Vendor Code of Conduct

1.1 Purpose. People trust Orange Health with their health and their personal data. That trust depends on the businesses we buy from. This Code sets the minimum standards of legal compliance, integrity, treatment of people, safety, data protection and quality that every vendor must meet.

1.2 Who it applies to. This Code applies to every person or business that supplies goods or services to Orange Health or its affiliates, whatever its type or size. That includes suppliers, service providers, contractors, consultants, agents, agencies, licensors and landlords (each a "Vendor"). The Vendor is responsible for compliance by its directors, employees, workers, contractors, subcontractors and agents (together, "Personnel").

1.3 Relationship to your agreement. This Code is part of each agreement between Orange Health and a Vendor that refers to it. It supplements, and does not replace, the ESG Compliance clause and the other terms of that agreement. Where both cover the same subject, the standard that better protects people, patients and data applies. Nothing in this Code reduces a Vendor's obligations under law or under the agreement.

1.4 Law and higher standards. Vendors must follow all laws that apply to them. Where this Code sets a higher standard than the law, the Vendor must meet the higher standard.

• Follow all applicable laws and hold every license and permits, the work or delivery needs.
• Never give or take a bribe, kickback or improper advantage, and disclose conflicts of interest.
• Never use forced, bonded or child labour and always ensure equal opportunity to every recruitment.
• Pay workers at least the legal minimum, on time, extend maternity benefits as the law requires, and respect their rights.
• Treat people fairly, keep workplaces free of discrimination and harassment, and comply with the POSH Act (Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013), including having an Internal Committee where required.
• Keep people safe and protect the environment, including safe handling of samples, chemicals and biomedical waste.
• Protect patient and personal data, and ensure the privacy and confidentiality of all Orange Health business data and sensitive information at all times, during and after the engagement.
• Deliver goods and services that are safe, genuine and of the agreed quality, with honest records.
• Use subcontractors only with our consent, and keep them to the same standards.
• Keep records, cooperate with audits, report concerns and protect whistleblowers (no retaliation against anyone who reports in good faith), and fix problems promptly.

3.1 Licences and registrations. The Vendor must hold, and keep valid, every licence, registration, permit, authorisation and accreditation its work requires, and give Orange Health a copy on request. It must tell Orange Health promptly if any of them is suspended, cancelled, not renewed or made subject to conditions.

3.2 Taxes and statutory dues. The Vendor must register for and pay all taxes, provident fund, employees' state insurance and other statutory dues that apply to it, and must issue valid invoices.

3.3 Accurate information. Everything a Vendor tells Orange Health, including during onboarding, in invoices, certificates and declarations, must be true and complete. A Vendor must tell Orange Health promptly if something it provided earlier is no longer accurate, including a change of ownership, control or legal status.

3.4 Regulatory action. The Vendor must tell Orange Health promptly of any government notice, investigation, penalty or legal proceeding that could affect the services or Orange Health's reputation.

3.5 MSME status. The Vendor must tell Orange Health in writing at onboarding whether it is a micro, small, medium or other enterprise, and give its Udyam registration number if it has one. It must tell Orange Health promptly if its status changes or its registration lapses, so that Orange Health can pay it correctly and on time.

4.1 Anti-bribery and anti-corruption. The Vendor must not, and must ensure its Personnel do not, directly or indirectly offer, pay, promise, authorise or accept any bribe, kickback, facilitation payment or other improper advantage in connection with its dealings with Orange Health. This applies to public officials and to private parties alike. The Vendor must comply with the Prevention of Corruption Act, 1988 and other anti-corruption laws, and keep adequate procedures to prevent bribery in its own business.

4.2 Gifts and hospitality. A Vendor must not give gifts, entertainment or hospitality to Orange Health personnel to influence a decision or reward a business outcome. Anything offered must be of nominal value, infrequent and openly given. Cash and cash equivalents are never acceptable under any circumstances. Nothing may be offered while a tender, quotation or contract decision is pending.

4.3 Conflicts of interest. The Vendor must disclose in writing, before engagement or as soon as it arises, any personal, financial or family relationship between its owners, directors or Personnel and any Orange Health director, employee or decision-maker. Orange Health personnel may not hold an undisclosed interest in a Vendor.

4.4 No inducements to healthcare professionals. A Vendor acting for or with Orange Health must not give or promise money, gifts, free services or any other benefit to a doctor, clinic, hospital or other healthcare provider in return for referrals, prescriptions or test volumes, and must not make misleading health or accuracy claims about Orange Health's services.

4.5 Sanctions, money laundering and tax evasion. The Vendor must not be the subject of economic or trade sanctions, and must not do anything that would cause Orange Health to breach a sanctions law. It must not take part in money laundering, and must not facilitate tax evasion, including through false invoicing or payments to unrelated parties or accounts.

4.6 Fair competition and fair dealing. The Vendor must comply with competition law, must not take part in bid-rigging, price-fixing or sharing of competitively sensitive information, and must deal honestly with Orange Health, its customers and other suppliers.

4.7 Honest records. Books, invoices, test records, certificates and reports must be accurate. Falsifying, back-dating or destroying records to mislead is prohibited.

4.8 Use of Orange Health's name and public statements. The Vendor must not use Orange Health's name, logo or brand, or say or suggest that Orange Health endorses it, without Orange Health's prior written consent. This includes marketing material, tenders and client lists. The Vendor must not make public statements about Orange Health, its customers or its work for Orange Health, including to the media or on social media, without that consent, unless the law requires it.

5.1 No forced labour. The Vendor must not use forced, compulsory, bonded, trafficked or prison labour. All work must be voluntary. Workers must be free to leave in line with the law, without threat or penalty. The Vendor must not hold workers' identity documents or require deposits or recruitment fees from them, and must not charge workers for recruitment.

5.2 No child labour. The Vendor must not employ or engage anyone below 14 years in any capacity, or anyone below 18 years in work that is hazardous, harmful to health or likely to harm their development. The Vendor must take reasonable steps to verify the age of its Personnel and must comply with the Child and Adolescent Labour (Prohibition and Regulation) Act, 1986, as amended.

5.3 Wages, hours and benefits. The Vendor must pay all workers at least the applicable minimum wage, in full and on time, with no unlawful deductions. Working hours, rest days, leave and overtime must follow the law, and overtime must be voluntary and paid at the legal rate. The Vendor must provide provident fund, insurance and other social security benefits that the law requires, and give workers clear written terms of engagement and wage records. The Vendor must extend maternity benefits to its women workers in line with the Maternity Benefit Act, 1961 (as amended) and the Code on Social Security, 2020, including paid maternity leave of the statutory duration, protection from dismissal or any reduction in pay or position during or because of maternity, nursing breaks, and crèche facilities where the law requires them. No worker may be refused engagement, or treated less favourably, because she is pregnant or on maternity leave.

5.4 Non-discrimination. The Vendor must not discriminate in hiring, pay, training, promotion or termination on grounds of race, caste, religion, gender, pregnancy, sexual orientation, disability, age, nationality or any other ground protected by law.

5.5 Harassment, abuse and POSH. The Vendor must keep its workplaces free of harassment, abuse, intimidation and violence. It must comply with the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 and its Rules (the "POSH Act"), including adopting a written POSH policy, constituting an Internal Committee where required, training its Personnel, handling complaints within the time limits the POSH Act sets, and filing the annual report. Where the Vendor's Personnel work at Orange Health sites or with Orange Health personnel or customers, the Vendor must cooperate with any inquiry under Orange Health's POSH policy and act on its findings.

5.6 Freedom of association. The Vendor must respect its workers' lawful rights to form or join associations and to raise concerns collectively, without retaliation.

5.7 Grievance channel. The Vendor must give its workers a way to raise grievances, including anonymously, and must resolve them fairly. Where a Vendor's workers carry out work for Orange Health, they may also use the reporting channel in Section 11.

5.8 Workers on Orange Health premises. Where the Vendor's Personnel work at Orange Health sites or with Orange Health customers, the Vendor must ensure they are properly engaged, trained, paid and insured, and that no Personnel are misrepresented as Orange Health employees.

6.1 Safe workplaces. The Vendor must provide a safe and healthy workplace that meets the Occupational Safety, Health and Working Conditions Code, 2020 and other safety laws. That includes safe premises and equipment, fire safety and emergency plans, suitable protective equipment and training, and clean drinking water and sanitation.

6.2 Biosafety and hazardous materials. Where the Vendor handles blood or other samples, reagents, chemicals, sharps or other hazardous materials, it must store, label, transport and dispose of them safely and in line with the law and Orange Health's reasonable instructions. Its Personnel must be trained for the tasks they perform.

6.3 Biomedical and other waste. Where the Vendor generates, collects, transports, treats or disposes of biomedical waste, it must hold the authorisations required under the Bio-Medical Waste Management Rules, 2016, segregate waste at source, keep manifests and records, and never dispose of biomedical waste in general waste or in any unauthorised way. All other waste must be handled lawfully.

6.4 Environmental compliance. The Vendor must hold and follow all environmental permits and consents that apply to it. It must manage emissions, effluent and waste responsibly, and make reasonable efforts to save energy and water and to reduce single-use plastic, provided this never compromises biosafety or patient safety.

6.5 Incidents. The Vendor must tell Orange Health promptly, and in any case within 24 hours, of any death, serious injury, exposure incident, fire, spill or environmental release connected with work for Orange Health, and must cooperate fully with any investigation.

7.1 Lawful use. The Vendor must comply with the Digital Personal Data Protection Act, 2023 and its Rules, the Information Technology Act, 2000 and all other data protection laws that apply. Where the Vendor handles personal data for Orange Health, it must use it only to provide the agreed services and in line with Orange Health's written instructions, and never for its own purposes, marketing or profiling.

7.2 Access and security. The Vendor must give access only to Personnel who need it for the work, and must protect data with controls suited to its sensitivity. These include access controls, encryption in storage and transit, secure devices and networks, up-to-date software, and logging of access to patient data. The Vendor must never share Orange Health system credentials or use them for any other purpose.

7.3 Confidentiality and privacy of business data. The Vendor must ensure the privacy and confidentiality of all Orange Health business data and sensitive information at all times. This includes business, financial, commercial, operational, technical, pricing, customer, employee and Personnel information, test and laboratory data, systems and security information, and any other information that is marked confidential or that a reasonable person would treat as confidential, in whatever form it is held. The Vendor must use such information only for the agreed work, disclose it only to Personnel who need it for that work and are bound by written confidentiality duties, protect it with the same safeguards as in Section 7.2, and never disclose it to any third party or use it for its own or anyone else's benefit without Orange Health's prior written consent. This duty applies during the engagement and continues after it ends.

7.4 Breach notification. The Vendor must tell Orange Health without delay, and in any case within 24 hours of becoming aware, of any actual or suspected loss of, or unauthorised access to, data connected with Orange Health. It must contain the incident, preserve evidence, give all information Orange Health needs to meet its legal duties, and must not notify regulators or affected individuals on Orange Health's behalf unless Orange Health asks it to.

7.5 Location and onward transfer. The Vendor must not store or transfer Orange Health data outside India, or give any third party access to it, without Orange Health's prior written consent and compliance with applicable law.

7.6 Return or destruction. When the engagement ends, or earlier on request, the Vendor must return or securely destroy all Orange Health data and confirm this in writing, unless the law requires it to keep a copy, in which case it must protect that copy and tell Orange Health.

7.7 Price-sensitive and non-public information. Some Vendors may see non-public information about Orange Health's finances, results, plans, fundraising or transactions. The Vendor must keep it strictly confidential and share it only with Personnel who need it for the work. The Vendor and its Personnel must not use it to buy or sell securities, or encourage or tip anyone else to do so, in Orange Health, any related company or any other company the information concerns. The Vendor must comply with insider trading law as it applies, including the SEBI (Prohibition of Insider Trading) Regulations, 2015, and must keep a record of the Personnel who have access to such information and give it to Orange Health on request.

8.1 Specifications and standards. Goods and services must meet the agreed specifications and all laws and standards that apply to them. Where relevant, this includes the Medical Devices Rules, 2017 and the quality requirements that apply to Orange Health's NABL and ICMR accredited laboratories.

8.2 Genuine and in-date. The Vendor must supply only genuine, properly labelled goods. It must never supply counterfeit, adulterated, mislabelled, expired or near-expiry goods without Orange Health's written agreement, and must not change a product, material, process or site without telling Orange Health first.

8.3 Traceability and storage. The Vendor must keep batch, lot and delivery records that allow goods to be traced. It must store and transport goods under the required conditions, including temperature control where needed, and keep records that show those conditions were met.

8.4 Defects and recalls. The Vendor must tell Orange Health immediately of any defect, deviation, complaint or recall that could affect patient safety or test results, and must cooperate fully with corrective and recall action.

8.5 No falsification. The Vendor must not falsify, manipulate or misreport test data, calibration records, certificates of analysis, delivery times, service logs or any other quality record.

9.1 Subcontracting. The Vendor must not subcontract any part of the work without Orange Health's prior written consent and or information, where the work involves patient data, samples, biomedical waste, work at Orange Health sites, or Orange Health customers. For any other subcontracting the Vendor must tell Orange Health on request who its subcontractors are.

9.2 Same standards. The Vendor must bind every approved subcontractor to standards no less strict than this Code, and remains liable for their acts and omissions as if they were its own.

9.3 Responsible sourcing. The Vendor must take reasonable steps to ensure that its own suppliers do not use forced or child labour, do not pay bribes, and follow the law in the work they do for it. It must be able to tell Orange Health where key goods come from.

9.4 Business continuity. The Vendor must keep plans that let it keep supplying Orange Health during disruption, such as staff shortages, supplier failure, IT outage or natural events. It must tell Orange Health promptly of any event or financial difficulty that could interrupt supply or service.

10.1 Records. The Vendor must keep accurate records that show compliance with this Code, including licences, wage and attendance records, safety and incident records, waste manifests, data-access logs and quality records. It must keep them for the period the law requires and, where the law sets none, for at least three years after the engagement ends.

10.2 Information requests. On request, the Vendor must promptly give Orange Health information, documents, certificates, questionnaires and written confirmations of compliance. Orange Health may ask for these at onboarding, periodically and when it has a concern.

10.3 Audit right. Orange Health, or an independent auditor bound by confidentiality, may audit the Vendor's compliance with this Code on reasonable written notice, normally at least seven days. The audit may cover the Vendor's premises, records, systems and relevant Personnel and subcontractors, during business hours and limited to what relates to this Code. Orange Health may audit at shorter notice where it suspects a serious breach, or where a regulator or the law requires.

10.4 Cooperation. The Vendor must give auditors reasonable access and assistance, must not obstruct them or coach or pressure workers who are interviewed, and must not retaliate against anyone who takes part. Each side bears its own costs of an audit.

10.5 Confidentiality of audits. Orange Health will keep the Vendor's confidential information learned during an audit confidential and use it only to check compliance with this Code and to protect Orange Health's legal interests.

11.1 Duty to report. A Vendor must promptly tell Orange Health in writing when it becomes aware of any actual or suspected breach of this Code, whether by itself, its Personnel or its subcontractors.

11.2 How to report. Vendors, their workers and any other person may report a concern to Orange Health's Legal & Compliance team at compliance@orangehealth.in. Reports may be made anonymously, though a way to follow up helps us act.

11.3 Whistleblower protection and no retaliation. The Vendor must not dismiss, demote, penalise, threaten, harass, blacklist or otherwise act against any worker or other person (a "whistleblower") who raises a concern in good faith, whether to the Vendor, to Orange Health or to a regulator, or takes part in an audit or investigation. Orange Health will not retaliate against any Vendor or person who reports in good faith.

11.4 How we handle reports. Orange Health will treat reports confidentially, look into them fairly and keep the reporter's identity protected as far as the law and the investigation allow.

12.1 Classification. Orange Health will decide, acting reasonably and in good faith, whether a breach of this Code is minor or material, based on its seriousness, its effect on people, patients, data or Orange Health, and whether it was deliberate or repeated.

12.2 Minor breaches and corrective action. For a minor breach, Orange Health will give the Vendor written notice. The Vendor must then:

• send a corrective action plan within 7 days, setting out the cause, the steps it will take, who is responsible and the dates;
• carry out the plan within the period agreed with Orange Health, normally no more than 30 days;
• give evidence that the breach has been fixed and cannot easily recur, and allow Orange Health to verify it.

If the Vendor does not send the plan, does not carry it out, or repeats the same or a similar breach, the breach becomes material.

12.3 Material breaches. Each of the following is a material breach:

• bribery, corruption, kickbacks or any other breach of Section 4.1, 4.4 or 4.5;
• forced, bonded or child labour, or serious breaches of wage, safety or harassment law, including the POSH Act;
• falsifying records, certificates, test data or invoices;
• a breach of safety, biosafety or waste rules that has caused, or was likely to cause, injury, illness or contamination;
• a data breach caused by the Vendor's failure to protect data, any misuse of patient or personal data, or any unauthorised disclosure or misuse of Orange Health's business data or sensitive information;
• supplying counterfeit, adulterated or expired goods, or hiding a defect or recall;
• subcontracting work that needs consent without that consent;
• retaliating against a whistleblower or any other person who raised a concern, or obstructing an audit or investigation;
• loss, suspension or lapse of a licence the work requires; and
• any other breach that Orange Health reasonably considers serious.

12.4 Consequences of a material breach. For a material breach, Orange Health may, by written notice and without any cure period:

• terminate the agreement and all outstanding orders with immediate effect, without liability to the Vendor;
• suspend further orders, access to Orange Health sites and systems, or the Vendor's work while it investigates;
• decline to engage the Vendor again; and
• report the matter to the relevant authorities where the law requires or allows.

12.5 Other rights. These consequences are in addition to any other right or remedy Orange Health has under the agreement or the law, including recovery of losses.

Fair selection. We choose vendors on merit, price, quality and compliance, and treat bidders equally and without favour.

No improper demands. Our people are not allowed to ask for or accept bribes, kickbacks or gifts from Vendors. Vendors should report any such request to compliance@orangehealth.in.

Timely payment. We pay undisputed invoices within the agreed terms, and pay micro and small enterprises within the time the law requires.

Clear expectations. We explain what we need and give reasonable notice of changes that affect Vendors.

Confidentiality. We protect Vendors' confidential information and use it only for the purpose it was given.

Listening. We welcome feedback and concerns from Vendors and respond to them fairly and promptly.

14.1 Publication and updates. Orange Health publishes this Code on its website and may update it from time to time. Each version states its date, and the version in force is the one published on the website. An updated version applies to all Vendors from the date stated in it.

14.2 Interpretation. In this Code, "including" means "including without limitation", and references to a law include that law as amended, replaced or re-enacted and the rules made under it.

14.3 No waiver. If Orange Health does not enforce a part of this Code on one occasion, it does not give up the right to enforce it later.

14.4 Questions. Vendors can send questions about this Code to Orange Health's Legal & Compliance team at compliance@orangehealth.in.