Personal Data Processing Policy

APPROVED

by order of the General Director of Nobias Technologies LLC

dated October 12, 2026 No. ____

PERSONAL DATA PROCESSING POLICY

Nobias Technologies LLC

Version 1.0, 2026

1. General Provisions

This Personal Data Processing Policy (the “Policy”) has been prepared in accordance with Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (the “Personal Data Law”), Federal Law No. 149-FZ of July 27, 2006 “On Information, Information Technologies and Information Protection,” and other regulatory legal acts of the Russian Federation concerning personal data.

The Policy defines the purposes, legal grounds, scope, procedures and conditions for processing personal data, the measures taken to ensure its security, and the procedure for exercising the rights of personal data subjects at Nobias Technologies Limited Liability Company (“Operator,” “Company”).

Personal data operator: Nobias Technologies Limited Liability Company (Nobias Technologies LLC), Taxpayer Identification Number (INN) 7726474518, Tax Registration Reason Code (KPP) 237801001, Primary State Registration Number (OGRN) 1217700104962. Registered address: 1 Triumfalny Drive, Sirius Urban-Type Settlement, Federal Territory of Sirius, Krasnodar Territory, 354340. Email for inquiries concerning personal data processing: contact@mverse.bio.

The Policy applies to all personal data received by the Operator from visitors to https://m-balance.ru (the “Website”), as well as from representatives of organizations contacting the Operator about the supply of reagents, access to the software platform, and cooperation.

The Operator is not a medical organization and does not process health information or other special categories of personal data through the Website. The Operator’s products are intended for scientific and research use. Laboratory test results are not transmitted through the Website.

The Policy is a publicly available document. Unrestricted access is provided by publishing it on the Website at https://m-balance.ru/privacy and linking to it from every Website page where personal data is collected (Part 2, Article 18.1 of the Personal Data Law).

The Policy takes effect on the date of its approval and remains in force until a new version is approved. The Operator reviews the Policy if legislation, the purposes or methods of personal data processing, or the categories of third parties engaged change. The new version is published on the Website with its approval date.

The Policy is binding on all Operator employees who have access to personal data and is also taken into account when entering into agreements with persons entrusted by the Operator with processing personal data.

2. Key Terms

Personal data: any information relating to an identified or identifiable natural person, directly or indirectly (the personal data subject).

Operator: a legal entity that independently organizes and carries out personal data processing and determines its purposes, the scope of personal data, and the actions performed on it.

Personal data processing: any action or set of actions performed on personal data, using automation tools or otherwise, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction.

Automated processing: processing of personal data using computer technology.

Provision of personal data: actions aimed at disclosing personal data to a specific person or a specific group of persons.

Dissemination of personal data: actions aimed at disclosing personal data to an indefinite group of persons.

Cross-border transfer: transfer of personal data to the territory of a foreign state, to a foreign state authority or a foreign natural or legal person.

Blocking: temporary cessation of personal data processing, except where processing is necessary to clarify the data.

Destruction: actions that make it impossible to restore the content of personal data in an information system or that destroy its physical media.

Depersonalization: actions that make it impossible to identify the personal data subject without using additional information.

Personal data information system: the personal data contained in databases, together with the information technologies and technical means that process them.

Cookies: small data files that the Website stores on a visitor’s device and uses for proper Website operation and traffic analysis.

3. Principles of Personal Data Processing

3.1. Personal data is processed lawfully and fairly.

3.2. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes of collection is not permitted.

3.3. Databases containing personal data processed for purposes incompatible with one another may not be combined.

3.4. Only personal data relevant to the purposes of processing is processed. The content and volume of the data processed correspond to the stated purposes and are not excessive.

3.5. The Operator ensures the accuracy, sufficiency and currency of personal data in relation to the purposes of processing and takes measures to delete or clarify incomplete or inaccurate data.

3.6. Personal data is stored in a form that allows the subject to be identified for no longer than required by the purposes of processing, unless a retention period is established by federal law or an agreement to which the subject is a party. Once the purposes of processing have been achieved, or when they are no longer necessary, personal data is destroyed or depersonalized.

4. Legal Grounds for Processing Personal Data

4.1. The legal grounds for processing personal data are:

• The Articles of Association of Nobias Technologies LLC;

• the personal data subject’s consent to the processing of their personal data (Clause 1, Part 1, Article 6 of the Personal Data Law);

• the conclusion and performance of an agreement to which the personal data subject is a party, beneficiary or guarantor, or an agreement concluded at the subject’s initiative or under which the subject will be a beneficiary (Clause 5, Part 1, Article 6 of the Personal Data Law);

• the exercise of the Operator’s rights and legitimate interests, provided that this does not violate the rights and freedoms of the personal data subject (Clause 7, Part 1, Article 6 of the Personal Data Law);

• the Civil Code of the Russian Federation, the Tax Code of the Russian Federation, and Federal Law No. 402-FZ of December 6, 2011 “On Accounting,” with respect to retaining documents related to the performance of agreements.

4.2. Consent to personal data processing is given by the subject in the form required by Article 9 of the Personal Data Law: specific, informed, conscious and unambiguous. When a form on the Website is completed, consent is recorded separately from other information and documents confirmed by the subject (Part 1, Article 9 of the Personal Data Law), by checking a separate box in the form.

4.3. Consent to receive informational and promotional messages about the Operator’s products is obtained separately from consent to personal data processing and may be withdrawn at any time.

5. Purposes of Processing, Categories of Subjects, Personal Data Scope and Processing Periods

5.1. The Operator processes personal data for the following purposes and within the following scope.

5.1.1. Purpose: reviewing inquiries submitted through Website forms, by email and in messengers, and contacting the applicant. Subject categories: Website visitors and organization representatives. Personal data: surname, first name, patronymic; organization name and type; job title; email address; telephone number; inquiry contents. Legal ground: subject’s consent. Processing period: until the purpose is achieved, but no longer than 3 years from the last interaction with the subject, or until consent is withdrawn.

5.1.2. Purpose: preparing and sending commercial proposals; concluding and performing agreements for the supply of reagents and access to the software platform; and maintaining correspondence and records under agreements. Subject categories: representatives of counterparties (employees and authorized persons). Personal data: surname, first name, patronymic; job title; organization name; business email address and telephone number; information in a power of attorney or other document confirming authority. Legal grounds: an agreement to which the organization represented by the subject is a party; subject’s consent. Processing period: for the term of the agreement and 5 years after its termination, in accordance with accounting and archival legislation.

5.1.3. Purpose: providing laboratory and research organization representatives with demonstration and working access to the M-BALANCE software platform. Subject categories: platform users. Personal data: surname, first name, patronymic; job title; organization; email address; telephone number; login credentials; information about user activity in the personal account. Legal grounds: agreement; subject’s consent. Processing period: for the access period and 1 year after access ends.

5.1.4. Purpose: sending informational messages about the Operator’s products, platform updates and events. Subject categories: persons who have separately consented to receive mailings. Personal data: name; organization; email address. Legal ground: separate subject consent. Processing period: until consent is withdrawn.

5.1.5. Purpose: operating the Website, analyzing traffic and improving its performance. Subject categories: Website visitors. Data: IP address; browser, operating system and device details; date and time of visit; pages viewed; referral source; cookie identifiers. Legal grounds: subject’s consent expressed through browser settings and the Website cookie banner; the Operator’s legitimate interest in ensuring the Website functions. Processing period: for the lifetime of the relevant cookies, but no longer than 1 year.

5.2. The Operator does not process special categories of personal data through the Website (information about racial or ethnic origin, political opinions, religious or philosophical beliefs, health, or intimate life) or biometric personal data.

5.3. The Operator does not make decisions based solely on automated personal data processing that produce legal effects for the subject or otherwise affect their rights and legitimate interests.

5.4. The Operator does not process personal data for dissemination to an indefinite group of persons.

6. Procedure and Conditions for Processing Personal Data

6.1. Personal data is processed by mixed means: using automation tools (the Operator’s information systems, email and the M-BALANCE software platform) and without automation (paper documents).

6.2. Personal data is obtained directly from the subject: when Website forms are completed, through email and messenger correspondence, when an agreement is concluded, or when registering on the software platform. The Operator does not obtain subjects’ personal data from other sources without their knowledge.

6.3. Personal data of citizens of the Russian Federation is collected, recorded, systematized, accumulated, stored, clarified and retrieved using databases located in the Russian Federation (Part 5, Article 18 of the Personal Data Law).

6.4. The Operator may entrust another person with processing personal data under an agreement specifying the list of actions with personal data, processing purposes, the duty to maintain confidentiality and ensure personal data security, and data protection requirements (Part 3, Article 6 of the Personal Data Law). A person processing data on the Operator’s instructions is not required to obtain the subject’s consent. The Operator is liable to the subject for that person’s actions.

6.5. The Operator entrusts personal data processing to the following categories of persons: hosting and infrastructure providers storing Website and software platform data; the operator of the application intake and tracking service (CRM); the operator of the email and mailing service; and the web analytics service operator. The current list of such persons, including the purposes and scope of data transferred, is provided to the subject upon request under Section 9 of the Policy.

6.6. Personal data may be transferred to authorized government authorities upon their reasoned request, in cases and in accordance with the procedure established by the legislation of the Russian Federation.

6.7. The Operator does not carry out cross-border transfers of personal data. The Operator uses services whose servers are located in the Russian Federation to process personal data. If a cross-border transfer becomes necessary, the Operator will notify Roskomnadzor before the transfer begins and ensure compliance with Article 12 of the Personal Data Law.

6.8. The Operator ensures the confidentiality of personal data: employees granted access to personal data must not disclose it to third parties or disseminate it without the subject’s consent, unless otherwise provided by federal law (Article 7 of the Personal Data Law).

6.9. Personal data on paper is stored at the Operator’s premises with restricted access. Electronic personal data is stored in the Operator’s information systems with access rights differentiated by user.

7. Cookies and Web Analytics Services

7.1. The Website uses cookies and similar technologies to ensure proper Website operation, remember the selected language and settings, and collect depersonalized traffic statistics.

7.2. The Website uses Yandex Metrica web analytics to analyze traffic. The service collects information about IP address, device, browser, pages viewed and actions on the Website. This information is used in aggregate form to assess the Website’s effectiveness and is not used to identify a specific visitor.

7.3. On a visitor’s first visit to the Website, a notice about the use of cookies is displayed. By continuing to use the Website, the visitor consents to processing of data collected through cookies for the purposes specified in Clause 5.1.5 of the Policy.

7.4. Visitors may disable or delete cookies at any time in their browser settings. In that case, certain Website functions may not work properly.

8. Measures to Ensure Personal Data Security

8.1. In accordance with Article 18.1 of the Personal Data Law, the Operator:

• has appointed a person responsible for organizing personal data processing;

• has approved this Policy and local regulations establishing procedures to prevent and detect violations of personal data legislation and remedy their consequences;

• applies legal, organizational and technical measures to ensure personal data security in accordance with Article 19 of the Personal Data Law;

• conducts internal monitoring of compliance of personal data processing with applicable legislation and this Policy;

• assesses the harm that may be caused to subjects in the event of a violation of the Personal Data Law and compares that harm with the measures taken;

• familiarizes employees directly involved in personal data processing with the legislation, this Policy and the Operator’s local regulations;

• has notified Roskomnadzor of its intention to process personal data in accordance with Article 22 of the Personal Data Law.

8.2. In accordance with Article 19 of the Personal Data Law, the Operator takes the following measures:

• identifies current personal data security threats when processing data in information systems;

• establishes access rules for personal data and keeps records of persons with such access;

• uses password protection and two-factor authentication for access to information systems containing personal data;

• uses secure connections (HTTPS) when transmitting data through the Website and software platform;

• provides backups and the ability to restore personal data modified or destroyed as a result of unauthorized access;

• keeps records of physical media containing personal data;

• logs actions involving personal data in information systems;

• detects unauthorized access to personal data and takes measures to stop it;

• monitors the effectiveness of the measures taken.

8.3. If an unlawful or accidental transfer (provision, dissemination or access) of personal data is found to have resulted in a violation of subjects’ rights, the Operator shall notify Roskomnadzor of the incident, its presumed causes and harm, and the measures taken within 24 hours, and shall submit the results of its internal investigation, identifying the persons whose actions caused the incident, within 72 hours (Part 3.1, Article 21 of the Personal Data Law).

9. Rights of Personal Data Subjects and Procedure for Exercising Them

9.1. A personal data subject has the right to:

• receive information about the processing of their personal data to the extent provided for in Part 7, Article 14 of the Personal Data Law: confirmation that processing is taking place; legal grounds and purposes; methods used; the Operator’s name and location; information about persons with access to personal data; the personal data processed and its source; processing and storage periods; procedures for exercising rights; and information about persons entrusted with processing;

• request clarification, blocking or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose;

• withdraw consent to personal data processing;

• opt out of informational and promotional messages;

• appeal the Operator’s actions or omissions to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court;

• seek protection of their rights and legitimate interests, including damages and compensation for moral harm through the courts.

9.2. To exercise their rights, the subject shall send the Operator a written request to the postal address specified in Clause 1.3 of the Policy or an electronic document to contact@mverse.bio. The request must include: the subject’s surname, first name and patronymic; the number of their primary identity document, its issue date and issuing authority, or other information confirming the subject’s relationship with the Operator (for example, the email address from which an inquiry was sent through the Website); the substance of the request; and the signature of the subject or their representative.

9.3. The Operator reviews the request and responds within 10 business days of receipt. This period may be extended by no more than 5 business days, provided the subject is sent a reasoned notice stating the grounds for the extension (Part 1, Article 20 of the Personal Data Law).

9.4. If consent is withdrawn, the Operator ceases processing personal data and destroys it within no more than 30 days of receiving the withdrawal, unless otherwise provided by an agreement or federal law. Withdrawal of consent does not stop processing carried out on other legal grounds, including to perform an agreement or retain documents as required by law.

9.5. The Operator maintains a log of personal data subject inquiries, recording requests received, measures taken and response deadlines.

10. Updating, Blocking and Destruction of Personal Data

10.1. If inaccurate personal data is identified, the Operator blocks it while it is reviewed, clarifies the data within 7 business days from the date the subject or their representative provides supporting information, and lifts the block.

10.2. If unlawful processing is identified, the Operator ceases it within no more than 3 business days and destroys the personal data within no more than 10 business days from identification (Part 3, Article 21 of the Personal Data Law).

10.3. Once the processing purpose has been achieved, the retention period has expired, consent has been withdrawn, or the purpose is no longer necessary, the Operator ceases processing and destroys the personal data within no more than 30 days, unless otherwise provided by an agreement or federal law.

10.4. Destruction of personal data is documented by a destruction certificate and, in information systems, confirmed by an export from the event log. Paper records containing personal data are destroyed by a method that prevents restoration of their contents.

11. Liability

11.1. Persons responsible for violating the requirements of the Personal Data Law and this Policy are subject to disciplinary, civil, administrative and criminal liability in accordance with the legislation of the Russian Federation.

11.2. The Operator is liable to the personal data subject for the actions of persons to whom it has entrusted personal data processing.

12. Final Provisions

12.1. Matters not governed by this Policy are governed by the legislation of the Russian Federation concerning personal data.

12.2. Oversight of compliance with the Policy is assigned to the person responsible for organizing personal data processing at Nobias Technologies LLC.

12.3. Inquiries concerning personal data processing should be sent to: 1 Triumfalny Drive, Sirius Urban-Type Settlement, Federal Territory of Sirius, Krasnodar Territory, 354340, Nobias Technologies LLC, or to contact@mverse.bio with the subject line “Personal Data”.