This Policy is effective as of June 2026

PRIVACY

Fisher & Paykel Healthcare Limited ("F&P", "we", "our", or "us") respects your privacy. This Notice is intended to provide you with information regarding our use of personal data collected about users of InfoSmart™ Web ("Website"). Please note that this Notice does not relate to data about patients which you, as a user of the Website, upload and/or access on the Website. Details regarding the collection, use, disclosure, storage, security and transfer of patient data collected through the Website are set out in the Patient Information and Consent Form located at https://www.fpinfosmart.com/terms/patientconsent. Any handling of personal data not contemplated by this Notice, including any handling of personal data by us outside of the Website, is subject to our Global Privacy Statement, which is located at https://www.fphcare.com/privacy, and includes information on associated privacy rights. If you are a provider in the United States, protected health information created by you or on your behalf by F&P is governed by the https://www.fpinfosmart.com/terms/baa?country=US. It is your responsibility to provide your patients with a Notice of Privacy Practices describing your collection and use of health information, not F&P.

COLLECTION OF PERSONAL DATA

Personal data is information about you which identifies you, or which could be used to identify you. Personal data does not include anonymised information about you. When you use our Website, we will request that you provide us with certain personal data, such as your name, email address and business contact information. You will also be asked to create a username and password to access your account on the Website. You are not obliged to provide us with the information requested. If you choose not to provide this information, it may mean that we are unable to provide you with information or services from the Website.

USE OF YOUR PERSONAL DATA

We will only use your personal data for the purpose for which it was collected or as otherwise permitted by law. We will collect, process and use your personal data which we obtain through the Website for the following purposes in accordance with the InfoSmart Web Terms and Conditions https://www.fpinfosmart.com/terms or any other agreement with you:

• to create and maintain your account;
• to display content on the Website;
• to provide you with a service or goods which you have requested;
• to operate, evaluate and improve our products, Website and business;
• to respond to and communicate with you about your requests, questions and comments;
• to provide you notices about your account;
• to protect against identity theft and prevent fraud and other criminal activity, claims and other liabilities; and/or
• to comply with and enforce applicable legal requirements, relevant industry standards and our internal policies.

We may also access your data in an aggregated or anonymised form for data analytics purposes to support product, and treatment insights and product or service improvements. We may use your personal data in other ways as indicated to you at the time of supply of the information to us. For example, if you have consented to your personal data being used by F&P group companies for direct marketing purposes.

DISCLOSURE OF YOUR PERSONAL DATA

Your personal data may be disclosed to duly authorised staff of F&P, including those located in New Zealand and to duly authorised staff of other F&P group companies for the above purposes. We do not disclose your personal data outside of the F&P group of companies unless:

• the disclosure is required by law (for example disclosure is necessary to comply with legal obligations or to respond to lawful requests from public, regulatory or other governmental authorities);
• the disclosure is to trusted third parties (such as our service providers or advisors) under confidentiality, data protection and data security obligations for the purposes set out in the "Use of Your Personal Data" section above; or
• you otherwise consent to the disclosure

STORAGE AND SECURITY

To the extent permitted by applicable law, we will retain your personal data for as long as you are using your account on our Website and for a period of up to seven (7) years after the last recorded user activity on your account. We will maintain reasonable, appropriate administrative, technical and physical safeguards to the personal data you provide to protect against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use, and to keep this information accurate and up to date. While we will endeavour to take all reasonable, appropriate steps to keep secure any personal information which we hold about you and prevent unauthorized access, you acknowledge that the internet is inherently insecure and that we cannot provide any absolute assurance regarding the security of your personal information.

DATA TRANSFERS

We may transfer your personal data outside of your country or jurisdiction, for example to our duly authorised staff in New Zealand. Where processing involves a cross-border transfer, appropriate safeguards will be applied to comply with applicable privacy laws. Depending on where you are located and the requirements of local law, your personal data will be stored on dedicated servers located in the Netherlands, Japan, France or the United States that are operated by a third party service provider. This hosting service provider strictly acts on our behalf and in accordance with our instructions and is not permitted to use personal data uploaded onto the Website for its own purposes.

YOUR RIGHTS

Subject to applicable law in your country or jurisdiction, you may have the right to 1) access your personal data, 2) have the personal data we hold about you corrected or updated if it is incorrect, incomplete or inaccurate, 3) have your personal data deleted or its use restricted, 4) object to the use of your personal data 5) receive, in a structured, commonly used and machine-readable format, the personal data that you have provided to us, and to transmit this personal data to a third party and/or 6) make a complaint if you believe your privacy has been breached or if you have a complaint about how we handle your personal data. If you wish to exercise any of these rights (to the extent applicable in your country or jurisdiction), please contact us at [email protected] and provide a copy of your valid certified ID document (valid national ID card, driver's license or passport) with your request. For full contact details of Fisher & Paykel Healthcare or its representative in your country, please visit https://www.fphcare.com/our-company/contact-us/fph-offices/. We will comply with your request as soon as reasonably possible in compliance with applicable law. If you are not satisfied by our response, you may lodge a complaint with a data protection authority.

LINKS TO NON-FISHER & PAYKEL HEALTHCARE SITES

The Website contains numerous links to other websites. F&P takes no responsibility for the privacy practices of such other websites. You should consult the privacy policies of each linked website in order to determine whether the site utilises similar privacy protections to us.

HOW TO CONTACT US

Fisher & Paykel Healthcare Limited has its registered office at 15 Maurice Paykel Place, East Tamaki, Auckland 2013, New Zealand. For full contact details of F&P or its representative in your country, please visit https://www.fphcare.com/our-company/contact-us/fph-offices/. If you have any questions or concerns about privacy matters relating to the Website, please contact our Data Protection Officer at [email protected]

COOKIES

We aim to make your experience of interacting with the Website as informative and supportive as possible. One of the ways that we try to achieve this is by collecting information through the use of cookies and web beacons, and collecting information relating to your IP address. These tools allow us to gather information about your use of the Website, enabling us to make your visits to the Website easier and more efficient. They also assist in our administration of the Website, allowing us to improve the service offered by the Website.

What are Cookies

A cookie is a small data file that a website transfers to online users' hard drives to remember service settings. The use of cookies is industry standard and most major websites use cookies.

Types of Cookies we use

• Internal cookies essential for the Website to work - We use first-party authentication and security cookies to identify you once you log in to the Website and to ensure that your usage of the website is kept secure. Please note that without these cookies, you will not be able to access the Website.
• Analytics cookies - these cookies collect information about how visitors use the Website and provide information on performance and errors that may occur.

Consent and Control

Essential cookies will be used to enable core functionality of the Website and cannot be disabled. You can set your browser to notify you when you receive a cookie, and to decline or accept it, however the functionality of the Website will be impaired without such cookies. These settings are usually found in the 'options' or 'preferences' menu of your internet browser. Please visit https://www.aboutcookies.org/how-to-delete-cookies for more information about deleting or blocking cookies. Please note that if you visit the Website from various browsers or devices, you will have to change your settings on each of these browsers or devices to accept or decline cookies. In certain jurisdictions, when you first visit our Website, a banner will inform you of the use of these tools. Non-essential cookies will only be used after you provide consent through the banner, as required by applicable law. You can withdraw your consent at any time by adjusting your browser settings.

GENERAL

Your use of the Website signifies that you accept the terms of this Notice. We may change or update this Notice from time to time, for example (but without limitation) because our Website or the rules relating to the matters addressed in this Notice change. Such changes or updates are effective immediately after we give notice of the change or update, which we will do by posting on the Website, or by email or conventional mail, and/or by any other means that provide reasonable notice. Your use of the Website after such notice is posted means that you accept these changes or updates. If you do not agree to the amended Notice, you must cease accessing and using the Website and request deactivation of your InfoSmart Web account in accordance with the InfoSmart Web Terms.