Privacy Notice Signia One App English

1.1This Privacy Notice explains how WS Audiology A/S, established in Denmark (hereinafter “WSA”, “we”, “us”, “our”), collects and processes your personal data when you use this App (hereinafter “the App”).

1.2WSA is considered the data controller for the processing of your personal data when you use the App.

1.3WSA has affiliate companies in various countries, and should you consent to our processing of your personal data for research and development purposes please be aware that we will process your personal data together with certain of our group companies listed in Section 2 below. You can read more about how we jointly process your personal data in Section 2.2.

1.4You can find contact information of all data controllers in Section 2.1 and how we have shared responsibilities between us in Section 2.2.

1.5Your personal data will be processed in accordance with this Privacy Notice and applicable law. WSA is established within EU and for that reason the General Data Protection Regulation (EU) 2016/679 of 27 April (hereinafter “GDPR”) applies to our processing in addition to any applicable local privacy regulation.

2.1WSA is responsible for the processing of your personal data when you use the App, see more in Section 4.

The contact information for WSA is:

WS Audiology A/S

Reg. no. 15771100

Nymøllevej 6,

3540 Lynge, Denmark

Phone +45 44 35 56 00

E-mail: privacy@wsa.com

If you consent and allow us to process your personal data for research & development purposes, see Section 5, WSA is jointly responsible for such processing together with our three group companies, Sivantos GmbH, Sivantos Pte. Ltd. and Sivantos India Pvt. Ltd. Please find the contact information on the additional WSA companies below:

Sivantos GmbH,

Reg. no. DE30144051,

Henri-Dunant-Straße 100,

91058 Erlangen, Germany

Phone number: +49 91313080

E-mail: privacy@wsa.com

Sivantos Pte. Ltd.

Reg. no. 198600657G,

18 Tai Seng Street, #08-08,

Singapore 539775

Phone number: +65 6370 9666

E-mail: privacy@wsa.com

Sivantos India Pvt. Ltd.

24th Floor, One West – A Terminus Project

Narsing Nanakramguda Service Rd.

Financial District, Nanakramguda, Telengana 500008,

India

E-mail: privacy@wsa.com

2.2WSA, Sivantos GmbH, Sivantos Pte. Ltd. and Sivantos India. Pvt. Ltd. have made an agreement that governs our respective responsibilities under Art. 26 of GDPR.

2.3In summary, we have agreed that WSA is primarily responsible for ensuring a lawful basis for our processing, i.e. to obtain your consent, and that you are informed of our processing and your rights. Further, WSA is responsible for responding to any request you may have and in relation to securing and deleting or anonymizing personal data when required.

2.4Regardless, you may assert your rights, as informed in this Privacy Notice, with and against any of the above companies.

3.1In addition to contacting us as outlined in Section 2 above, you can always contact our Data Protection Officer (“DPO”), who is the person responsible for answering questions about personal data protection and exercising your rights under applicable law. Please use the following email address: dpo@wsa.com.

4.1BACKGROUND

4.1.1When you use the App most of the personal data processed will be processed on your device and not by us. Below is a description of how WSA processes your personal data when you use the App.

4.2PERSONAL DATA PROCESSED WHEN YOU USE THE TELECARE FEATURE

4.2.1Depending on the type of your hearing aids and the country you are in, your Hearing Care Professional may offer you remote assistance via the Telecare feature in the App.

4.2.2Please be aware that Telecare is a transmission only service. All communications made through Telecare are solely between you and your Hearing Care Professional for which WSA is not involved in any of these communications other than to provide you and your Hearing Care Professional with the functionality to enable such communications. For Telecare your Hearing Care Professional is therefore considered the data controller. If you have any questions as to how your Hearing Care Professional processes your personal data when you use the Telecare feature please contact your Hearing Care Professional.

4.3PERSONAL DATA PROCESSED WHEN YOU USE THE ASSISTANT

4.3.1The Assistant offers the opportunity to further optimize your hearing experience by suggesting small sound adjustments to the configuration in your hearing aids as well as the opportunity to use a chat functionality.

4.3.2The categories of data that we process when you use the Assistant are the following:

•Information about the country you are located in and your hearing loss (your audiogram and hearing profile), which is considered information about your health.

•Information about your hearing aids and their configurations, e.g. the model of your hearing aids.

•Information about your usage of the Assistant, including the content of chat messages in the Assistant.

•Information about your App and mobile device, including technical data.

•Data about your satisfaction with the Assistant provided by you in the App.

4.3.3Your personal data will not be associated with you by name, but with a unique ID.

4.3.4The legal basis for our processing and sharing is your consent (article 6(1)(a) and 9(2)(a) in the GDPR).

4.3.5It is voluntary if you want to provide your consent, but please be aware that we cannot provide the Assistant to you without your consent to the processing of your personal data.

4.3.6We will collect the above personal data from your mobile device, the App and your hearing aids.

4.4PERSONAL DATA WE SHARE WITH YOUR HEARING CARE PROFESSIONAL

4.4.1If you provide a separate consent we will share with your Hearing Care Professional:

•Data about your hearing aids and any changes to the configuration that you have applied in your hearing aids by the use of the Assistant.

4.4.2Your personal data will not be associated with you by name, but with a unique ID.

4.4.3We will do so to keep your Hearing Care Professional updated on the sound adjustments you have made to the configuration in your hearing aids. The legal basis for our processing and sharing is your consent (article 6(1)(a) and 9(2)(a) in the GDPR).

4.4.4You should contact your Hearing Care Professional if you have any questions about how the data we share is used by your Hearing Care Professional.

4.5PERSONAL DATA PROCESSED FOR RESEARCH AND DEVELOPMENT PURPOSES

4.5.1With your consent, we will collect and use data related to your hearing loss and your hearing aids for research & development purposes so we can make even better hearing solutions in the future. As part of this we will use your personal data to develop and train algorithms.

4.5.2The categories of personal data that we collect and process are:

•Information about the country you are located in and your hearing loss (your audiogram and hearing profile), which is considered information about your health.

•Information about your hearing aids and their configurations, e.g. the model of your hearing aids.

•Information about your usage of the App, including the content of chat messages in the Assistant.

•For chat messages to your Hearing Care Professional via Telecare we will not collect the content of messages, only supporting data such as length of message etc.

•Information about your general usage of your hearing aids such as wearing time and sound environments

•Information about your App and mobile device, including technical data

•Data about your satisfaction with the App and its features provided by you in the App.

4.5.3Your personal data will not be associated with you by name, but with a unique ID.

4.5.4The legal basis for our processing is your consent (article 6(1)(a) and 9(2)(a) in the GDPR).

4.5.5We will collect the above data from you, your mobile device, the App and your hearing aids.

4.6PERSONAL DATA WE ARE REQUIRED TO COLLECT

4.6.1As a manufacturer of medical devices, we are obliged to fulfill certain legal requirements to document our solutions. For this purpose we collect certain personal data about you.

4.6.2The categories of personal data that we collect and process are:

•Information about the country you are located in and your hearing loss (audiogram and hearing profile), which is considered information about your health.

•Information about your hearing aids and their configurations, e.g. the model of your hearing aids.

•Information about your App, the usage of the App and technical data about the App. This does not include your chat messages.

4.6.3Your personal data will not be associated with you by name, but with a unique ID.

4.6.4The legal basis for our processing is in compliance with legal requirements (article 6(1)(c) and 9(2)(i) in the GDPR).

4.6.5We will collect the above data from your mobile device, the App and your hearing aids.

5.1With WS Audiology. WSA is a part of a global group of companies known as WS Audiology. We may share your information with our subsidiaries or affiliated companies who handle your information as data processors in order to provide you with access to our services, offer customer support, improve and optimize the App etc.

5.2With Service Providers. In the course of providing our services, we may engage third-party service providers to assist us with various functions, such as infrastructure, analytics, customer support etc. In the course of providing such services, these Service Providers may have access to your personal information as our data processors. We take measures to ensure that such transfers comply with applicable data protection laws, and we require our service providers to uphold strict confidentiality and security standards.

5.3For Legal and User Interests. We may disclose and use personal data about you when we reasonably believe it’s necessary to: (a) Satisfy any applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service and other agreements, policies, standards, or other legal rights, including the investigation of potential violations; (c) Detect, prevent, or address illegal or suspected illegal activities, including security or technical issues; (d) Protect against harm to our rights, property, safety, security or that of our users or the public, as required or permitted by law; (e) protect infringements to third party intellectual property rights which we have been legally licensed / authorized to act on behalf of. This disclosure may involve sharing information with law enforcement agencies, public authorities, third-party intellectual property holders, or other organizations as strictly necessary.

5.4Merger or acquisition. In the event of a merger, acquisition, reorganization, bankruptcy, or similar occurrences, your personal data may be transferred to the succeeding entity. We will make efforts to provide advance notice, share pertinent details about the event and the successor, and request the successor to handle your personal data in alignment with this Privacy Notice.

6.1Since WSA is established within EU, your personal data will be processed within the EU. In addition, if you consent to our data collection for research & development purposes, your personal data will be transferred to Singapore and India because the other data controllers are established in Singapore and India.

6.2If you reside in the EEA, please note that your personal data may also be transferred to our data processors established outside the European Economic Area (“EEA”), including the United States of America. From the perspective of the European Union (“EU”), some countries outside EEA do not guarantee an “adequate level of protection” for the processing of personal data in accordance with EU standards. However, before we pass on the data, we always ensure that the recipient of your personal data remains subject to a level of protection comparable to what is required under the laws of your country (and in any event, in line with our commitments in this Privacy Notice). Specifically under GDPR, we ensure that such recipient either has an appropriate level of data protection and that the requirements of art. 44 of GDPR are met, e.g. due to an adequacy decision by the EU Commission for the respective country in accordance with Art. 45 of the GDPR, or that the so-called EU standard contractual clauses prepared by the European Commission have been agreed with the recipient in accordance with art. 46 of GDPR.

6.3If you reside outside the EEA, we have put in place appropriate safeguards (such as contractual commitments or recognized certifications) in accordance with applicable legal requirements to ensure that your data is adequately protected.

6.4We are committed to ensuring the security and compliance of your personal data, regardless of where your data is processed or stored, and will take all necessary and appropriate measures to safeguard your information in accordance with applicable laws and regulation.

6.5If you require further information on the above data transfers, you can request it from us – please send your request to us or our DPO, as laid out above in Section 2 and 3.

7.1We will retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law.

7.2When you use the Assistant (see Section 4.3): We will only process your personal data while you use the Assistant.

7.3When you agree that we can share your personal data with your Hearing Care Professional (see Section 4.4): Your personal data will be available for your Hearing Care Professional to access and download for 80 days after collection whereafter it will be automatically deleted.

7.4When you agree that we can use your personal data for research & development purposes (see Section 4.5): Your personal data is stored for 5 years. Hereafter the personal data is deleted or anonymized.

7.5Personal data we are legally required to collect (see Section 4.6): Your personal data will be stored for 5 years after collection. Hereafter the personal data will be deleted or anonymized.

7.6When you use Telecare (see Section 4.2): As for your personal data processed when you use the Telecare feature we refer to your Hearing Care Professional as they control and store such data.

You may have certain rights when it comes to the processing of your personal data. Below is a summary of your rights, how to exercise them and any limitations to them.

The right to withdraw your consent. You have the right at any time to withdraw your consent given to WSA. You can withdraw your consent in the App under Privacy Settings. Please note that withdrawal of consent does not affect the lawfulness of the processing based on the consent prior to withdrawal. (art. 7 (3) of GDPR).

Request access to your personal data. It allows you to receive a copy of personal data that WSA has recorded about you and ensure that WSA processes it lawfully. You may send a written request to WSA via the contact details provided under clause 2. You may be asked to prove that you are who you say you are. (art. 15 of GDPR).

The right to rectification. Request rectification of personal data that WSA holds about you. This gives you the opportunity to have incorrect or incomplete information WSA holds about you corrected. (art. 16 of GDPR).

The right to erasure. You may have the right to have all or some of your personal data erased by WSA. To the extent that continued processing of your data is necessary, for example, to comply with WSA‘s legal obligations or to establish, exercise, or defend legal claims, WSA is not obliged to delete your personal data. (art. 17 of GDPR).

The right to restriction of processing. You may have the right to restrict the processing of your personal data to storage only, for example if you want WSA to demonstrate its accuracy or WSA‘s purpose for processing it. (art. 18 of GDPR).

The right to data portability. You may have the right to receive the personal data that you have provided to us in a structured, common and machine-readable format (“data portability”) and the right to have this data transmitted to another person responsible (controller) if the requirement in art 20 (1) of GDPR is present.

The right to lodge a complaint. If you believe that the processing of your personal data violates data protection law, you also have the right under art. 77 of GDPR to complain to a data protection supervisory authority of your choice. This also includes the data protection supervisory authority responsible for us:

Datatilsynet

Carl Jacobsens Vej 35

2500 Valby

Denmark

Tlf. 33 19 32 00

dt@datatilsynet.dk

The Data Protection Supervisory Authority responsible for Sivantos GmbH:

Bayerisches Landesamt für Datenschutzaufsicht

Promenade 18

91522 Ansbach

Germany

Phone: +49 (0) 981 180093-0

Telefax: +49 (0) 981 180093-800

E-Mail: poststelle@lda.bayern.de

The Data Protection Supervisory Authority responsible for Sivantos Pte. Ltd.:

Personal Data Protection Commission

10 Pasir Panjang Road

#03-01 Mapletree Business City

Singapore 117438

Phone: +65 6377 3131

Telefax: +65 65773888

Website: https://www.pdpc.gov.sg/

8.1In order to safeguard your privacy and ensure the secure handling of your personal data, you may be required to verify your identity or account ownership before we can accept or respond to your request. While we strive to accommodate all requests, we may decline or charge a fee for those that are unreasonable or unnecessary and permitted by applicable law. This includes situations that are clearly repetitive or excessive, could pose significant practical challenges, require disproportionate technical efforts, or introduce operational risks, such as the potential for fraud.

8.2Kindly be aware that should you choose to withdraw your consents or object to the collection, processing or retention of specific essential information or activities, it may impact our ability to provide you with our services, either partially or entirely, due to operational or technical constraints.

If your personal information was collected in Canada, please note the following additional aspects about how we process your personal information:

For your rights, including those relating to access, correction, and erasure, you may contact our DPO should you have any questions or concerns about the processing of your personal information, see Section 3 in the Privacy Notice. We strive to address all such requests in a timely manner. If you are located in the province of Quebec, we must reply to your request for access or rectification promptly and no later than 30 days after your request is received. Should you not be satisfied with our response, or you wish to file a formal complaint, you may always contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376 (toll-free) or via regular mail: Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, QC K1A 1H3. You may also contact the Office of the Privacy Commissioner in the provinces of British Columbia and Alberta or the Commission d’accàs à l’information in the province of Quebec, as applicable.

This section provides additional disclosures that solely apply to residents of the United States.

Personal Data We Collect. Section 4 of the Privacy Notice describes the categories of personal data we have collected from consumers within the last twelve (12) months. California residents, please note that this includes the following types of “personal information” described under California law:

•Identifiers and personal information identified in California’s Consumer Records Statute, including IP address, internal unique identifiers;

•Commercial information, such as hearing aids and services you purchased, obtained, or considered;

•Audio, electronic, visual, or similar information, such as changes to your hearing aids conducted via our App or sound environment data from hearing aids;

•Sensitive personal information, such as the health-related data described below;

•Geolocation data – you can enable our App to collect your location (if you do that, please note that it is only used to pair your hearing aids and you can deactivate the pairing at any time in your device settings);

•Internet or other electronic network activity information, including but not limited to information regarding your interaction with our App and hearing aids, as described above.

•Inferences drawn from the information listed above.

Sources of Personal Data. We obtain the personal data described in this Privacy Notice (a) directly from you, (b) from your hearing aids, mobile device and your interactions with our App, (c) from third parties, including Hearing Care Professionals, operating systems and platforms.

Uses of Personal Data. Sections 4 in the Privacy Notice describes the business and commercial purposes for which we collect personal data and how we use personal data.

Disclosures of Personal Data; No Targeted Advertising. Sections 5 in the Privacy Notice describes the categories of third parties (processors) with whom we share personal information. Please note:

•All personal data may be disclosed for a business purpose: We disclose all or substantially all of the personal data described in this Privacy Notice with all categories of third parties identified in this Privacy Notice for our business purposes.

•No “sales” of personal data or targeted advertising. We do not “sell” personal data as defined under U.S. privacy laws. We also do not share personal data for targeted advertising. We also do not let third parties target ads to you while using the App based on your activity over time and across different Internet websites or online services.

Your Privacy Rights. You may exercise the rights listed in Section 8 in the Privacy Notice. To exercise your rights, you can contact us as follows:

•Email us at privacy@wsa.com

•Call us at +1 888 857 5754

Residents of certain US states can elect to exercise their rights themselves, or to have an authorized agent submit requests on their behalf. If you use an authorized agent, we may verify your identity, your agent’s identity, your agent’s authority to act on your behalf, or any other matter permitted by law.

In certain US states, you may have the right to appeal our response to your rights requests. If so, we will inform you in our response to your request how to exercise your right to appeal.

If you are a resident of the People’s Republic of China (PRC) and you have any questions, concerns, or complaints about this Privacy Policy or our personal information handling practices, you may contact us at: customerservice.shil@wsa.com.

We will acknowledge and investigate all valid requests promptly. We typically aim to provide a substantive response within fifteen (15) business days of verifying your identity, unless otherwise required by law. For complaints involving sensitive personal information or cross-border data transfers, the processing time may be extended. In such cases, we will notify you of the delay and the reasons for it using the contact details you have provided.

If you are a resident of India, you have the right to lodge a complaint with us regarding any act or omission concerning the fulfillment of our obligations or the exercise of your rights under applicable data protection laws.

To raise a concern or complaint, please contact our DPO, whose contact details are provided in Section 3 of this Privacy Statement. We strive to resolve and respond to all such requests within thirty (30) days.

If you are not satisfied with the outcome of your complaint to us, you have the right to escalate the matter by filing a complaint with the Indian Data Protection Board in accordance with applicable law.