Whistleblowing Portal

Joaquim Chaves Saúde guarantees confidentiality, the possibility of anonymity, and the security of personal data throughout the entire process of receiving, assessing, and following up on reports.

Whistleblowers acting in good faith benefit from the legal protection provided under the General Regime for the Protection of Whistleblowers, including protection against any form of retaliation. The following, among others, are considered retaliatory acts when carried out as a result of a report:

- Dismissal or termination of employment;
- Failure to convert a fixed-term contract into a permanent contract when such conversion would be expected;
- Changes to duties, working hours, or workplace, reduction in remuneration, or changes to working conditions;
- Negative performance evaluations or professional references;
- Disciplinary sanctions;
- Coercion, intimidation, harassment, or ostracism;
- Inclusion on sector-specific blacklists;
- Refusal of promotion or training opportunities.

Any act carried out against a whistleblower within two years of the report is presumed to be retaliatory. The burden of proof lies with the party carrying out the act to demonstrate that it was based on a legitimate reason independent of the report (Article 21(4) of the General Regime for the Protection of Whistleblowers).

To benefit from these protections, the whistleblower must act in good faith, meaning they have reasonable grounds to believe that the information reported was true at the time the report was made.

A report may be submitted through this Portal by any person who has become aware of an irregularity in the context of their current or past relationship with Joaquim Chaves Saúde, including:

- Employees and former employees;
- Job applicants or individuals in a pre-contractual relationship with - - - Joaquim Chaves Saúde;
- Service providers, contractors, subcontractors, and suppliers, as well as persons acting under their direction or supervision;
- Shareholders and members of the administrative, management, audit, or supervisory bodies of Joaquim Chaves Saúde, including non-executive members;
- Volunteers and interns, whether paid or unpaid;
- Patients and family members, when they become aware of irregularities related to matters covered by the Portal;
- Any other individuals who, in the context of their professional activities or their relationship with Joaquim Chaves Saúde, become aware of irregularities.

Legal protection also extends to individuals who assist the whistleblower, as well as to family members or colleagues who may be subject to retaliation.

The following violations may be reported through this Portal, as provided for in Article 2 of Law No. 93/2021:

- Acts of corruption and related offences, fraud, abuse of power, and similar violations;
- Violent, particularly violent, and highly organized crimes, as well as economic and financial crime;
- Procedures and practices relating to public procurement;
- Financial services, products, and markets, including the prevention of money laundering and terrorist financing;
- Product safety and compliance;
- Transport safety;
- Environmental protection and preservation;
- Nuclear safety and radiation protection;
- Food safety for human and animal consumption, as well as animal health and welfare;
- Public health;
- Consumer rights and protection;
- Privacy, personal data protection, and the security of network and information systems;
- Competition and State aid rules, as well as corporate tax regulations;
Infringements affecting the financial interests of the European Union.

Also covered are situations involving breaches of the Joaquim Chaves Saúde Code of Conduct, including:

Harassment (sexual or workplace harassment);
Discrimination;
Conflicts of interest;
Accounting and financial irregularities;
Non-compliance with internal policies and procedures.

A report may be submitted through any of the following channels, at the whistleblower’s discretion:

- Online form, through this Portal;
- In writing, by post, sent in a sealed envelope marked “Confidential — Whistleblowing Portal”, addressed to:
Joaquim Chaves Saúde, SGPS, S.A.
Compliance Officer
Rua Aníbal Bettencourt, 3
2790-225 Carnaxide, Portugal
- Verbally, online, through this Portal;
- In a face-to-face meeting, to be arranged within a reasonable period, upon the whistleblower’s request through any of the channels mentioned above.

Reports may be submitted either with identification or anonymously, regardless of the reporting channel chosen.

Joaquim Chaves Saúde guarantees respect for anonymity whenever the whistleblower chooses to submit a report anonymously, regardless of the level of detail provided.

After an anonymous report is submitted, a unique tracking code and password are automatically generated. These must be kept securely by the whistleblower and must not be shared.

These credentials allow access to the Portal in a secure environment to view the acknowledgment of receipt, subsequent communications, and any requests for additional information, while maintaining anonymity.

For security reasons, the loss of the tracking code will make it impossible to recover the communication channel with the whistleblower. Should this occur, the whistleblower may submit a new report, referring to the previous one if they so wish.

The handling of reports complies with the statutory deadlines established under Article 11 of the General Regime for the Protection of Whistleblowers (RGPDI):

- Acknowledgement of receipt: within 7 days of receiving the report, the whistleblower is informed that the report has been received and of the applicable procedure;
- Communication of planned or adopted measures: within 3 months of the acknowledgement of receipt, which may be extended, in duly justified cases due to the complexity of the report, up to a maximum of 6 months;
- Request for additional information: where necessary for the assessment of the report, additional information may be requested from the whistleblower at any time during the procedure, without prejudice to the deadlines set out above.

Without prejudice to Joaquim Chaves Saúde’s preference that reports be submitted first through this internal channel, as it enables a faster corrective response, whistleblowers may use an external reporting channel directly in the cases provided for in Article 7(1) of Law No. 93/2021, namely when:

- No internal reporting channel exists, or the existing channel does not allow reports to be submitted by persons other than employees;
- They have reasonable grounds to believe that the infringement cannot be effectively identified or addressed internally, or that there is a risk of retaliation;
- They have submitted an internal report and have not been informed, within the statutory deadlines, of the measures planned or adopted.

The following are external reporting channels, depending on the subject matter involved:

- Public Prosecutor’s Office and Criminal Police Authorities — for matters involving criminal offences;
- National Anti-Corruption Mechanism (MENAC) — corruption and related offences;
- National Data Protection Commission (CNPD) — personal data protection;
- Health Regulatory Authority (ERS) and Inspectorate-General of Health Activities (IGAS) — healthcare-related matters;
- Tax and Customs Authority (AT) — taxation matters;
- Portuguese Competition Authority (AdC) — competition and State aid matters;
- Bank of Portugal, Portuguese Securities Market Commission (CMVM), and Insurance and Pension Funds Supervisory Authority (ASF) — financial services and markets, and anti-money laundering matters;
- ASAE (Food and Economic Safety Authority) — food safety and consumer protection;
- Authority for Working Conditions (ACT) — working conditions and harassment;
- Inspectorate-General of Finance (IGF), sector-specific inspectorates, independent administrative authorities, and other entities referred to in Article 12 of Law No. 93/2021.

Public disclosure of a report is also possible, under the terms of Article 7(2) of Law No. 93/2021, provided that the legal requirements are met.

The receipt, assessment, and follow-up of reports are the responsibility of the Compliance Officer, a body designated by the organization for this purpose, operating with autonomy and functional independence. Its members are bound by a duty of confidentiality and may incur disciplinary, civil, administrative, or criminal liability in the event of a breach.

In the event of a conflict of interest involving the channel operator in relation to a specific report, a designated alternate will be appointed to ensure an impartial review of the matter.

The legal protection afforded to whistleblowers depends on the report being made in good faith. Submitting a report that the whistleblower knows to be false, or based on information obtained through criminal means, is punishable under the law, namely:

- As an administrative offence under Article 27(1)(e) of the General Regime for the Protection of Whistleblowers (RGPDI);
- As the criminal offence of false accusation under Articles 365 and 387 of the Portuguese Criminal Code, where the relevant legal elements are met;
- As a civil offence, giving rise to an obligation to compensate for any damages caused;
- As a disciplinary offence, in the case of employees.

This section specifically describes the processing of personal data carried out by Joaquim Chaves Saúde through the Whistleblowing Portal, supplementing the general Privacy Policy of the website.