1.INTRODUCTION

This Whistleblowing Policy establishes minimum standards to be implemented as prescribed by Erom Healthcare Limited for all its employees. It also includes additional requirements as warranted by our business or where required by applicable law.

This Policy has been established to ensure that all cases of suspected breach of controls, policy and company's values are reported and managed in a timely and appropriate manner. This document supports our core values and norms, the code of professional conduct as well as good governance. Our principle of “Integrity” implies that we remain consistent and honest in our dealings with others and strive to treat people with trust and mutual respect while maintaining transparency and accountability.

In line with its code of conduct, Erom's Whistleblowing Policy and Procedures outlines the Company's commitment to ensure that all stakeholders can raise their concerns regarding any illegal conduct or practice without being subjected to victimisation, harassment or discriminatory treatment, and to have such concerns properly investigated.

Also, this Policy sets out the mechanism and framework by which staff, contractors, consultants, vendors, etc. can confidently, and anonymously, voice their concerns/complaints without fear of discrimination and be assured that their concerns are duly investigated to the latter.

2.PURPOSE

Erom is committed to maintaining the highest possible standards of ethical and legal conduct within all entities in the group. In line with this commitment and to enhance good governance and transparency, the main drive of this policy and procedures is as follows:

• To provide clear reporting channels for whistleblowing for employees and other stakeholders, who feel the need to raise matters of concern relating to the Company
• To ensure that employees and other stakeholders can raise concerns regarding any illegal conduct or malpractice and to have such concerns properly investigated
• To encourage employees and other stakeholders to disclose any wrongdoing or unethical behaviour that may adversely impact the Company or the Group
• To provide guidance on clear procedures for reporting matters of such concerns
• To manage all disclosures in a timely, consistent, and professional manner; and
• To provide assurance that all disclosures will be taken seriously, treated as confidential and managed without fear of retaliation to the whistleblower.

3.ANCHORS OF THE WHISTLE-BLOWING MECHANISM

Good governance in all Erom entities is enhanced by the institution of a whistleblowing mechanism that cuts across the Group. Consistent with its policy on good governance, Erom has put in place several processes and initiatives that discourage red flag activities within the organization. The implementation of controls that foster an environment in which management sets the tone at the top by sensitizing members of staff on matters of integrity and ethical values, assignment of authority and responsibility, and reinforcement of internal controls measures.

Erom's core values and norms, the delivery of the best quality service to customers with utmost diligence, efficiency, and transparency are the anchor of all Erom's activities and it demands the highest standards of ethics, honesty and accountability at all times. These anchors would be further strengthened by a credible whistleblowing and complaints handling mechanism as presented.

4.WHO IS A WHISTLE-BLOWER OR COMPLAINANT?

A Whistle-Blower or a Complainant is any person or party who conveys or is about to convey a concern, allegation or any information indicating that fraud, corruption or any other misconduct is occurring or has occurred in the Company; with knowledge or good faith that the concern, allegation or information is true. Such persons or parties, without limitation, include staff members of Erom's entities, contractors, consultants, former staff members, or any other entity or person.

The success of this Policy depends in part on the conscience and professional ethics of the Whistle-Blower or Complainant and the attendant assurance of confidentiality. To avoid the psychological pressures such conflicts can cause Whistle-Blowers and Complainants, Erom shall take all reasonable steps to keep the identity of Whistle-Blowers or Complainants confidential.

It should be noted that Whistle-Blowers and Complainants are reporting parties. They are neither investigators nor finders of fact; they do not determine if corrective measures are necessary; and they do not determine the appropriate corrective or remedial action that may be warranted.

5.COVERAGE AND SCOPE

This Policy applies to the Company and covers all employees (including temporary and contract employees), officers, consultant and agents acting in the Company. All are required to disclose acts relating to fraud, corruption, or any other misconduct, including actions that undermine our operations and mission that come to their attention.

Misconduct can take many forms but for clear understanding, Erom points out the following types of misconduct:

1. Issues relating to HR (including harassment, discrimination, inadequate behaviour at work and/or any potential breach of local Labour Law).
2. Misappropriation of assets (including theft; misuse or abuse of company assets such as phone, computer, funds, data etc.).
3. Financial statement fraud (misrepresentation, falsification, concealment, misstatement, or omission of financial records).
4. Other fraudulent statement (i.e. related to non-financial management information such as HR, strategic, commercial, asset management, etc.). Corruption, bribery, extortion (including gift, commission, political contribution, conflict of interest etc. that are not compliant with Erom Code of Conduct, Erom Compliance and Ethics Guide and/or any local legislation).
5. Other breach of applicable laws or regulation (including unfair competition/anti-trust, insider trading, Money laundering and financing terrorism).
6. Endangering health, life and/or safety.
7. Customer mistreatment including improper use of customer data.
8. Failures to comply with statutory obligations and requirements.
9. Misconduct, i.e. failure to observe the Company's code of conduct or standards of behaviour.
10. Coercive practices, i.e. impairing or harming, or threatening to impair or harm, directly or indirectly, any party or the property of the party to influence improperly the actions of a party.
11. Collusive practices, which mean an arrangement between two or more parties designed to achieve an improper purpose, including influencing improperly the actions of another party; and
12. Any other activity which undermines the Company's operations and mission.

It is not intended that this list be considered as a comprehensive list of subjects upon which whistle-blowing events can be made. If it is not clear which category a report should fall into then guidance should be sought from the Chief Risk Officer/General Counsel.

Whistle-Blowing and complaints should be made in the certainty that what is being reported is true. Allegations and concerns expressed anonymously shall be considered at the discretion of the Chairman, Board Audit & Risk Committee. In the exercise of such discretion, the factors to be considered shall include, without limitation, the seriousness of the allegation, its credibility, and the extent to which the allegation can be confirmed or corroborated by reliable sources.

6.PROTECTION OF WHISTLE-BLOWER UNDER THE POLICY

The Company shall protect the Whistle-Blower's or Complainant's identity. For whistle-blowing and complaint handling mechanism to be effective, the concerned parties must be adequately assured that the information given will be treated as confidential and above all that they will be protected from discrimination and against retaliation from within or outside the Company.

The Company will maintain the Whistle-Blower or Complainant's identity as confidential unless such person agrees to be identified or in the following circumstances where:

1. Identification is necessary to allow the Company or the appropriate law enforcement officials to investigate or respond effectively to the disclosure
2. Identification is required by law or where a false accusation has been maliciously made, or
3. The person accused is entitled to the information as a matter of legal right.

In any of the above instances, the Company shall inform the Whistle-Blower or Complainant prior to revealing his or her identity, with the promise of protection from discrimination.

7.CHANNELS AND PROCEDURES

The Company shall nominate a Designated Complaint Recipient (DCR) to receive and handle any report of misconduct. Where more than one DCR exists in a territory these responsibilities should be clearly allocated to ensure that there is no omission or unnecessary duplication. The Designated Complaint Recipient (DCR) is the Compliance Officer who reports to the General Counsel.

The channels and procedures for whistleblowing or raising complaints shall depend on whether the allegation, complaint or information is being made or disclosed by a staff member or by a party external to the Group. Staff members are expected to whistle-blow on transactions, operations or/and any other activities of the Group that involve fraud, corruption and misconduct, whether internal or external. Parties external to the Company, however, are required to bring allegations and complaints of corruption, fraud and any other misconduct in the execution of any business of the Company or project(s) that involve the Company.

8.INTERNAL WHISTLE-BLOWING PROCEDURE

Internal whistleblowing involves staff members across the Group raising concern about unethical conduct. The following procedure shall be adopted for internal whistleblowing:

Whistle-Blowers must not suffer or be held accountable for a complaint made in good faith for which the investigation proves that allegations are non-substantiated. However, if complaints are found to have been made from malicious intent, then the Whistle-Blower may be subject to disciplinary action as deemed appropriate.

Any internal Whistle-Blower that feels victimized can report his/her grievance(s) to the Chairman, Board Audit and Risk Committee. This is without prejudice to the fundamental right of the internal Whistle-Blower to seek redress in the court of law.

9.EXTERNAL WHISTLE-BLOWING PROCEDURE

External Whistle-Blowers are non-staff of the Company and they may fall into any of these categories: Contractors, Service Providers, Shareholders, Depositors, Analysts, Consultant, Job Applicants, and the General Public.

External whistleblowing shall follow the procedure below:

In addition, an external Whistle-Blower is at liberty to report to appropriate regulatory authority or even seek further redress in the court of laws If he/she is not satisfied with the action taken to address the concern(s).

10.DEFINITION

1. Complaint: an allegation or concern known to the Office of the Chairman of the Board Audit & Risk Committee that is subject to investigation.

2. Complainant/Whistle-Blower: any party who conveys a concern, allegation or information indicating fraud, corruption or misconduct.

3. Investigation: a process designed to gather and analyze information in order to determine whether an act of fraud, corruption, or other misconduct has occurred and if so, and uncover the party or parties responsible for the misconduct.

4. Fraudulent and Corrupt Practices include:

   1. Corrupt Practice: the offering, giving, receiving, or soliciting, directly or indirectly, anything of value to influence improperly the actions of another party;
   2. Fraudulent Practice: any act or omission, including a misrepresentation, that knowingly or recklessly misleads, or attempts to mislead, a party to obtain a financial or other benefit or to avoid an obligation;
   3. Coercive Practice: an intimidating, harming, or threatening action that is aimed at impairing, damaging or harming, directly or indirectly, any party or the property of the party to influence improperly the actions of a party;
   4. Collusive Practice: a secretive arrangement between two or more parties designed to achieve an inappropriate purpose, including influencing the actions of another party.

5. Misconduct is a failure by a staff member to observe the rules, code of conduct or standards of behaviour as prescribed by the Company.

6. Standard of proof: the purposes of an investigation, an information that, shows that something is more plausible than not. It shall be used to determine whether a complaint is validated.