Privacy Policy This Privacy Policy describes how OptiNose US, Inc. (“Optinose”, “we”, “us”, “our”) may collect, use and share the information you provide us and the information we collect about you in the course of operating our business, including in association with your use of this website and any website linking to this Privacy Policy that is owned and operated by Optinose (collectively, the “Services”). BEFORE ACCESSING THE SERVICES, PLEASE READ THIS PRIVACY POLICY CAREFULLY.BY ACCESSING THE SERVICES, YOU SIGNIFY YOUR AGREEMENT TO THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES. YOU SHOULD REVIEW THIS POSTING OF THE PRIVACY POLICY EACH TIME YOU ACCESS THE SERVICES AS THE POLICY MAY CHANGE AT ANY TIME AT OUR SOLE DISCRETION, AND YOUR USE OF THE SERVICES AFTER SUCH CHANGE WILL SIGNIFY YOUR ACCEPTANCE OF THE CHANGED TERMS. For those who reside in California, please see “Additional Information for California Residents.” For those who reside in Nevada, please see “Additional Information for Nevada Residents.” For those who reside in the European Economic Area (EEA), please see “Additional Information for EEA Residents.” How We Collect Your Personal Information As used in this Privacy Policy, “personal information” is any information that may reasonably identify you. We may collect personal information about you from a variety of sources, including: • From you: We collect information that you submit to us. For example, some of our Services ask you to submit personal information for you to benefit from the specified features or to participate in a particular activity. On the registration screen for such feature or activity, we clearly label which information is required for registration or participation, and which information is optional and may be given at your discretion. You may always refuse to provide information to us, but this may lead to our inability to provide you with certain information, products or services or for you to participate in certain activities. • From your devices: When you use our Services, we may collect information about the devices you use to access the Services, including hardware model, operating system and version, Internet Protocol (“IP”) address and other unique device identifiers, mobile network information, and information about the device’s interaction with our Services. We also collect information about how you use our Services, including your access times, browser types, and language. This type of data enables us to understand how often individuals use parts of the Services so we can analyze and improve them. To collect this information, we use cookies and web beacons, and other similar technologies. To learn more about how we automatically receive and record information when you interact with the Services, please see the section “Cookies, Tracking, & Third-Party Advertising” below. Note that this Privacy Policy covers only how we use information collected via cookies; it does not cover the use of such information by third parties. • From third parties: We may obtain information about you or your use of the Services from third parties and sources, such as our vendors, like web hosting providers, analytics providers, marketing vendors or advertisers, research partners and government entities. You may give us permission to access your information from services offered by third parties. The information we obtain from third party services depends on your account/privacy settings with those third parties and the third parties’ privacy policies, so be sure to check those policies and to adjust your settings to meet your preferences. When you access the Services through third-party platforms, you are authorizing Optinose to collect, store and use such information and content in accordance with this Privacy Policy. Please keep in mind that any information provided to us by a third party may also be subject to that third party’s privacy policy. What Personal Information We Collect About You Currently and in the preceding 12 months, Optinose has collected the following categories of personal information: Categories of Personal Information Collected Categories of Sources from which Personal Information is Collected Categories of Third Parties to Which Personal Information is Disclosed Applicable Categories of Individuals Contact Information : Name (including your written or digital signature), alias, postal address, telephone number, online identifier, device ID, internet protocol (IP) address, email address, account name, or other similar identifiers as well as demographic information such as date of birth, country of residence, National Provider Identifier (NPI), or other similar identifiers. From our interactions with individuals seeking to obtain or obtaining our products and services or otherwise interacting with or contacting us Automated collection on our websites, products, applications, databases, devices, information systems and networks, and through cookies Service providers, business partners and contacts Service providers, such as commercial partners, and cloud storage providers Third parties who deliver our communications such as the postal service and couriers Third parties including government agencies as required by law Healthcare providers and other customers Patients Website visitors Investors Clinical trial investigators, site staff and participant Authorized Representatives Protected Characteristics: Characteristics of legally protected classifications such as race, sex, gender identity or gender expression, age, marital status, military or veteran status, , medical conditions, nationality, physical or mental disability. From our interactions with individuals seeking to obtain or obtaining our products and services or otherwise interacting with or contacting us Public sources Service providers, including Clinical Research Organizations Third parties including government agencies as required by law Clinical Trial Participants Patients Purchase History and Tendencies: Information regarding products or services purchased, obtained or considered. From our interactions with individuals seeking to obtain or obtaining our products and services or otherwise interacting with or contacting us Product sponsors, service providers, business partners and contacts Service providers Healthcare providers and other customers Patients Website Visitors Authorized Representatives Biometric Information: Physiological, biological, or behavioral characteristics that can establish an individual’s identity, including DNA, face, iris or retina imagery, fingerprint, photographs, video or voice recordings and health or exercise data that contain identifying information. From our interactions with individuals seeking to obtain or obtaining our products and services or otherwise interacting with or contacting us Service providers Clinical Trial Participants Customers Network Activity: Internet or other electronic network activity information, such as browsing history, search history, and information regarding an individual’s interaction with an internet website, application, or advertisement. Includes analytics evaluation, cookies. Automated collection on our Sites, services, products, applications, databases, devices, information systems and networks, and through cookies. Product sponsors, service providers, business partners and contacts Service providers, such as cloud storage providers Third parties including government agencies as required by law Healthcare providers and other customers Clinical Trial Investigators and Site Staff Patients Website Visitors Authorized Representatives Geolocation Data: Precise geographic location information about a particular individual or device. Service providers and business partners Service providers Website Visitors Electronic and Sensory Data: Audio, electronic, visual, or similar information (e.g., a recording of a customer service call or profile photograph). From our interactions with individuals seeking to obtain or obtaining our products and services or otherwise interacting with or contacting us Product sponsors, service providers, business partners and contacts Individuals applying for positions with us or those referring them to us, such as recruiters or referral sources Service providers Healthcare providers and other customers Clinical Trial Investigators, Site Staff and Participants Patients Website Visitors Authorized Representatives Education and Professional Information: An individual’s academic information and records, licenses, professional or employment-related information and professional interactions with Optinose From our interactions with individuals seeking to obtain or obtaining our products and services or otherwise interacting with or contacting us Product sponsors, service providers, business partners and contacts Service providers, such as commercial partners Third parties including government agencies as required by law Healthcare Providers Clinical Trial Investigators and Site Staff Website Visitors Inferences: Inferences drawn from any of the information listed above to create a profile about an individual reflecting the individual’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. We may create analyses from information obtained about customers and potential customers Prospective clinical trial participants Healthcare providers and other customers Clinical Trial Investigators, Site Staff and Participants Households Optinose does not sell personal information and has not done so in the preceding 12 months. If you are a current or former job applicant, employee, owner, director, officer, or contractor, please contact us for the appropriate policy. How We Use Your Personal Information We may use personal information collected through the Services for the purposes described below, or for purposes which are reasonably like the ones described below. Relationship Management—To respond to your request, to improve the content of the Services, to customize the Services to your preferences, to analyze use of our products and the Services, to communicate information to you, as well as for any other purpose specified and communicated to you, to identify potential business partners, on-board and off-board business partners, and manage business partner relationships, to open accounts; service existing accounts; close accounts; respond to requests and concerns; offer services, events, and educational activities and materials; determine suitability of financial products and services; to support, facilitate and arrange for travel for Optinose programs; and to define and manage appropriate patient engagement activities, and patient support programs. Business Operations—For conducting routine and regular business operations such as: To provide the information, product or service requested by you or as reasonably expected given the context in which with the personal information was collected (such customer credentialing, providing customer service, personalization and preference management, providing product updates, bug fixes or recalls, and dispute resolution); For identity and credential management, including identity verification and authentication, system and technology administration; To protect the security and integrity of systems, networks, applications and data, including detecting, analyzing and resolving security threats, and collaborating with cybersecurity centers, consortia and law enforcement about imminent threats; For fraud detection and prevention; For legal and regulatory compliance, including all uses and disclosures of personal information that are required by law or for reasonably needed for compliance with company policies and procedures, for managing and investigating reports and concerns raised, including from Optinose’s business integrity ethics and compliance hotline, for conducting internal investigations as well as for compliance with civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; To exercise or defend the legal rights of Optinose and its employees, affiliates, customers, contractors, and agents; To comply with applicable tax, health and safety, anti-discrimination, immigration, labor and employment, and social welfare laws; For corporate audit, analysis and reporting; To enforce our contracts and to protect against injury, theft, legal liability, fraud or abuse, to protect people or property, including physical security programs; To de-identify the data or create aggregated datasets, such as for consolidating reporting, research or analytics; To make back-up copies for business continuity and disaster recovery purposes; and For corporate governance, including mergers, acquisitions and divestitures. Marketing—To develop, personalize and execute sales, marketing and customer relationship management including the delivery of programs and materials. Market Research—To administer and analyze surveys and other market research. Research & Development—For staffing, facilitating, conducting and managing clinical trials, including prospectively vetting potential participation by investigators and investigative sites in clinical trials and other research and development activities and facilitating the delivery of product to patients participating in clinical trials. Personnel Services—To identify you; communicate with you; help others identify and communicate with you, for instance, to offer you services (including educational opportunities, products that may be useful to you at work, etc.), including for business development and training; to market your services; maintain a company directory and offering functions, events, and education; to determine what information may be of interest to you. Personnel Administration—For determining eligibility to work, administering pay and benefits, offering accommodations for health and other conditions, managing holiday, sick leave and any other absences like family leave and sabbaticals; emergency and family points of contact and beneficiary information; managing business expenses and travel, such as a credit card account for business meals or traveler information; making decisions about your ongoing engagement with us (e.g., salary, promotions) and the terms and conditions that will apply to it; performance management and appraisal; processing for vetting and verification purposes to determine suitability for a particular role; identifying and assessing candidates for positions with us or our partners, managing recruitment, evaluating applications, and on-boarding and retention processes; authenticating and monitoring access to our buildings, systems, information, and networks (e.g., employee badges); maintaining personnel records. Lawful Bases for Processing We rely on the following lawful bases to process your personal information: Consent We may obtain your consent to process your personal information in certain circumstances, which may include when you elect to receive information from us. We may also rely upon our legitimate interest in developing our business as a basis for sending you marketing information and information about the Services. Performance of a Contract We rely on this lawful processing ground when we process your personal information to perform a contract which we have with you, or when we take steps in anticipation of entering into a contract with you, for example in connection with the provision of the Services to you and the management of our relationships with third parties. Compliance with a Legal Obligation We rely on this lawful processing ground when we process your personal information to meet legal and regulatory obligations that apply to us. Legitimate Interests We rely on this lawful processing ground when we process your personal information to provide the Services, to respond to specific requests, to manage our business operations, to manage our relationships with you and with third parties in connection with our business, and when we provide you with marketing information or other information in relation to the Services which we believe may interest you. If you wish to have more information regarding the legitimate interests we rely on, please contact us at dataprivacy@optinose.com. How We Disclose Your Personal Information The personal information you provide to us is generally used for our purposes, but we may disclose personal information you provide through these Services to other Optinose affiliates that agree to treat it in accordance with this Privacy Policy. We also may disclose personal information you provide through the Services to third parties that are not Optinose affiliates, such as: to agents, contractors and business partners we use to support our business, including our lawyers, auditors, consultants, and service providers, in which case we will seek to restrict such third parties’ use of such data to the purposes for which it has been provided, and commit them to comply with applicable data privacy standards. However, Optinose shall not be responsible for third parties’ unauthorized uses, disclosures or other violations of this Privacy Policy or any other rights of users of these Services; or to third parties who deliver our communications such as the postal service and couriers; to a purchaser or successor entity in connection with the sale, merger, assignment, or other transfer of Optinose or any of its affiliates, or line of business or product of Optinose or any of its affiliates, or sale of substantially all of the assets of Optinose or any of its affiliates; or to respond to law enforcement requests or where we determine in good faith that disclosure is required by applicable laws, court orders or government regulations; or to enforce our Terms of Use; to protect our operations; to protect the rights, privacy, safety or property of Optinose, you or others; or to permit us to pursue available remedies or limit the damages that we may sustain; or if you have consented to the disclosure. Specific Services may include additional or different provisions relating to the collection, use and disclosure of personal information. In the event of a conflict between such provisions and this Privacy Policy the terms for such specific Services shall govern. Except in limited circumstances, we are not responsible for removing personal information from the databases of third parties with whom we have already shared your personal information and shall not be responsible for any damages resulting from the loss, corruption or unauthorized acquisition or misuse of such personal information by third parties. Submissions Your feedback and comments regarding our company, products and services are valuable to us. We will be free to use, for any purpose whatsoever, any feedback, comments or other information you provide as further set forth in our Terms of Use. Personal Information Protection We take appropriate technical and organizational measures designed to prevent unauthorized intrusion to the Services and the alteration, acquisition or misuse of personal information. We also maintain physical and electronic safeguards that limit access to your personal information to our employees (and others working on our behalf under confidentiality agreements), who through the course of standard business activities, need to access your personal information. Despite our efforts to protect your personal information, there is always a risk that an unauthorized third party may circumvent such procedures or that transmissions of your information over the Internet may be intercepted. The confidentiality of any communication or material transmitted to or from us via the Services or via email cannot be and is not guaranteed. Therefore, we will not be responsible for loss, corruption or unauthorized acquisition or misuse of personal information that you provide through the Services or that is stored by us, or for any damages resulting from such loss, corruption or unauthorized acquisition or misuse. Other Websites The Services may contain links or references to other websites. Please be aware that we do not control and are not responsible for these linked websites and that this Privacy Policy does not apply to those websites. It is possible that these links may be used by third parties or others to collect personal or other information about you. We encourage you to read the privacy policy of every website you visit. About Children The Services are not intended for children under the age of 13. We do not knowingly collect personal information through the Services from visitors in this age group, and if we learn we have collected personal information from a child under 13, we will delete that information. If You are under the age of 13, please do not submit any personal information through the Services. If You have reason to believe that we may have accidentally received personal information from an individual under age 13, please contact us immediately at dataprivacy@optinose.com. All users must be at least 18 years of age in order to use the Services. Additional Information for California Residents Personal Information Under the California Consumer Privacy Act (CCPA) Optinose collects “personal information” as defined by the CCPA, which is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information does not include de-identified or aggregate information, publicly-available information that is lawfully made available from federal, state, or local government records, and information covered by certain sector-specific privacy laws, such as medical information under California’s Confidentiality of Medical Information Act and protected health information under Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Your CCPA Rights California residents have certain rights under the CCPA as further described below. The Right to Know You have the right to request any or all of the following information relating to your personal information we have collected and disclosed in the last 12 months, upon verification of your identity: The specific pieces of personal information we have collected about you; The categories of personal information we have collected about you; The categories of sources of the personal information; The categories of personal information that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed; The categories of personal information we have sold about you (if any) and the categories of third parties to whom the information was sold; and The business or commercial purposes for collecting or, if applicable, selling personal information about you. The Right to Request Deletion You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions. The Right to Opt-Out of Personal Information “Sales” You have the right to opt-out of the sale of personal information. Optinose does not sell personal information. The Right to Non-Discrimination You have the right not to receive discriminatory treatment for exercising these rights. In the past 12 months, Optinose collected the specific type and categories of personal information indicate above in “What Personal Information We Collect About You” for the purposes indicated above in “How We Use Your personal information.” The categories of third parties that we have disclosed such information to is indicated above in “How We Disclose Your Personal Information.” How to Exercise Your Rights If you wish to make a request to know or to delete your information, please click here or call us at 833-286-6450. When submitting your request, please indicate your relationship with us as well as your specific request with enough information to allow us to understand and respond appropriately. We may request additional personal information from you in order to verify your identity. We will only use personal information provided in connection with a rights request under California law to review and comply with the request. If we are unable to verify your identity, we may decline a request to exercise rights under California law. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. To make a request on your behalf, an authorized agent may contact us here and include proof of your written and signed permission to do so. Note that Optinose may also require you to verify your identity and confirm that you gave permission. Once we are able to verify your identity, we will proceed with processing your request. Please note that we may require additional information from you in order to honor your request, and there may be circumstances where we will not be able to honor your request. For example, if you request deletion, we may not be able to honor your request, for example, if we need to retain certain personal information to comply with our legal obligations or for other permitted purposes. Additional Information for Nevada Residents Although Optinose does not sell personal information, Nevada residents may have the right to opt-out of the any future sale of personal information we have collected or will collect. To make such a request, please email us at dataprivacy@optinose.com. Additional Information for EEA Residents If you live in the EEA, you may have the right to (1) request access to, rectification, or erasure of your personal information or restrict the processing of your personal information; (2) object to processing; (3) data portability (receive and transfer your personal information); (4) lodge a complaint with a supervisory authority; and, (5) where processing of your personal information is based on consent, withdraw your consent at any time without affecting the lawfulness of the processing of personal information that occurred before you withdraw consent. To make such a request, please email us at dataprivacy@optinose.com. Consent to Transfer The Services are operated in the United States and are intended for U.S. residents only. If you are located outside of the United States, please be aware that any information you provide to us will be transferred to the United States. This means that if you are accessing the Services outside of the United States, we will transfer your information outside of your jurisdiction to the United States which may not have equivalent laws and rules regarding personal information as your country of residence. By using the Services or providing us with your information you acknowledge that your personal information will be transferred across national borders, including to the United States. If you are an EU resident you should note that to govern the transfer of your personal information from the EU/EEA to recipients outside of the EU/EEA, including to the United States, we have entered into standard data protection contractual clauses which have been adopted by the European Commission. If you would like to receive such standard data protection contractual clauses please see the section “Contact Us” below to request a copy. Cookies, Tracking, & Third-Party Advertising We use cookies, tags, and beacons on our Services in order to offer you a full range of functions and to make the use of our Services more convenient for you. Cookies are small pieces of text sent by your web browser by a website you visit. A cookie file is stored in your web browser and allows the website or a third party to recognize you and make your next visit easier and the website more useful to you. Pixel tags are electronic images that may be associated with cookies. Specifically, we use Google Analytics. The Google Analytics opt-out policy is available here. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page here. If you wish to amend your cookie preferences for our website, you can do this through your browser settings or through the cookie banner settings on our site. Your browser’s ‘help’ function will tell you how to do this. You may also manually delete your cookies here. Note that blocking or disabling certain types of cookies may result in a deterioration of the website experience and the services we provide. We do not respond to web browser “do not track” signals or other mechanisms that provide a method to opt out of the collection of information across the networks of websites and online services in which we participate. If we do so in the future, we will describe how in this Privacy Policy. Visit the following website, here, for more information on this developing area. How Long We Keep Personal Information Personal Information will be saved for a period of time needed to fulfill legitimate and lawful business purposes in accordance with our record retention policies and applicable laws and regulations. When determining the appropriate retention period for personal information, we take into account various criteria, such as the amount, nature and sensitivity of the personal information, potential risk of harm from unauthorized use or disclosure, purposes for which we process your personal information, whether we can achieve those purposes through other means, and our business operations and legal requirements. Contact Us OptiNose US, Inc. is the entity responsible for the processing of your personal information. If you have any questions about this Privacy Policy or our privacy practices, please contact Optinose’s Chief Compliance Officer at: 1020 Stony Hill Road, Suite 300 Yardley, Pennsylvania 19067 Email: dataprivacy@optinose.com You may also make a complaint to your local data protection authority. Changes to This Privacy Policy Please note that Optinose reserves the right to revise this Privacy Policy at any time at our sole discretion. Any changes will be effective immediately upon posting to these Services. Therefore, you are urged to review the Privacy Policy each time you access these Services to ensure that you are familiar with the most current version. Use of the Services following such modification constitutes your agreement to the revised Privacy Policy then in effect. This Privacy Policy was last updated on December 18, 2020. Contact Us P.O. Terms & Conditions Join Our Team Privacy Policy Terms of Use Site Map ©2018 OptiNose US, Inc. OPTINOSE-17-013b 10/2017