Information Security Policy (ENS)

Approval and entry into force

Text approved by the Management of EUREKA FERTILITY on April 28, 2026. This Information Security Policy is effective from that date until it is replaced by a new Policy.

Introduction

EUREKA FERTILITY depends on ICT (Information and Communication Technologies) systems to achieve its objectives. These systems must be managed diligently, taking the appropriate measures to protect them against accidental or deliberate damage that may affect the security—confidentiality, integrity, availability, traceability, and authenticity—of the information processed or the services provided.

The objective of information security is to guarantee the quality of information and the continuous provision of services by acting preventively, monitoring daily activity, and reacting promptly to incidents.

ICT systems must be protected against rapidly evolving threats with the potential to impact the confidentiality, integrity, availability, intended use, and value of information and services. To defend against these threats, a strategy that adapts to changes in environmental conditions is required to ensure the continuous provision of services. This implies that departments must apply the minimum security measures required by the National Security Scheme (ENS), as well as continuously monitor service delivery levels, track and analyze reported vulnerabilities, and prepare an effective response to incidents to ensure the continuity of the services provided.

The different departments must ensure that ICT security is an integral part of each stage of the system's life cycle, from its conception to its withdrawal from service, including development or acquisition decisions and operational activities. Security requirements and funding needs must be identified and included in planning, in requests for proposals, in tender specifications, and in contracts for ICT projects.

Personnel must be prepared to prevent, detect, react to, and recover from incidents.

Prevention

Departments must avoid, or at least prevent as far as possible, information or services from being harmed by security incidents. To this end, departments must implement the minimum security measures determined by the ENS, as well as any additional controls identified through a threat and risk assessment. These controls, along with the security roles and responsibilities of all personnel, must be clearly defined and documented.

To ensure compliance with the policy, departments must:

• Authorize systems before they become operational.
• Regularly evaluate security, including assessments of routinely made configuration changes.
• Request periodic review by third parties in order to obtain an independent evaluation.

Detection

Given that services can degrade rapidly due to incidents, ranging from a simple slowdown to a complete halt, services must monitor operations continuously to detect anomalies in service delivery levels and act accordingly. Mechanisms for detection, analysis, and reporting will be established to reach managers regularly and whenever a significant deviation from pre-established normal parameters occurs.

Response

EUREKA FERTILITY shall:

• Establish mechanisms to respond effectively to security incidents.
• Designate a point of contact for communications regarding incidents detected within the organization or in other entities.
• Establish protocols for the exchange of incident-related information. This includes two-way communications with Computer Emergency Response Teams (CERT).

Recovery

To guarantee the availability of critical services, business continuity plans for ICT systems will be developed as part of the overall business continuity plan and recovery activities.

Scope

This Policy will be applicable and mandatory for the entire EUREKA FERTILITY organization, its resources, and the processes affected by the ENS, whether internal or external, linked to the entity through contracts or agreements with third parties.

All members of EUREKA FERTILITY affected by the scope of the ENS have the obligation to know and comply with this Information Security Policy and the corresponding security regulations, it being EUREKA FERTILITY's responsibility to provide the necessary means for the information to reach the affected personnel.

Mission

EUREKA FERTILITY's mission is to provide specialized online marketing and strategic consulting services for the assisted reproduction sector, guaranteeing the maximum visibility and reputation of our clients.

Aware of the sensitivity of the information we manage—which affects both the intellectual property of the clinics and the privacy of potential patients—our technical mission is to ensure the confidentiality, integrity, and availability of all information assets. We are committed to offering a secure digital environment that protects the flow of data between clinics and their patients, strictly complying with the National Security Scheme (ENS) to project an image of trust, ethics, and excellence in the field of reproductive health.

The Management of EUREKA FERTILITY has established an Information Security Management System in its organization based on Royal Decree 311/2022, of May 3, which regulates the National Security Scheme, addressing the following objectives:

• Guarantee Confidentiality in lead capture: ensure that personal and health data of potential patients, obtained through marketing campaigns and online forms, are accessed only by authorized personnel, preventing any leakage that affects the privacy of users.
• Ensure the Integrity of marketing strategies: protect the information and digital assets of our clients (assisted reproduction clinics) against unauthorized modifications, guaranteeing that the advertising and content published are always truthful and aligned with health regulations.
• Maintain the Availability of digital services: implement security measures that guarantee that capture platforms and campaign management systems are continuously operational, minimizing downtime so as not to harm our clients' investments.
• Specialized training in sensitive data: continuously train the entire marketing and support team in security best practices and in the processing of "special categories of data," ensuring they understand the legal and ethical responsibility of handling information in the assisted reproduction sector.

Regulatory Framework

The regulatory framework in which EUREKA FERTILITY carries out its activities, and in particular the provision of its electronic services to citizens, is made up of the following standards:

• Royal Decree 311/2022, of May 3, regulating the National Security Scheme
• Information security, cybersecurity and privacy protection — Information security management systems. Requirements. (ISO/IEC 27001:2022)
• Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (LOPDGDD)
• Royal Legislative Decree 1/1996, of April 12, approving the revised text of the Intellectual Property Law, regularizing, clarifying and harmonizing the current legal provisions on the matter.
• Royal Decree 255/2025, of April 1, regulating the National Identity Document.
• Law 34/2002, of July 11, on information society services and electronic commerce (LSSI-CE)
• Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 (hereinafter GDPR).

In addition to general security regulations, EUREKA FERTILITY adapts its information security processes to the specific requirements of the health and assisted reproduction sector, including:

• Law 14/2006 on Assisted Human Reproduction: regarding the protection of privacy and anonymity of users.
• Law 41/2002 on Patient Autonomy: for the secure management of data that may be part of the medical history.
• Health Advertising Regulations: ensuring that the information systems supporting marketing campaigns comply with the principles of ethics and legality required in the health sector.
• LSSI-CE 34/2002: for security in electronic communications and information society services.

Information Security Committee

• Information Manager: Natalia Álvarez Hernández
• Service Manager: Pedro Perles Roselló
• Security Manager: Carlos González Bustos
• Systems Manager: Javier Sánchez-Moreno Giner

Roles: Functions and Responsibilities

Information Manager

• Establish and approve the security requirements applicable to the service within the framework established in Annex I of Royal Decree 311/2022, of May 3, prior proposal by the Security Manager and/or Information Security Committee.
• Accept residual risk levels affecting the Service.
• Approve the Information Security Policy.
• Perform the evaluations referred to in Article 40 of the ENS (security categories), as well as, where appropriate, their subsequent modification.
• Receive information about incidents and the actions taken for their resolution.
• Determine the criteria for assigning and modifying the required security level for each piece of information, and be responsible for its documentation and formal approval.
• Establish information requirements/levels regarding security, taking into account the Security Policy.
• Assume ultimate responsibility for any error or negligence that leads to a confidentiality or integrity incident.
• Approve the Business Continuity Plan.
• Approve the information management system.
• Provide financial resources for Information Security.

Service Manager

• Establish and approve the security requirements applicable to the service within the framework established in Annex I of Royal Decree 311/2022, of May 3, prior proposal by the Security Manager and/or Information Security Committee.
• Undertake and direct the information security policy.
• Provide financial resources for Information Security.
• Perform the evaluations referred to in Article 40 (security categories), as well as, where appropriate, their subsequent modification.
• Be informed of incidents and the actions carried out for their resolution.
• Establish service requirements/levels regarding security, taking into account the Security Policy.

Security Manager

• Determine the security category of the system, based on the evaluations of the Information and Service Managers.
• Draft and approve the Statement of Applicability, addressing the requirements of the Information and Service Manager.
• Maintain the security of the information handled and the services provided by the ICT systems in their area of responsibility.
• Determine the decisions to satisfy the information and service security requirements, supervise the implementation of the necessary measures to ensure the requirements are met, and report on these matters.
• Formalize and approve the selected measures from Annex II in the Statement of Applicability, including compensatory or complementary surveillance measures and their correspondence with the aforementioned Annex II measures.
• Verify that the information security measures have been adequately implemented by the System Manager.
• Analyze first, second, or third-party Audit reports that refer to the systems within their area of competence, and present their conclusions to the System Manager and, where appropriate, to the Information Security Committee.
• Explicitly approve changes involving a HIGH level of risk prior to their implementation regarding data protection set by the data controller or data processor, with the advice of the DPO.
• Participate in drafting and proposing the Information Security Policy and the procedures, regulations, and instructions in application of the ENS.
• Analyze the risks before deploying artificial intelligence systems in the entity, addressing the evaluations of the Information and Service Manager and, where appropriate, the Data Protection Officer, and supervise their deployment.
• Promote training and awareness regarding information security within their area of responsibility.
• When the system processes personal data, the Security Manager will gather the data protection requirements.
• Conduct or promote regular self-assessments or audits to verify compliance with the ENS.
• In the management of cyber incidents, together with the entity's information and service managers, classify their severity according to the CCN-STIC 817 Guide, acting as a point of contact with competent security authorities and, depending on the roles assigned in the Policy, may notify them, where appropriate, to the CCN-CERT. When notification to the reference CSIRT is necessary, this must be done without undue delay and immediately, without prejudice to the gradual submission of expanded information.
• Verify that the established security measures are appropriate for the protection of the information handled and the services provided.
• Analyze, complete, and approve all documentation related to system security.
• Monitor the security status of the system, which may be provided by specific elements, such as security event management tools and auditing mechanisms implemented in the system.
• Support and supervise the investigation of security incidents from notification to resolution.
• Prepare the periodic security report for the entity's senior management, including the most relevant incidents of the period.
• The Security Manager will collaborate with the Entity's Data Protection Officer in the management of incidents affecting personal data and, where appropriate, in the notification to the control authorities and affected persons.

Systems Manager

• Paralyze or suspend access to information or service provision if aware that they present serious security deficiencies.
• Develop, operate, and maintain the information system throughout its entire life cycle.
• Develop the necessary operational procedures.
• Define the topology and management of the Information System, establishing usage criteria and the services available on it.
• Ensure that specific security measures are properly integrated into the overall security framework.
• Provide the Security Manager with advice for determining the System Category.
• Collaborate, if required, in the drafting and implementation of security improvement plans and, if applicable, continuity plans.
• Carry out the functions of the system security administrator:
• Manage authorizations granted to system users, in particular privileges granted, including monitoring the activity carried out in the system and its correspondence with what is authorized.
• Approve changes to the current configuration of the Information System.
• Ensure that established security controls are strictly complied with.
• Ensure that approved procedures are applied to manage the Information System.
• Register or deregister users.
• Keep a log of incoming and outgoing media.

Designation Procedures

General responsibility for information security shall fall upon the Security Manager, with ultimate responsibility resting with the Information Security Committee and Management as the ultimate head of the Information Security Management System. The appointment will be reviewed every 2 years or when the position becomes vacant.

Information Security Policy

It will be the mission of the ICT Security Committee to annually review this Information Security Policy and propose its revision or maintenance. The Policy will be approved by the Management of EUREKA FERTILITY and disseminated so that all affected parties are aware of it.

Personal Data

EUREKA FERTILITY processes personal data. The security document COD. 105 RECORDS OF PROCESSING ACTIVITIES, to which only authorized persons will have access, lists the affected files and corresponding managers. All EUREKA FERTILITY information systems will adjust to the security levels required by regulations for the nature and purpose of the personal data collected in the aforementioned Security Document.

Risk Management

All systems subject to this Policy must perform a risk analysis, evaluating the threats and risks to which they are exposed. This analysis will be repeated:

• Regularly, at least once a year.
• When the information handled changes.
• When the services provided change.
• When a serious security incident occurs.
• When serious vulnerabilities are reported.

For the harmonization of risk analyses, the ICT Security Committee will establish a baseline assessment for the different types of information handled and the different services provided. The ICT Security Committee will dynamize the availability of resources to meet the security needs of the different systems, promoting horizontal investments.

Development of the Information Security Policy

This Information Security Policy complements EUREKA FERTILITY's security policies in different areas:

• POL-01 Access Control Policies
• POL-02 Password Policy
• POL-03 Acceptable Use of Assets Policy
• POL-04 Cryptographic Control Policies
• POL-05 Development Policy
• POL-06 Acceptable Use of Cloud Services Policy

The security regulations will be available to all EUREKA FERTILITY members who need to know them, particularly those who use, operate, or administer information and communications systems.

This Policy will be developed through security regulations that address specific aspects.

The Information Security Policy will be available on the organization's website.

Personnel Obligations

All members of EUREKA FERTILITY have the obligation to know and comply with this Information Security Policy and the Security Regulations, it being the responsibility of the ICT Security Committee to provide the necessary means for the information to reach those affected. All members of EUREKA FERTILITY will attend an ICT security awareness session at least once a year.

A continuous awareness program will be established to attend to all members of EUREKA FERTILITY, particularly new hires. Personnel with responsibility in the use, operation, or administration of ICT systems will receive training for the secure handling of systems to the extent they need it to perform their work. Training will be mandatory before assuming a responsibility, whether it is their first assignment or if it involves a change of job or responsibilities within it.

Third Parties

When EUREKA FERTILITY provides services to other organizations or handles information from other organizations, they will be made aware of this Information Security Policy, channels for reporting and coordinating the respective ICT Security Committees will be established, and action procedures will be set up to react to security incidents.

When EUREKA FERTILITY uses third-party services or transfers information to third parties, they will be made aware of this Security Policy and the Security Regulations that apply to said services or information. Said third party will be subject to the obligations established in said regulations, being able to develop their own operational procedures to satisfy them.

Specific incident reporting and resolution procedures will be established. It will be guaranteed that third-party personnel are adequately aware of security matters, at least to the same level as established in this Policy.

When any aspect of the Policy cannot be satisfied by a third party as required in the previous paragraphs, a report from the Security Manager will be required detailing the risks incurred and how to treat them. Approval of this report by the managers of the affected information and services will be required before moving forward.

Valencia, April 28, 2026
Rev. 01