Privacy Policy

Introduction

Alleviant Medical and its subsidiaries (“Alleviant Medical”, “we”, “us” or “understand the importance of privacy to our customers, visitors, suppliers, business partners, employees, and other individuals (“you”, the “user”, or “data subject”). We are committed to protecting and respecting your privacy. This Alleviant Medical privacy policy (“Policy”) applies only to information collected through the website on which it is posted (“Site”) as well as any other applications (apps), events, newsletters, communications, or services provided by or on behalf of Alleviant Medical that link or reference this Policy (“Services”).

Some of the information we collect through this Site may be “Personal Data” as defined below. This privacy policy describes what information we collect about you and how we process your personal data.

Your acknowledgment of this Policy

By using this Site, including your choices regarding cookie settings, you are acknowledging and agreeing to the collection, use, disclosure, and transfer of your information as described in this Policy (and any additional Privacy Notices that apply to you). If you have questions about this Policy, or any Privacy Notice, please contact us using the information provided below.

Where any of your Personal Data is processed based on your consent, you may revoke your consent to the collection, use, disclosure, and transfer of your information as described in this Policy (and any Privacy Notices that apply to you) by contacting us directly.

Data Controller

Alleviant Medical, Inc.

7801 N Lamar Blvd.

Suite D103

Austin, TX 78752

USA

E-Mail: privacy@alleviantmedical.com

What is Personal Data?

Personal Data means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data Security

We take appropriate technical and organizational measures to ensure an adequate level of protection appropriate to the risk of the data processing to keep your data safe. These measures include ensuring the confidentiality, integrity and availability of your data through appropriate controls on physical and electronic access to the data as well as controls on input, disclosure, availability and segregation.

Alleviant Medical takes reasonable precautions to provide a level of security appropriate to the sensitivity of the information we collect. Although we seek to use the reasonable measures above to help protect your information against unauthorized use or disclosure, we cannot guarantee the security of information provided over the Internet or stored electronically, whether by us or a third party.

Accessing the Website

Automatic Data Collection

When you access our website, Alleviant Medical collects information through this Site that is sent to us automatically by your web browser or mobile device. This information may include but is not limited to:

• Product use and application data (including date and time of your visit)

• IP address

• The browser you are using (including name and version)

• Your location and other geographic data

• The website you came from and the website you visit after leaving

• Pages viewed on the Site

• Links clicked on the Site

• Time spent on a particular page of the Site or the Site as a whole

• Site data used to facilitate the use of the Site such as login and technical data

Manual Data Collection

Alleviant Medical collects the information you manually provide (e.g., using your keyboard, mouse, or touchscreen) when you use this Site. For example, we collect the information you provide if you choose to complete a pre-screening questionnaire entitled, “See If You Qualify?” or similar questionnaire, contact us with questions, or otherwise interact with this Site. Some of the information you may choose to manually provide will be Personal Data including but not limited to:

• Contact data: such as name, title, address, phone number, mailing address, and email.

• Other identifiers: types of personal health information (e.g. medical information, and the like), online identifiers, and other similar identifiers.

• Communication data submitted by you: such as questions and feedback.

• Demographic data: such as language, age, and gender.

Cookies Data Collection

We use “cookies” to collect information and support certain features of this Site. Cookies are small files that are stored on the device. We may use Cookies to:

• Collect information about the ways visitors use this Site—which pages they visit, which links they use, and how long they stay on each page

• Support the features and functionality of this Site—for example, to save you the trouble of reentering information already in our database or to prompt the settings you established on previous visits

• Personalize your experience when you use this Site

The information we collect using cookies is not, in and of itself, personally identifiable, but we may link it to Personal Data that you provide. If you do not wish to receive cookies, you may choose to reject cookies in your cookie settings when you visit our Site. We use CookieYes as a consent management platform (CMP), which mainly stores consent preferences. You may also set your browser to reject cookies or to alert you when a cookie is placed on your computer. Although you are not required to accept cookies when you visit this Site, you may be unable to use all of the functionality of this Site if you or your browser rejects cookies.

Google Analytics data is the only 3rd party Cookies collection used on our Website and will be used if you Consent. You may download an Opt-out Browser Add-on to opt-out of Google Analytics by clicking here.

Website Hosting

We use web hosting providers including technical security and maintenance services to provide our website. Through these hosts we collect data on access to our website (log files), including the date and time of access, the browser type and version, the operating system and the IP address. These log files may be used for security purposes (e.g., in the event of abusive attacks) and to ensure the server stability based on our legitimate interests.

For the provision and hosting of our website, we use Vercel Inc. located at 650 California St, San Francisco, CA 94108, USA; Website: https://vercel.com/legal/privacy-policy

Contacting Us

If you contact us by email, telephone, via social media or using our contact form, we store your contact data and the content of your enquiry for the purpose of processing your request and contacting you if necessary.

You may have the option to take part in surveys on our websites, that help determine if you may be a candidate for one of our clinical trials. In this case, we will ask for certain data about you and your health. This data is only used to determine whether you are a suitable candidate for such studies and will not be permanently stored.

As a potential candidate you may have the option to provide us with your contact data and information so that you may be contacted to explore your participation in the trial. We process this data on the basis of your consent.

If your request relates to pre-contractual measures or an existing contract, for example a request for a quote, this forms the legal basis for the data processing. In all other cases, processing of your request is based on our legitimate interests. We will store your data until fulfilling the purpose (normally this is the completion of your request) or until you request us to delete it, provided that there is no legal retention period.

Online Presence in Social Networks (social media)

We maintain online presences within social networks to communicate with users or to offer them information about us. In this context, user data is processed outside the European Union.

User data is regularly processed within social networks for market research and interest-based advertising purposes and to create user profiles based on the user preferences and the identified interests. For this purpose, cookies and, if you are logged into your social media account, further user data will be stored on your device and in your user profile. For a detailed description and opt-out options see the privacy policies of the respective network operators.

Note, that requests for information and other data subject rights can be asserted most effectively with the providers themselves, as only they have access to their own user data and can respond appropriately. If you still need help with this, please feel free to contact us.

Facebook

We are jointly responsible with Facebook for the collection of, but not for the further processing of data of visitors to our Facebook page (so-called “Fanpage”). This data includes, in particular, information about content viewed or interacted with, as well as information about the devices used by users, e.g. IP addresses, operating system, browser type, and language settings. See Facebook`s data policy: https://www.facebook.com/policy. As explained in the Facebook Data Policy under “How do we use this information?” Facebook also uses information to provide analytics services (“Page Insights”) to page operators to provide them with insights into how people interact with their pages and with content associated with them. We have entered into a specific agreement with Facebook (“Page Insights Information”, https://www.facebook.com/legal/terms/page_controller_addendum), which specifically sets out the security measures that Facebook must observe and in which Facebook agrees to comply with data subjects’ rights. For example, users can send information or deletion requests directly to Facebook. Further information can be found in Facebook’s “Information on Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data).

Service providers:

Facebook: 1 Meta Way, Menlo Park, CA 94025, USA;

Website: https://www.facebook.com;

Privacy policy: https://www.facebook.com/about/privacy;

Option to object (Opt-Out): https://www.facebook.com/adpreferences/ad_settings (Facebook login is required).

LinkedIn: 1000W Maude Ave, Sunnyvale, CA 94085, USA;

Website: https://www.linkedin.com;

Privacy policy: https://www.linkedin.com/legal/privacy-policy;

Option to object (Opt-Out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

X (formerly Twitter): Hyperloop Plaza, Bldg. 2, 865 FM-1209, Bastrop, TX 78602, USA;

Privacy policy: https://x.com/en/privacy

(Settings): https://x.com/settings/account/personalization

YouTube: 901 Cherry Ave, San Bruno, CA 94066, USA;

Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA;

Privacy policy: https://policies.google.com/privacy;

Possibility to object (Opt-Out): https://adssettings.google.com/authenticated

Plugins and Embedded Content

To enable user-friendliness and provide adequate customer service on our website we use functional and content elements (videos or city maps; hereinafter: “content”) from different service providers (hereinafter: “third-party providers”) in our online services. These third-party providers regularly process the IP address, which is necessary for displaying the website content.

Third-party providers may also store pseudonymous so-called pixel tags on the users’ device (invisible graphics, also known as “web beacons”) to collect information such as page visits and device specifications for statistical or marketing purposes.

If we ask for your consent to the use of the third-party providers, the legal basis for the processing of data is your consent, or where legally permitted, our legitimate interests in offering economic and recipient-friendly services.

Storage Period

We process personal data only as long as it is necessary for the underlying processing purpose (until you revoke your consent or other authorizations cease to apply) and for the period required to comply with applicable laws, regulations, guidance, ethical and safety requirements. We may also maintain your information as required to comply with any contract of which we are a party.

Children’s Privacy

This Website is not targeted to children under the age of 18 and we do not knowingly collect or solicit Personal Data about such children. If we discover that a child has provided us with Personal Data online through this Website, we will delete this information as quickly as possible. If you believe we may have received Personal Data from a child under the age of 18, please contact us immediately.

Updates to the Privacy Policy

Alleviant Medical reserves the right to update or modify this Policy and any Privacy Notice, at any time and without prior notice, by posting the revised version of the Policy or Privacy Notice on this Site. Suh changes will only apply to the information we collect after we have posted the revised Policy or Privacy Notice on this Site.

Your Rights

Data Privacy – EU Residents – with Reference to the EU General Data Protection Regulation (GDPR)

Alleviant Medical undertakes to respect the confidentiality of your Personal Data and to guarantee you can exercise your rights. You have the right under this Policy, and by law to:

• Request access to your Personal Data. The right to access, update or delete the information we have on you. You may contact us to assist you with such requests. This also enables you to receive a copy of the Personal Data we hold about you.

• Request correction of the Personal Data that we hold about you. You have the right to have any incomplete or inaccurate information we hold about you corrected.

• Object to processing of your Personal Data. This right exists where we are relying on a legitimate interest as the legal basis for our processing and there is something about your particular situation, which makes you want to object to our processing of your Personal Data on this ground.

• Request erasure of your Personal Data. You have the right to ask us to delete or remove Personal Data when there is no good reason for us to continue processing it.

• Request the transfer of your Personal Data. We will provide to you, or to a third-party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw your consent. You have the right to withdraw your consent on using your Personal Data. If withdraw your consent, we may not be able to provide you with access to certain specific functionalities of the Service.

• To file a complaint to a Supervisory Authority. You have the right to complain to a Supervisory Authority about our collection and use of your Personal Data. For more information, if you are in the European Economic Area (EEA), please contact your local Supervisory Authority in the EEA.

Exercising of Your GDPR Data Protection Rights (For residents of Europe or United Kingdom)

You may exercise your rights of access, rectification, cancellation and opposition by contacting us:

Alleviant has contracted with FieldFischer as its Data Protection Representative in the European Union. Data Protection Representative contact information:

Fieldfisher Tech Rechtsanwaltsgesellschaft mbH

Am Sandtorkai 68

20457 Hamburg, Germany

+49 40 8788698-303

Data transfers

As a U.S. company, we also process your data in countries outside the European Union and the European Economic Area (“EEA”), primarily in the United States. Further, we will only process your data or have your data processed in countries outside the EEA, if an adequate level of data protection in accordance with the requirements of Articles 44 to 49 GDPR is ensured. This can be achieved, for example, by concluding so-called standard contractual clauses (e.g. with our service providers such as HubSpot or Google).

We will only transfer your personal data to third parties in accordance with the legal requirements and if the transfer is necessary in order to fulfill our contractual obligations to you, we are otherwise entitled or obligated to transfer the data, or you have given us your consent to do so.

United States

You may revoke your consent for the receipt of communication that we send to you at any time by using the “unsubscribe” functionality included in our emails to you or by contacting us directly.

You should note that this will not affect all communications from us, for example, we are legally required to provide notices such as notification of a data breach in which case you should expect to receive a notification via email. It is important that the Personal Data we hold about you is accurate and current. Please let us know if your Personal Data changes.

You may make a request to access, correct, or delete your Personal Data or otherwise object to our processing of such Personal Data by contacting us directly. We will respond to reasonable requests in accordance with applicable law and subject to legal and contractual restrictions. We will not discriminate against you for exercising these rights.

There may be times where we cannot comply with your request. For example, if such disclosure would interfere with the privacy of others or if it would result in a breach of confidentiality. We will provide an explanation for our refusal to grant access.

California Residents

"Do Not Track" Policy as Required by California Online Privacy Protection Act (CalOPPA)

Our Site does not respond to Do Not Track (“DNT”) signals. However, some third-party websites do keep track of your browsing activities. If you are visiting such websites, you can set your preferences in your web browser to inform websites that you do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of your web browser.

California's Shine the Light law

Under California Civil Code Section 1798 (California's Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their Personal Data with third parties for the third parties' direct marketing purposes.

If you'd like to request more information under the California Shine the Light law, and if you are a California resident, you can contact us using the contact information provided in this Policy.

California Privacy Rights for Minor Users (California Business and Professions Code Section 22581)

California Business and Professions Code section 22581 allow California residents under the age of 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted.

To request removal of such data, and if you are a California resident, you can contact us using the contact information provided in this Policy and include the email address associated with your account.

Be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.