Data Privacy Policy Iaso Automated Medical Systems Ltd (Iaso AMS) complies with the Australian Privacy Act 1988 (Cth) (Privacy Act), New Zealand Privacy Act 2020 (NZ Privacy Act), 2016/679 General Data Protection Regulation (GDPR), [HIPAA??], California Consumer Privacy Act (CCPA) and California Online Privacy Protection Act (CalOPPA) (collectively, Privacy Legislation). Iaso AMS only collects and uses your personal information in accordance with the Privacy Legislation, as applicable. By providing personal information or continuing to engage with Iaso AMS you consent to your personal information being collected, used and disclosed in accordance with this Data Privacy Policy (privacy policy or policy). Iaso AMS and the Iaso AMS Group is committed to protecting the privacy of your personal information and does so through: compliance: compliance with the Privacy Legislation. governance: appointment of a Global Data Protection Officer who is responsible for privacy compliance and raising awareness and educating employees on privacy rules. The Global Data Protection Officer may, from time to time, delegate, either in whole or partially, responsibility for the implementation of activities relating to compliance monitoring, raising awareness and educating employees to suitable qualified persons. Iaso AMS implements internal policies and procedures to ensure compliance of and with applicable privacy rules. training: monitoring privacy education and compliance within Iaso AMS employees through training. third party compliance: evaluating privacy compliance from third parties Iaso AMS works with which process your personal information on our behalf. This Data Privacy Policy describes the kinds of personal information (including sensitive information) that Iaso AMS collects, the purpose(s) for which it is used, and how your personal information is managed. It also gives details of how to contact us if you want access to or wish to correct your personal information held by us or have any queries or complaints about our management of your personal information. Definitions Company Representative includes employees, agents, contractors, directors, etc of Iaso AMS or engaged by Iaso AMS to carry out business activities on behalf of Iaso AMS. Personal information means information or an opinion, whether true or not, that identifies you, or from which your identity can be easily determined. It includes information such as your name, age, gender and contact details, should these have been provided by you. Processing means any operation performed on your personal information, whether or not by automated means, such as the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of your personal information. Sensitive information is a subset of personal information and includes information or an opinion on your race or ethnic origin, political opinions, membership of political, professional or trade associations or trade unions, religious beliefs, sexual orientation, criminal record, state of physical or mental health or medical history. In this policy all references to personal information include sensitive information. Collection of personal information Iaso AMS may collect personal information reasonably necessary to carry out its business. The types of personal information we may collect are described below, depending on your interaction with us: Healthcare Professional - identifying and contact information such as your name and business contact details, comments regarding our products and services (including about this website), details during your interactions with Company Representatives, Iaso AMS social media accounts and handles if you interact with us on our social media platforms. This information is collected through some of the followings ways: reactive or proactive direct contact in connection with providing information or services, conducting market research and purchasing such information from third party providers and conducting clinical research in accordance with clinical research guidelines and regulatory requirements. Member of the public - identifying and contact information such as your name and contact details. This information is collected through some of the followings ways: responding to your request for contact, conducting market research and conducting clinical research in accordance with clinical research guidelines and regulatory requirements. Iaso AMS will not collect sensitive information without your consent. Iaso AMS will collect personal information directly from you where it is reasonable and practicable to do so. We may also collect personal information from third parties such as: organisations that Iaso AMS engages to assist us to carry out our functions and activities (such as conference organisers); healthcare providers or colleagues; and online directory providers or providers of customer contact databases. Iaso AMS may engage third parties such as data verification providers to provide services to us, which may include processing and validating personal information on our behalf. Purposes for which we collect, hold, use and disclose personal information Generally, Iaso AMS collects, holds, uses and discloses personal information for the following purposes: providing information about Iaso AMS technology, clinical research activities, products and services which may be of interest to you; to plan conferences, events and seminars including to organise travel to such events and accommodation and invite speakers and attendees; to help Iaso AMS research the needs of its users and to market its products and services (where regulatory status permits legal promotion of therapeutic goods) with a better understanding of individual needs and the needs of users generally; to conduct clinical trials and research in accordance with clinical research guidelines, regulatory requirements and ethical principles; to establish and run medical boards or to acquire general opinions or publications on medical, scientific, clinical research and product technology related issues; administering conferences, symposia, expert panels, webinars, seminars or other similar programs organised by us, which you agree to participate in or be involved with, including any recordings; manage, review, develop and improve our business and operational processes and systems; manage, review and resolve any regulatory, government or other medical authority matters, notifications or requirements (including adverse event reporting); to recruit and manage human resourcing requirements and needs; manage relationships with Iaso AMS suppliers and vendors; communication and relationship management and promotional and non-promotional activities with healthcare professionals including interactions (eg through our social media accounts and websites), profiling activities, contract management, congress and meetings management and databases; post-market surveillance, vigilance and medical management which includes maintaining a record of medical queries, complaints and adverse event or adverse reaction reports relating to our products and reporting these to relevant regulatory bodies, such as the Therapeutic Goods Administration, as may be required; to conduct due diligence with respect to our service providers; managing, planning and arranging meetings between healthcare professionals and us, including our Company Representatives; to gain insights in to how Iaso AMS’s products are deployed and used in practice; generating customer lists for the purposes of market research; if applicable, complying with our transparency obligations to report transfers of value; resolve any legal and/or commercial complaints or issues; and perform any of our other functions and activities relating to our business. In order to carry out the above purposes, Iaso AMS may disclose personal information to persons or organisations such as: Iaso AMS Head Office in New Zealand and its subsidiaries, affiliates or employees including those based in the US; third party data verification providers who maintain and verify our company databases. Please note that such third party data verification providers may collect and disclose such personal information to their clients; our agents and service providers such as mailing houses, conference organisers and suppliers; our professional advisors; healthcare professionals; persons authorised by or responsible for the individual, including their agents and advisors; government agencies including regulatory authorities, within or outside of Australia; and other parties to whom we are authorised or required by law to disclose information. Iaso AMS is a global organisation, with a presence in Australia, New Zealand and the United States of America, and assets, IT systems, management structures and processes that cross borders. As such, it is sometimes necessary for Iaso AMS to transfer personal information to other Iaso AMS entities or third parties, in the same country as or in countries other than the country in which it was initially provided, and store personal information in databases that may be hosted in or accessible from other countries. Any transfer of personal information will comply with the requirements of the Privacy Legislation that relates to the respective transborder data flow(s). Iaso AMS takes all reasonable endeavours to ensure any third parties who handle or obtain personal information as service providers to Iaso AMS comply with the Privacy Legislation however, you acknowledge that, by agreeing to the disclosure of your personal information to these third parties operating within or outside of Australia, we will no longer be required to take reasonable steps to ensure the overseas third parties’ compliance with the Privacy Legislation in relation to your personal information and we will not be liable to you for any breach of the Privacy Legislation by third parties and on this basis you consent to such disclosure. Our range of products and services and our functions and activities, as well as those of our contracted service providers, may change over time. Communications From time to time, Iaso AMS may use personal information to contact you (including by mail, telephone call, text message or email), reactively or proactively, to provide information and material about Iaso AMS, our products (where regulatory status legally enables such information to be provided) and services or the products or services of third parties relevant to Iaso AMS activities. If you do not wish to receive such communications, you can request not to receive this information by following the opt out instructions set out in the relevant communication or contacting our Global Data Protection Officer using the details set out below. Data quality, storage and security Iaso AMS may store personal information that we hold in hard copy documents or as electronic data in our IT systems. To the extent required by the Privacy Legislation, Iaso AMS will take reasonable steps to: limit the collection of your personal information to what is necessary in relation to the purposes for which it is collected and processed; make sure that the personal information that we collect, use and disclose is accurate, complete and up to date; retain your personal information only for the legal and business retention requirements of Iaso AMS and in a form which permits your identification for no longer than is necessary for the purposes for which your personal information is processed; protect the personal information that we hold from misuse and loss and from unauthorised access, modification or disclosure and take reasonable steps to ensure that any third parties who Iaso AMS works with which process your personal information on our behalf comply with the same or at least as stringent security measures as those applied by Iaso AMS however we will not be responsible for any breach of security caused or experienced by such third parties; and where permitted by law, destroy, permanently de-identify or erase your personal information that is no longer needed for any purpose that is permitted by the Privacy Legislation. If you believe that any of the Personal Information we hold about you has been the subject of a data breach or has otherwise been unlawfully accessed, used or disclosed, you should notify us immediately so that we can take appropriate steps to ensure its security. Access to and correction of personal information You have the right to: access your personal information: depending on whether you are a member of the public, clinical research participant, healthcare professional, vendor or otherwise, your personal information may be disclosed either to you directly or through a healthcare professional or another person designated by you rectify and update your personal information erase your personal information restrict the Processing of your personal information exercise your right to data portability: and obtain from Iaso AMS the right to receive your personal information in a structured, commonly used and machine-readable format object: at any time of the Processing, free of charge and without having to state legitimate grounds, object to the Processing of your personal information for the purposes of communications and other purposes (including profiling to the extent that it is related to such direct communication) lodge a complaint: regarding the use of your personal information, by contacting our Global Data Protection Officer using the details set out below. There are some circumstances where Iaso AMS may not allow you to access or correct your personal information, in which case Iaso AMS will provide you with the reasons for this decision in accordance with law. Complaints procedure If you have a complaint about Iaso AMS’s handling of your personal (including sensitive) information, or you believe Iaso AMS has acted in a manner that has breached the Privacy Legislation, you should put your complaint in writing and send it to our Global Data Protection Officer (details set out below). The Global Data Protection Officer will assess the complaint and advise you of the outcome within one month (subject to the level of complexity of the case) after the complaint was received. If the Global Data Protection Officer determines that the complaint was valid, appropriate action will be taken to remedy the breach. The Global Data Protection Officer will keep a record of all complaints and review them annually for possible identification of systemic problems and to assist in finding ways in which Iaso AMS’s privacy practices can be improved. If you are not satisfied with our response to a complaint and you are based in: Australia, you can contact the Office of the Australian Information Commissioner New Zealand, you can contact the Office of the Privacy Commissioner Relevant government authorities based on your residency. Contact Iaso AMS If you have any concerns or complaints about the manner in which personal information is collected or handled by Iaso AMS, or you wish to exercise any of your rights as described above in relation to your personal information, please contact the Iaso AMS Global Data Protection Officer by phone: +64 22 5757096, in writing at Iaso AMS Ltd, St Johns Road, St Johns, Auckland 1027 New Zealand or via email at hello@iasoams.com . . Further information Further information about the application of the: Privacy Act can be found at the website of the Office of the Australian Information Commissioner at www.oaic.gov.au NZ Privacy Act can be found at the website of the Office of the Privacy Commissioner at www.privacy.org.nz General Data Protection Regulation (GDPR) can be found at the website of the European Union Office of ____________ Commissioner at URL California Consumer Privacy Act (CCPA) and California Online Privacy Protection Act (CalOPPA) can be found at __________________ URL Changes to our Privacy Policy Iaso AMS reserves the right to change the Data Privacy Policy at any time and the updated version will be posted on this website.