Privacy and data protection policy

We are Fluidda PLC, a company governed by Belgian law, having our registered address at Groeningenlei 132, 2550 Kontich, Belgium, and registered with the Register of Legal Entities of Antwerp, Belgium (division Antwerp) under company number 0877.160.706, hereinafter referred to as “Fluidda”, “we”, “us” and “our”.

With this privacy and data protection policy (“Policy”), we describe how we process any personal information relating directly or indirectly to you (“Personal Data”) in relation to our Broncholab tool. In particular, we explain how and why we collect your Personal Data, what we do with it, with whom we share it, how we protect it, how long we store it and we inform you of your rights.

This Policy applies to your Personal Data we process in the framework of our Broncholab tool (“Broncholab”).

We invite you to read the provisions of this Policy. By making us of Broncholab you agree with us processing your Personal Data in the ways set out in this Policy.

Who is responsible for the processing of your personal data and what is their contact information?

Fluidda is responsible for the processing of your Personal Data and will act as the data controller.

Fluidda cares about your privacy and the protection of your Personal Data. You can ask questions, make remarks, and file complaints or other enquiries regarding our Policy. You can reach us via e-mail, telephone or post, whichever suits you best. You may address your messages to our privacy contact point:

Anjali.nair at fluidda.com / Groeningenlei 132, 2550 Kontich, Belgium.

Below you can find an overview of the Personal Data which we may process, on which legal ground we base ourselves to do so, the purposes of the respective processing operation and the applicable retention periods.

Types of Personal Data Please note that we may process the following Personal Data:

Identification details such as: name, surname; Contact details such as: username, e-mail address; Contact details of the medical institution such as: location. Location details such as: medical institution location; We do not process any special categories of Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data or data concerning someone’s sexual activity. In this respect, we would like to clarify that the CT Scans including the age and gender that are uploaded into Broncholab do not qualify as Personal Data since they can not direct or indirect be identified to a natural living person. Hence, we do not process special categories of Personal Data.

Legal grounds When we process your Personal Data, we will always rely on one of the following processing grounds:

Performance of a contract with you: when the processing is necessary for the performance of a contract you are a party to or in order to take the steps at your request to enter into a contract. In particular, providing your Personal Data is necessary for the performance of a contract with us to give you access to Broncholab. If you do not provide your Personal Data, we, regrettably, cannot give you (any further) access to Broncholab; Our legitimate interest: when processing is necessary for the purposes of our legitimate interest, except where our interests are overridden by your fundamental rights and freedoms. We will provide you with more information about our legitimate interest at the appropriate time of the processing operation; Your consent: we may occasionally ask you for your specific permission to process some of your Personal Data, and we will only do so if you give your free, explicit and informed consent to us. Please note that you can withdraw your consent at any time; and Compliance with law: in some cases, we are required to process your Personal Data to comply with a legal obligation, such as keeping records for tax purposes or providing information to a public body or law enforcement agency.

Purposes of processing We will only process your Personal Data for specific purposes. Please note that we do not intend to further process your Personal Data for a purpose other than described below or via specific notification.

We will process your Personal Data in relation to your use of Broncholab. In this respect, we will process your information for registration purposes allowing us to provide you with an account, all necessary log-in details. We will process your Personal Data for all subsequent access to and (general) use of Broncholab. Moreover, we will process your Personal Data for all interactions you have with us regarding Broncholab. This includes but is not limited to administrative or technical purposes to ensure the full functionality of Broncholab.

Furthermore, we will process your Personal Data for other interactions we may have with you. For example, if you contact us with any questions, remarks, complaints or other enquiries we will process your Personal Data to respond to your enquiry.

Retention period We will only store your Personal Data as long as necessary while ensuring appropriate protection of your personal information. How long we keep your Personal Data depends on the purpose we use it for as described in this Policy. We will store your Personal Data as long as you are making use of Broncholab.

We will remove or anonymize your Personal Data you have provided us with regarding your use of Broncholab when you have not used Broncholab (i.e. inactivity) for a period of two years.

In case you have submitted a complaint or enquiry, we will store your Personal Data relating to your request for a period of five years starting the day after we receive your complaint or enquiry, after which we will anonymize or delete all your Personal Data you have provided us within this context.

With whom do we share your personal data?

Depending on the purposes for which we collect your Personal Data, we may share your Personal Data with another affiliate or subsidiary of Fluidda.

Please note that the following recipients are located in the United States of America, Portugal, Belgium, and IndiaBecause some of these recipients are located outside of the European Economic Area, we will provide appropriate safeguards for the protection of your Personal Data through the use of standard contractual clauses as drafted by the European Commission.

How do we protect your personal data?

We have a set of technical and organizational security measures in place to protect your Personal Data against unlawful or unauthorized access or use, as well as against accidental loss or damage to their integrity. These measures are been designed taking into account our IT infrastructure, the potential impact on your privacy and the costs involved and in accordance with current industry standards and practice. Your Personal Data will only be processed by a third party if that third party agrees to comply with those technical and organizational data security measures.

Job Applications

FLUIDDA welcomes all qualified Applicants to apply to any of the open positions published by sending us their contact details and CV (“Applicants Information”) via the Job page on our Website, or through any other means provided by us [(e.g. by email or post)].

We understand that privacy and discreetness are crucial to our Applicants and are committed to keep Applicants Information private and use it solely for FLUIDDA’s internal recruitment purposes (including for identifying Applicants, evaluating their applications, making hiring and employment decisions, and contacting Applicants by phone or in writing).

Please note that FLUIDDA may retain Applicants Information submitted to it for no longer than two years after the applied position has been filled or closed. This is done so we could re‑consider Applicants for other positions and opportunities at FLUIDDA; so we could use their Applicants Information as reference for future applications submitted by them; and in case the Applicant is hired, for additional employment and business purposes related to his/her work at FLUIDDA.

If you previously submitted your Applicants Information to FLUIDDA, and now wish to access it, update it or have it deleted from FLUIDDA systems, please contact us at [email protected].

Your rights

You have the possibility to exercise your rights as described in the GDPR. As a data subject, you can exercise the following rights:

  • Right to information

You may request access to all personal data collected (including processing purposes, categories of personal data, estimated retention period) for inspection Right to rectification, erasure and restriction You have the right to have incorrect personal data corrected or amended and, under certain circumstances, the right to have your personal data removed from our files. You have the right to have any of your Personal Data erased (except in some cases, for example, to prove a transaction or when required by law). You acknowledge that, if you refuse to provide certain data or ask for the erasure of your personal data, we will no longer be able to provide certain services. You have the right to request a restriction of processing if we are not entitled to use your Personal Data (anymore) or if you contest its accuracy

  • Right to withdraw consent

If the processing activity is based on consent, you have a right to withdraw this consent at any point. Please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

  • Right to object

If you no longer wish to be informed about any updates or receive direct marketing, you are entitled to make such a request by mailing to [email protected]. Please note that you are not entitled to object to the processing of your personal data if such personal data is necessary for the execution of the agreement between us or your company (for example: for invoicing the data subject or the data subject’s company for ordered services).

  • Right to data portability

Under certain conditions, you have the right to receive your Personal Data, which you have provided to us, in a commonly used, structured machine readable format and to transmit your Personal Data to any third party of your choice.

  • Right to lodge a complaint

If, at any time, you are of the opinion that we have infringed your privacy, you have the right to lodge a complaint with the supervisory authority which is responsible for the protection of personal data in the country where you reside.

  • Right to access and correction:

You have the right to access your Personal Data. Before providing access, we may ask for proof of identity and sufficient information about your interactions with us for security purposes. If we agree that we are obliged to grant you reasonable access, we will do so free of charge but only for your first request. If the Personal Data we hold about you is incorrect, you may always ask us to correct any inaccuracies;

You can make a request or exercise these rights by contacting us and we will make all reasonable and practical efforts to comply with your request, so long as it is consistent with applicable law and professional standards. To exercise the above rights, you can contact [email protected]. After verifying your identity and data subject rights applicability criteria, we will do everything reasonably possible to comply with the request unless it will require completely unreasonable measures (e.g. technically or organizationally virtually impossible or extremely costly). We may refuse to process requests that are unreasonably repetitive or systematic.

How can you lodge a complaint?

If you do not agree with the way we process your Personal Data, you always have the right to lodge a complaint with the Belgian Data Protection Authority acting as the supervisory authority:

[email protected] Tel: +32 (0)2 274 48 00/Fax: +32 (0)2 274 48 35 Rue de la Presse 35, 1000 Brussels, BELGIUM

Changes to our policy

We may modify this Policy from time to time to reflect our current privacy practices. We encourage you to periodically review this Policy to be informed on how we process and protect your Personal Data.

If we make any significant changes in the way we treat your Personal Data you will be notified.

This Policy was last updated on May 31, 2020.

Contact information

If you have any questions or remarks about this Privacy Policy or wish to exercise any of your rights, please contact us at [email protected] or send a post to FLUIDDA NV Groeningenlei 132, 2550 Kontich, Belgium

We will attempt to resolve any complaints regarding the use of your Personal data in accordance with this Privacy Policy.