Privacy & data Security

Practices

Scope of data protection policy

Our Privacy Policy is publicy avaiable, check it here.

Rights provided to consumers regarding the control of their data

RD Saúde’s Data Privacy Policy ensures that data subjects have the right to access, correct, and delete their personal data. In addition, we provide a Data Subject Portal through which requests and inquiries can be submitted in a simplified manner. To learn more about how we process personal data, please refer to our 2025 Sustainability Report.

Measures to address data breaches

We have some Policies related to the topic, such as “Security Incident Management Policy” and “Security Incident Communication Policy to ANPD and Data Holders”. The materials, however, are not public as they contain strategic information from RD Saúde.

Frequency of audits of information security system

Periodic and independent audits are conducted to assess the maturity and effectiveness of our cybersecurity management.

Responsibility for privacy and data security

The Audit Committee of the Board of Directors is responsible for overseeing risk management activities, data management and protection, and cybersecurity.

Evidence of access control and protection of personal or sensitive data

Our current practices involve storing only personal data and/or sensitive personal data for the regular exercise of our rights or for the fulfillment of legal or regulatory obligations, in accordance with the provisions of Article 27 of the Brazilian Consumer Defense Code (CDC), from the date of purchase. The data collected from customers is anonymized and processed in a grouped manner.

More information can be found at our Sustainability Report (from pages 27 and 99) and also at the Cybsersecurity and Data Privacy Policies.

Consent policy for use of consumer data for secondary purposes

As stated in our Privacy Policy RD does not rent, sell, or provide personal data to third parties

Collection, usage and retention of customer information

According to Brazilian law (LGPD), companies are required to limit the retention of personal data as follows: 5 years for data related to payment management or paid hours control; 20 years for medical record data; 3 years for contact information of a potential customer who has not responded to any requests; and 6 months for log data. Our company’s data privacy policy explicitly states that we adhere to these legal limits for data retention.

Scope of employee training on privacy and data security

Building employee awareness and capabilities remains a central pillar of RD Saúde’s cybersecurity and data protection strategy. The Company conducts regular phishing and cyberattack simulation exercises to strengthen security readiness and promote a culture of risk awareness. In 2025, approximately 24,000 employees completed training on data privacy and information security, including the requirements of Brazil’s General Data Protection Law (LGPD).

Scope of information security management system certifications

As digital channels continue to expand, RD Saúde has increased investments in technology modernization and the strengthening of controls and procedures, reinforcing its commitment to operational excellence. This commitment is reflected in the achievement of the internationally recognized ISO/IEC 27001:2022 and ISO/IEC 27701:2019 certifications, covering information security management and privacy information management systems, respectively.

These certifications encompass the physical and logical security controls associated with the infrastructure, processes, and people supporting the Univers website and management portal, RD Saúde’s Medication Benefits Program, as well as the Raia and Drogasil websites and mobile applications. They also cover the processing of personal and sensitive data handled through these platforms and services, reinforcing the Company’s commitment to information security, data privacy, and regulatory compliance.

Data protection programs covering suppliers and business partners

Inspections are conducted on a regular basis