WHISTLEBLOWING REPORTING PROCEDURE FOR BSL GROUP

INTRODUCTION

 The whistleblowing tool https://emeis-brazil.signalement.net/ allows you to report any concerns relating to acts that may violate law or the BSL Group Code of Conduct following the procedure described below. You can also report alerts to your manager, your manager´s manager, Human Resources, your Compliance Officer, or the Corporate Audit, Risk and Compliance Department.  BSL Group values the use of the reporting system as it provides the opportunity for the company to prevent or stop conduct in violation of law or BSL Group policy and the damage that these acts may cause to BSL Group employees, residents, patients, partners, providers and the communities in which BSL Group operates. This reporting system is open to employees, contractors, subcontractors and providers of BSL Group subsidiaries in Latin America.  Your alert made in good faith will be received and investigated by the Audit, Risk, and Compliance Group, which is responsible for the whistleblowing tool and system at BSl Group confidentially and without negative consequences as outlined below. In Latin America this function is carried out by the Chief Risk and Compliance Officer for Latin America.  This whistleblowing procedure has been developed to fulfill the requirements of applicable anticorruption laws, including but not limited to, the French Law on Transparency, Combating Corruption and the Modernization of Economic Life (“Sapin II”), Law No. 12.846/2013 (Brazil), Law No. 20.393 (Chile), Laws Nos. 1474 and 1778 (Colombia), National Anticorruption System Act (Mexico), and Ley 17.060 (Uruguay).  

2. GUARANTEES TO PERSON MAKING THE REPORT

  Confidentiality 

Your report is confidential, as are the investigation and measures taken by the company as explained below. In certain cases, your identity may be revealed to a competent governmental agency, but if you are still employed by the company you will be informed before such revelation is made. BSL Group is committed to the confidentiality of the report and the admissibility and investigative process, as well as the action plans and measures implemented.  Please be aware that you will only be associated to the investigation process at the fact checking stage. The investigation progress, its contents, its outcome, and the subsequent report are strictly confidential. While you will be informed if the investigation continues or has been closed, the findings, report and measures taken may not be shared with you to protect the rights of the persons involved. Any information gathered and processed in the framework of this Whistleblower Reporting Procedure that might identify you as a whistleblower, will be kept confidential unless otherwise required by law.  The managers, executives and all those who have participated in the reception, investigation or resolution of the complaint shall comply faithfully with this guarantee of confidentiality. Any person receiving a whistleblowing alert shall promptly report it to the Compliance Officer so that the appropriate measures to ensure confidentiality. 

Anonymity

 You can file report anonymously. However, any anonymous reporting not stating serious facts and/or without sufficient detail shall not be considered and shall be immediately rejected. If facts are serious and detailed enough, the reported alert shall be reviewed but its investigation will be longer and less effective, as the interaction between you and the Compliance Officer in charge of its treatment is more complex.  Using the whistleblowing tool in good faith, even if the facts subsequently prove to be inaccurate or give raise to no action shall not expose you to any disciplinary measures or unjustified negative consequences. On the contrary, if the whistleblowing tool is not properly used and if the reported facts are deliberately false or in bad faith, that may result in legal action if necessary. 

  Due Process

The investigation and application of sanctions shall be performed in accordance with the concepts of due process and applicable law, including impartiality, objectivity and independence. All parties involved in the investigation shall be afforded the opportunity to be heard and to offer relevant information.  

Prohibition of Retaliation

 BSL Group will not tolerate any kind of retaliation against you for making a report in good faith under this Whistleblower Reporting Procedure. Claims of retaliation against you for making a report shall be treated seriously and solved as soon as possible.   

3. TYPES OF AUTHORIZED REPORTINGS

  What to report  

You can report facts that you personally know or have witnessed related to:  

Conflicts of interest;

Corruption or bribery of government officials or in the private sector;

Any kind of theft or fraud including but not limited to theft of money, accounting of financial statement fraud, unauthorized use of company property or services;

Influence peddling;

Activity in violation of competition laws, including price fixing;

Discrimination or harassment;

Money laundering or financing of terrorism;

A serious and clear breach of an International commitment ratified by France or country where BSL Group is operating, including binding acts of International Organizations;

A threat or serious damage of the public interest;

Any other crime, violation of BSL Group Code of Conduct, policy or law, or serious breach of applicable law.  

 What to avoid reporting 

You should not report any situations relating the following topics through the whistleblowing mechanism:

Confidential medical or legal information protected by professional secrecy or other norms; or

Issues related to national security issues. 

You should also avoid reports that involve:

A value judgment or biased comment regarding another´s behavior;

Facts that you do not have personal knowledge. If you use this whistleblowing process in good faith, even if the facts subsequently prove to be inaccurate or there are no actions taken, you will not be exposed to any disciplinary measures or unjustified negative consequences. On the contrary, if you use the whistleblowing process to report information that you know to be false or for malicious reasons, you may face negative consequences and even legal action.  

 How to answer your doubts if you should make a report

Your local Compliance Officer as well as the Corporate Audit, Risk and Compliance Department are available for any questions regarding if this whistleblowing procedure would apply to the facts in your case.  

4. PROCEDURE TO REPORT AN ALERT TO THE COMPLIANCE OFFICERS APPOINTED BY THE COMPANY

 You can report your alert through https://emeis-brazil.signalement.net/ the Compliance Officers appointed by the Company. In Latin America, the Latin America Chief Compliance Officer and the Corporate Compliance Officer are the only recipients of the information you will provide, as far as these data are necessary for them to fulfill their mission. The Corporate Audit, Risk and Compliance Department is responsible for the whistleblowing procedure and the registers relating to whistleblowing reports.  

5. HOW DOES THE WHISTLEBLOWING PROCEDURE BEGIN? 

  You should file your report at https://emeis-brazil.signalement.net . You can also report alerts to your manager, your manager´s manager, Human Resources, your Compliance Officer, or the Corporate Audit, Risk and Compliance Department.  When submitting your report, you should include:

Facts that you personally know or have observed with as much detail as possible;

Place and time of events;

Identity and function of all persons who witnessed or are involved in the facts or conduct, including any individual who appeared to engage in the wrongdoing;

Relevant documents, if any (file, picture, or any other useful evidence) to support your alert.

If possible, your identity, functions and contact details (anonymous reports are possible but much more difficult to investigate). If you choose to report on an anonymous basis, a contact e—mail will be useful in case further information is required. 

 Once your report is submitted, you will receive a receipt of the submission of your report with a unique identification number to interact with the Compliance Officer who has received your reporting. You can use this code to submit further information and check the status of your report at any time. If you report on an anonymous basis, it is important to return to the website to check if any additional information has been requested.  

6. INVESTIGATION PROCESS FOR THE ALERTS 

If you use the internet site, https://emeis-brazil.signalement.net/ , your alert will only be received by the Compliance Officers for Latin America and the Corporate level. If you use another method, the person receiving it should deliver it to the Compliance Officer, who will place it into the platform if not already there. 

Checking and Preliminary Assessment

The Compliance Officer will perform a preliminary assessment to determine if your report shall be considered under this whistleblowing procedure. 

Depending on the nature of the alert and the subject, the Compliance Officer may ask you or others for further information.

If it obvious that the reported alert is out of the scope of this procedure, the report shall be immediately destroyed, and the Compliance Officer shall inform you accordingly.

If the alert is admissible, the Compliance Officer shall inform you that the report shall be investigated.

This process to determine the admissibility of your report shall be completed within two months. Some reports may be required by national law, collective bargaining agreements or other mandatory laws or regulations to be treated with a separate procedure. If this is the case for your complaint, you will be notified accordingly and informed of the process that will be applied.

Investigation:

When the report received is credible and adjusted to the scope of use of the platform, the following process will govern the internal investigation: 

The Compliance Officer perform an investigation alone or if necessary, with a small internal team formed by employees of the Group with the experience and necessary knowledge to properly carry out the investigation. All members of the internal team will be subject to the duty of confidentiality and privacy.  

When necessary and bearing in mind the gravity of the alleged facts reported, the investigation may be conducted by third party professionals outside of BSL Group, such as experts in investigations, audit, or forensic accounting, to achieve greater objectivity and impartiality. In such a case, these third parties shall be contractually bound to maintain confidentiality and respect data privacy rules. The Compliance Officer will take all relevant precautions to forward the only data necessary to third parties so that they can fulfil their respective missions.

During the investigation all means legally allowed may be used for the clarification of facts. It may include interviews and the examination of any documentation understood as useful for the investigation. It may also include the testimony of the person making the report and any people against whom the report is made. It may also include the recovery and analysis of the information contained in electronic devices using software and hardware tools preserving the integrity of the evidences. The investigation will take care to protect the privacy, honor, private life, and image of the persons involved.

During this process, the Compliance Officer shall adopt the necessary measures to effectively conduct the investigation and aimed at the prompt cessation of improper activity.

The investigation and investigative report should be completed within two (2) months unless there is a justified reason to extend it for a further time. 

You and the other persons involved in the report will not have access to the details of the investigation as all of the details are subject to confidentiality, except as necessary to respect the principles of due process and labor law.  

Conclusion: 

 After reviewing the results of the internal investigation, the Compliance Officer and if applicable the internal team shall decide whether an infraction of policy or law has been proven, and if so, the personas responsible. 

If a violation of policy or law is not proven, the Compliance Officer will order the closure of the case leaving evidence in writing of the reasons for such decision.

If a false report or one in bad faith is made, the Compliance Officer will suggest to the Company management appropriate disciplinary measures or of any other nature with respect to who made such report in violation of this procedure.  

If the violation of policy or law is proven, the team shall:

Adopt appropriate and permitted disciplinary measures. 

If the facts have a legal implication, the Legal Department shall be consulted to determine the necessary measures, including informing the authorities in the shortest possible term of the facts in order to demonstrate BSL Group commitment to collaborating with authorities. 

You shall be informed that the investigation has closed and as practicable, the results of the investigation. It is possible that not everything will be shared with you, for example, the disciplinary actions taken against other employees or third parties are generally kept confidential to respect labor law and other requirements. 

7. GRADUATED REPORTING PROCEDURE

 French law related to whistleblowing

The French Sapin II law establishes a specific reporting procedure for employee whistleblowers. To benefit from the protection of the law you shall have to comply with the three-graduated reporting procedure as follows:  

You should first report to the Compliance Officer(s) appointed by the company. Upon the receipt of your alert, the Compliance Officer(s) must check its admissibility within two months. If you do not receive confirmation that the report is admissible, you can move on to the second step below. If you have decided to report anonymously, it is up to you to return to the alert platform, with your unique identification number to follow the treatment of your reporting). If the Compliance Officer notifies you that the report is admissible, but does not notify you of the measures implemented, this does not mean that you can move to the second step. The confidentiality of the implemented measures is guaranteed in the same way as the contents of the reporting and the information provided.

You may submit your report to the courts or public prosecutor or an administrative agency. These authorities have a three-month period to reply to your report. If you receive no reply you can move to the third step. 

You may make your report public.

However, in case of imminent and serious danger or if there is a risk of irreversible damage, your reporting can be directly forwarded to bodies mentioned in the second step above or be made public.  To tell or testify in bad faith with the intention of causing damage or with the knowledge that the facts made public or disseminated are partially inaccurate (that it is about facts related to a situation of conflicts of interests or about any fact liable to lead to disciplinary measures) may subject you to criminal and disciplinary measures.  Failure to comply with the graduated procedure described above and if the disclosure of information was not necessary and not proportioned to safeguarding the interests involved, in France you would not be able to benefit from the protection granted to the whistleblowers.  The French Sapin II Law allows you to send your reporting to the French Defender of Rights who may direct you to the competent body to receive it. This procedure is different than the procedure outlined above and falls out of the scope of the graduated reporting procedure as described above.  

Latin American laws related to whistleblowing

National laws in the different Latin American countries may protect persons that make reports under this procedure under constitutional, labor, civil and administrative laws. These national laws generally do not require or allow a graduated reporting procedure to obtain protection or to exercise rights to bring complaints to relevant authorities.

  8. DATA PROCESSING AND RETENTION PERIOD  

Data Processing

BSL Group as part of emeis Group is responsible for processing of personal data provided on the alert platform https://emeis-brazil.signalement.net/ as well as the other whistleblowing reports and investigations and of those further collected in the framework of this whistleblowing procedure. Personal data processing only aims at treating your report. The processing of personal data may vary by country but will comply with national law.  The person object of the report will be informed as soon as possible of the treatment of their data. Nevertheless, he/she shall only be informed of the treatment of their data once the precautionary measures have been adopted in the event of risk of destruction of evidence, to guarantee the good outcome of the internal investigation and to avoid any negative consequence for BSL Group or its employees and clients.  You as well as anyone that is included in the alert and investigation are always entitled to request access, rectification, or suspension of the processing of their personal data, as well as to oppose the treatment as set forth in national law and company policy.  To exercise such right, requests should be sent to the Data Protection Officer for your company and/or Marcia Salgado, Data Protection Officer for Brazil, e-mail: dpolatam@bslsaude.com.br . Any request shall be signed, attach a copy of a method of identification accepted by law, and provide an address or email to receive the response.

 Retention  

Data concerning any received alert which fall out of the scope of the procedure, shall be immediately destroyed after anonymization. Data concerning an alert will be made anonymous within two months from the end of the investigation process if the alert is not followed by legal proceedings or disciplinary measures or other plans of action.  Data relating to an alert shall be retained until the definitive closing of the procedure, if there is any disciplinary or legal proceedings brought against the individual on whom the alert is made or against the author of an abusive alert.  In the event the alert refers to a violation of applicable law or would be required to be retained by a relevant authority such as the labor authority, the alert and corresponding personal data can be retained for five (5) years after the date of the alert. 

 9. CLARIFICATIONS OR DOUBTS  

Any clarifications or doubts regarding this procedure can be referred to BSL Group Chief Compliance Officer.

  10. BSL GROUP WHISTLEBLOWING PROCEDURE

 This procedure supplements the Whistleblowing Procedure of BSL Group that has governed the whistleblowing process in Latin America until the issuance of the procedure.