Garofalo Health Care S.p.A.

Governance roles

Reference: pages 44-50.

Board of Directors: 11 members, appointed by the Shareholders' Meeting on 29 April 2024 (page 44). At 31.12.2025: 3 executive (27%) and 8 non-executive (73%); 5 independent (45%); 6 men (55%) and 5 women (45%); 2 members aged 30-50 and 9 over 50 (page 45). Board of Statutory Auditors: 3 standing and 2 alternate members; 3 men (60%) and 2 women (40%), all over 50 (pages 45-46).

Employee and other worker representation on these bodies "is not currently envisaged" (page 46).

Sustainability oversight: the Risk and Sustainability Control Committee has 3 members, all independent, 2 of them women, chaired by Franca Brusco (page 47). It also acts as the Sustainability Committee (page 49). The functions that monitor impacts, risks and opportunities are the CFO Function, Enterprise Risk Management, Sustainability and Internal Audit. From 2025 the CFO is also the Officer Responsible for sustainability matters (page 49). Business conduct governance is repeated under G1 (pages 121-122).

Information to the administrative, management and supervisory bodies

Reference: pages 51-52.

The bodies are informed at least annually about material impacts, risks and opportunities by the CFO Area Directorate, Enterprise Risk Management, Sustainability, Internal Audit and Legal and Corporate Affairs (page 51).

Sustainability matters addressed in 2025 (page 51):

• the ERM assessment of recruiting and retention, mainly of healthcare staff
• the physical climate risk assessment of the Emilia-Romagna facilities
• Internal Audit reports on health, safety and environment audits at subsidiaries
• an IT briefing on NIS2 cybersecurity obligations and the related policies
• the 2025 activity plans of the ERM, IT, Internal Audit and Sustainability functions
• review and approval of the 2024 sustainability reporting

Two Board inductions in 2025 covered NIS2 and the EU Pay Transparency Directive 2023/970 (page 52). In Q1 2026 the Board approved the Double Materiality Analysis, the 2026 CEO incentive plan and third cycle of the 2024-2026 Performance Share Plan, and the 2025 sustainability reporting (page 52).

Sustainability-linked incentives

Reference: pages 52-53, 85.

The CEO's FY2025 short-term variable pay (MBO) "required the achievement of 3 ESG objectives, with an overall weighting of 20%" (page 53): assessment of acute climate risks, assessment of HR processes in recruiting and retention, and digital evolution initiatives. Medium-to-long-term plans carry ESG weights of 15% (2021-2023 Performance Share Plan) and 20% (2024-2026 Performance Share Plan) (page 53).

The plans are approved and updated by the Board on proposal of the Nomination and Remuneration Committee and then submitted to the Shareholders' Meeting. The ESG targets themselves are in the 2026 Report on the Remuneration Policy and on remuneration paid in 2025, which the statement refers to (page 53).

Under E1 the statement says the objectives defined for the administrative, management and supervisory bodies "are not currently linked to targets for reducing GHG emissions" (page 85).

Statement on due diligence

Reference: pages 53-54, 81.

The statement maps the five due diligence elements of ESRS 1 chapter 4 to where each is covered (pages 53-54):

• Integrating due diligence into governance, strategy and business model: GOV-2, GOV-3, SBM-3, and the SBM-3 sections of E1, S1, S2 and S4.
• Engaging stakeholders: GOV-2, SBM-2 (including S1, S2, S4), IRO-1, S1-2, S2-2, S4-2.
• Identifying and assessing negative impacts: IRO-1, SBM-3.
• Acting on negative impacts: E1-3, E5-2, S1-4, S2-4, S4-4.
• Monitoring effectiveness and communicating: E1-5, E1-6, E5-5, S1-6 to S1-11 and S1-13 to S1-17.

In the EU Taxonomy section the Group says it met the Article 18 minimum safeguards "with the exception of Human Rights Due Diligence activities, which are currently not covered by company policies" (page 81), citing its business nature and an Italy-only value chain.

Risk management and internal controls over sustainability reporting

Reference: pages 55-58.

Sustainability reporting sits inside the Internal Control and Risk Management System (SCIGR), for which the Board is responsible (page 55). In 2025 the Group wrote a dedicated Consolidated Sustainability Reporting Procedure, approved by the Parent Company in November 2025 and adopted by the subsidiaries (page 55).

Roles (page 56): subsidiary Sustainability Officers collect and verify data and sign a sub-attestation letter with their CEO or General Manager; the Parent Sustainability Function consolidates and drafts; the Risk and Sustainability Control Committee reviews; the Board approves. The Executive in Charge for sustainability matters and the CEO sign the attestation under art. 154-bis, paragraph 5-ter of the TUF.

Risk areas (pages 57-58): subsidiary Sustainability Managers who lack seniority; data without documentary support; data handled by people who are not formally named; no checks beyond the audit firm; no formal procedure. Controls include mandatory back-up evidence, a Process Map naming a Data Owner for each data point, and sample checks by the Parent Sustainability Function in addition to the audit firm's work.

Strategy, business model and value chain

Reference: pages 59-63, 137.

GHC is an Italian accredited private healthcare group listed on Euronext STAR Milan (page 59). At 31.12.2025 it ran 37 operating facilities across 8 regions of central-northern Italy, delivering hospital, diagnostic and social care services; "the Group currently operates exclusively in Italy" (page 59). All 2,714 employees are in Italy (page 62). It works inside the Italian National Health Service (SSN) as an accredited private provider (page 61).

Market context from the OASI Report 2025: total Italian healthcare spending in 2024 of about EUR 187.6bn, of which about EUR 143.8bn was borne by the SSN (EUR 30.1bn through accredited private facilities) and EUR 43.8bn was private (page 62).

Value chain (page 63): upstream is non-employee medical staff, healthcare materials, goods and services (cleaning, linen, catering, waste disposal, equipment maintenance) and other services; own operations are the healthcare and social care services; downstream is patients.

The Group "does not have formalized Sustainability objectives" beyond the ESG objectives in its remuneration reports (page 61). The IRO-2 index notes that for FY2025 it omitted ESRS 2 SBM-1 paragraph 40, points (b) and (c), under Appendix C (page 137).

Interests and views of stakeholders

Reference: pages 63-65, 95, 107, 111.

Main stakeholders, identified since the IPO: personnel (employees and non-employees); patients and caregivers; public administrations, universities, research centers and the local community; investors and funders; suppliers (page 63). The engagement methods are tabulated on page 64 and include training and team-building events, reporting channels, service charters, satisfaction surveys, the MyGHC app, roadshows and results calls.

In 2025 engagement ran inside the double materiality assessment: 13 dedicated 1-to-1 meetings with personnel and with investors and lenders (credit institutions, bondholders, financial analysts), coordinated by Investor Relations and Sustainability with a specialist advisor (page 65). "During 2025, no changes were made to the Group's strategy or business model because of the engagement activity involving the various stakeholders" (page 65). The Board is informed at least annually of stakeholder views.

The S1, S2 and S4 chapters repeat SBM-2 and tie stakeholder protection to the Code of Ethics (pages 95, 107, 111).

Material impacts, risks and opportunities

Reference: pages 69-79, 137.

The SBM-3 table (pages 69-74) lists 39 impacts, risks and opportunities, each with a type label, time horizon and value chain position. By topic: E1 climate 4, E5 waste 3, S1 own workforce 7, S2 value chain workers 2, S4 patients as end-users 14, G1 business conduct 9. The company states no total; 39 is the row count.

The IROs are then grouped under 12 sustainability pillars in three layers (pages 74-79). Fundamental: quality of care; technological innovation and digitalization; attraction, development and wellbeing of staff; focus on patients and caregivers. Integrator: governance and compliance; sustainable supply chain management; workers' health and safety; data security and privacy; ethics and integrity. Enforcement: energy consumption; climate change adaptation; responsible waste management.

Current financial effects are handled in the consolidated financial statements, and no significant risk of material adjustments to carrying amounts in the next year is identified (page 79). The statement says "The Group does not currently carry out a formal qualitative and quantitative resilience analysis" (page 79). The IRO-2 index notes the omission of SBM-3 paragraph 48, point (e), under Appendix C (page 137).

Climate resilience is also presented under E1-3 (2025 ESRS numbering).

Process to identify and assess material IROs

Reference: pages 66-69.

For 2025 the Group ran a context review with a specialist advisor to look for "trigger events" against the 2024 double materiality analysis: internal context, value chain, regulation, sector benchmarking of first ESRS reports, and a media review. It found no changes in strategy, business model, operating context, value chain or market conditions that would require updating the IROs or material topics (page 66).

The 2024 method still applies (pages 66-67): IRO identification using sources such as SASB sector standards and the ERM function; impact assessment on severity (scale, scope, irremediable character) and likelihood; risk and opportunity assessment on magnitude of financial effect and likelihood, within the ERM framework; thresholds for each materiality perspective; stakeholder validation. Results went to the Risk and Sustainability Control Committee, the Board of Statutory Auditors and the Board.

Topic sections: the climate physical risk pilot (pages 68-69, see E1-2 scenario analysis) and an E5 review that held no consultations with communities or other external stakeholders (page 69).

Climate-specific risk identification and scenario analysis is also presented under E1-2 (2025 ESRS numbering).

Disclosure requirements covered by the sustainability statement

Reference: pages 137-140, 141-152.

The "Table of Contents of ESRS covered by the Sustainability Reporting [IRO-2]" (pages 137-140) lists, with page numbers, ESRS 2 (BP-1, BP-2, GOV-1 to GOV-5, SBM-1 to SBM-3, IRO-1, IRO-2), E1-1 to E1-9, E5-1, E5-2, E5-3, E5-5, E5-6, S1-1 to S1-11 and S1-13 to S1-17, S2-1 to S2-5, S4-1 to S4-5, and G1-1, G1-2, G1-3, G1-4, G1-6, plus MDR-P, MDR-A, MDR-T and MDR-M rows. E2, E3, E4 and S3 are absent, as are E5-4, S1-12 and G1-5.

A transitional-provisions column records omissions under ESRS 1 Appendix C: SBM-1 paragraph 40(b) and (c); SBM-3 paragraph 48(e); E1-9 and E5-6 in full; S1-13 paragraphs 83a, 84 and 85 (printed "S113"); S1-14 paragraph 88, points d and e; S1-15 paragraph 93, point b. The S1 notes cite the validity extension under the "Quick Fix" delegated act.

Pages 141-151 hold the index of datapoints derived from other EU legislation, which marks E2, E3, E4 and S3 datapoints "Not relevant". The EU Taxonomy template is on page 152.

Transition plan for climate change mitigation

Reference: page 85.

GHC has no transition plan. The statement says "the Group has not defined a climate transition plan" as of FY2025, and that it reserves the right to adopt one in the medium to long term, folding it into its value creation strategy and weighing stakeholder needs (page 85).

What it points to instead: new energy-efficiency measures in 2025 and the continued benefit of the Power Purchase Agreement signed in 2024 for renewable electricity, which covers a large part of its electricity needs (see E1-3). The Group sets no GHG reduction target, no base year and no net-zero date (E1-4, page 87).

E1-1 is listed in the IRO-2 content index (page 137), so it counts as reported here, as a statement that no plan exists. The statement also says the objectives set for its administrative, management and supervisory bodies are not linked to GHG reduction targets (page 85).

Identification of climate-related risks and scenario analysis

Back-filled from ESRS 2 IRO-1, climate section (pages 68-69), and the E1 SBM-3 section (page 85), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Risk types (page 85): the DMA found one transition risk (compliance or financial exposure if GHG regulation tightens) and one physical risk (extreme weather such as landslides and floods, plus long-term effects such as rising temperatures). The physical risk was not material in FY2024 and was added after the first pilot analysis.

Physical risk method (pages 68-69): a pilot on all facilities in Emilia-Romagna, about 38% of EBITDA and 20% of real estate value (FY2024 data), owned and leased. It screened 15 chronic and acute risks, analyzed each site by coordinates with specialist software for 2030 and 2050 under "three climate scenarios (optimistic, intermediate and pessimistic)", adjusted scores after site inspections, and modeled value at risk from business interruption in a prudent and a worst-case simulation. Most facilities came out at medium, medium-low or low risk over both horizons. The scenarios are not named by pathway and no temperature projection is given.

Transition risk: an analysis of climate scenarios for transition risks and opportunities "has not yet been carried out" (page 68).

Resilience in relation to climate change

Back-filled from ESRS 2 SBM-3 (page 79) and the E1 SBM-3 section (pages 85-86), where this content is disclosed in the FY2025 report. This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

The statement says "The Group does not currently carry out a formal qualitative and quantitative resilience analysis" (page 79). All risks are mapped and, where applicable, managed through the periodic ERM activities and vertical assessments of processes with a significant risk profile.

The 2025 climate risk pilot is described as a step toward resilience: the Group "took a first significant step towards assessing its resilience to climate change" (page 85). The statement says the pilot is a base on which it may, in the coming years, build a broader analysis of the resilience of its strategy and business model (pages 85-86).

Environmental risks to real estate are already part of the risks transferred through insurance; a "Property" policy covers climate-linked events such as snow load, hail and floods (page 86).

Policies related to climate change mitigation and adaptation

Reference: page 86.

For fiscal year 2025 the Group "does not have formalized policies addressing mitigation and adaptation to climate change or energy efficiency" (page 86). It may adopt them in the medium to long term, depending in part on stakeholder needs.

The only anchor is the Code of Ethics (described under G1), which treats respect for the environment as a fundamental value. The statement quotes it: GHC recognizes "the importance of respecting the environment and requires the Recipients to assess the environmental impact of their decisions, in order to minimize any negative effects" (page 86).

Actions and resources in relation to climate change policies

Reference: pages 86-87.

In 2025 the Group made energy-efficiency investments of EUR 0.5 million, approved by the administrative bodies of the subsidiaries involved and by the Parent Company's administrative body (page 86). Items tied to EU Taxonomy activities: LED lamps for common areas and replacement of lighting systems (EUR 0.02 million, activity 7.3), and a building energy management system (EUR 0.07 million, activity 7.5) (pages 86-87).

The Group also kept using its Power Purchase Agreement with Iren Mercato S.p.A., effective 1 January 2024 and valid for 2024-2028, which supplies renewable electricity certified by Guarantees of Origin. "The PPA enables the Group to cover most of its energy needs through the energy produced by the Iren Group's 18.4 MW photovoltaic plant located in Palo del Colle (BA)" (page 87). Villa Garda and XRay One have photovoltaic panels for self-generation (page 87).

Targets related to climate change mitigation and adaptation

Reference: page 87.

For 2025 the statement says "no formal targets have been defined relating to climate change mitigation and adaptation or to energy efficiency" (page 87). The Group says it recognizes the topic's relevance for its activities and its medium-to-long-term potential. Energy-efficiency measures are monitored through trends in energy consumption and carbon footprint analyses. No GHG reduction target, base year or pathway is given.

Energy consumption and mix

Reference: pages 87-88.

Total energy consumption was 54,845 MWh in 2025 (2024: 55,436 MWh). Fossil sources supplied 31,384 MWh, or 57.2% (2024: 32,559 MWh, 58.7%). Renewable sources supplied 23,461 MWh, or 42.8% (2024: 22,877 MWh, 41.3%). No coal, nuclear or renewable fuels are reported.

2025 detail, MWh: natural gas 22,136; crude oil and petroleum products 671; unconventional fossil gas 9; purchased electricity, heat, steam and cooling from fossil sources 8,568; purchased electricity, heat, steam and cooling from renewable sources 23,346; self-consumed renewable energy without fuels 115.

The Iren PPA lifted the renewable share of purchased electricity to about 89% (23,346,274 kWh of 26,138,815 kWh), from 85% in 2024 (page 88). Five real estate companies (GHC Real Estate, Gestiport '86, GHC Project 11, RAM and Finaur) fall in the high-climate-impact category by NACE code 68.20.1 but record no energy consumption, so their energy intensity is zero (page 87).

Gross Scopes 1, 2, 3 and total GHG emissions

Reference: pages 88-90.

Scope 3 in 2025: purchased goods and services 23,358; capital goods 7,819; fuel- and energy-related 1,528; upstream transport 214; waste 3,115; business travel 119; employee commuting 4,210; upstream leased assets 1,028; investments 585. Categories 9-14 are marked n.a. Intensity is 0.101 tCO2e per EUR k of revenue, market-based (0.103), on revenue of EUR 478,833k (462,175k) (page 89).

Method (pages 89-90): GHG Protocol, operational control; Scope 1 and 2 activity-based with IEA factors; categories 1, 2, 4, 5, 6 and 8 spend-based with EPA factors; category 3 with Ecoinvent and DEFRA; category 7 modeled with DEFRA factors; category 15 revenue-based. The statement attributes the category 2 and 5 swings to a method refinement and updated emission factors (page 90).

GHG removals and GHG mitigation projects financed through carbon credits

Reference: page 90.

The statement says "In the course of the 2025 no initiatives were carried out that resulted in the absorption and/or storage of GHGs" (page 90). The disclosure is a nil return: no removals and no carbon credits are reported. E1-7 is listed in the IRO-2 content index (page 138).

Internal carbon pricing

Reference: page 90.

The statement says "The GHC Group did not apply internal carbon pricing systems in 2025" (page 90). It gives no further detail. E1-8 is listed in the IRO-2 content index (page 138), so this nil return counts as reported.

Policies related to resource use and circular economy

Reference: pages 91-92.

The Group has no formalized policy on resource use and the circular economy, waste included (page 91). Its main waste is healthcare waste, treated as "special" waste under Legislative Decree 152/2006 and split into hazardous (infectious risk, chemical-physical risk, or needing specific disposal such as expired medicines) and non-hazardous (page 91).

The Code of Ethics treats respect for the environment as a fundamental value. The Group envisages a Waste Management Procedure at each subsidiary, covering classification by EWC code and hazard class, treatment and disposal, roles and controls, collection and storage, temporary storage areas and the waste loading and unloading register (pages 91-92). Each concerned subsidiary has named a responsible person, formalized its procedure and contracted authorized waste transporters; in 2025 it brought its procedures into line with Ministerial Decree 4 April 2023, no. 59 (RENTRI) (page 92).

Actions and resources related to resource use and circular economy

Reference: page 92.

Subsidiaries are subject to stringent mandatory rules because the waste they produce is mainly classed as special waste. For that reason the statement says no further specific actions on waste management were formalized during 2025 (page 92). The controls described under E5-1 remain the operating arrangements: a Waste Management Procedure at each subsidiary, service contracts with authorized waste companies, and the 2025 update to the RENTRI traceability decree.

Targets related to resource use and circular economy

Reference: pages 92-93.

For fiscal year 2025 the statement says "no formal objectives related to waste management were set" (page 92), given the nature of the Group's activities. The Group says it recognizes the relevance of the topic for its activities and its medium-to-long-term potential (page 93). No waste target, baseline or target year is given.

Resource outflows

Reference: pages 93-94.

All facilities have service contracts with specialized, authorized companies that collect waste from the temporary storage areas inside the facilities, then transport and dispose of it (page 93).

The outflow reported is waste: 1,223 t in 2025 (2024: 1,335 t), of which 797 t hazardous and 426 t non-hazardous (2024: 909 t and 426 t). Of the 2025 total, 598 t (49%) was not intended for disposal and 625 t (51%) was. Non-recycled waste was 1,195 t (98%) (2024: 1,286 t, 96%). No radioactive waste is reported. No other outflows, such as products, packaging or recycled content, are reported. The waste tables are under E5-5-Waste.

Waste

Reference: pages 93-94.

Waste produced in 2025, tonnes (hazardous / non-hazardous / total / share of total):

On-site storage before disposal was 30 t and other disposal 117 t; composting 0 t. Figures are as printed; a few rows differ from the sum of their parts by 1 t, which looks like rounding. Non-recycled waste was 1,195 t (98%), radioactive waste 0 t. For 2024 the total was 1,335 t and non-recycled waste 1,286 t (96%).

Scope (page 94): data come from each subsidiary's Waste Identification Form and annual Single Environmental Declaration. The Parent Company is excluded as a holding with insignificant municipal waste. Some municipal waste from healthcare facilities was estimated from average container capacity and treated as disposed of, for lack of disposal detail.

Policies related to own workforce

Reference: pages 96-98.

Policies cover the whole own workforce and rest on two documents: the Group Code of Ethics (see G1-1), which sets out human and labor rights commitments, and a Diversity & Inclusion Policy approved by the Parent Company's Board and applicable to all subsidiaries (page 96).

The D&I Policy commits the Group to prevent discrimination on age, gender, sexual and affective orientation, disability, geographic origin and ethnicity, religion, political and trade union affiliation, marital and pregnancy status, socio-economic status and contractual classification (page 97). Its areas are non-discrimination, equal opportunities and gender balance, an inclusive work environment, diversity in corporate bodies and a culture of listening. It is published in Italian and English on the website, compliance is monitored, a dedicated system takes violation reports, and no retaliation is tolerated (pages 97-98).

For health and safety the Group relies on workplace accident management systems and prevention policies, and on the Risk Assessment Document (DVR), which each company's employer approves and turns into procedures by professional role (page 98).

Taking action on material impacts on own workforce

Reference: pages 99-100.

The Group says it oversees material impacts, risks and opportunities for its own workforce through its policies and processes (page 99). The one action named for 2025 is a qualitative and quantitative assessment of recruiting and retention, run by Enterprise Risk Management within its annual budget, to strengthen the ability to attract and retain staff, especially healthcare staff. It covered all Group companies, employees and self-employed professionals nationwide. The qualitative part reviewed HR governance, recruiting channels, contract forms, retention tools and the degree of structuring of the subsidiary HR functions; the quantitative part measured turnover and replacement indicators and set up monitoring of freelance professional turnover. It was one of the CEO's short-term ESG objectives (page 100).

Also reported: Ospedali Privati Riuniti (Emilia-Romagna) became the first Group facility to obtain UNI/PdR 125:2022 Gender Equality Certification, and GHC was named among Italy's Best Employers by Corriere della Sera and Statista (page 100). No resources figure is given.

Targets related to own workforce

Reference: page 100.

For 2025 the statement says "no formal objectives have been defined in connection with these areas" (page 100). The Group says it recognizes the relevance of these matters to its sustainability and medium-to-long-term success, and that they are monitored through formalized, structured processes at each company and within the ERM framework, which reports to the governing, management and supervisory bodies on findings and corrective actions.

Characteristics of the undertaking's employees

Reference: page 101.

At 31.12.2025 the Group had 2,714 employees by headcount (2024: 2,708): 708 men and 2,006 women. By contract: permanent 2,549 (667 men, 1,882 women); fixed-term 159; apprenticeship 5; variable hours 1. About 94% are permanent. Full-time 2,329 and part-time 385 (2024: 2,344 and 364). All employees are in Italy.

Turnover: 451 employees left in 2025, a rate of 16.6% (2024: 459 leavers, 16.9%), calculated as leavers over employees on staff at 31.12.2025; the text rounds it to about 17%. The Group says it will keep monitoring facility turnover in 2026 (page 102).

Personnel costs in the income statement are EUR k 114,994, and the statement refers to Note 46 of the consolidated financial statements (page 101).

Characteristics of non-employees in the undertaking's own workforce

Reference: page 102.

At 31.12.2025 the Group had 2,669 non-employee personnel by headcount (2024: 2,528), mainly self-employed professionals such as doctors, consultants, psychologists and healthcare technicians (page 102).

By gender, 2025: 1,772 men and 897 women (2024: 1,692 and 836). The table is by headcount, not full-time equivalents, and no breakdown by role or hours is given.

Collective bargaining coverage and social dialogue

Reference: page 102.

Virtually all employees on staff at 31.12.2025 are covered by collective bargaining agreements: a coverage rate of 99.96%, in line with 2024. All facilities operate in Italy, so within the EEA. The Group's facilities have worker representatives as defined by the applicable reference standards, and trade union organizations are present in the healthcare facilities through appointed worker representatives. The statement gives no figure for workers' representation or works council coverage beyond this.

Diversity metrics

Reference: pages 102-104.

At 31.12.2025 women are about 74% of employees (in line with 2024) and about 16% of employees are under 30 (15% in 2024). There are 18 executives, 0.7% of employees (page 102).

By age, 2025: under 30, 431 (16%); 30-50, 1,204 (44%); over 50, 1,079 (40%). Executives are 10 aged 30-50 and 8 over 50. Board diversity is reported under GOV-1 (page 45).

Adequate wages

Reference: page 104.

The statement says the vast majority of employees (99.96%) receive an adequate wage set by the National Collective Labour Agreement (CCNL) of reference. One individual in 2025 is not covered by a CCNL and receives the same treatment as the CCNL comparable to the role performed. The statement cites no wage benchmark other than the CCNL.

Social protection

Reference: page 104.

Virtually all employees are covered by the social protection instruments provided for under the relevant National Collective Labour Agreements. The statement ties this to the 99.96% CCNL coverage reported under S1-8. One individual in 2025 is not covered by a CCNL and receives the same treatment as the agreement comparable to the duties performed. No breakdown by type of social protection (sickness, unemployment, parental leave, retirement) is given.

Training and skills development metrics

Reference: pages 104-105.

The Group delivered 26,023 training hours in 2025 (2024: 29,462): 6,476 to men and 19,547 to women. By category, 2025: executives 86, managers 177, clerks 23,362, workers 2,397. Per employee, 2025: 10 hours overall (men 9, women 10); executives 5, managers 8, clerks 10, workers 8 (2024: 11 overall) (page 105).

The IRO-2 index carries a note that the Group omitted the information prescribed by "S113" (as printed), paragraphs 83a, 84 and 85, under Appendix C (page 139). The statement reports no share of employees who took part in performance and career development reviews.

Health and safety metrics

Reference: pages 105-106.

"100% of the Group's employees are covered by the Company's occupational health and safety management system." All facilities can be audited on health and safety by Internal Audit or the facility's RSPP (page 105).

Employees, 2025 (2024): 0 fatalities (0); 0 serious work-related injuries excluding fatalities (1); 78 recordable work-related accidents (77). Hours worked were 3,992,512 (3,963,221). The statement prints the recordable injury rate as 20 (19) without naming the unit; 78 injuries over 3,992,512 hours is about 19.5 per million hours. The death rate is 0 (page 106). There were no deaths from workplace accidents or work-related illness among external workers in the Group's facilities in 2025 or 2024.

The IRO-2 index notes the Group omitted S1-14 paragraph 88, points (d) and (e), under Appendix C (page 139).

Work-life balance metrics

Reference: page 106.

The statement says the right to leave for family reasons is provided for in the relevant National Collective Labour Agreements and so covers substantially all employees, as reported under S1-8 (page 106). No share of entitled employees who took leave, and no breakdown by gender, is reported. The IRO-2 index notes the Group omitted S1-15 paragraph 93, point (b), under Appendix C (page 139).

Compensation metrics (pay gap and total compensation)

Reference: page 106.

The gender pay gap at 31.12.2025 is about 15% (about 16% in 2024), calculated on Gross Annual Remuneration (RAL), which excludes the end-of-service indemnity (TFR), social security charges and variable pay. The ratio of the CEO's total annual remuneration to the average total annual remuneration of employees is 44.5x (2024: 47.3x).

For the ratio, CEO remuneration includes fixed pay, variable non-equity pay and the fair value of equity pay; employee remuneration is staff costs from the consolidated financial statements divided by employees on payroll at 31.12.2025. The Group says that, with operations only in Italy, it does not expect a median-based calculation to differ significantly (page 106).

Incidents, complaints and severe human rights impacts

Reference: page 106.

The statement says that, based on what the Parent Company's competent functions know, "during the reporting period no incidents, allegations or severe impacts relating to human rights occurred" (page 106). The disclosure is a nil return. It gives no counts of discrimination incidents, complaints filed or fines.

Policies related to value chain workers

Reference: page 108.

For 2025 the Group "does not have formalized policies relating to workers in the value chain", in particular on occupational health and safety (page 108). Its commitments are in the Group Code of Ethics (see G1-1). Forced and child labor are addressed in each Group company's Legislative Decree 231/2001 Model, which suppliers must follow, and the statement says "At present, the Group does not have a Supplier Code of Conduct" (page 108). No cases of non-compliance with the UN Guiding Principles, the ILO Declaration or the OECD Guidelines have been identified for value chain workers.

Taking action on material impacts on value chain workers

Reference: page 110.

The statement says "no actions or initiatives were undertaken in relation to the identified material impacts and risks" during 2025, given the control safeguards and monitoring already in place at subsidiary and Parent Company level (page 110). If significant adverse health and safety impacts arose, company procedures assign responsibility to identify the response case by case. The Group monitors the risks through the ERM function and its ERM metrics, with mitigation actions shared with risk owners and followed up by ERM and Internal Audit. It reports that "no serious human-rights issues or incidents connected to its value chain have been reported".

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 110.

For 2025 the statement says no formal objectives have been defined for value chain workers (page 110). The Group says it recognizes the relevance of these matters to its medium-to-long-term development, and that they are monitored by the competent functions through formalized processes at each company and within the ERM framework, which informs the management, executive and control bodies of findings and corrective actions.

Policies related to consumers and end-users

Reference: pages 112-117.

The formal policy is the Group Code of Ethics (see G1-1), addressed to patients as end-users. It is backed by each facility's mandatory Service Charter, clinical risk management procedures, and data security and privacy procedures, including a Cyber Incident Management procedure approved by the Parent Company (pages 112-113).

In 2025 the Group strengthened its data security policies under the NIS2 Directive (EU 2022/2555) and Legislative Decree 138/2024, which led to its healthcare facilities being identified as "Essential entities". It formalized a Cybersecurity Policy, a staff cybersecurity training policy, a Procedure on NIS2 Roles and Responsibilities and an updated IT incident management procedure, all approved by the Parent Company's Board and the subsidiaries' administrative bodies (pages 113-117). The statement says "no violations were identified of the principles of the United Nations Global Compact and of the OECD Guidelines for Multinational Enterprises that concern consumers and/or end users" (page 117).

Taking action on material impacts on consumers and end-users

Reference: pages 119-120.

The one area of 2025 action described is technological innovation and digitalization, coordinated by the IT Function within its annual budget (page 120):

• a new Group website for the facilities acquired in 2022-2023 (GVDR, Sanatorio Triestino, Gruppo Aurelia)
• extension of the MyGHC app (bookings, reports, payments) to Rugani Hospital, Casa di Cura Prof. Nobili, Istituto Raffaele Garofalo, XRay One and Aesculapio, a CEO short-term ESG objective for 2025
• growth in digital bookings, added in July 2025 to the ESG objectives of the Group's Sustainability-Linked Loan, with 3,159 online bookings recorded through the website and app in 2025; it is also a CEO short-term objective for 2026

The Group also began preparing for Ministerial Decree 232/2023 implementing the Gelli Law, in force from March 2026, mapping serious adverse events to choose governance and clinical safeguards.

Targets related to managing material negative impacts, advancing positive impacts, and managing material risks and opportunities

Reference: page 120.

For 2025 the statement says "no formal objectives have been defined in connection with these areas" for consumers and end-users. The Group says it recognizes their relevance to its medium-to-long-term success and that they are monitored by the competent functions through formalized processes at each company and within the ERM framework, which informs the management, executive and control bodies of findings and corrective actions (page 120). The one numeric digital-bookings KPI appears in the 2026 CEO incentive and the loan terms (see S4-4), not as an S4 target.

Business conduct policies and corporate culture

Reference: pages 122-133.

The Group frames conduct around propriety, legal compliance (especially offences against the Public Administration and private corruption) and independence from influence. Each company publishes the Code of Ethics, the whistleblowing procedure and a link to a reporting platform open to external parties such as suppliers (page 122).

Code of Ethics: updated in 2023 for whistleblowing rules and approved by the Board on 14 November 2023. It covers directors, employees, collaborators and suppliers, with standards on conflicts of interest, money laundering, accounting, IT and privacy, and environment and safety (pages 123-128). Whistleblowing: each company has a procedure with confidentiality, anti-retaliation protection and a Whistleblowing Committee. Employee training ran in 2025 at subsidiary level; training for staff who receive reports follows in 2026 after new ANAC guidelines (pages 128-129). Anti-Corruption Policy: approved by the Board in 2023 and mandatory for subsidiaries; it covers gifts, acquisitions, third parties, hiring, sponsorships, facilitation payments and traceability (pages 129-133).

Purchasing and Communication are the functions most exposed to corruption; "no specific training activity was carried out for the above-mentioned functions at risk of active and passive corruption and for the corporate bodies of administration, management and control" in 2025 (page 133).

Targets related to business conduct

Back-filled from the business conduct chapter, where targets are addressed under the MDR-A and MDR-T disclosures rather than as a numbered disclosure requirement. G1-3 became a standalone DR only in the 2025/2026 ESRS.

GHC sets no business conduct targets. For 2025 the statement says "no formal actions or objectives related to these areas have been defined" (page 136). Effectiveness is tracked in their absence: the Group says the aspects and the effectiveness of the policies adopted are constantly monitored through formalized, structured processes at each Group company and within the ERM framework, which periodically informs the governing, management and supervisory bodies of findings and corrective actions (page 136). The IRO-2 index lists an MDR-A, MDR-T row for G1 at page 136.

Incidents of corruption or bribery

Reference: page 135.

In the reporting period "no cases of violations of laws against active and passive bribery occurred" (page 135). The Group says it learned of none through internal channels (whistleblowing), external channels (ANAC), periodic reviews or internal audits. The FY2025 table shows nil returns for convictions, fines, substantiated cases, confirmed dismissals or sanctions of own workers, and business partner contracts terminated or not renewed for bribery-related violations.

Payment practices

Reference: pages 44, 136.

The Group reports average payment time through an Alternative Performance Indicator, "Average payment days", disclosed in the Report on Operations (the statement lists G1-6 paragraph 33(a) as incorporated by reference to "Group Overview", paragraph 2 of the Management Report, page 44). The indicator is trade payables divided by the sum of raw materials and consumables, services and third-party asset use, and other costs, multiplied by the days in the year, reported on a consolidated and aggregated basis (page 136).

The statement says "there are no formalised standard payment terms at Group level for the different categories of suppliers" (page 136). There are no pending legal proceedings arising from late payments at the report's publication date. The statement gives no payment-day figure inside the sustainability statement itself.