3. Applicability

This Policy applies to all directors, employees, officers, trainees, interns, consultants, contractors, temporary personnel, service providers and other persons having a business relationship with Favnox, to the extent applicable. For any Favnox entity or activity outside India, this Policy shall operate subject to mandatory local law and local reporting requirements.

Nothing in this Policy limits any statutory right or obligation to report a matter to a government, regulatory, law-enforcement, judicial or other legally authorised authority.

4. What May Be Reported

A concern may be reported where a person reasonably believes that misconduct, wrongdoing or a serious compliance issue has occurred, is occurring or may occur. Examples include:

Ø  Fraud, financial misconduct, accounting irregularities, falsification of records or misappropriation of Company assets.

Ø  Bribery, corruption, kickbacks, improper payments, conflicts of interest or unethical dealings with customers, vendors or other business partners.

Ø  Violation of applicable laws, licences, regulatory requirements or Company policies and procedures.

Ø  Pharmaceutical quality, GMP, product safety, data integrity or regulatory concerns, including falsification or manipulation of laboratory, batch, manufacturing, validation or regulatory records.

Ø  Concealment or inappropriate handling of product quality complaints, adverse events, safety information or other matters that may affect patients or public health.

Ø  Unauthorised changes, deliberate deviations, falsification of manufacturing or quality documentation, or deliberate concealment of non-compliance.

Ø  Procurement fraud, vendor misconduct, diversion, counterfeit concerns or improper commercial practices.

Ø  Unauthorised access, misuse, disclosure or compromise of confidential or personal information.

Ø  Serious harassment, intimidation, abuse of authority, discrimination or other conduct that involves retaliation, illegality or serious ethical misconduct.

Ø  Attempts to suppress, destroy, alter or conceal evidence or interfere with a whistle-blower investigation.

5. Matters Normally Outside This Policy

Routine employment or service matters such as ordinary salary or increment disputes, routine leave matters, job applications, transfers, facilities complaints, IT equipment issues and suggestions for operational improvement should normally be raised through the relevant HR or business process. However, a matter shall not be excluded merely because it relates to employment if it involves fraud, discrimination, retaliation, harassment, deliberate manipulation, illegality or other serious misconduct.

Complaints of sexual harassment at the workplace shall be handled through Favnox’s Internal Committee and POSH procedure as required by applicable law. Retaliation, concealment or interference connected with a POSH matter may also be addressed under this Policy.

6. Guiding Principles

Ø  Good faith: Reports should be made honestly and with a reasonable belief that the information is relevant and substantially true.

Ø  Confidentiality: Information will be restricted to persons who need it for assessment, investigation, decision-making or legal/regulatory purposes.

Ø  Independence: Persons with an actual, potential or perceived conflict of interest shall not participate in the relevant matter.

Ø  Fairness: An investigation is a fact-finding process and is not, by itself, a finding of guilt.

Ø  Non-retaliation: Retaliation against a protected reporter, witness or person assisting an investigation is prohibited.

Ø  Need-to-know disclosure: Information will be shared only to the extent reasonably necessary and permitted by law.

7. Reporting Channels

Concerns may be submitted through the following channels:

Ø  Dedicated email: whistleblower@favnox.in

Ø  Written complaint: Ethics/Whistle-Blower Committee, Favnox Pharmaceuticals Private Limited, Favnox House, Plot Number 92, Phase II, Sree Kanaka Durga Nagar, Chengicherla, Hyderabad – 500092, Telangana, India.

Ø  Exceptional/sensitive matters involving senior management, a Director, Managing Director or a member of the Ethics/Whistle-Blower Committee may be escalated directly to the designated Board/Audit Committee authority, where constituted and applicable.

Ø  Favnox may introduce a secure online or third-party reporting channel from time to time.

The dedicated reporting channel for this Policy is whistleblower@favnox.in. Reports received through this channel shall be handled confidentially in accordance with this Policy.

8. Anonymous Reporting

Favnox may accept anonymous reports where sufficient information is provided to permit a meaningful preliminary assessment. An anonymous reporter may provide a secure means for follow-up communication without disclosing identity. Anonymous reporting will not be used to avoid lawful investigation or reporting obligations.

9. Protection Against Retaliation

Retaliation is strictly prohibited against any person who, in good faith, makes a protected disclosure, provides information, participates in an investigation, assists an investigator, or refuses to participate in misconduct.

Retaliation may include termination, demotion, adverse performance treatment, denial of opportunities, punitive transfer, intimidation, threats, harassment, exclusion, adverse contractual action or any other adverse treatment intended to punish or discourage protected activity.

Retaliation is a separate misconduct matter and may result in disciplinary or other appropriate action even where the underlying concern is ultimately not substantiated.

10. Governance and Oversight

The Board of Directors shall have overall governance oversight of this Policy. Where an Audit Committee is constituted and the statutory vigil mechanism requirements apply, the Audit Committee shall exercise the oversight assigned to it by applicable law.

A Whistle-Blower/Ethics Committee shall administer the day-to-day framework. The Company may designate suitable senior personnel from management, HR, finance/internal audit, quality/regulatory and/or legal/compliance functions. The composition shall be reviewed periodically to preserve independence and effectiveness.

Any person who is the subject of a concern, has a conflict of interest, or may reasonably be perceived as conflicted shall immediately and mandatorily recuse from receipt, assessment, investigation and decision-making concerning that matter.

11. Receipt and Preliminary Assessment

1.  Concerns should, where possible, identify the nature of the concern, persons involved, relevant dates, locations, documents or other supporting information.

2.  An acknowledgement should normally be issued within 3 working days where the reporter’s identity or a secure communication channel is available.

3.  A preliminary assessment should normally be completed within 7 working days, subject to complexity and availability of information.

4.  The Company may close a matter at the preliminary stage where it is clearly outside scope, unsupported by sufficient information, duplicative, or otherwise inappropriate for investigation, with reasons documented.

5.  Where a matter indicates immediate patient safety, product quality, public health, significant regulatory or legal risk, it shall be escalated without waiting for completion of the ordinary process.

12. Investigation

Where investigation is warranted, Favnox shall conduct or appoint an investigation that is fair, objective, proportionate and legally compliant. An external investigator, specialist, auditor, lawyer, quality/regulatory expert or other appropriate professional may be appointed where independence or specialist expertise is required.

Ø  Relevant evidence should be preserved promptly.

Ø  Investigators should document interviews, evidence reviewed, findings and significant decisions.

Ø  The subject of a concern should be given a fair opportunity to respond where appropriate, subject to confidentiality, evidence-preservation and legal requirements.

Ø  Investigators shall avoid unnecessary disclosure of identity or sensitive information.

Ø  Interim protective measures may be adopted where necessary to prevent retaliation, evidence tampering, continuing harm or interference with the investigation.

Investigations should normally be targeted for completion within 45 calendar days. Complex matters may require additional time; such extensions should be documented and, where appropriate, reported to the relevant oversight authority.

13. Investigation Outcome and Corrective Action

The investigation report should, as appropriate, record the allegation, scope, evidence considered, findings, basis for conclusions, identified control failures, recommended corrective/preventive actions and responsible persons/timelines.

Where misconduct is substantiated, Favnox may take proportionate disciplinary, contractual, corrective, preventive, recovery, training, control or regulatory actions. Where required by law, applicable regulatory requirements or the nature of the matter, the Company may make appropriate external disclosures.

The reporter may be informed of the outcome to the extent reasonably practicable and legally permissible. Detailed confidential personnel, commercial or legally privileged information may not be disclosed.

14. False or Malicious Reporting

A concern that cannot be substantiated, or that is found to be incorrect after a good-faith investigation, shall not by itself be treated as a false or malicious report.

Disciplinary action may be considered only where there is credible evidence that a person knowingly provided materially false information, deliberately fabricated evidence, or made a report with demonstrable mala-fide or malicious intent. Honest mistakes and reasonable suspicions are protected.

15. Confidentiality and Personal Data

Favnox will protect the confidentiality of whistle-blower and investigation information to the maximum extent reasonably practicable and permitted by law. Personal data collected through this Policy shall be accessed, used, stored, disclosed and retained only for legitimate purposes connected with assessment, investigation, remediation, legal/regulatory compliance and related governance.

Favnox shall apply appropriate organisational and technical safeguards to protect investigation information. Processing of personal data shall be carried out in accordance with applicable data-protection law, including the Digital Personal Data Protection Act, 2023 and applicable rules/provisions as they become effective.

16. Record Retention

Records relating to complaints, investigations, evidence, decisions and corrective actions shall be maintained securely in accordance with Favnox’s record-retention requirements and applicable law. Records shall be retained for the applicable legal/regulatory period and longer where reasonably necessary for an ongoing investigation, dispute, audit or regulatory matter.

17. Management and Board Reporting

At appropriate intervals, the designated oversight authority shall receive anonymised information on the operation of the mechanism, including number and categories of concerns, status, closure trends, material findings, retaliation allegations and significant corrective actions. Personal information shall be limited to what is necessary.

18. Training and Awareness

Favnox shall communicate this Policy to relevant personnel and may provide periodic awareness or training. Managers and functional heads are expected to facilitate good-faith reporting and must not suppress, discourage or retaliate against a protected disclosure.

19. No Waiver of Legal Rights

Nothing in this Policy prevents a person from making a disclosure to a government, statutory, regulatory, law-enforcement, judicial or other legally authorised body where permitted or required by law. Nothing in this Policy limits any legal right, remedy or protection available to a person under applicable law.

20. Policy Administration and Review

The designated Ethics/Whistle-Blower Committee shall review this Policy periodically. Amendments shall be approved by the competent authority under Favnox’s governance framework and applicable law. This Policy shall be reviewed at least annually and earlier where there is a material legal, regulatory, organisational or operational change.

Document Owner: Ethics/Whistle-Blower Committee / designated Compliance authority

Approving Authority: Board of Directors / competent authority, as applicable

Version: 2.0

Effective Date: 29 August 2026

Next Review Date: 29 August 2028

21. Frequently Asked Questions

Q: Can I report anonymously?

A: Yes, Favnox may accept anonymous reports where sufficient information is available for assessment and investigation. A secure follow-up method is encouraged.

Q: What if my concern is about my manager?

A: You do not need to report through the person who is the subject of the concern. Use the dedicated reporting channel or an appropriate escalation channel.

Q: What if the concern involves a Director or Managing Director?

A: The matter should be routed to the appropriate independent Board/Audit Committee authority, where constituted and applicable, and the person concerned must not participate in the matter.

Q: What if my concern turns out to be wrong?

A: A good-faith report that cannot be substantiated will not, by itself, result in disciplinary action.

Q: Can a vendor or consultant report a concern?

A: Yes, eligible business partners and other persons covered by this Policy may raise genuine concerns.

Q: Can I report a patient-safety or product-quality concern?

A: Yes. Serious quality, safety, data-integrity or regulatory concerns should be escalated promptly and may require immediate action.

Q: Will my identity be kept confidential?

A: Favnox will protect confidentiality to the maximum extent reasonably practicable and permitted by law, but absolute confidentiality cannot be guaranteed where disclosure is legally required or necessary for a fair process.

Q: Can I approach a regulator or authority?

A: Nothing in this Policy prevents a person from making a disclosure to a legally authorised authority where permitted or required by applicable law.

22. Reporting Channel Information

The dedicated whistle-blower email address is whistleblower@favnox.in. The Company shall ensure that the reporting channel is monitored by the designated authority and that current reporting details are maintained on the Company's website.

General corporate contact details are not a substitute for the dedicated whistle-blower reporting channel established under this Policy.