Policy on the Functioning of the Ethical Channel

Introduction

DIATER is fully committed to the highest standards of ethical business conduct and legal compliance. As part of this commitment, DIATER has an Ethical Channel for receiving reports of any action or omission, fact, or behavior contrary to DIATER 's ethics, its internal regulations, or any mandatory law or regulation¹.

Scope of Application and Entry into Force

The Ethical Channel is available to all employees, collaborators, and executives of the DIATER Group, as well as its clients, contractors, suppliers, and any other person or entity that detects conduct or facts that may be reported through the Channel.

This policy will come into force upon its publication.

Responsibilities

It is the responsibility of all employees and suppliers of the DIATER Group to know this Policy and report the facts or omissions described in it.

Conduct to be Reported through the Ethical Channel

The actions or omissions that must be reported through the Channel are:

• Non-compliance with legality
• Non-compliance with DIATER 's Code of Ethics
• Non-compliance with Farmaindustria's Code, or any other Code of Conduct adopted by DIATER, now or in the future.
• Non-compliance with policies, procedures, or other types of internal regulations.

It is expressly mentioned that the Ethical Channel is not a means for submitting doubts, complaints, or suggestions on matters unrelated to those described above.

In particular, the following situations should be reported: harassment of any kind; misappropriation or diversion of Company resources; money laundering, or terrorist financing; corruption; influence peddling; illegal financing of political parties; falsification of information; disclosure of trade secrets; crimes against urban planning; non-compliance with labor regulations; actions seriously harmful to the environment; obstruction of inspection activity; retaliation against a person who has reported a situation in good faith through the Channel, etc.

Rights and Obligations of Ethical Channel Users

Rights

• Confidentiality: The informant's identity remains absolutely confidential at all stages of the process and at all levels. It will only be known by those necessary to carry out the investigation.
• Possibility of anonymity: Anonymous reporting is allowed through the designated channels.
• No retaliation: Any form of retaliation, penalty, or detriment against those who submit a report or inquiry through the Channel is strictly prohibited, provided they act in good faith.
• Receive a response: An acknowledgment of receipt will be issued within seven days of receiving the information, unless it may compromise its confidentiality or the informant's. All communications will receive a response as soon as possible. If contact details have not been provided, it will be posted in the relevant section on the website www.canaletico.com, and the communicator will be responsible for checking it. A reference number will be provided at the time of communication. The maximum period for responding to investigation actions is three months, except for particularly complex cases that require an extension, which may be extended by an additional three months.

Obligations

• Good faith: All communications must be truthful and made in good faith. If a false report is made, it will be considered a serious violation, and the person responsible may be sanctioned. A report will be considered false when the following requirements are met simultaneously:
• The report lacks justification and basis.
• The communicator acted in bad faith, knowing the accusation's falsity, with manifest disregard for the truth, or with the sole objective of causing harm to the reported person.
• Collaboration: The communicator must provide all available information and evidence truthfully and completely. Although the Channel allows anonymous reports, it is recommended to identify oneself in case additional information is needed.
• Confidentiality: The duty of confidentiality also applies to the communicator, who must avoid disclosing information to persons not involved in the investigation

Protection of the Reported Person

When investigative procedures involve a reported person, their rights will be guaranteed, particularly: honor, being informed of the actions or omissions attributed to them, the presumption of innocence, and the principle of contradiction, allowing them to be heard at all times.

The reported person, upon request, may be assisted by a trusted companion of their choice and may present and provide any evidence deemed appropriate for their defense.

The Ethical Committee will ensure the lawful obtaining of evidence to guarantee its validity in a possible judicial process.

Handling of Information

All communications will be received by an external advisory team to strengthen the Channel's confidentiality. This team will regularly connect with the company through the head of the LC Department and, if applicable, another member of the Compliance Committee.

Each communication will be assigned a unique reference number to identify it throughout its processing and allow the communicator to check the processing status through the relevant section on the website www.canaletico.com. Once submitted, the communicator will receive a notification confirming receipt.

Communications or inquiries that do not provide sufficient information to infer the occurrence of a situation described in section 6 of this Regulation will not be accepted for processing. Nor will those that do not provide a reasonable level of credibility or good faith in the communication be accepted.

If the informant requests a face-to-face meeting and uses this method to report, the meeting will be documented in one of the following ways:

• By recording the conversation in a durable and accessible format.
• Through detailed meeting minutes. Once prepared, the informant will be offered the opportunity to review, correct, and accept them. Once accepted, it will be an original document and cannot be modified. Any subsequent modifications must be made in a way that preserves the change's record.

Investigation Procedure

The preliminary report of the case will be directed to the LC Manager, who will forward it to the Compliance Committee and, if necessary, any other person deemed necessary to involve in the investigation. This team will be collectively referred to as the "Ethical Committee."

The Ethical Committee will meet within one week of receiving the report to decide:

• On the admission of communication.
• On the need to establish precautionary measures, if applicable.

All communications that:

• Lack sufficient indications of credibility.
• Refer to conduct different from those provided for in this Policy.
• Clearly lack foundation or there are rational indications that they were obtained through the commission of a crime.
• Do not contain new and significant information about an already investigated violation whose corresponding procedures have been concluded, unless there are new circumstances justifying different follow-up.
• Are explicitly provided for in DIATER 's internal regulations to be managed by another body or communication channel, in which case the matter will be redirected to the competent body or channel.

If necessary, the notifier will be informed of the non-admission for processing.

If admitted for processing, the Ethical Committee may take any measures, actions, evidence, and procedures deemed necessary to clarify the facts. This includes, but is not limited to, interviews with the communicator or witnesses, access to documentation, hearings with the reported person (if applicable), conducting specific audits, and hiring expert witnesses.

All persons interacted with during the investigation must collaborate with the Committee, always maintaining due confidentiality regarding the procedure.

The professional nature of the work tools provided by the Company is reminded, which may be investigated during the investigation when required, without any expectation of privacy by the employee regarding these tools, particularly concerning corporate email content or folders or files located on the device.

If there are founded suspicions that the reported facts may constitute a criminal offense, they will be brought to the attention of the Public Prosecutor's Office or the European Public Prosecutor's Office, as appropriate.

Closing the Procedure

The investigation procedure may last a maximum of three months, except for particularly complex cases, which may extend it by an additional three months. The final decision will be communicated to the notifier using the contact method used or, if the communication was made verbally, through the available email or contact method.

If the procedure has concluded with the decision to impose a disciplinary measure or sanction on employees, its execution will be the responsibility of the HR Department.

Communication Channels with the Ethical Channel

A face-to-face meeting with the Ethical Committee or any of its members can also be requested through any of the listed means.

If an employee mistakenly receives a communication addressed to the Ethical Channel, they must immediately forward it to the members of the Compliance Committee and maintain confidentiality regarding the information accessed for this reason. Failure to comply with this section may constitute a very serious offense, with possible disciplinary and sanctioning consequences.

Content of the Communication

The communication content must include:

• Related company or entity.
• Brief description of the detected event or behavior, or the inquiry to be made.
• When known, the type of event (fraud, negligence, theft, harassment, internal non-compliance, etc.).
• Detailed description of the event or behavior, or the inquiry to be made.
• Date or period when the reported behavior occurred, indicating whether it is known for certain or an approximation.
• Notifier's details: relationship with the reported company or entity, name and surname, ID or equivalent, and email address.

Anonymous communications are also acceptable. However, anonymous inquiries are not recommended, as they may hinder the investigation by making it impossible to request additional information.

If there is evidence or documentary support for the reported facts or behaviors, it should also be attached.

Data Protection

The data controller within the scope of this procedure will be DIATER Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, S.A. and, if another DIATER Group company is involved, it will act as a joint controller. DIATER 's data are:

• Corporate name: Diater Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, S.A
• CIF: A-82481813
• Registered office: Av. Gregorio Peces Barba 2, Parque Tecnológico de Leganés, 28918 Leganés, Madrid (Spain)
• Contact email: legalcompliance@diater.com

The categories of data processed will be those necessary for processing the inquiry, usually including identifying, contact, and employment data, and may include health data if necessary. The purpose of the processing is exclusively the management of the Ethical Channel and the instruction of the corresponding procedures.

The legal basis for the processing is the fulfillment of a legal obligation applicable to the data controller, specifically as established in Law 2/2023, of February 20.

It is also based on the legitimate interest of the controller to:

• Maintain an environment free from the violations described in this Policy, to maintain a culture and environment that is ethical, safe, and compliant with the law.
• Allow DIATER to operate a crime prevention system and demonstrate its operation.

The information collected within the scope of the Channel will only be communicated to those who need access to it to perform their duties, particularly the members of the Compliance Committee and external advisors. This information may also be communicated to public authorities when required or when the facts may constitute a criminal offense. The person to whom the reported facts relate will not be informed of the informant's identity.

The data will be kept during the investigation procedure and, once completed, until the potential legal liabilities arising from it are time-barred.

If it is proven that the provided information or part of it is not true, it should be immediately deleted once it is known, unless the lack of truthfulness may constitute a criminal offense, in which case the information will be retained for the necessary time during which the judicial procedure is processed.

Data subjects may exercise their rights of access, rectification, deletion, limitation, opposition, and portability through the following email address: dpogrupo@grupodiater.com. If they believe their rights have been violated, data subjects may contact the competent data protection authority.

External Channels

Anyone may report to the Independent Authority for Whistleblower Protection, A.A.I., or to the corresponding regional authorities or bodies, any actions or omissions within the scope of Law 2/2023, of February 20, either directly or after communication through the internal channels described in this policy.

Incompatibilities

If the information is directed against a member of the Ethical Committee, it significantly affects them, or constitutes a conflict of interest of any kind, they will refrain from intervening in the processing of such information, being replaced in their duties by another person within the body, or one expressly designated by the Management Body.

Read more

Ethical Channel

Global anti-corruption policy

Sustainability Policy of the DIATER Group

Conflict of Interest Policy

Transparency Report