InVivo Therapeutics Privacy Policy PLEASE READ THIS PRIVACY STATEMENT CAREFULLY. Privacy is very important to us. We also understand that privacy is very important to you. This Privacy Statement tells you how we protect and use information that we gather through this InVivo Therapeutics web site. InVivo Therapeutics and any affiliates also operate other web sites. This Privacy Statement does not apply to the other InVivo Therapeutics web sites. You should review the privacy statement posted on other InVivo Therapeutics web sites when you visit them. This web site and this Privacy Statement are intended for a U.S. audience. This Privacy Statement was last revised on March 8, 2006. We may change this Privacy Statement at any time and for any reason. Significant changes to the Privacy Statement are discussed below in the Section called “Changes to the Privacy Statement.” We encourage you to review this Privacy Statement each time you visit the web site. By using this web site, you agree to the terms of the most recent version of this Privacy Statement. Please read our Terms of Use to understand the general rules about your use of this web site. Except as written in any other disclaimers, policies, terms of use, or other notices on this web site, this Privacy Statement and the Terms of Use are the complete agreement between you and InVivo Therapeutics with respect to your use of this web site. You may be subject to additional terms that may apply when you access particular services or materials on certain areas in this web site, or by following a link from this web site. Introduction The information we receive, and how we use it, depends on what you do when visiting our web site. We collect and use your non-personal information (information that is not identifiable to you personally) differently than your personal information. What is non-personal information? Non-personal information is information we collect through this web site that does not identify you as an individual person. It may include information such as the following: the type of web browser software you use (for example, Netscape Navigator or Internet Explorer) the name of the domain from which you access the Internet the Internet address of the web site from which you linked directly to our web site the date and time you access our web site which pages you have visited on our web site personal information that has been de-identified If you visit our web site to read or download information, such as information about a health condition or about one of our products, we may collect certain non-personal information about you from your computer. This information is collected from your computer’s web browser: If you only read or download information on our web site, we do not collect or learn your name, e-mail address, home address, or other personal information about you. We may place a text file called a cookie in the browser files of your computer when you visit. The cookie may be stored on your computer’s hard drive. The information that we collect using cookies is non-personal information. You are always free to decline our cookies if your browser permits, but some parts of our web site may not work properly for you if you do so. We will not allow third parties to place cookies on our web site. What does InVivo Therapeutics do with non-personal information? Because non-personal information cannot identify you or be tied to you in any way, there are no restrictions on the ways that we can use or share non-personal information. We are always looking for ways to better serve you and improve this web site. We will use non-personal information from you to help us make this web site more useful to visitors. We also will use non-personal information for other business purposes. For example, we may use non-personal information or aggregate de-identified personal information to: create reports for internal use to develop programs, products, services or content customize the information or services that are of interest to you share it with or sell it to third parties provide aggregated “traffic statistics” and “response rates” to third parties What is personal information? Personal information is information we collect through this web site that we can use to specifically identify you, such as your: name telephone number e-mail address medical device serial number personal health information date of birth In some places on this web site you have the opportunity to send us personal information about yourself. For example, you may fill out a registration form, a survey, or an e-mail form. You also may choose to allow us to personalize your visits to the web site, in which case we will ask you for certain personal information to make your visits to our web site more helpful to you. When this information is combined with the non-personal information that we collect through cookies (described above), we will be able to tell that you have visited our web site before and can personalize your access to our web site, for example, by telling you about new features that may be of interest to you. How does InVivo Therapeutics keep and use personal information? We may keep and use personal information we collect from you through this web site to provide you with access to this web site. In addition, we may keep and use your personal information: to respond to your requests to personalize your access to our web site, for example, by telling you about new features that may be of interest to you to develop records, including records of your personal information to contact you with information that might be of interest to you, including information about clinical trials and about products and services of ours and of others for analytical purposes and to research, develop and improve programs, products, services, and content to remove your personal identifiers (your name, e-mail address, social security number, etc.). In this case, you would no longer be identified as a single unique individual. Once we have de-identified information, it is non-personal information and we may treat it like other non-personal information. to enforce this Privacy Statement and other rules about your use of this web site to protect our rights or property to protect someone’s health, safety or welfare to comply with a law or regulation, court order or other legal process Does InVivo Therapeutics ever share personal information with third parties? InVivo Therapeutics will not share your personal information collected from this web site with an unrelated third party without your permission, except as otherwise provided in this Privacy Statement. In the ordinary course of business, we will share some personal information with companies that we hire to perform services or functions on our behalf. For example, we may use different vendors or suppliers to ship you products that you order on our web site. In these cases, we provide the vendor with information to process your order such as your name and mailing address. In all cases in which we share your personal information with a third party, we will not authorize them to keep, disclose, or use your information with others except for the purpose of providing the services we asked them to provide. We will not sell, exchange, or publish your personal information, except in conjunction with a corporate sale, merger, dissolution, or acquisition. We may be legally compelled to release your personal information in response to a court order, subpoena, search warrant, law or regulation. We may cooperate with law enforcement authorities in investigating and prosecuting web site visitors who violate our rules or engage in behavior that is harmful to other visitors (or illegal). We may disclose your personal information to third parties if we feel that the disclosure is necessary to: enforce this Privacy Statement and the other rules about your use of this web site protect our rights or property protect someone’s health, safety or welfare comply with a law or regulation, court order or other legal process Please note: In addition to the ways that we may keep, disclose, and use information described in this Privacy Statement, we also may keep, disclose, and use personally identifiable information that you give us through this web site in ways that we believe are consistent with FDA and other governmental guidance, directions, regulations, and laws. What happens if the privacy statement changes? If we decide to make a significant change to our Privacy Statement, we will post a notice on the homepage of our web site for a period of time after the change is made. Significant changes are also described below. What about privacy on other web sites? This web site may contain links to other web sites. Some of those web sites may be operated by InVivo Therapeutics, and some may be operated by third parties. We provide the links for your convenience, but we do not review, control, or monitor the privacy practices of web sites operated by others. This Privacy Statement does not apply to any other web site, even the other InVivo Therapeutics web sites. We are not responsible for the performance of web sites operated by third parties or for your business dealings with them. Therefore, whenever you leave this web site we recommend that you review each web site’s privacy practices and make your own conclusions regarding the adequacy of these practices. Does InVivo Therapeutics ever communicate directly with visitors to this web site? We may contact you periodically by e-mail, mail or telephone to provide information regarding programs, products, services, and content that may be of interest to you. In addition, some of the features on this web site allow you to communicate with us using an online form. If your communication requests a response from us, we will send you a response via e-mail. The e-mail response or confirmation may include your personal information, including personal information about your health, your name, address, etc. We cannot guarantee that our e-mails to you will be secure from unauthorized interception. Are there special rules about children’s privacy? We care about protecting the online privacy of children. We will not intentionally collect any personal information (such as a child’s name or e-mail address) from children under the age of 13. If you think that we have collected personal information from a child under the age of 13, please contact us. What about web site security? We take reasonable steps to protect your personal information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. You should keep in mind that no Internet transmission is ever 100% secure or error-free. In particular, e-mail sent to or from this site may not be secure, and you should therefore take special care in deciding what information you send to us via e-mail. How to contact InVivo Therapeutics. If you have questions or comments about this Privacy Statement, please use the Contact InVivo Therapeutics feature at the bottom of your screen or contact us at: InVivo Therapeutics Corp. One Kendall Square Building 1400 East, Floor 4 Cambridge, MA 02139 © 2021 INVIVO THERAPEUTICS PRIVACY POLICY TERMS OF SERVICE