Viving Personal Data Processing Policy

At Viving we recognize the importance of protecting personal data and the right of every person to know, update, and control the information they share with us.

That is why the purpose of this Personal Data Processing Policy is to clearly explain how we collect, use, store, protect, and, in general, process the personal data we obtain through our website and in the course of our activities and services.

Personal data will be processed in accordance with the principles of legality, purpose, freedom, transparency, security, and confidentiality established in the applicable personal data protection regulations.

By interacting with our website or voluntarily providing their information, the data subject accepts the processing of their data under the terms described here. At VIVING.CO we handle personal information with responsibility, respect, and commitment, always seeking to ensure the proper and secure use of the data our users entrust to us.

VIVING.CO acts as the data controller under the applicable personal data protection regulations, which means that it decides on the collection, use, storage, circulation, and deletion of personal information.

Data controller contact details:

• Name or company name: PVL Performance Wellness & fitness coaching S.A.S.
• Tax identification number: 901948864 - 4
• Principal place of business: Bogotá, Colombia
• Contact email for data protection matters: hola@viving.co
• Website: https://viving.co/

Through the channels above, data subjects may exercise their rights regarding the processing of their personal data.

This Personal Data Processing Policy applies to all personal data collected, stored, used, transmitted, or otherwise processed by VIVING.CO in the course of its activities.

This policy covers the information of users, potential users, customers, and other natural persons whose data is processed by VIVING.CO through the website, the mobile application, registration forms, contracting processes, telehealth services, wellness programs, and tests performed by partner laboratories.

It includes both general personal data and sensitive data, especially health-related data, such as laboratory test results, medical history reported by the user, tracking metrics recorded in the application, and any information necessary for support and analysis within the contracted services.

The policy also governs data processing carried out by third parties acting on behalf of VIVING.CO, such as partner laboratories, technology providers, and health professionals involved in providing the services, who must comply with the confidentiality and data protection standards required by the applicable regulations.

For the purposes of this policy, the following terms mean:

• Authorization: Prior, express, and informed consent given by the data subject for the processing of their personal data.
• Personal data: Any information that identifies or can be used to identify a natural person.
• Sensitive data: Information that affects the data subject's privacy or whose misuse may lead to discrimination. In the case of VIVING.CO, it especially includes health-related data, such as laboratory test results, medical history, biometric metrics, and other clinical information.
• Health data: Information related to a person's physical or mental condition, including medical test results, diagnoses, history, treatments, biometric indicators, and data derived from the tracking carried out through the platform.
• Data processor: A natural or legal person that processes personal data on behalf of the data controller. In the case of VIVING.CO, these may be partner laboratories, technology providers, or health professionals acting under its instructions.
• Data controller: A natural or legal person that decides on the database and the processing of personal data. For the purposes of this policy, the data controller is VIVING.CO.
• Data subject: A natural person whose personal data is processed.
• Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, analysis, transmission, transfer, or deletion.
• Transmission: Processing of personal data that involves communicating it within or outside the national territory when its purpose is for the data processor to carry out processing on behalf of the data controller.
• Transfer: Sending personal data to a recipient that acts as a data controller, located within or outside the country

VIVING.CO may collect and process the following categories of personal data:

• Identification data: first name, last name, type and number of identity document, date of birth, and other data necessary for registration.
• Contact data: email address, phone number, city, and country of residence.
• Billing and payment data: information necessary to process payments, issue invoices, and fulfill contractual obligations.
• Platform usage data: information related to the user's interaction with the website and the application, including access logs, browsing, and use of digital tools.
• Data from connected devices and apps: when the data subject voluntarily connects a watch, ring, or training app (for example, Garmin Connect, WHOOP, Oura, Polar, or TrainingPeaks), we receive data such as sleep, heart rate, heart rate variability, activity, and workouts. Data from some of these brands is subject to its own rules, described in the "Device data that is not processed with artificial intelligence" section.
• Health data (sensitive data): information related to the user's health, including but not limited to:
  • Results of laboratory tests performed by partner laboratories.
  • Medical information provided directly by the user.
  • Health history.
  • Biometric indicators and metrics recorded in the application.
  • Information derived from tracking and support in wellness and longevity programs.

Providing sensitive data is voluntary; however, in some cases it may be necessary for the proper provision of the contracted services.

The personal data collected by VIVING.CO will be processed for the following purposes:

• Managing the user's registration and account creation.
• Enabling access to, use of, and administration of the platform and the contracted services.
• Processing payments and managing the corresponding billing.
• Coordinating and analyzing the results of tests performed by partner laboratories.
• Tracking the user's health and wellness status through the application.
• Providing support, guidance, and telehealth services through the partner professional team.
• Generating personalized analyses, reports, metrics, and recommendations within the scope of the contracted plan.
• Improving the services, technology tools, and user experience.
• Complying with legal, regulatory, and contractual obligations.
• Responding to inquiries, requests, complaints, or claims.
• Sending information related to the service, news, and updates and, where additional authorization exists, informational or commercial communications about VIVING.CO products and services.
• Conducting studies, statistical analyses, and scientific research using data that has been previously and irreversibly anonymized, in order to contribute to the development of knowledge in wellness, preventive health, and longevity. This purpose will apply only to the data of data subjects who have given express and specific authorization for it, through the mechanism enabled on the platform. Data used for these purposes will be completely dissociated from the data subject's identity and cannot be re-identified.

VIVING.CO uses artificial intelligence models and its own algorithms to analyze the user's health and wellness data, including laboratory test results, biometric indicators, and tracking metrics. The purpose of this automated processing is to generate personalized analyses, identify patterns, calculate wellness indicators (such as estimated biological age), and produce recommendations within the scope of the contracted plan. The results generated by these models are informational and for guidance purposes only, and do not constitute a medical diagnosis or a clinical prescription. This does not apply to the data described in the "Device data that is not processed with artificial intelligence" section.

Under no circumstances will the data be used for purposes other than those described here without the data subject's prior authorization.

Data we receive from Garmin Connect, WHOOP, Oura and Strava through their APIs is used only to show it to the account holder in the app and in their messages, to show it to their coach where the brand allows it and the account holder authorizes it, and in calculations performed by our own code using rules written and reviewed by people. This data, and any data derived from it, is not shared with external artificial intelligence providers, is not processed with artificial intelligence models, and is not used to train, fine-tune or evaluate any model. This applies even if the account holder has authorized the use of artificial intelligence for the rest of their information. What the account holder writes or uploads themselves, and data from sources that allow it with their consent (for example, Apple Health), is governed by the "Purposes of processing" section.

Before connecting Apple Health, VIVING.CO asks the data subject, inside the app and in an express and separate way, for their authorization to process the data they share from Apple Health with artificial intelligence. With that authorization, this data (steps, sleep, heart rate, resting heart rate, heart rate variability, workouts and their distance, calories, weight and body mass index, VO2 max, respiratory rate, blood oxygen and body temperature) is processed with Anthropic, PBC, VIVING.CO's artificial intelligence provider, acting as a data processor, for the sole purpose of building and explaining the data subject's plan. Apple Health data is not used for advertising and is not sold.

If the data subject does not give this authorization, or from the moment they withdraw it, their Apple Health data is still shown in the app and used in calculations performed by our own code, but it is not sent to any artificial intelligence provider. The data subject can withdraw this authorization at any time from "Your connections", on the Apple Health card, with "Withdraw AI permission". Withdrawing it does not delete their data. They can also stop sharing Health data from their iPhone Settings (Health › Data Access & Devices).

VIVING.CO will request the data subject's prior, express, and informed authorization to process their information, in accordance with the purposes described in this Policy.

Authorization may be given through physical, electronic, or digital means, including acceptance through checkboxes, electronic signature, acceptance of the terms and conditions, or any other mechanism that leaves a record of consent.

In the case of sensitive data, especially health-related data such as laboratory test results, medical history, biometric metrics, or information derived from the tracking carried out in the application, VIVING.CO will request the data subject's express and specific authorization.

Providing sensitive data is voluntary. However, the data subject understands that providing certain health information may be necessary for the proper provision of the contracted services. If the data subject does not authorize the processing of this data, VIVING.CO may be unable to provide the services in whole or in part.

The authorization given by the data subject implies acceptance of the processing of their data for the stated purposes and may be revoked at any time, except where a legal or contractual obligation prevents its immediate deletion.

Acceptance of this Policy and of the Terms and Conditions constitutes proof of the authorization given by the data subject for the processing of their personal data.

The data subject has the right to exercise the following rights over their data at any time:

• Access: To know which of their personal data is being processed by VIVING.CO and to obtain information about the purposes of the processing.
• Update and correction: To request the correction or update of their personal data when it is inaccurate, incomplete, or out of date.
• Erasure or deletion: To request the deletion of their personal data when they consider that it is not necessary for the authorized purposes, unless a legal or contractual obligation prevents its immediate erasure.
• Revocation of authorization: To withdraw, in whole or in part, the authorization given for the processing of their personal data. In this case, revocation may mean that they can no longer use the VIVING.CO services that depend on that data.
• Information about the use of data: To request details about how their personal data has been used or shared.
• Filing complaints: To submit claims to VIVING.CO or to the competent data protection authority when they consider that their rights have not been respected.

These rights may be exercised free of charge, unless the law allows a reasonable fee to cover administrative costs.

To exercise their rights regarding their personal data, the data subject must follow this procedure:

• Communication channel: Send the request to VIVING.CO's official email address: hola@viving.co
• Minimum information required: The request must include:
  • The data subject's full name.
  • Up-to-date contact details.
  • A clear and precise description of the right they wish to exercise (access, update, erasure, revocation, information, complaint, among others).
  • Documents proving the data subject's identity, if requested.
• Handling of the request: VIVING.CO acknowledges receipt of the request within a reasonable period of approximately 2 days and will address it based on the applicable regulations and the complexity of the request.
• Response time: Requests will be addressed within a reasonable period of 10 to 15 days or according to the time limits set by law, ensuring that the data subject receives clear information about the steps taken.
• Final response: VIVING.CO will notify the data subject of the decision made, the information provided, the correction made, or the reasons why the request could not be fulfilled, in accordance with current regulations.
• Limitations: Rights may be limited only when there is a legal or contractual obligation or a risk to third parties, in which case the data subject will be informed clearly and in a timely manner.

VIVING.CO adopts reasonable and appropriate technical, administrative, and organizational measures to protect data subjects' personal data, especially data considered sensitive, such as health-related data.

These measures are aimed at preventing the loss, misuse, unauthorized access, alteration, disclosure, or destruction of information. Among other actions, VIVING.CO implements access controls, authentication mechanisms, confidentiality protocols, secure storage, and good practices in handling clinical and digital information.

Access to personal data is restricted solely to authorized personnel, partner professionals, and providers who need that information to perform their duties, under confidentiality obligations.

However, the data subject acknowledges that, although VIVING.CO adopts adequate security standards, no technology system is completely infallible. In the event of a security incident that compromises personal data, VIVING.CO will act in accordance with the applicable regulations and take the necessary measures to mitigate the risks and manage the situation responsibly.

For the proper operation of the platform and the provision of the contracted services, VIVING.CO may transmit or transfer personal data to partner third parties or providers involved in its operations.

Data transmission occurs when a third party acts on behalf of VIVING.CO as a data processor, under its instructions and with a confidentiality obligation. These may include, among others:

• Partner laboratories responsible for collecting and processing medical tests.
• Health professionals who are part of the partner team.
• Technology providers, cloud storage services, and information processing platforms.
• Payment processors and billing services.

Data may be transferred when the third party acts as an independent data controller, always in compliance with the applicable regulations.

If data is transmitted or transferred to other countries, VIVING.CO will verify that the recipient has adequate levels of data protection or that there are contractual safeguards ensuring the protection of the information, especially in the case of sensitive health-related data.

In all cases, VIVING.CO will require its partners and providers to comply with security and confidentiality standards appropriate to the nature of the information processed.

VIVING.CO will retain personal data only for as long as necessary to fulfill the purposes for which it was collected, as well as to meet any applicable legal, contractual, regulatory, or administrative obligations.

In the case of health-related data, including laboratory test results and tracking records made through the application, the information may be retained for as long as necessary to ensure continuity of service, proper support for the user, and compliance with legal obligations regarding health regulation or consumer protection.

Once the purpose of the processing has been fulfilled, or when the data subject requests the deletion of their data and there is no legal or contractual duty requiring its retention, VIVING.CO will securely delete, anonymize, or block the information.

Where the data subject has expressly authorized the use of their data for scientific research purposes, VIVING.CO may retain the information in an irreversibly anonymized format, indefinitely, for the development of studies, analysis models, and the improvement of methodologies. This anonymized data does not constitute personal data under Colombian Law 1581 of 2012, as it does not allow the direct or indirect identification of the data subject

Information will be retained under strict security and confidentiality measures, especially in the case of sensitive data.

VIVING.CO guarantees the confidentiality of the information shared by users in connection with the contracted services, including support processes, wellness programs, telehealth services, analysis of laboratory results, and tracking carried out through the application.

Information related to health status, medical history, test results, and any other sensitive data will be handled with strict confidentiality and will only be accessible to authorized personnel, partner professionals, and providers who need to know it for the proper provision of the service, under confidentiality obligations.

Telehealth or remote support sessions will not be recorded or disclosed without the user's prior and express authorization, unless required by law.

VIVING.CO implements technical and administrative measures to protect the privacy of the processes carried out within the platform. However, the user acknowledges that the use of digital services involves risks inherent to electronic communications.

It is the user's responsibility to adequately protect their access credentials, passwords, devices, and any information they wish to keep confidential. VIVING.CO will not be responsible for unauthorized access resulting from the user's negligence in safeguarding their passwords or personal information.

Likewise, users agree to act with respect and confidentiality regarding any information they may have access to within group or collaborative spaces offered by the platform.

VIVING.CO uses cookies and similar technologies on its website and application to improve the user experience, facilitate navigation, and optimize the operation of the platform.

Cookies are small text files that are stored on the user's device when they visit a website. These files make it possible to remember preferences, recognize the device, analyze usage patterns, and offer personalized content or features.

VIVING.CO may use cookies to:

• Enable the proper technical operation of the site.
• Remember the user's preferences and settings.
• Analyze the use of the platform for statistical purposes and to improve the service.
• Facilitate authentication and security processes.

By browsing the Site, the user accepts the use of cookies in accordance with this Policy. However, they may configure their browser to reject or delete cookies at any time. Please note that disabling certain cookies may affect the proper operation of the platform.

If third-party analytics tools or technology services that use cookies are used, VIVING.CO will seek to ensure that they meet adequate data protection standards.

VIVING.CO may modify this Personal Data Processing Policy at any time in order to update it, improve its processes, or comply with regulatory changes.

Changes will be published on the website, indicating the date of last update, and will take effect upon publication, unless another date is expressly indicated.

When changes are substantial and significantly affect data subjects' rights, VIVING.CO will inform users through the contact details it has on record, so that they can review and accept the changes.

Continued use of the website or of VIVING.CO's services after the changes are published implies acceptance of the updated policy.

The processing of personal data by VIVING.CO will be governed primarily by Law 1581 of 2012 of the Republic of Colombia. However, for users residing in the United States of America or the European Union, VIVING.CO will seek to provide commercially reasonable levels of protection aligned with international privacy standards, without this implying a waiver of the application of Colombian law as the law of the contract.

Any dispute, controversy, or claim related to privacy, the processing of personal data, security breaches, or the exercise of data subjects' rights (Habeas Data) that cannot be resolved through the internal inquiry or claim procedure before VIVING.CO will be finally resolved through international arbitration decided at law.

• Seat of Arbitration: The seat of the arbitration will be the city of Bogotá D.C., Colombia.
• Rules: The arbitration will be conducted in accordance with the International Commercial Arbitration Rules of the Arbitration and Conciliation Center of the Bogotá Chamber of Commerce, in force on the date the request for arbitration is filed.
• Language: The official language of the proceedings will be Spanish.
• Tribunal: The Tribunal will consist of one (1) sole arbitrator, appointed by mutual agreement of the parties from the official list of the aforementioned Arbitration Center. Failing such agreement, the arbitrator will be appointed by the Center itself.
• Costs: The costs of the arbitration and the arbitrator's fees will initially be borne by the party filing the claim, without prejudice to what the Tribunal decides in the final award regarding the allocation of costs.

By accepting these terms, the User voluntarily waives their right to sue before ordinary judges or state courts in their country of residence, accepting that arbitration in Bogotá is the sole competent forum.

This Personal Data Processing Policy takes effect on the date of its publication on the VIVING.CO site and will remain in force for as long as users' personal data is processed.

Any updated version of this policy will fully replace previous versions as of its publication date, unless another application date is expressly indicated.

Last updated: October 14, 2026