Privacy Policy

Introduction
Aroa Biosurgery Limited and its subsidiaries (referred to as “AROA”, “we”, “us” or “our”) is committed to treating personal information with care and respect.

This Privacy Policy (“Policy”) explains how AROA collects, stores, uses and discloses personal information collected about other parties and applies to all interactions you may have with AROA and our products in accordance with applicable law. More specific information about how we handle your personal information and impacts to your privacy may also be provided in disclosures and privacy notices provided when you interact with us.

For the purposes of this Policy, personal information is any information which directly or indirectly relates to an identified or identifiable individual. It includes names, unique identifiers, location information, financial information, IP addresses, or one or more factors specific to the physical, physiological, genetic, mental, economic, social or cultural identity of an individual.

This Policy seeks to reflect all of AROA’s business activities involving personal information, therefore some processing activities and third party recipients may vary or not be applicable to you.

If you have any concerns or would like more information about how we handle your personal information, please contact us.

We may need to amend this Policy from time to time. If we make any changes, then we will post an updated Policy on our website. Any changes will take effect from the date we update and post the amended Policy, so please check this Policy when you access our website.

1. AROA’s general principles for collection, use and disclosure of personal
information
To the extent required by applicable law, whenever AROA collects personal information, we seek to:

• Collect your personal information only for specified and legitimate purposes. We endeavour to ensure that the information we collect is relevant and not excessive for the purposes for which it is collected.Process your personal information in a manner consistent with the purposes for which it was originally collected or to which you have otherwise consented.Take commercially reasonable steps to ensure that your personal information is reliable for its intended use, accurate, complete, and, where necessary, kept up-todate. Respect your rights to control and access your personal information when appropriate.Be transparent about what personal information we collect and how it is collected.Use technical and organisational safeguards to protect personal information.Not use your personal information for direct marketing purposes without giving you an opportunity to “opt-out”.Take appropriate measures, by contract or otherwise, to provide adequate protection for personal information that is disclosed to a third party or transferred to another country.

2. Who we collect personal information from
As a medical device manufacturer, AROA may collect personal information, including from the following categories of individuals:

• End-users which include end-users of AROA’s products that receive treatment from our Customers.Customers which include individuals or entities that use or distribute AROA’s products. Customers can generally be classified as:
  • Distributors which include entities and individuals who purchase and distribute AROA products (including authorised sub-distributors).Healthcare providers which include entities and individuals who purchase and use AROA products, including healthcare professionals, hospitals and clinics.

• Customer Staff which include individuals representing our Customers Participants which include participants in clinical trials, studies or research that AROA sponsors or contributes to. Participants may include individuals we have no other relationship with, as well as End-users and Customers.AROA Staff which include employees or contractors who are or have been employed or engaged by AROA.Applicants which include prospective employees and any persons who inquire about employment opportunities with AROA.Shareholders which include all entities and individuals who have a shareholding in Aroa Biosurgery Limited.

3. Personal information we may collect
AROA may need to collect and process a range of personal information from you, or in certain instances from third parties. We endeavour to only collect personal information from third parties when you have been told first, where permitted by law of where you have authorised another agency to share that information.

Categories of information and examples of specific information that we may collect include:

• Name and contact information including your title, email address, postcode, address, phone number etc.Demographic information such as your age, date of birth, gender, ethnicity, nationality, preferred language etc.Financial information such as payment information, bank account details, salary/income information, insurance information, sales and transaction history, sales interactions with AROA representatives etc.Online/technology information such as IP address, device identifier and information, session IDs, cookie information, browser history, preferences and interests, log-in information (username and password), website forms, other communications etc.Marketing information such as information about AROA conferences and events you may be interested in, contact information, email marketing subscriptions, preferences, product interests, cookies and web beacons etc.Feedback and survey information including information you choose to provide such as contact, health, and complaint information etc.Staff information such as recruitment information, current and past staff information including name, contract, role, performance, job history, education and qualification information, financial information, vaccination status, workplace information, training, background, criminal and financial checks, shares, trade union affiliations, timesheets etc.Applicant information such as name, email address, CV, cover letter information, job history, phone number, qualifications and certifications, references, criminal and financial checks etc.Medical and health information such as medical and health records, history and conditions, lifestyle information, insurance identifiers etc.Product investigations information such as complaints, investigations, images, health information, device information, contact information and communications etc.Research and clinical information such as information gathered from participation in research and clinical trials, images, video, contact information, related medical and health information, dietary, lifestyle or other personal information relevant to the research or clinical trial etc.

We may also use your personal information for other purposes, either after notifying you at the time of collection or where those uses are otherwise permitted by law.

4. Sharing of your personal information

Your personal information may be shared within the AROA group to provide the products and support you requested and/or provide administrative and business development support. This may include supporting the security and safety of our products, services and business operations.

AROA may also need to share your information with trusted third parties to carry on our business. We endeavour to only share your personal information with third parties where we have notified you at time of collection, as permitted by law, and/or as set out in this Policy.
Trusted third parties include:

• Regulatory bodies to comply with our obligations as a medical device manufacturer, including post-market customer care, and may include our responsibilities to protect Participants, End-users, Customers and Employees.Third-party service providers who support us to provide the products and support you requested, support our business operations and other necessary and legitimate business purposes. This includes supporting or providing necessary software and systems to support our business operations. It may also include third-party service providers to support the use, maintenance, security and safety of our products and operations.Third party platforms including our social media and analytics partners who serve advertising or content (including personalised advertising) based on your personal information or preferences.Respond to legal process and to protect AROA’s rights and property of AROA and our Employees.Our professional advisers, where required to enable any such adviser to provide services to us.Local law and government bodies to comply with our legal obligations including employment, tax and finance law and workplace health and safety. In rare circumstances this may include responding to lawful requests to share personal information to support local law enforcement or government requests regarding official investigations.Other persons disclosed to you at the time the relevant personal information is collected.

In the transfer of your information to third parties, AROA endeavours to apply suitable safeguards to protect the security of your personal information and to ensure that the transfer of personal information is undertaken in accordance with applicable law and regulations.

AROA may share anonymised or aggregated information internally and with third parties for any purpose.

AROA will never sell any of your personal information to third parties.

5. Security of your personal information

AROA uses technical and organisational safeguards designed to protect personal information which it holds about you to mitigate the risk of loss, misuse or disclosure.

Nevertheless, please note that the electronic transmission or storage of personal information can never be guaranteed secure.

6. Retention of your personal information

AROA endeavours to retain your personal information for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations.

If you would like to know more about where and how long your personal information is stored please contact us at privacy@aroabio.com.

7. Website cookies and third parties

Our website uses cookies and local storage to collect and store information about you when you visit our site. Cookies are small data files which may include an anonymous unique identifier. They enable web sites to recognise repeat users, allowing sites to compile aggregated data for content and site improvements. They are typically sent to your browser from a web site and then stored on your device, from where they may send data to other web servers. Cookies and local storage are widely used.

Cookies are necessary to protect your privacy while disclosing your address details and while logging in and allow us to provide an optimal experience when using our website. Please note if you choose not to allow cookies, you may not be able to access all the services on our website.

We also promote our products and services using technology partners, including our social media and analytics partners, as a method of targeting our advertising based on how you interact with our website. This means that you may see ads from us when you visit other websites.

When you first visit our website, you will be given the option to accept or reject the use of cookies. If you chose to not allow cookies it may result in a loss of functionality on our website and may affect your browsing experience.

8. Links to third party websites

Our website may contain links to other websites for your convenience and information. These websites may be operated by businesses not affiliated with us. Linked websites may have their own privacy statement, which we suggest you review if you visit them.

AROA is not responsible for the content of any websites that we do not control, any use of those websites or the privacy practices of those businesses.

9. Children

Our website is not intended for or directed at minors. In the rare event we collect personal information from minors, this would only be with the express consent of their parent/guardian (whether provided directly to us or to a Customer who has been authorised to share it with us for a specific purpose).

10. Your privacy rights

You have certain rights in respect of your personal information, including the right to ask for a copy of any personal information we hold about you, and to ask for it to be corrected if you think it is wrong.
To exercise your rights or if you have any questions or concerns about the privacy of your personal information, please contact us at privacy@aroabio.com.

If you are not satisfied with how we manage your personal information or respond to your privacy request, you may have a right to lodge a complaint with the appropriate data protection or privacy supervisory authority.

AROA is headquartered in New Zealand, so the New Zealand supervisory authority’s contact details are as follows:
Office of the Privacy Commissioner
PO Box 10 094,
The Terrace,
Wellington 6143
+64 (09) 3028680
https://www.privacy.org.nz/

AROA also does business in other countries, so additional supervisory authorities may also be applicable. Please see below contact details for some (non-exhaustive) local authorities.

Australia: Office of the Australian Information Commissioner (https://www.oaic.gov.au/)
USA: Federal Trade Commission (https://www.ftc.gov/)

Released: 11 May 2023