Privacy policy

1. Introduction and purpose

MSK – Medical & Scientific Knowledge (hereinafter “MSK”, the “Company”, or the “Group”) recognizes the importance of privacy, confidentiality, and the protection of personal data belonging to individuals who use its websites, educational platforms, applications, services, and other digital channels.

This Personal Data Protection and Processing Policy explains transparently how MSK collects, records, uses, stores, consults, analyzes, discloses, retains, and protects personal information relating to users, students, prospective students, customers, and others interacting with its services.

MSK undertakes to process personal data lawfully, transparently, securely, and proportionately to the stated purposes, respecting individuals' rights and applicable legislation in each territory where it operates.

Using MSK services does not, by itself, constitute consent to all processing activities described in this Policy. Specific authorization will be requested where legally required.

2. Identity and responsibility for processing

MSK is a corporate group providing digital education and academic and professional training, specializing in courses, certifications, educational programs, and content, primarily in the medical, healthcare, and scientific fields. The holding company is headquartered in the Eastern Republic of Uruguay.

The entity identified in the corporate documentation accompanying the current policy is:

• Genatos S.A.
• Address: 25 de Mayo 555, office 314, postal code 11100, Montevideo, Uruguay.
• Tax Identification Number (RUT): 219231840016.
• Trade name: MSK – Medical & Scientific Knowledge.
• Data protection email: privacidad@msklatam.com.

The Group conducts commercial, academic, and administrative activities through the companies and entities operating in its respective markets. The entity that determines the purposes and means of processing will be responsible for that processing under applicable law. The company entering into a contract or issuing an invoice will be identified in the respective commercial, contractual, or billing documents; this alone does not determine its responsibility for all processing activities.

Where multiple Group entities jointly determine purposes and means, the responsibilities required by law will be established. Individuals may request information about the entity responsible for their personal-data processing through the contact channels specified herein.

3. Territorial scope

This Policy establishes a common regional framework for personal-data protection and processing applicable to MSK's educational and commercial operations in Argentina, Bolivia, Chile, Colombia, Costa Rica, Ecuador, El Salvador, Guatemala, Honduras, Mexico, Nicaragua, Panama, Paraguay, Peru, Uruguay, and Venezuela.

The Policy applies to processing associated with educational and commercial services offered in those territories, without excluding country-specific rules on consent, information, data protection, marketing communications, international transfers, retention, and the exercise of rights. Stricter local mandatory provisions prevail where applicable.

MSK's primary server infrastructure is hosted in Brazil, without prejudice to processing by technology providers or services engaged in other jurisdictions.

4. Applicable legislation

This Policy is governed by the personal-data protection laws applicable to MSK's activities in the Latin American countries within its territorial scope. Processing governed by Uruguayan law will comply with Law No. 18,331 of August 11, 2008, on Personal Data Protection, its implementing regulations, and other applicable provisions. Relevant mandatory legislation in the other operating jurisdictions will also be observed.

4.1. International standards

In preparing this Policy, MSK has considered the principles and provisions of the European Union General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) as guidance and good practice. This does not signify voluntary submission to the GDPR; the GDPR does not apply to the processing covered by this Policy where the territorial conditions in Article 3 are not satisfied.

4.2. Grounds for territorial non-applicability of the GDPR

The processing addressed herein concerns MSK's educational and commercial operations in Latin America. Under the Group's operating structure: (a) the processing of student and customer data covered by this Policy is not carried out in the context of activities of an MSK establishment in the European Union; (b) the covered educational and commercial services are not directed at offering goods or services to individuals located in the European Union; (c) the described processing does not seek to monitor individuals' behavior within the European Union; and (d) the holding company is headquartered in Uruguay and its primary hosting infrastructure is in Brazil.

The presence of an EU office devoted exclusively to developing products and educational content, without involvement in the student and customer personal-data processing covered herein, does not by itself make the GDPR applicable. Under the operating and territorial conditions described, that processing falls outside the GDPR's territorial scope.

This delineation does not waive or contractually exclude mandatory rules. If operations, establishment functions, service recipients, or processing practices change so as to satisfy Article 3 of the GDPR, MSK will reassess its legal obligations.

5. Categories of personal data collected

Depending on the services used and interactions undertaken, MSK may collect and process the following information.

5.1. Identification and contact data

First name, surname, identification document where needed, email, telephone number, country, province, state, department, city, address, and other information supplied during registration, purchasing, or service use.

5.2. Professional and academic data

Profession, specialty, educational institution, professional activity, workplace, employer, membership of professional associations or scientific societies, academic background, professional interests, and areas of specialization.

5.3. Educational activity data

Purchased courses, enrollments, started or completed programs, academic progress, assessment results, grades, participation in learning activities, issued certificates, access and completion dates, and interactions with learning content.

5.4. Commercial and administrative data

Sales inquiries, service purchases, purchase history, billing, payments, financing arrangements, promotions, discounts, coupons, cancellations, refunds, inquiries, and communications relating to transactions. Payment-method information may be processed directly by specialized providers in compliance with applicable legal and security conditions.

5.5. Technical and browsing data

IP addresses, session or device identifiers, browser, operating system, access logs, platform activity, and other data needed to operate, secure, maintain, and improve services.

5.6. Communications and interaction data

Information supplied through forms, email, telephone calls, WhatsApp, messaging services, virtual assistants, support tools, and other authorized channels. Where communications are recorded, transcribed, or analyzed, legally required information and authorizations will be provided or obtained.

6. Sources of personal data

MSK may collect personal data directly from individuals registering on its websites or educational platforms; requesting information about courses; completing contact forms; purchasing educational services; participating in academic activities; using support services; updating profiles; interacting with digital functions; or participating in MSK promotions, events, or activities.

Data may also be obtained from authorized third parties, commercial partners, technology providers, or advertising platforms where a valid legal basis exists and applicable information obligations are fulfilled.

7. Required data and data minimization

MSK collects only personal data that is adequate, relevant, and necessary for previously disclosed legitimate purposes. Some identification, contact, billing, or professional details may be required for the purchase and delivery of educational services.

Required fields will be identified during registration, purchase, or use of the relevant features. Failure to provide data necessary for a service may prevent completion of a transaction or access to certain features. Additional information not needed to provide the service may be supplied voluntarily under the corresponding processing conditions. MSK will avoid requesting excessive or irrelevant information.

8. Purposes of processing

MSK processes personal data, as applicable, for the following purposes:

8.1. User management

Creating and managing accounts, authenticating users, verifying information, and maintaining personal profiles.

8.2. Educational service delivery

Managing enrollments, granting course access, administering programs, tracking progress, managing assessments, issuing certificates, and delivering learning content.

8.3. Commercial and contractual management

Responding to inquiries, preparing commercial offers, entering into contracts, and managing student and customer relationships.

8.4. Administrative and financial management

Processing payments, issuing invoices, collecting payments, reconciling accounts, handling refunds, and fulfilling accounting and tax obligations.

8.5. Support

Responding to requests, providing academic, technical, and commercial assistance, and resolving complaints and incidents.

8.6. Academic and operational communications

Sending enrollment confirmations, academic reminders, notices concerning purchased courses, assessment notifications, certificates, and other communications necessary for service delivery.

8.7. Marketing and commercial communications

Providing information about courses, academic programs, news, events, promotions, and related services where there is a valid legal authorization.

8.8. Educational personalization

Analyzing interests, profession, specialty, academic history, and learning activity to recommend content or programs suited to students' training needs.

8.9. Statistics and service improvement

Preparing statistics, studying educational trends, assessing academic outcomes, analyzing platform performance, and developing technological and educational improvements.

8.10. Security and fraud prevention

Preventing unauthorized access, detecting irregular activity, protecting systems, and managing security incidents.

8.11. Legal compliance

Responding to legitimate authority requests and meeting administrative, tax, contractual, and regulatory obligations.

9. Legal bases for processing

MSK will process personal data only where a valid legal basis exists under applicable law. Depending on jurisdiction, data type, and purpose, this may include the data subject's consent, performance of a contract, pre-contractual measures, legal obligations, legitimate interests where recognized and subject to statutory conditions, or other legally established grounds.

Where consent is required, it must be freely given, informed, specific, and verifiable, in accordance with local legal standards. Performance of a contract does not automatically justify unrelated processing activities.

10. Academic profiles, profiling, and educational personalization

MSK may develop features to personalize learning according to students' professional characteristics, academic interests, training history, and platform activity.

10.1. Information used

The information analyzed may include profession, specialty, academic interests, courses purchased, learning progress, grades, content consulted, and interactions with educational services.

10.2. Purposes of personalization

Educational profiling may be used to recommend courses and programs, suggest complementary content, identify learning-improvement opportunities, propose learning pathways, adapt platform features, support educational continuity, and improve recommendation systems.

10.3. Consent for educational personalization

MSK will request students' specific consent for optional profiling intended to provide personalized educational experiences. Consent must be freely given, informed, specific, and verifiable under applicable requirements.

Refusal or later withdrawal will not prevent access to purchased courses or essential functions needed for the contracted learning. Processing necessary to deliver academic services may continue where another valid legal basis exists.

10.4. Commercial profiling

Processing personal data to personalize promotions, advertising, or commercial offers is a separate purpose from educational personalization. Separate authorization will be requested where required.

10.5. Preference controls

Students may manage or withdraw optional consents through MSK's designated mechanisms. Withdrawal does not affect earlier lawful processing or operations that may continue under another valid legal basis.

11. Artificial intelligence and automated systems

MSK may use artificial intelligence and automated systems to improve educational services, facilitate access to information, offer digital assistance, recommend content, and optimize academic, administrative, and commercial processes. These technologies may support virtual assistants, educational recommendations, learning analytics, request classification, and process automation.

Where such features involve personal data, MSK will apply the relevant legal bases and safeguards and seek to limit data to what is necessary for each purpose. Personal data will not be used to train or improve MSK's or third parties' AI models without a valid legal basis and compliance with applicable information and protection duties.

For solely automated decisions with legal or similarly significant effects, MSK will provide the information and safeguards and enable the legally required review mechanisms. Automated processing is not a blanket authorization to use student data for any purpose.

12. Commercial communications

MSK may contact users, students, and prospects by email, telephone, instant messaging, and other authorized channels regarding courses, educational programs, promotions, events, academic content, and news. Communications will comply with applicable law and recipients' preferences; consent will be requested where required.

Users may unsubscribe through mechanisms included in messages or through MSK contact channels. Unsubscribing from promotional messages will not prevent communications needed for purchased services, legal duties, or security incidents.

13. Data subject consent

MSK will request consent where required as the legal basis for specific processing. Authorization may be obtained through forms, checkboxes, user settings, or other legally valid mechanisms that allow consent to be demonstrated.

Separate consent may be requested for: (a) processing requiring authorization for purchasing or providing educational services; (b) optional educational personalization profiling; (c) profiling to personalize commercial offers and campaigns; (d) promotional communications where consent is required; and (e) other specific processing requiring authorization by law.

Accepting general purchase terms does not automatically authorize additional purposes requiring independent consent. MSK may log the date, time, version of the notice, country, and other elements required to demonstrate consent. Individuals may withdraw consent under applicable law; withdrawal does not retrospectively invalidate previously lawful processing.

14. Country-specific privacy notices and consents

This Policy is a common personal-data protection framework for the Latin American countries within its scope. MSK may also provide jurisdiction-specific privacy notices, information clauses, and consent mechanisms during registration, inquiries, purchases, course enrollment, or use of specific features.

Local notices may address the responsible entity, specific purposes, legal bases, required authorizations, international transfers, individual rights, objection and withdrawal mechanisms, profiling and automated systems, and other national legal requirements.

Where appropriate, authorizations will be collected separately and verifiably. Local notices supplement this Policy and prevail on matters where compliance with mandatory local provisions requires it.

15. Storage and international transfers

MSK operates in several Latin American countries and uses technological infrastructure to administer educational and commercial services. Its primary servers are hosted in Brazil. Consequently, some personal data collected in operating countries may be stored, accessed, or processed through systems outside individuals' country of residence.

Certain technology suppliers may process or access information from additional jurisdictions, depending on their services. MSK will transfer personal data internationally only with valid legal authorization and in compliance with applicable conditions.

Where required, MSK will apply appropriate safeguards, contractual agreements, recognized international transfer mechanisms, technical and organizational security measures, and other legally prescribed instruments. Hosting mainly in Brazil does not mean all processing occurs exclusively there. Individuals may request additional information about relevant transfers and applicable safeguards.

16. Disclosure to third parties

MSK may disclose personal data to third parties where necessary to deliver contracted services, conduct legitimate activities, comply with legal duties, or where another lawful basis exists.

Recipients may include hosting and infrastructure providers; academic management platforms; commercial management and CRM systems; payment and invoicing providers; email and messaging tools; support services; analytics providers; artificial intelligence services; technology and professional service providers; and competent authorities where required by law.

Personal data may be shared among MSK Group entities for legitimate purposes in compliance with legal obligations. Where appropriate, MSK will enter into agreements with providers establishing confidentiality, security, and processing limitations. MSK will not market student or user personal-data databases to unrelated third parties for purposes outside those disclosed without valid legal authorization.

17. Security and confidentiality

MSK will implement appropriate technical, administrative, and organizational measures to protect the confidentiality, integrity, and availability of personal data. Measures may include access controls and permissions, authentication, communications protection, encryption where appropriate, access logging and monitoring, backups, infrastructure protection, vulnerability management, incident response procedures, and confidentiality duties for staff and providers.

Those accessing personal data in the course of their work are bound by confidentiality obligations, including after their employment or contractual relationship ends where legally required. Security measures will be reviewed and updated in line with technological developments and identified risks.

18. Personal-data retention

MSK will retain personal data for as long as necessary for the purposes for which it was collected and processed, with a general maximum period of ten (10) years. If applicable local law specifies a shorter retention period, that shorter period must prevail.

Personal data may be erased or anonymized earlier when no longer needed and no legal obligation justifies retention. Retention periods depend on the type of data, processing purpose, when that purpose ends, and applicable law.

Exceptionally, where mandatory law requires retention beyond ten years, MSK will keep only the affected data for the legally required period. Once the applicable period ends, data will be erased, anonymized, or blocked as required by law.

Effectively anonymized information may be retained for statistics, academic studies, analytics, and improvements to educational services. Valid consent alone does not oblige MSK to retain data for ten years or justify use for purposes that have ceased to be legitimate.

19. Anonymization and statistical use

MSK may anonymize personal data collected in academic, commercial, administrative, and technological activities to generate statistics, improve education, examine trends, study learning patterns, and support strategic planning.

Anonymization seeks to transform personal data so that individuals can no longer be identified or reasonably identifiable, taking into account available methods and re-identification risks. Techniques may include removing direct identifiers, aggregating records, grouping categories, generalizing variables, reducing granularity, and other appropriate technical methods.

Effectively anonymized results may be used for indicators, reports, statistical analyses, academic studies, and business intelligence. Once reasonably irreversible anonymization is verified, the resulting information may be retained even after original personal data is removed.

Pseudonymization—substituting direct identifiers with codes or methods allowing later re-identification using supplementary information—is not equivalent to anonymization. Pseudonymized data remains subject to the laws and safeguards governing personal data. Anonymization processes must respect applicable legal bases, purpose limitation, security, and other legal requirements.

20. Data subjects' rights

MSK recognizes the personal-data protection rights granted by the laws of its operating countries. Depending on the applicable rules, these may include:

• Access: determining whether personal data is processed and obtaining relevant information.
• Rectification and updating: correcting inaccurate, incomplete, or outdated data.
• Erasure or cancellation: requesting deletion where legally appropriate.
• Objection: objecting to certain processing in legally established circumstances.
• Withdrawal of consent: withdrawing previously granted authorizations.
• Portability: requesting delivery or transmission of data where recognized by law.
• Restriction or suspension: requesting limitations on certain processing activities where permitted.
• Review of automated decisions: exercising statutory safeguards for solely automated decisions with significant effects.

All rights are subject to applicable legal conditions, exceptions, and procedures.

21. Exercising rights and identity verification

Data subjects may exercise access, rectification, updating, erasure, objection, portability, consent withdrawal, and other rights established by applicable law by emailing MSK's official privacy address: privacidad@msklatam.com.

Requests must identify the individual and the right sought. MSK may request further information where needed to verify identity and prevent improper disclosure, using proportionate methods and avoiding extra documents where less intrusive verification is sufficient.

Requests will be handled within the procedures and deadlines established by each country's applicable law. If a request cannot be fulfilled wholly or partly, MSK will communicate the reasons and legally available avenues of complaint.

22. Sensitive personal data

MSK mainly provides academic and professional education. Some educational material concerns health because of its medical, healthcare, and scientific specialization; ordinary academic information does not necessarily constitute sensitive personal data.

MSK will seek not to collect or process sensitive data unless needed for a specific legitimate purpose. Where exceptionally necessary, it will apply the required legal bases, authorizations, and enhanced protections.

Users must not insert identifiable patient clinical information or other people's health information into forms, academic activities, or digital assistants unless an expressly authorized procedure complies with applicable law.

23. Minors' personal data

MSK's educational services are intended for adult learners and professionals. MSK may implement verification mechanisms or access restrictions to ensure use exclusively by adults.

24. Cookies and similar technologies

MSK's websites and educational platforms may use cookies and similar technologies to operate services, maintain sessions, enhance security, analyze platform use, and offer additional features. Their categories, purposes, settings, and consent mechanisms, where applicable, are described in MSK's Cookie Policy.

25. Registration of personal-data databases

MSK will register, enroll, or declare its personal-data databases with competent authorities only where legally required, under the terms, conditions, and requirements of legislation in each operating country. Where no legal obligation to register or declare exists, MSK has no such duty, without prejudice to its other personal-data protection obligations.

26. Security-incident management

Where an incident may compromise the confidentiality, integrity, or availability of personal data, MSK will follow procedures to assess its scope, contain its consequences, adopt corrective measures, and reduce associated risks.

Where required by applicable law, MSK will notify relevant authorities and affected individuals within legally established deadlines and conditions. Incidents may be documented and analyzed to improve security controls.

27. Third-party links and services

MSK websites and platforms may contain links to third-party applications, platforms, or services. When users access external services, their personal data may be governed by those providers' own privacy policies and terms. This provision does not limit MSK's legal responsibilities where third parties act as its suppliers or processors.

28. Complaints to competent authorities

Individuals may submit inquiries or complaints to MSK through available channels and may also approach the competent administrative, judicial, or data protection authorities in their jurisdiction. In Uruguay, where appropriate, complaints may be brought before the Personal Data Regulatory and Control Unit (URCDP). Using MSK's internal channels does not restrict statutory rights or remedies.

29. Policy amendments and updates

MSK may update this Personal Data Protection and Processing Policy to reflect legal, technological, organizational, or operational changes. The current version will be available through the Company's official channels.

Where a change introduces processing requiring new consent or further information, MSK will implement the measures required by law. Amendments cannot retroactively legitimize processing for which a required legal basis or authorization was not obtained.

30. Information and contact

For questions about this Policy, requests to exercise rights, or issues relating to personal-data processing, individuals may contact:

• MSK – Medical & Scientific Knowledge
• Holding company entity: Genatos S.A.
• Address: 25 de Mayo 555, office 314, postal code 11100, Montevideo, Eastern Republic of Uruguay.
• RUT: 219231840016.
• Data protection email: privacidad@msklatam.com
• Website: https://msklatam.com

The entity responsible for each transaction will be identified in the corresponding contractual, commercial, or invoicing information, without prejudice to other identification duties under applicable law.