In all of Labfit's activities with regard to interaction with its customers and the provision of services, we guarantee the total confidentiality that we value as a fundamental criterion for maintaining the trust deposited in this company. This commitment, in which all employees and service companies contracted by Labfit are involved, guarantees the non-disclosure of customer identification, services provided and results thereof, except when expressly authorized by data subjects or imposed by legal or contractual obligations.

With respect to personal data (relating to the identification of living individuals), Labfit, its employees and service providers contracted by Labfit comply with the provisions of the General Regulation on Data Protection (RGPD - Regulation (EU) 2016 / 679 of the European Parliament and of the Council of April 27^th, 2016). Since the activity of Labfit mainly involves commercial relations with companies (whose data are not covered by the aforementioned Regulation), the points - that compliance with this legislation refer to - within the scope of this activity are the following:

- Personal data of employees of companies and other entities with which Labfit establishes commercial relations (for example, registered email addresses) are not disclosed to other entities, unless they are explicitly authorized to do so.

- The personal data of employees fall into a contractual relationship that is not covered by the Regulation for the purposes for which they are intended. These data are not treated, dispensed or transmitted outside the scope described unless explicit authorization exists for this.

- In research projects involving the participation of volunteers (or biological samples of volunteers) the collection, processing and storage of personal data is predefined taking into account the minimization of the data collected and submitted for consideration by a suitable Ethics Committee. In such cases, and in accordance with the principle of transparency, the Free and Informed Consent document clearly explains in simple and accessible language what personal data collected during the investigation, its treatment, retention period and storage, while safeguarding restricted and controlled access to which these data are subject in Labfit. In cases where treatment serves multiple purposes, consent is required for all of these purposes. In all cases, the data are not provided to third parties, nor stored in a database, without the explicit authorization of the volunteers.

- The system of collection and archiving of personal data implemented in Labfit follows the principles of maximizing security and protecting the privacy of citizens, thus maintaining the minimum risk to the rights of the holders of this data. In case of breaches of personal data security, the risk of notification to the National Data Protection Commission, although unlikely, will be assessed by Labfit according to the RGPD.

- With respect to the personal data received in the context of employment applications (programmed or spontaneous), Labfit defines that the curricula accessed are stored for a maximum period of one year, at the end of which the documents are destroyed and the contacts deleted from the system. Candidates will be informed by email (by the administration or administrative personnel) of the procedures implemented at Labfit regarding this processing of personal data.

- The elimination of paper documents containing personal data is carried out by destruction of documents that guarantees the non-identification of the holders. The deletion of digital files is performed by permanently deleting the files from the memory of the computer media.

- The RGPD provides that citizens can request the deletion of their personal data from the database where they are inserted (right to forget). In order to satisfy this request, the owner must contact Labfit directly (in writing - email or postal address) formally requesting this process. However, the holder must take into account that this elimination will never have retroactive effect on documents already issued (for example study reports) nor will it include information that Labfit is obliged to preserve in the context of the management of the study carried out.

- If applicable and, when formally requested, the individual information will be properly organized in order to be transferred to the destination that the applicant, being himself, understand.

- In addition to forgetting / deleting data and their portability, owners of personal data will be freely provided to Labfit, the possibility of access (check which personal data of the holder is in the possession of Labfit), rectification (correction of data that if they are wrong or outdated) or limitation of the processing of the same, being enough its formal request as described for the forgetfulness of data.