Whistleblowing

WHISTLEBLOWING INFORMATION NOTICE (PURSUANT TO ART. 5 OF LEGISLATIVE DECREE OF 10 MARCH 2023, NO. 24)

Preamble

Legislative Decree No. 24 of 10 March 2023 (hereinafter also referred to as the “Decree”), published in the Official Gazette No. 63 of 15 March 2023, implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019, regulates the protection of persons who report violations of national or European Union regulatory provisions that harm the public interest or the integrity of public administrations or private entities, of which they have become aware in a public or private work context.

The attention of the EU and national legislator is primarily directed at providing adequate “protection” for the reporting person, who may be exposed to forms of retaliation, defined as “any behaviour, act or omission, even if only attempted or threatened, carried out as a result of the report, the complaint to the judicial or accounting authority, or the public disclosure, which causes or may cause, directly or indirectly, unjust harm to the reporting person or the person who filed the complaint.”

1. Violations

The aforementioned protection is recognised for reports concerning “violations” of national and European Union regulatory provisions.

For the purposes of the said Decree, the term “violations” refers to behaviours, acts, or omissions that harm the public interest or the integrity of public administrations or private entities, and which consist of:

Administrative, accounting, civil, or criminal offences not falling under points 3), 4), 5), and 6);

Unlawful conduct relevant under Legislative Decree No. 231 of 8 June 2001, or violations of the organisational and management models provided therein, not falling under points 3), 4), 5), and 6);

Offences falling within the scope of EU or national acts listed in the annex to the said Decree, or national acts implementing the EU acts listed in the annex to Directive (EU) 2019/1937, even if not listed in the annex to the Decree, relating to the following sectors: public procurement; financial services, products and markets, and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and personal data protection; and network and information systems security;

Acts or omissions affecting the financial interests of the Union as referred to in Article 325 of the Treaty on the Functioning of the European Union, as specified in the relevant EU secondary legislation;

Acts or omissions relating to the internal market, as referred to in Article 26(2) of the Treaty on the Functioning of the European Union, including violations of EU competition and State aid rules, as well as violations relating to the internal market connected with acts that infringe corporate tax rules or mechanisms whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax legislation;

Acts or behaviours that defeat the object or purpose of the provisions set out in the EU acts in the sectors referred to in points 3), 4), and 5).

It should be noted that the Decree does not apply to reports relating to “disputes, claims and requests linked to a personal interest of the reporting person (…) that relate exclusively to their individual employment or public employment relationships, or to their employment or public employment relationships with hierarchically superior figures.”

2. Reporting Persons

The Decree defines a “reporting person” as the natural person who makes the report or public disclosure of information on violations acquired within the scope of their “work context.”

The aforementioned legislation applies to “persons who report,” identified in Article 3, paragraph 3 of the Decree, namely:

a) Employees of public administrations, treated separately owing to the specific nature of the public employment relationship (Legislative Decree No. 165/2001, Art. 1, paragraph 2);

b) Employees of all other entities in the “public sector”;

c) Subordinate employees in the “private sector” (including occasional work arrangements);

d) Self-employed workers (including collaboration relationships as referred to in Art. 409 of the Italian Code of Civil Procedure, such as commercial agents or collaboration relationships involving a continuous and coordinated work performance, even if not of a subordinate nature);

e) Workers or collaborators who carry out their work activities at entities that are “suppliers” of goods, services, and works to public or private sector entities;

f) Freelancers and consultants of private or public entities;

g) Volunteers and trainees (including unpaid ones);

h) Shareholders and persons with administrative, management, control, supervisory, and representative functions, including de facto ones.

Article 3 of the Decree also extends the protections provided therein to the following persons:

a) “Facilitators,” i.e. natural persons who assist a reporting person in the reporting process, operating within the same work context;

b) Persons belonging to the “same work context” as the reporting person, who have a family relationship with them up to the fourth degree of kinship or a “stable emotional bond”;

c) “Work colleagues” who have a “habitual or current relationship” with the reporting person;

d) “Entities owned by the reporting person” and the persons operating within them.

The protection of reporting persons also applies where the report is made in the following circumstances:

a) When the legal relationship has not yet begun (if information on violations was acquired during the selection process or other pre-contractual phases);

b) During the probationary period;

c) After the termination of the legal relationship (if information on violations was acquired in the course of that relationship).

3. Reporting Channels

The Decree specifically regulates “reports,” i.e. written or oral communications of information on violations.

The reporting person — i.e. the natural person who makes the report or public disclosure of information on violations acquired within the scope of their work context — may, in particular, make:

an “internal report”: a written or oral communication of information on violations, submitted via internal reporting channels (Art. 4);

an “external report”: a written or oral communication of information on violations, submitted via external reporting channels (Art. 7).

3.1. Internal Reporting Channels of J|medical S.r.l.

In compliance with Article 4 of Legislative Decree No. 24/2023, in order to ensure the confidentiality of the identity of the reporting person, the person involved, and any person mentioned in the report, as well as the content of the report and the related documentation, the Company has updated its reporting channels, entrusting their management to the Company’s Supervisory Board.

Internal reports may be submitted via:

Written communication, addressed by registered letter to the Company’s Supervisory Board, at the following address: Avvocato Enrico Cairo – Studio Avvocato Chiusano, via Bertolotti n. 2 – 10121 Turin. The report should preferably be placed in two sealed envelopes: the first containing the reporting person’s identifying details together with a photocopy of their identity document; the second containing the report itself, so as to separate the reporting person’s identifying details from the report. Both envelopes should then be placed in a third sealed envelope, bearing on the outside the wording “confidential — for the Whistleblowing Manager.”

Oral report, via telephone contact at mobile number +39 3333920306 (not subject to a recording procedure), managed by the Company’s Supervisory Board. Upon receipt of the report, the Manager documents it by means of a detailed account, and the content thereof is countersigned by the reporting person, following verification and any necessary rectification.

Direct and confidential meeting with the Manager of the internal reporting channel, by contacting mobile number +39 3333920306 (not subject to a recording procedure), managed by the Company’s Supervisory Board. The report is received by the Manager through a direct meeting, which takes place within 15 days of the request, in a place appropriate to ensure the confidentiality of the reporting person.

In the context of managing the internal reporting channels, the Manager is required to carry out the following activities:

a) Issue the reporting person with an acknowledgement of receipt of the report within seven days of the date of receipt;

b) Maintain communication with the reporting person and, if necessary, request additional information from them;

c) Diligently follow up on reports received;

d) Provide feedback on the report within three months of the date of the acknowledgement of receipt, or, in the absence of such acknowledgement, within three months of the expiry of the seven-day period from the submission of the report;

e) Make available clear information on the channel, procedures, and requirements for submitting internal reports, as well as on the channel, procedures, and requirements for submitting external reports.

3.2. External Reporting Channels

The National Anti-Corruption Authority (ANAC) has activated an external reporting channel that ensures the confidentiality of the identity of the reporting person, the person involved, and any person mentioned in the report, as well as the content of the report and the related documentation.

Legislative Decree No. 24/2023 provides (Art. 6) that the reporting person may make an external report where, at the time of submission, one of the following conditions applies:

a) No mandatory activation of an internal reporting channel is provided for within their work context, or such a channel, even if mandatory, is not active, or, even if activated, does not comply with the provisions of Article 4 of Legislative Decree No. 24/2023 (see above, § 3.1);

b) The reporting person has already submitted an internal report pursuant to Article 4 and no follow-up has been given;

c) The reporting person has reasonable grounds to believe that, if they were to submit an internal report, it would not be effectively followed up, or that the report itself may give rise to a risk of retaliation;

d) The reporting person has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest.

External reports may be submitted:

In written form, via an IT platform;

or

In oral form, through telephone lines or voice messaging systems, or, at the request of the reporting person, through a direct meeting arranged within a reasonable timeframe.

With regard to the external reporting channels (Art. 7 of Legislative Decree No. 23/2023) and the related management activities (Art. 8), reference is made — in addition to the aforementioned Decree — to the information published on the ANAC institutional website, including (Art. 9):

a) An outline of the protection measures set out in Chapter III of the Decree (“Protection Measures”);

b) ANAC’s contact details, including in particular the telephone number;

c) Instructions on the use of the external reporting channel and internal reporting channels;

d) An outline of the confidentiality regime applicable to external and internal reports;

e) The procedures by which ANAC may request the reporting person to provide additional information, the deadlines for responding to an external report, as well as the types of responses and follow-up that ANAC may provide to an external report; f) The list of third-sector entities that have entered into agreements with ANAC pursuant to Article 18, paragraph 1, together with their contact details.