

• Identity and contact data — your name, email address and/or mobile number, used to create your secure profile, issue your unique participant ID, deliver your report to you, and send you the service messages described in section 7.

• Demographic and profile data — age or date of birth, sex at birth, height and weight, and similar attributes needed for the screening algorithms to interpret your measurements correctly.

• Health and wellness data — the measurements and risk indicators generated by the three screenings: metabolic (including blood pressure, heart rate, blood oxygen saturation, and related indicators), retinal eye (including indicators associated with glaucoma, diabetic retinopathy, age-related macular degeneration, and for participants over age of 40 a cardiovascular risk indicator), and musculoskeletal (functional movement, range of motion, balance, flexibility, posture and injury risk). This is Special Category / sensitive health data.

• Questionnaire responses — any lifestyle or history questions you choose to answer.

• Consent records — which version of this notice you accepted, which optional consents you gave or declined, and when.

• Technical and usage data — device type, browser, IP address, and log records of access to your report, kept for security and audit purposes.

You are not required to answer every question. Some screenings may be unavailable or less accurate if you decline to provide certain information.

4. Why we process your data and our legal basis

Purpose: Delivering your screening and producing your personal report Legal basis: Your explicit consent to the processing of health data

Purpose: Making your report available to you in the online viewer and as a PDF Legal basis: Your explicit consent

Purpose: Service messages about your Event, your profile and your report (section 7) Legal basis: Necessary to deliver the service you asked for; your consent

Purpose: Optional clinical consultation with a licensed clinical partner Legal basis: Your explicit consent; provision of healthcare by a licensed professional

Purpose: Escalating an urgent or critical finding to you (and, with your consent, to a clinician) Legal basis: Your vital interests; explicit consent

Purpose: Creating de-identified data for aggregate reporting and for improving ACT’s AI models Legal basis: Your explicit consent (see section 5)

Purpose: Optional updates about ACT services and future Events Legal basis: Your opt-in consent, withdrawable at any time

Purpose: Security, audit, fraud prevention and platform integrity Legal basis: Our legitimate interests

Purpose: Meeting legal, regulatory and health-authority obligations Legal basis: Compliance with a legal obligation

This notice is issued under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and UAE Federal Law No. 2 of 2019 on the Use of ICT in Health Fields, together with the ADGM Data Protection Regulations 2021.

5. De-identified data and de-identified summaries

With your consent, ACT creates a de-identified copy of your screening data. De-identification means we permanently remove your name, email address, mobile number, date of birth (retained only as an age band), participant ID, and any other identifier that could reasonably single you out, and we replace them with a non-reversible code. ACT does not hold a key that would allow the de-identified record to be linked back to you.

We use de-identified data for two purposes only:

• Aggregate summaries — group-level statistics such as the proportion of a screened population showing an elevated risk indicator, distribution of results by age band, and change over time between Events. These are shared with the Sponsor as described in section 6.

• Improving our services — training, validating,testing and improving ACT’s AI wellness screening models, quality assurance, and producing population-level research and insights, including insights ACT may publish or share commercially in aggregate form.

De-identified data is no longer personal data. Because it can no longer be linked to you, it is retained after your identifiable data has been deleted, and requests to delete personal data (section 10) do not extend to de-identified records already created. If you would prefer your data not to be used in this way, you can decline the de-identified use at the consent screen and still take part in the screening.

What your employer, insurer or broker receives — and does not receive

HR, management, your insurer and your broker do NOT receive: your individual results or scores; any risk flag, indicator or measurement attributable to you; your report or PDF; They receive ONLY aggregate, de-identified statistics covering a group of at least 5 participants.

6. Reporting to the Sponsor — the 5-participant rule

Any summary provided to a Sponsor is de-identified and aggregated. ACT applies a minimum cohort threshold: no statistic, breakdown, sub-group, site, department or filter is reported where fewer than five (5) participants fall within it. Where a breakdown would fall below that threshold, the figure is suppressed or merged into a larger group before the report is issued.

ACT also applies secondary-suppression checks so that a small group cannot be inferred by subtracting one reported figure from another, or by comparing reports issued at different times. Aggregate reports carry no free-text comments, no participant identifiers, and no data that would allow an individual to be singled out.

7. How we contact you

We contact you in a small number of ways, and we keep them separate. Anything promotional is opt-in only.

• Service messages - confirmation that your profile is set up, Event reminders and schedule changes, notice that your report is ready, a reminder shortly before your report access expires, and technical, security or service notices. These are part of delivering the screening you asked for, so you receive them while you are taking part.

• Clinical follow-up - if a result indicates a potential urgent or critical concern, ACT or its licensed clinical partner will contact you directly. If you asked for a consultation, the clinical partner contacts you to arrange it.

• Feedback - a short satisfaction survey after your Event. You can opt out at any time using the link in the message.

• Updates about ACT services (opt-in only) — invitations to future screening Events, information about new ACT services, and wellness content. We send these only if you tick the relevant box, every message carries an unsubscribe link, and whether you tick it makes no difference to your screening or your results.

We contact you by email and/or SMS or messaging app, using the details you provide. You can update your contact details in your profile, change your preferences at any time, or contact data_privacy@alliancecaretech.com.

8. Who we share your data with

• You. Your individual report is made available to you and to nobody else by default.

• ACT’s licensed clinical partners. If you request an optional consultation, the relevant data is shared with a clinical provider licensed by the competent UAE health authority (MOHAP, DoH, DHA or EHS), who is bound by professional confidentiality and by contract with ACT.

• Service providers. Hosting, communications and technical providers who process data on our instructions under written contracts containing confidentiality and security obligations. They may not use your data for their own purposes.

• Regulators and authorities. Where we are legally required to disclose, or to protect someone's vital interests.

We do not sell or rent personal information.

9. Where your data is stored, and for how long

All participant health data relating to services delivered in the UAE is hosted and processed in line with the ICT Health Law. We do not transfer UAE health data outside the UAE without the approvals required by law. Where any transfer of other personal data is necessary, we apply appropriate safeguards such as approved contractual clauses.

Data Retention

Data: Your report in the online viewer Retention Period: One (1) month after the Event, unless extended storage has been purchased. Download your PDF before then if you want to keep it.

Data: Identifiable profile and screening data Retention Period: Deleted or anonymised within 180 days of the end of the access period, unless a longer period is required by law or clinical record-keeping rules

Data: Contact details held for opt-in updates Retention Period: Until you unsubscribe or withdraw consent, or after 24 months of no engagement.

Data: Consent records Retention Period: 6 years, as evidence that consent was properly obtained.

Data: De-identified data Retention Period: Retained indefinitely; no longer personal data and cannot be linked back to you.

Data: Security and access logs Retention Period: 12 months

10. Your rights

Subject to applicable law, you have the right to: access your data and receive a copy; correct inaccurate data; have your data erased; restrict or object to processing; receive your data in a portable format; opt out of any communication that is not a service message; and withdraw your consent at any time. Withdrawing consent stops further processing but does not affect what was done lawfully beforehand, and does not extend to de-identified records already created.

To exercise any right, contact: data_privacy@alliancecaretech.com. We respond within the timeframes required by applicable law. You may also lodge a complaint with the UAE Data Office or, where applicable, the ADGM Office of Data Protection.

11. Security

Each participant has a secure profile and a unique ID. We apply encryption in transit and at rest, role-based access controls on a least-privilege basis, logging and monitoring, personnel confidentiality obligations, and regular security assessments. Access to identifiable participant data within ACT is limited to the small number of personnel who need it to deliver the service or provide support.

If a personal data breach occurs that is likely to result in a risk to you, we will notify the relevant regulator and, where required, you, without undue delay.

12. Children

The Platform and the Events are intended for adults aged 18 and over. We do not knowingly screen or collect data from anyone under 18 without verified parental or guardian consent.

13. Changes to this notice

The current version of this notice is always published at alliancecaretech.com/privacy. We may update it from time to time. Updates take effect when posted, and the version number and effective date are shown at the top of this notice. We do not notify participants individually of routine updates, so please review the published version before each screening.

You accept this notice each time you create a profile for an Event, so the version in force at your Event governs the data collected at that Event. If we later want to use data we already hold about you for a materially different purpose, we will ask for your consent separately rather than relying on a website update alone.

PART 2 — TERMS & CONDITIONS OF USE

1. Acceptance

By creating a profile and using the Catalyst Assess platform, or by taking part in an ACT wellness screening Event, you agree to these Terms & Conditions and to the Privacy Notice in Part 1. If you do not agree, please do not use the Platform or take part in an Event.

2. What the service is — and what it is not

The screenings identify the risk or likelihood of certain conditions. They are wellness screenings, not medical diagnoses, and they are not a substitute for medical advice, examination or treatment. Only a qualified physician can diagnose a medical condition.

A result that appears normal does not mean you are free of a condition, and an elevated indicator does not mean you have one. Always consult a qualified healthcare professional about any health concern, and never delay seeking medical advice because of a screening result.

If a result indicates a potential urgent or critical concern, ACT and its clinical partners will follow an escalation protocol and contact you. You remain responsible for seeking appropriate medical care.

3. Voluntary participation

Participation is voluntary. You may skip any screening, decline any question, stop at any point, or withdraw afterwards, without giving a reason and without any consequence to your employment, insurance or benefits. Your Sponsor is not informed of your decision.

4. Your profile and account

You must provide accurate information and keep your access credentials confidential. Results are interpreted against the demographic details you provide, so inaccurate information may produce an inaccurate result. Tell us promptly at data_privacy@alliancecaretech.com if you believe someone else has accessed your profile.

5. Access to your results

Your report is available in the online viewer and as a PDF download for one (1) month after your Event, unless extended storage has been arranged. Download and save your PDF within that period if you wish to keep a copy. After the access period the report is removed from the viewer.

6. Communications

While you are taking part, we send service messages about your Event, your profile and your report, as described in section 7 of the Privacy Notice. Promotional messages about future Events and other ACT services are sent only if you opt in, and you can unsubscribe at any time.

7. Acceptable use

• Use the Platform only for lawful purposes and only for your own screening.

• Do not attempt to access another participant's profile, report or data.

• Do not probe, scan, disrupt or reverse-engineer the Platform, or introduce malicious code.

• Do not scrape, copy or redistribute Platform content other than your own report.

We may suspend access where we reasonably believe these terms have been breached or where required for security.

8. Intellectual property

The Platform, the screening technology, the AI models, and all content, designs, logos and documentation are owned by ACT or its licensors and are protected by intellectual property law. You may use, keep and share your own report freely. Nothing else may be reproduced, distributed, modified or used to develop a competing service without ACT's written permission.

Where the Platform is presented under a Sponsor's branding, that branding belongs to the Sponsor and does not transfer any rights in the Platform.

9. Third-party clinical services

Optional consultations are delivered by independently licensed clinical partners contracted by ACT. Those clinicians are solely responsible for the clinical content of any advice, interpretation or follow-up they provide, and for their own professional and regulatory obligations.

10. Availability

We aim to keep the Platform available but do not guarantee uninterrupted access. The Platform, screening equipment and reports are provided on an “as is” basis to the fullest extent permitted by law, without warranties as to diagnostic accuracy or fitness for a particular medical purpose.

11. Limitation of liability

To the fullest extent permitted by law, ACT is not liable for any indirect, incidental or consequential loss arising from your use of the Platform or participation in an Event, or for any decision you take, or fail to take, on the basis of a screening result. Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud, or for any liability that cannot lawfully be excluded.

12. No fee to participants

Where an Event is arranged and paid for by a Sponsor, no fee is payable by you. Any optional service you purchase directly, such as extended report storage or additional screeining options, is subject to the terms presented at the point of purchase.

13. Termination

You may stop using the Platform at any time and ask us to close your profile. We may suspend or end your access if these terms are breached or if the underlying arrangement with the Sponsor ends. Sections on intellectual property, limitation of liability and governing law survive termination.

14. Governing law

These Terms & Conditions and the Privacy Notice are governed by the laws applicable in the Abu Dhabi Global Market (ADGM), together with applicable UAE federal health and data protection law. Disputes are subject to the exclusive jurisdiction of the ADGM Courts.

15. Changes to these terms

The current version of these Terms is always published at alliancecaretech.com/terms. We may update them from time to time and updates take effect when posted, with the version number and effective date shown at the top. We do not notify users individually of updates. Your continued use of the Platform, or participation in a further Event, constitutes acceptance of the version published at that time.

16. Contact

Data protection and privacy: data_privacy@alliancecaretech.comGeneral enquiries: act@alliancecaretech.com • +971-58-550-9179

Alliance Care Technologies International Limited, Al Khatem Tower, 16th Floor, 118-19, Abu Dhabi Global Markets Square, Al Maryah Island, Abu Dhabi, UAE.

By creating a profile or taking part in an Event, you confirm that you have read and accepted this Privacy Notice and these Terms & Conditions of Use.