Information security policy

Background and purpose

Humana provides guidelines for employees' use of IT and data. This is to protect all data associated with the customers and clients we work with.

It is essential that we all protect Humana’s information effectively to prevent unauthorized access to sensitive data. This is necessary to achieve our business goals and to ensure that customers, clients, partners, the public, and employees have confidence in us.

Scope

The policy covers all information assets within Humana’s operations without exception, regardless of whether the information is processed manually or automatically, and irrespective of the form or environment in which it appears.

Definitions

Information Security – The protection of information assets with regard to confidentiality, integrity, and availability.

Information Owner – A role that carries designated responsibility for information within one or more business areas, managed within their own operations.

Guiding principles

Information security work must be based on regular risk analyses aimed at balancing the correct level of protection for information in all parts of the organization in order to:

• Prevent or restrict unauthorized access to information (confidentiality)
• Ensure that the information created, managed, and processed is correct, up to date, and complete (integrity)
• Ensure that information is accessible to authorized personnel when needed (availability)
• Verify who has accessed or made changes to the information (traceability)
• For each of these areas, organizational, administrative, and technical safeguards must be implemented and documented in such a way that it is possible to verify that a satisfactory level of protection has been achieved.

Strategies and goals

Humana will continuously monitor and ensure data security through:

• Identification, classification, and evaluation of information assets to meet the requirements for integrity, confidentiality, traceability, and availability.
• Internal audits of information security and compliance with applicable legislation.
• Managing deviations in accordance with current guidelines, with the goal that deviations should always be few in number, and that Humana will work actively to manage and resolve security incidents. Deviations and incidents must be systematically documented and followed up on, and lessons learned should be utilized as part of continuous improvement efforts.
• Ongoing education and training of employees regarding relevant information security rules and the secure handling of information related to their own work and the IT systems used.
• Systematic, risk-based, and uniform work based on the ISO/IEC 27001 and ISO/IEC 27002 standards.
• The results of the security work must be reported annually during the management review.

Roles and responsibilities

All employees have a responsibility to ensure that security functions correctly. Anyone who discovers deficiencies in information security must report the issue to their immediate supervisor. All employees must also report incidents that could expose our information assets to risk.

The Board of Directors and CEO

The Board of Directors adopts the policy. The CEO has ultimate responsibility for Humana’s information and its security and integrity, as well as ensuring that the information security work is adapted to the Group's operations.

CIO

Responsible strategically and operationally for information security work, as well as developing and coordinating information security initiatives. Every year, the CIO must review and, if necessary, revise the information security policy.

Responsible managers within the operations

Managers at all levels are responsible for informing their employees about information security and its applications.

Information users

An information user is anyone who handles information, regardless of the form it takes. Information users include all employees as well as non-employees.

Information users must comply with Humana's policy, guidelines, and procedures for information security, and are also responsible for ensuring that information they create is protected in the manner determined by the information owner.

Information owners

All information must have a designated information owner. If the role has not been delegated, the CIO is responsible for the information and acts as the information owner. The information owner is responsible for evaluating the information and setting requirements for the system's security level.

IT

IT is responsible for the operation and development of Humana’s IT functions, and for ensuring that IT security meets Humana’s needs. The IT department is responsible for managing Humana's shared infrastructural IT platform and providing support to operational managers regarding IT security.

The policy was approved by the Board of Directors of Humana AB on 1 June 2026.

Translated from Swedish. In case of any discrepancies between the Swedish text and the English translation, the Swedish text shall prevail.

Responsible Artificial Intelligence at Humana

Humana’s AI Guideline applies to all employees of the Humana Group. It ensures the safe, ethical, and lawful use of artificial intelligence across Humanas operations. To maintain trust and safeguard our business, the policy specifically mandates the following principles:

Respecting data privacy: Humana strictly prohibits the use of personal data as input for any AI tools that have not been specifically approved by Humana, ensuring full compliance with applicable privacy policies.

Avoiding potential bias: Employees are instructed to validate input data to prevent unreliable results and must always check the output material of any AI tool for factual errors or biases.

Keeping humans "in the loop" for critical decisions: AI is utilized solely to support decision-making. The policy strictly states that decisions must not be made by AI, ensuring continuous human oversight.

Ensuring transparency and explainability: Humana commits to transparency when content is produced using generative AI. Furthermore, decisions affecting individuals cannot be based on AI-generated reasoning unless the reasons can be fully explained by a human.

Establishing clear accountability: While AI is a powerful tool, the guidelines make it clear that the responsibility for the final result and the use of AI-produced content always lies with a human.

Defining clear boundaries: The guideline provides concrete "Do" and "Do Not" directives, establishing clear operational boundaries regarding intellectual property, handling of confidential information, and appropriate tool usage.

The 'AI Guideline' was issued by Humana's CIO and approved by the Humana Group's Privacy Office on 9 June 2025.