Privacy Policy

Information on the Processing of Personal Data by Lungpacer Medical Inc.

 

Lungpacer Medical Inc. (“Lungpacer” or “we”) processes your personal data only to the extent permissible under statutory provisions, in particular, the EU General Data Protection Regulation (“GDPR“), Canadian federal and provincial privacy legislation (including the Personal Information Protection and Electronic Documents Act (“PIPEDA”), the British Columbia and Alberta Personal Information Protection Acts, and Quebec’s Act respecting the protection of personal information in the private sector), U.S. state comprehensive consumer privacy laws, and other country specific data protection regulations. The purpose of this notice is to inform you about the nature, scope and purposes of your personal data collected and processed by Lungpacer. This information is intended for any natural person (in particular, patients, health professionals, representatives or contact persons of vendors, other (potential) business partners or (potential) customers) to whom we have (or will have) a contract or business relationship or any other communication relationship. This data processing information does not apply to patients and health professionals who participate in a clinical trial conducted by Lungpacer. Clinical trial related data processing activities are covered by separate data processing notifications.

 

I. Responsibilities and contact details

The data controller, i.e. the company responsible for processing your personal data is:

 

Lungpacer Medical Inc., Canada
601 W. Cordova Street, Suite 130
Vancouver, BC V6B 1G1
Canada

 

Our data protection officer is available by email at: [email protected]

Telephone: +1-833-410-5864

 

Our EU data protection representative according to Art. 27 GDPR is:

Prighter EU Rep GmbH, 3 Schellinggasse, 1010 Vienna, Austria, web page available at: https://prighter.com/privacy-representation/eu-gdpr/ 

 

II. Processing of your personal data

1. Data processing on our Website

a. General information

During your visit to our website, we will collect data about your computer and your visits including the IP address of the computer you are using, your geographical location, the type of web browser and operating system being used, the domain name of the internet service provider, the web page you are coming from, the Lungpacer web pages visited and the date and duration of the visit. The data will also be stored in log files in our system.

 

We require this information for technical purposes to guarantee the stability and safety of our website. In this context, the data is analyzed only for statistical purposes and in an anonymized form.  Alternatively, the data may be analyzed for statistical purposes in a pseudonymised form. In this latter case, we will ask for your consent to do so. Furthermore, with your consent, we localize your geographical location in order to display the respective website adapted to your country.

 

b. Use of cookies

On our website, we use cookies, i.e., small text files that are stored on your computer. These cookies enable analysis of your use of the website and are used for marketing purposes. Cookies do not cause any damage to your computer, handheld or mobile device, but make it easier, for example, to find preferences, pre-fill certain fields and adapt the content of the services on the site visited. Such data allows the improvement of ergonomics and services according to your interests.

 

When you visit our website, we will ask for your consent to use cookies other than cookies required for the basic functioning of the website. You may refuse the use of cookies by selecting the appropriate settings. Please note that if you do this, you may not be able to use the full functionality of our website. The data collected will be analyzed only in a pseudonymised form.

 

We will only keep cookies for as long as necessary to achieve the relevant purposes set out in this Data Processing Notification, notably for marketing and statistical purposes.

 

Generally speaking, we use 1st and 3rd-party session and persistent cookies. The cookies set by us are called “1st-party cookies” and the cookies set by our third-party partners and service providers are called “3rd-party cookies”. Session cookies are temporary cookies that remain on your device until you close your web browser. Many session cookies are essential to make our website work correctly, as they typically enable you to move around and use specific features of our website.

 

Persistent cookies remain on your device after you close your browser or until you manually delete it (for the former, how long the cookie remains on your device will depend on the duration or “lifetime” of the specific cookie and your browser settings).

 

Persistent cookies help us recognize you as an existing user of our website, so it’s easier and convenient to return to our website or interact with our services without signing in again. In addition, persistent cookies also help us recognize you when you view a resource belonging to our website from another website or app (such as an advertisement) and help us record information about your web browsing habits during the lifetime of the persistent cookie.

 

Examples of cookies we may use:

• Essential Cookies: These cookies are strictly necessary for our website to function properly and ensure our services are accessible to you (e.g., log-in functionality, load balancing, navigation, filling in forms). The website cannot function properly without these cookies.
• Preference Cookies: Preference cookies enable our website to provide enhanced features or settings based on your previous visits and selections, such as language preferences, remembering log-in details.
• Statistic Cookies: Statistic cookies enable us to understand how visitors interact with our website by collecting and reporting information anonymously.
• Marketing Cookies: Marketing cookies are used to track visitors across our website. The intention is to display advertisements that are relevant and engaging for the individual user and thereby more valuable for publishers and third-party advertisers.

 

If you have any concerns about our use of cookies, you can take action to prevent them from being set, such as by changing your browser settings to block certain types of cookies. You may also delete cookies held on your device at any time by going to the appropriate settings within your web browser.

 

You have the option to configure your devices to accept all cookies, to notify you when a cookie is issued or to never accept cookies. However, the latter option may result in some personalized services not being provided and, as a result, you may not be able to take full advantage of all the features offered by our website. If you do not wish to receive cookies in general or only to refuse certain cookies, you can change your browser settings accordingly.

You can also visit the below link for an overview of how to block or delete cookies on the most common browsers: http://www.allaboutcookies.org

 

For any further queries or information related to cookies, please write to [email protected] with the subject line “Cookie Policy.”

 

c. Social Network Icons

On our website, we are using icons of YouTube, X, and LinkedIn which are web links to the respective websites. We are not processing any personal data in this context. When you visit our profile on YouTube, X, and LinkedIn, the data processing notification of the respective social media service apply.

 

d. Email contact information

Our website contains information that enables you to contact us (including our email address). If you click on this email address, the e-mail client on your computer (if installed) will open. If you contact us via email, we will ask for your consent to use the personal data transmitted by you to contact you and answering your request (opt-in verification). The personal data is stored in our e-mail system. You have the possibility to withdraw your consent at any time (opt-out). We will not share your personal data with third parties.

 

e. Online application form

On our website, we may use an online application form where you can enter your name, email address, phone number and your message to us. We will ask for your consent to use the personal data entered in our online application form in order to process your specific request (opt-in verification). You have the possibility to withdraw your consent at any time (opt-out). We will not share your personal data with third parties.

 

f. Login for closed user groups (Healthcare Professionals)

We may provide portals for Healthcare Professionals on our website to share information about clinical trials or commercial educational material for their use with patients. Access to these portals for closed user groups is only available to Healthcare Professionals who are participating in a clinical trial, or who purchased the product. The portals are password protected. With their consent, Healthcare Professionals can register via e-mail providing their name, e-mail-address, professional information and contact details and we will create a user profile. When a Healthcare Professional uses a user group, we will process the login data (email-address and password). 

 

 

2. Other data processing activities by Lungpacer

We process your contact details as well as other personal data required for the performance of a contract with you. This includes pre-contractual communication upon your request.

 

We may also process your personal data to send you our communication (e.g., business information; communication regarding contracts or other business-related materials for clinical or commercial activities; our correspondence with you). In case of marketing-related emails, you will have the right to opt-out of this communication. For more information, please see below section “Your Rights”.

 

In particular, we may also collect and use your personal data for the following purposes:

• Commercial communications related to the conduct of clinical studies and commercialization of our products;
• internal administrative purposes (e.g., for accounting purposes);
• ensure IT security and IT operations at our enterprise;
• prevent criminal offences and conduct compliance investigations in individual cases;
• engage service providers (e.g., external IT service providers) who support our business processes;
• business communication purposes, such as vendor management and advertising; and,
• for any other purpose we may disclose to you from time to time.

 

If you choose not to provide us with your personal data, we are unable to perform the contractual relationship initiated with you and/or cannot fulfill the above described communication purposes.

 

 

III. Disclosure of your personal data

Your personal data may be stored in our website server, email/electronic file servers, or Customer Relationship Management (“CRM”) system and may be transmitted to and processed by specialized third party service providers inside and outside the European Economic Area (“EEA”) to the extent required for the purposes outlined above. The service providers perform specific services for us such as, e.g., data storage, IT services, and email services.

The service providers will process data only on our behalf and only on the basis of our strict instructions laid down in the respective data processing agreement. Every third-party service provider has been chosen carefully and will be monitored regularly by Lungpacer.

 

 

IV. Confidentiality and deletion of your personal data

1. Confidentiality and security

Each of our employees as well as all staff members of third-party service providers who have access to personal data are obliged to treat your data as confidential. We take steps designed to ensure that only those employees or staff members who need access to your personal data to fulfil their employment duties will have access to it.

 

While we maintain security measures to prevent unauthorized access to or disclosure of your personal data, no security measures are absolute or wholly guaranteed. If you have reason to believe that your interaction with us is no longer secure (for example, if you believe that the security of the data you have provided to us has been compromised), please contact us immediately using the contact details in the section “Contact us” below. We will make reasonable attempts to notify you if we determine there were unauthorized acts by third parties that violate the law or this policy, or other security breaches, or where otherwise required by law.

 

2. Deletion of personal data collected in log files on our website

We delete log files collected during your visit of our website after a period of 8 weeks, unless it is necessary to store the data for a longer period of time for the purposes indicated above. In this case, we delete your personal data once it is no longer required for the purposes indicated above, and statutory retention periods (if applicable) have expired. Session cookies are usually deleted once your internet session is closed.

 

3. Deletion of personal data collected in connection with other data processing activities

We will delete your personal data after termination of our contract with you, or our contact relationship with you, if the storage is no longer necessary for the fulfilment of our (post-) contractual obligations or the legitimate interests cited in this data protection notice, and if there are no statutory retention obligations. In case statutory retention obligations apply, we will restrict the processing of your data for the duration of such retention obligations.

 

Where it is not possible to specify a fixed retention period, we determine how long we retain each category of personal data by reference to the following criteria: the purpose for which the data was collected and whether that purpose remains active; the nature and sensitivity of the data; the duration of our contract or contact relationship with you; applicable statutory retention obligations (including medical device, product safety, tax and corporate record-keeping requirements); and the establishment, exercise or defense of legal claims. We do not retain personal data that is no longer relevant and reasonably necessary for the purposes described in this notice unless retention is required or permitted by law, and personal data that is no longer required to fulfil those purposes is destroyed, erased or made anonymous.

 

 

V. Your Rights

Subject to the statutory requirements, the fulfilment of which must be assessed on a case-by-case basis, you have the right to access to your personal data and to require rectification and correction.

 

You also have the right to object to the processing of your personal data. Furthermore, you are entitled to lodge a complaint with a supervisory authority regarding the processing of your personal data.

 

If you wish to exercise your rights, or if you have any questions or concerns about your personal data or our privacy practices, please direct your request to [email protected].

 

If you no longer want to receive marketing-related emails from Lungpacer, you may opt-out of receiving marketing-related emails by clicking the “unsubscribe” link at the bottom of any email you receive from us, or, if you created an online account when you registered to receive Lungpacer’s emails, you may log-in to your account and make changes to your communication preferences.  You may also opt-out by contacting us directly using the contact information in the “Contact Us” section below.

 

We will endeavor to respond to your opt-out request promptly but ask that you please allow a reasonable time to process your request.  Please note that if you opt-out from receiving marketing-related emails, we may still need to send you communications about your use of our products or services, or other matters.

 

 

VI. Additional information for residents of the United States

This Section VI applies to residents of U.S. states that have enacted comprehensive consumer privacy legislation, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, as well as to residents of states with consumer health data laws, including Washington and Nevada. It supplements the rest of this notice and, in the event of a conflict, controls with respect to residents of those states. It does not apply to information that is exempt from those laws, such as protected health information governed by HIPAA, information collected as part of human subjects research or a clinical trial conducted in accordance with applicable good clinical practice requirements, or personal data processed in an employment or business-to-business context to the extent exempted by the applicable state law.

 

1. Categories of personal data we process, sources and purposes

In the twelve months preceding the date of this notice, and on an ongoing basis, we process the following categories of personal data: (a) identifiers and contact information (name, postal address, email address, telephone number, account log-in credentials for our healthcare professional portals); (b) professional and employment information (employer, job title, professional credentials, specialty and institutional affiliation); (c) commercial information (products purchased or evaluated, orders, correspondence and service records); (d) internet and other electronic network activity information (IP address, browser and operating system type, referring website, pages viewed, dates and duration of visits, and information collected through the cookies described in Section II.1.b); (e) approximate geolocation derived from IP address; (f) audio and electronic information contained in your correspondence with us; and (g) inferences drawn from the foregoing to create a profile of your professional interests and preferences.

We collect this personal data from the following categories of sources: directly from you (including through our website forms, portal registrations, email and other correspondence); from your employer, healthcare institution or other organization you represent; automatically from your device and browser when you visit our website; from our service providers and business partners; and from publicly available sources, including professional directories and registries.

 

We process these categories of personal data for the business and commercial purposes described in Sections II and III of this notice, namely: operating, securing and improving our website and portals; responding to your inquiries and requests; entering into and performing contracts; communicating with healthcare professionals and customers about our products, clinical activities and educational materials; vendor and customer relationship management; accounting and other internal administration; product safety, quality and regulatory compliance, including medical device reporting; fraud prevention, compliance investigations and information security; and establishing, exercising or defending legal claims. We limit our collection of personal data to what is adequate, relevant and reasonably necessary in relation to these purposes, and we will not process your personal data for a materially different purpose without first providing notice and, where required, obtaining your consent.

 

2. Categories of third parties with whom we share personal data

We may disclose each of the categories of personal data listed above to the following categories of third parties: cloud hosting, data storage and IT support providers; email, customer relationship management and marketing communications providers; website and analytics providers; professional advisors such as auditors, accountants and lawyers; regulatory authorities, including health authorities to which we are required to report product safety information, and other governmental bodies where required by law; and acquirers, investors and their advisors in connection with a merger, acquisition, financing, reorganization or sale of assets. Service providers act only on our documented instructions under written agreements and may not use your personal data for their own purposes.

 

3. Sensitive data

Certain personal data we process may constitute “sensitive data” or “sensitive personal information” under state law, including information concerning health, precise geolocation, account log-in credentials, and the contents of email and other correspondence. We collect and process sensitive data only where it is reasonably necessary, and in states that so require strictly necessary, to provide or maintain a product, service or communication you have requested, or where we have obtained your consent. We do not use or disclose sensitive personal information for purposes other than those permitted without notice, we do not use it to infer characteristics about you, and we do not sell it.

 

4. Sale, sharing, targeted advertising and profiling

We do not sell your personal data, and we do not share personal data for cross-context behavioral advertising or process personal data for targeted advertising as those terms are defined under state privacy laws. NOTICE: We do not sell your sensitive personal data. NOTICE: We do not sell your biometric data. We do not sell the personal data of, or engage in targeted advertising directed to, any individual we know or should know is under 18 years of age. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, and we do not use automated decision-making technology to make such decisions about you. If these practices change, we will update this notice, provide the required opt-out mechanism, and where required obtain your consent before the change takes effect.

 

To the extent any of our processing in the future constitutes a sale, sharing or targeted advertising, we will honor opt-out preference signals, such as the Global Privacy Control, that your browser or device transmits to us. An opt-out preference signal will be applied to the browser or device from which it is sent and, where we can reasonably associate the signal with your account, to that account. If an opt-out preference signal conflicts with a privacy setting you have previously selected with us, we will honor the signal but may notify you of the conflict and give you the opportunity to confirm your prior setting.

 

5. Your rights under U.S. state privacy laws

Subject to the requirements and exceptions of the privacy law of your state, you may have the following rights: (a) the right to confirm whether we process your personal data and to access that data, including, in California, the categories of personal data collected, the categories of sources, the business or commercial purposes for collecting or disclosing it, the categories of third parties to whom it is disclosed, and the specific pieces of personal data we hold about you; (b) the right to correct inaccuracies in your personal data; (c) the right to delete personal data you provided or that we obtained about you; (d) the right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format; (e) the right to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions producing legal or similarly significant effects; (f) in California, the right to limit our use and disclosure of your sensitive personal information; (g) the right to withdraw consent where processing is based on consent; and (h) the right not to be discriminated or retaliated against for exercising any of these rights, including through denial of goods or services, different prices or rates, or a different level of quality.

 

6. How to exercise your rights, verification and appeals

You may submit a request through the online request form available below, by calling our toll-free number at 1-833-410-5864, by emailing [email protected] with the subject line “U.S. Privacy Request,” or by writing to us at the address in Section I. We will not require you to create an account in order to submit a request, although if you have an existing account with us we may ask you to use it. Before responding to a request to access, correct, delete or port personal data, we will take reasonable steps to verify your identity by matching the information you provide against the information we hold, and we may request additional information where necessary; we will use that information only for verification, will not disclose it further, and will not retain it longer than necessary for that purpose. An authorized agent may submit a request on your behalf by providing written, signed permission from you, and we may ask you to verify your identity directly and confirm the agent’s authority.

 

We will respond to your request within the period required by the privacy law of your state, which is generally 45 days from receipt, and we may extend that period once by an additional 45 days where reasonably necessary, in which case we will notify you of the extension and the reason for it within the initial response period. If we decline to act on your request, we will explain the reason and inform you how to appeal. To appeal, reply to our response or email [email protected] with the subject line “Privacy Appeal.” We will respond to an appeal in writing within 60 days, explaining the reasons for our decision. If your appeal is denied, you may contact the attorney general of your state to submit a complaint; California residents may also submit complaints to the California Privacy Protection Agency.

 

7. Additional information for California residents

We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. We do not offer financial incentives or price or service differences in exchange for the retention, use, sale or sharing of personal information, and we will not retaliate against you, including in your capacity as a job applicant, employee or independent contractor, for exercising your privacy rights. California residents may also request, once per calendar year and free of charge, information about our disclosure of personal information to third parties for their own direct marketing purposes under California’s “Shine the Light” law; we do not currently make such disclosures. You may reach us with any question about this notice or our privacy practices at [email protected] or the address in Section I.

 

 

VII. Additional information for residents of Canada

This Section VII applies to individuals in Canada, whose personal information we handle in accordance with PIPEDA, the British Columbia and Alberta Personal Information Protection Acts, and, for individuals in Quebec, the Act respecting the protection of personal information in the private sector. We collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and we identify those purposes at or before the time the information is collected. Where we intend to use personal information for a purpose not previously identified, we will identify the new purpose before use and, unless the new purpose is required by law, obtain your consent. We do not require you, as a condition of supplying a product or service, to consent to any collection, use or disclosure beyond what is necessary to provide that product or service.

 

Our processing is generally based on your knowledge and consent. The form of consent we seek depends on the circumstances and the sensitivity of the information: we seek express consent where the information is likely to be considered sensitive, including health information, and consent may be implied where the information is less sensitive, the purpose would be obvious to a reasonable person and you voluntarily provide the information for that purpose. You may withdraw your consent at any time on reasonable notice, subject to legal or contractual restrictions, by contacting our Privacy Officer at [email protected]. We will inform you of the likely consequences of withdrawal, which may include our inability to continue providing a product, service or communication, and we will stop the collection, use or disclosure unless it is permitted without consent under applicable law.

 

The types of personal information we hold about individuals in Canada, and a general account of how we use them, are described in Sections II, III and VI.1 of this notice. Personal information may be made available to our affiliates and subsidiaries where necessary for the purposes described in this notice. We remain responsible for personal information under our control, including information transferred to a third party for processing, and we use contractual and other means to provide a comparable level of protection while that information is being processed on our behalf.

 

Personal information about individuals in Canada may be stored or processed by us or our service providers outside Canada, including in the United States and the European Economic Area, and may therefore be accessible to courts, law enforcement and national security authorities of those jurisdictions under their laws. Before communicating personal information outside Quebec, we conduct the privacy impact assessment required by Quebec law and put in place contractual protections designed to ensure the information receives adequate protection. You may contact our Privacy Officer for information about our policies and practices regarding service providers located outside Canada.

 

On written request, individuals in Canada have the right to be informed of the existence, use and disclosure of their personal information and to be given access to it, including information about the ways in which it has been and is being used and the names of the individuals and organizations to whom it has been disclosed. You may also challenge the accuracy and completeness of your personal information and request that an error or omission be corrected; if we are satisfied on reasonable grounds that a correction should be made, we will correct the information as soon as reasonably possible and send the corrected information to each organization to which we disclosed it in the preceding year, and if we do not make the correction we will annotate your information with the correction requested but not made. We will assist you if you need help preparing a request, and we will respond with due diligence and in any event within 30 days of receipt under PIPEDA and within 30 business days under British Columbia law, subject to any extension permitted by those statutes, of which we will notify you together with the reasons and your right to complain to the applicable commissioner.

 

Individuals in Quebec additionally have the right to receive computerized personal information they have provided in a structured, commonly used technological format and to have it transmitted to another organization, the right to request that dissemination of their information cease or that a hyperlink to it be de-indexed where the conditions in the applicable legislation are met, and the right to be informed of, to submit observations on, and to request review of any decision based exclusively on automated processing of their personal information. We do not currently make decisions about individuals based exclusively on automated processing, and we do not use technology that allows an individual to be identified, located or profiled without first informing you and offering the means to deactivate it.

 

Our Privacy Officer is the individual designated as accountable for our compliance with Canadian privacy legislation and for the policies and practices described in this notice, and is the person to whom complaints and inquiries may be directed. The Privacy Officer can be reached at [email protected], by telephone at +1-844-876-7223, or at Lungpacer Medical USA Inc., 260 Sierra Drive, Suite 116, Exton, PA 19341, USA. We have established a process to receive and respond to complaints and inquiries about the application of Canadian privacy legislation, and we will make information about our policies, practices and complaint process available on request. If you are not satisfied with our response to an access request, a correction request or a privacy complaint, you may complain to the Office of the Privacy Commissioner of Canada or, as applicable, to the Office of the Information and Privacy Commissioner for British Columbia or Alberta, or to the Commission d’accès à l’information du Québec.

 

If a breach of our security safeguards involving personal information under our control creates a real risk of significant harm to an individual, we will report the breach to the Office of the Privacy Commissioner of Canada and to any other applicable regulator as soon as feasible after we determine it has occurred, and we will notify affected individuals directly and conspicuously with sufficient information to allow them to understand the significance of the breach and to take steps to reduce or mitigate the resulting risk of harm. We will also notify any other organization or government institution that we believe may be able to reduce or mitigate that harm. In assessing whether a real risk of significant harm exists, we consider the sensitivity of the information involved and the probability that it has been, is being or will be misused.

 

 

VIII. Additional information for residents of the EEA

1. Our processing of your personal data