PRIVACY POLICY

Syreon Corporation recognizes the importance of maintaining and securing any personal information collected, in accordance with applicable laws, rules, and regulations. This privacy policy describes how Syreon collects, uses, discloses, and protects personal information. The term "personal information" applies to any information that can be used to identify an individual.

INFORMATION COLLECTED

Personal Information
Personal information may be collected when an individual submits information through one of our website services, including registries such as the Syreon Career Centre or Syreon Investigator Registry, if an individual signs up to receive Syreon newsletters or whitepapers, if an individual participates in a clinical trial or research program, and if an individual contacts us to inquire about our services or request support regarding our services. The types of Personal Information that we may collect from individuals may include name, home address, e-mail address, phone number, and account information. In the context of research, participant data is collected and processed by Syreon in a de-identified format and participants should contact their care-provider directly should they have any questions related to their data, and exercising of data rights. Personal information is only retained for the length of time required to fulfill the purpose of its intended use.

Device Identifiable Information
Syreon also collects device identifiable information about visits to Syreon websites to improve and enhance its features and serve users better. As an individual navigates the content of our site, we collect information regarding their computer or device, which is provided to us by the user's browser. This may include information such as browser type, language settings, referring website, and the tracking of Internet Protocol (IP) addresses. Gathering this information allows us to administer the website, analyze how users interact with our content, and how much time they may spend on individual pages. If an individual is using a mobile device, such as a phone or a tablet, we may collect information regarding the model, the operating system, the browser, the carrier, and identifiers assigned to the device such as the mobile carrier ID ascribed to your device from your device manufacturer. Location information such as approximate geographic area or zip code may be collected if the location services of your device have been enabled.

Cookies
Cookies are small text files that are stored on your device when you visit our webpages that make your experience browsing our site as smooth as possible. We use cookies to identify your device, to secure your identity when you log into one of our services, and remember your preferences so you don't have to insert your details again and again. You do have the ability to turn off cookies in the settings of your browser, but doing so may reduce the features of our website that are made available to you.

USE OF INFORMATION

Syreon may use the Personal Information and Device Identifiable Information we collect for a variety of purposes that include:

• to facilitate the ongoing operation of our website and our services
• to facilitate internal record keeping
• to contact you regarding information you have submitted
• to contact you regarding information or services you have requested
• to send you, with your permission, promotional material or informational content to manage and conduct research programs
• communication of information related to adverse drug reactions to regulatory authorities
• archiving of records for a reasonable length of time, for business administration and regulatory purposes
• other uses of information with individual's consent

We may also share Personal Information and Device Identifiable Information as permitted or required by law, or for law enforcement purposes, and as required by requests from enforcement agencies.

Third Parties
Syreon does not sell, share or distribute personal data collected through this website to third parties. However, as part of the overall development and hosting of our websites, software systems, and record keeping facilities, we have arrangements in place with third-party service providers to facilitate the support of sites and services and provide analytics, who may collect, store, and report the information on our behalf. Service Providers are only provided with the information they need to perform their designated functions and are not authorized to use or disclose personal information for their own marketing or other purposes. Syreon third-party service providers are monitored through Syreon's Vendor Surveillance Program and must safeguard data in a manner consistent with data transfer agreements and applicable local and international legislation. In certain circumstances, Syreon may also be required to disclose information to government and regulatory authorities to meet legislative requirements, such as by court order.

Security and Oversight
Syreon takes measures to protect your information against misuse, loss, disclosure, alteration or destruction by using a variety of commercially acceptable technologies and standards. In order to comply with the growing body of international data privacy laws and regulations, Syreon maintains a number of operational programs, including an Internal Data Privacy Officer, an External Data Privacy Officer, a Privacy Committee, and a Cybersecurity Committee, all tasked with monitoring the privacy landscape and enhancing technology and procedures related to securing data. Security safeguards are in place across all jurisdictions where data is collected, stored, or processed, and Syreon's project development procedures incorporate Privacy by Design principles.

Data Breach
Syreon adheres to breach notification requirements outlined by regulations across all jurisdictions in which data is collected, stored or processed.

Consent
An individual may consent to the collection and processing of personal information by various means. Either expressly through a formal consent process, or impliedly by submission of information for a request of information or use of a website or service. The method of consent may vary depending on the sensitivity of the information collected, and the context.

Consent for the collection or processing of data may be withdrawn at any time, subject to exceptions outlined in relevant legislation.

Accessing Your PI
If you require access to your personal information, or to update, correct inaccuracies, or to delete your information, please contact our privacy officer whose contact details are below.

The policy as outlined represents Syreon's minimum privacy standards related to the collection, processing, and storing of data and does not pre-empt more stringent practices and safeguards that may be imposed to meet contractual or regulatory requirements.

Syreon employees who violate this policy may be subject to disciplinary action including termination, and in cases where criminal or other serious violations of the law may have occurred, notification to the appropriate regulatory agency. Contractors, consultants, and third-party vendors who are found to be in violation of this policy will be subject to appropriate action, and in cases where criminal or other serious violations of the law may have occurred, notification to the appropriate regulatory agency.

Syreon reserves the right to change this policy at any time, without prior notice to you. Any changes will be posted on this page so you will always be aware of what information we collect, how we use it, and whether we disclose it. We may also notify you of changes via the website, via notices in registry portals, or directly through e-mails if we require additional consent.

If you have any questions about this policy, please contact Syreon's Privacy Officer at:

Privacy Officer
Syreon Corporation
220—1401 West 8^th Ave
Vancouver, BC
V6H 1C9   Canada
e-mail : privacy@syreon.com

This policy was reviewed and last updated on 01 May 2023.