KUALIFY PRIVACY NOTICE

Last updated: September 8, 2026

Non-binding translation. This English text is provided for convenience only. The binding version of this document is the Spanish one (`Aviso de Privacidad de Kualify`). In the event of any discrepancy, the Spanish version prevails.

At Kualify ("we", "our"), the privacy and security of your data are our highest priority. This Privacy Notice explains how we collect, use, disclose and protect your personal information, in strict compliance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and the European Union's General Data Protection Regulation (GDPR).

1. INFORMATION WE COLLECT

To provide our Service, we collect the following types of data:

• Identification and Contact Data: Name, email address, login credentials.
• Health, Biometric and Physical Data: Information about your weight, body metrics, heart rate, sleep patterns, body photographs for progress tracking, and any other health information you choose to enter.
• Technical and Usage Data: IP address, device type, operating system, and data about how you interact with our application.

2. "CHINESE WALL": ABSOLUTE PRIVACY OF SENSITIVE DATA

Kualify enforces a strict "Chinese Wall" policy with respect to your confidential information.

EXPLICIT PROHIBITION ON SHARING WITH THIRD PARTIES FOR ADVERTISING PURPOSES: It is categorically prohibited to share, sell, rent or transfer, under any circumstance, your Health Data, Biometric Data and Body Photographs to advertising platforms, including but not limited to Google AdMob, Meta Ads, or any other third party for marketing, profiling or targeted advertising purposes.

Your sensitive data is encrypted and used solely and exclusively to deliver the service, generate personal analytics inside the app, and improve your experience in Kualify.

3. USE OF ARTIFICIAL INTELLIGENCE AND THIRD-PARTY PROVIDERS

Kualify generates and adapts your nutrition and training plans using artificial intelligence models operated by external technology providers. As this is an essential component of the Service, we expressly inform you of the following:

a) AI providers involved (data processors).

• Google LLC / Google Cloud (Gemini API and Vertex AI): generation and adaptation of your plans, as well as the analysis of any images you voluntarily choose to submit (progress photographs, photographs of menus or recipes).
• OpenAI, L.L.C.: generation of vector representations (*embeddings*) used exclusively to search for and match exercises within our internal catalogue.

These providers act as data processors on Kualify's behalf, subject to data processing agreements (DPAs) and, where an international transfer applies, to standard contractual clauses.

b) Minimisation and de-identification of transmitted data. The data sent to the AI providers is limited to what is strictly necessary to deliver the service (dietary preferences, goals, body measurements, training history and, where applicable, the images you upload). Under no circumstance is your name, email address, login credentials or any other direct identifier transmitted: the information travels dissociated from your identity and encrypted using TLS 1.3.

c) Prohibition on model training. Kualify contracts these services under enterprise and API terms that expressly prohibit the provider from using your data to train, retrain or improve its public or general-purpose artificial intelligence models. Your data is processed transiently, for the sole purpose of returning the requested output, and is not incorporated into any public training corpus.

d) Express consent. By accepting the Terms and Conditions and this Privacy Notice, and by using the plan generation features, you grant your express consent to the automated processing described in this section, including the transfer of de-identified data to the AI providers listed above. You may withdraw this consent at any time; however, since plan generation constitutes the core functionality of the Service, such withdrawal will make it impossible to continue using it and shall take effect through the deletion of your account pursuant to Section 5.

e) Nature of generated content. Content produced by artificial intelligence is informational in nature and does not constitute medical advice, diagnosis or treatment. You retain the right not to be subject to decisions based solely on automated processing, and may request human intervention through the contact indicated in Section 8.

4. ARCO AND GDPR RIGHTS

You have full control over your personal information. Under the laws in force in Mexico and the GDPR framework, we guarantee you the following rights:

• Access: The right to know what personal data we hold about you, what we use it for, and the terms of that use.
• Rectification: The right to request correction of your personal information if it is outdated, inaccurate or incomplete.
• Cancellation / Right to be Forgotten: The right to have your records or databases removed from our application.
• Objection: The right to object to the use of your personal data for specific purposes.
• Data Portability: The right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.

5. RIGHT TO PERMANENT IN-APP DELETION

We make exercising your rights straightforward, with no administrative obstacles. You have the inalienable right to permanently delete your entire account and all associated data.

To do so, go to Settings > Privacy & Security > "Delete my account and all my data" inside Kualify. Upon confirming this action, all of your personal, health, biometric data and body photographs will be irrecoverably destroyed from our servers within a maximum of 72 hours.

6. DATA TRANSFERS

We will only share your data (strictly excluding Health and Biometric Data for advertising purposes, per Section 2) with essential infrastructure service providers (such as cloud hosting, e.g. AWS or Google Cloud) and with the artificial intelligence providers described in Section 3, which operate under rigorous confidentiality and data processing agreements.

7. SECURITY MEASURES

We implement military-grade security protocols, including AES-256 encryption for data at rest and TLS 1.3 for data in transit, ensuring that your information — especially data of an intimate or biometric nature — is protected against unauthorized access, alteration or destruction.

8. CONTACT AND EXERCISE OF RIGHTS

To exercise your ARCO rights, your rights under the GDPR, or for any question related to this notice, contact our Data Protection Officer: Email: info@kualifyapp.com