Privacy notice.

A private company limited by shares, incorporated in Ireland
Company registration number: 797644
Registered office: Dogpatch Labs, Unit 1, The CHQ Building, Custom House Quay, Dublin 1, Ireland
Electronic mail: sean@reablelabs.ie

2.2 ReAble Labs has not appointed a Data Protection Officer, not being an undertaking to which Article 37(1) of the GDPR applies. All enquiries concerning this Privacy Notice, and all requests made under Chapter III of the GDPR, should be directed to the electronic mail address at clause 2.1 and marked for the attention of the Chief Executive Officer.

3.2 Data generated by your correspondence with us. Where an exchange of correspondence follows your enquiry, we process the content of that correspondence together with associated metadata, including the dates and times of transmission and the electronic mail addresses of the parties to the exchange.

3.3 Analytics data. Where, and only where, you have signified your consent through the mechanism described in the Cookie notice, we process data generated by your interaction with the Website, comprising the pages requested, the dates and times of those requests, the approximate geographic region derived from your internet protocol address, and technical information concerning the device, operating system and browser used. Google Analytics 4 does not retain internet protocol addresses in a form accessible to us.

3.4 Technical log data. The web server on which the Website is hosted records, for each request, the internet protocol address from which the request originated, the date and time of the request, the resource requested, the response code returned, and the browser user agent string. These logs are rotated automatically and are retained for the period stated at clause 8.1. Our electronic mail provider separately records, for each message sent through the Website, the recipient address, the subject, the delivery status and the message content, for the period stated at clause 8.1.

3.5 Special categories of personal data. We do not solicit, and we have no wish to receive, personal data falling within Article 9(1) of the GDPR, including data concerning health. You are asked not to include information concerning your health, diagnosis, prognosis, clinical history or medical treatment in any message sent through the Website. Where such information is nonetheless volunteered by you, we process it solely for the purpose of responding to your correspondence, in reliance on Article 9(2)(a), and we erase it upon conclusion of the exchange or within six months of receipt, whichever occurs first.

3.6 We do not process personal data relating to criminal convictions or offences. We do not knowingly process personal data relating to children. We do not acquire personal data relating to you from data brokers, list vendors or other third-party sources.

4.2 Legitimate interests assessment. Where we rely upon Article 6(1)(f), the legitimate interests pursued are our interests in responding to persons who have chosen to contact us, in keeping an accurate record of our commercial and clinical correspondence, and in operating our systems securely. We have balanced those interests against your interests, rights and freedoms. We have had regard to the fact that the processing is limited to data you have volunteered for the express purpose of obtaining a response, that the processing is of a kind you would reasonably anticipate, that it is limited in scope and duration, and that it produces no legal or similarly significant effect upon you. We have concluded that our legitimate interests are not overridden. You may object to this processing at any time under clause 9.6, and we will cease processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms.

4.3 Consent. Where we rely upon Article 6(1)(a), consent is obtained by affirmative action taken by you through the consent mechanism described in the Cookie notice, is recorded, and may be withdrawn at any time under clause 9.7. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.4 Absence of automated decision-making. We do not carry out automated decision-making, including profiling, which produces legal effects concerning you or which similarly significantly affects you within the meaning of Article 22 of the GDPR.

4.5 No further processing. We do not process personal data collected through the Website for any purpose incompatible with those set out at clause 4.1. We do not sell, rent or licence personal data. We do not use personal data collected through the Website for advertising, for behavioural targeting, or for the training of machine learning models.

5.2 The provision of consent to the processing described at clause 3.3 is entirely voluntary. Refusal has no consequence for your use of the Website, no part of which is conditioned upon that consent.

• (a) Processors. The service providers identified at Schedule 1, each of which processes personal data solely on our documented instructions under a written agreement satisfying Article 28(3) of the GDPR.
• (b) Professional advisers. Our legal advisers, accountants, auditors and insurers, where disclosure is necessary for the purposes of obtaining professional advice or of establishing, exercising or defending a legal claim.
• (c) Public authorities. Any court, regulator, supervisory authority or law enforcement agency, where disclosure is required by law or by a validly issued order, including the Data Protection Commission, the Health Products Regulatory Authority and the Revenue Commissioners. A public authority receiving personal data in the framework of a particular inquiry in accordance with law is not treated as a recipient under Article 4(9) of the GDPR.
• (d) Successors in title. Any person to whom we transfer, or propose to transfer, the whole or part of our business or assets, in which case personal data may be disclosed subject to appropriate confidentiality undertakings.

6.2 We do not disclose personal data to any other person. In particular, no personal data collected through the Website is disclosed to any clinical partner, research institution, investor or robotics undertaking except where you have expressly asked us to make an introduction.

7.1A The single routine transfer outside the European Economic Area arises from the transmission of electronic mail. Our mail delivery provider, Resend, Inc., stores customer data in the United States of America. That transfer is governed by the provider's data processing agreement, which incorporates the standard contractual clauses adopted by the European Commission.

7.2 Where a transfer of personal data to a third country is necessary, we effect that transfer only where one of the following conditions is satisfied:

• (a) the European Commission has decided under Article 45 of the GDPR that the third country ensures an adequate level of protection, including, in the case of certified recipients in the United States of America, under the EU to US Data Privacy Framework;
• (b) the transfer is subject to the standard contractual clauses adopted by the European Commission under Article 46(2)(c) of the GDPR, supplemented where necessary by such technical, contractual and organisational measures as our transfer impact assessment identifies; or
• (c) a derogation under Article 49 of the GDPR applies.

7.3 You may obtain a copy of the safeguards relied upon in respect of any particular transfer by writing to the address at clause 2.1.

8.2 Upon expiry of the applicable period, personal data is erased or irreversibly anonymised. Where erasure is not immediately practicable because data is held in backup media, the data is isolated from further processing and erased upon the expiry of the backup cycle.

9.2 Right to rectification. You have the right under Article 16 to obtain without undue delay the rectification of inaccurate personal data concerning you, and to have incomplete data completed.

9.3 Right to erasure. You have the right under Article 17 to obtain the erasure of personal data concerning you where one of the grounds in Article 17(1) applies, subject to the exceptions in Article 17(3).

9.4 Right to restriction. You have the right under Article 18 to obtain the restriction of processing where one of the grounds in Article 18(1) applies, including while the accuracy of data is contested or while an objection under Article 21 is being considered.

9.5 Right to data portability. You have the right under Article 20 to receive personal data which you have provided to us, where processing is based on consent or on contract and is carried out by automated means, in a structured, commonly used and machine-readable format, and to transmit that data to another controller.

9.6 Right to object. You have the right under Article 21(1) to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f). Upon receipt of such an objection we will cease processing unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

9.7 Right to withdraw consent. Where processing is based on consent, you have the right under Article 7(3) to withdraw that consent at any time. Withdrawal is as straightforward as the giving of consent and is effected through the mechanism described in the Cookie notice. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

9.8 Exercise of rights. Requests should be made in writing to the address at clause 2.1. We will respond without undue delay and in any event within one month of receipt. That period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and of the reasons for it within one month of receipt.

9.9 Verification. Where we entertain reasonable doubts concerning the identity of the person making a request, we may request the provision of additional information necessary to confirm identity, in accordance with Article 12(6). We request no more information than is necessary for that purpose.

9.10 Fees. No fee is charged for the exercise of any right. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee reflecting the administrative costs of compliance, or refuse to act on the request, and in either case we will explain our reasoning and inform you of your right to complain.

9.11 Right to lodge a complaint. Without prejudice to any other administrative or judicial remedy, you have the right under Article 77 to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority in Ireland is:

Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963, Ireland
Telephone: +353 1 765 0100 or 1800 437 737
Website: dataprotection.ie

9.12 We would be grateful for the opportunity to address any concern before you approach the Data Protection Commission, but you are under no obligation to contact us first.

• (a) transmission of all Website traffic over Transport Layer Security, with HTTP Strict Transport Security enabled;
• (b) multi-factor authentication on the electronic mail accounts and administrative accounts through which personal data is accessible;
• (c) restriction of access to personal data to those personnel who require it in order to perform their duties;
• (d) selection of processors which provide sufficient guarantees to implement appropriate technical and organisational measures, and the imposition upon them of obligations under Article 28(3);
• (e) minimisation of the personal data collected, such that no account, customer database or payment mechanism exists on the Website; and
• (f) periodic review of these measures and of their effectiveness.

10.2 Personal data breaches. In the event of a personal data breach we will, where the breach is likely to result in a risk to the rights and freedoms of natural persons, notify the Data Protection Commission without undue delay and, where feasible, not later than 72 hours after becoming aware of it, in accordance with Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will communicate it to you without undue delay in accordance with Article 34. We maintain an internal record of all personal data breaches, their effects and the remedial action taken.

10.3 No method of transmission over the internet, and no method of electronic storage, is entirely secure. While we apply the measures described above, we cannot guarantee absolute security, and transmission of data to us over the internet is at your own risk.

12.2 Where an amendment materially alters the purposes or manner of processing, we will bring the amendment to your attention by a prominent notice on the Website, and, where the amendment requires it, we will obtain fresh consent.

12.3 The version of this Privacy Notice in force at the time of a given processing operation governs that operation.