ProSomnus Privacy Notice

INTRODUCTION

ProSomnus Sleep Technologies, Inc together with its affiliates (‘ProSomnus’, ‘we’, ‘our’, or ‘us’) is a global company and the leading non-CPAP OSA therapy® for the treatment of Obstructive Sleep Apnea, a serious medical disease affecting over 1 billion people worldwide, that is associated with comorbidities including heart failure, stroke, hypertension, morbid obesity, and type 2 diabetes. ProSomnus intraoral medical devices are engineered to precisely track the treatment plan and anatomy for each patient. Non-invasive, patient preferred and easy to use, ProSomnus devices have demonstrated excellent efficacy, safety, adherence, and overall outcomes in a growing body of clinical investigations. ProSomnus precision intraoral devices are FDA-cleared, patented, and covered by commercial medical insurance, Medicare, TRICARE and many Governments sponsored healthcare plans around the world, representing over 200 million covered lives.

ProSomnus value your privacy and are committed to protecting your Personal Data. In this Privacy Notice (‘Privacy Notice’) we describe who we are, how and for which purposes we process your Personal Data, how you can exercise your privacy rights and all other information that may be relevant to you. We did our best to provide you with all the necessary information in a clear and readable format, however, if you have any questions about our use of your Personal Data, this Privacy Notice, or any other comments, you can reach out to us via the contact details listed below.

We may also provide additional privacy notices or information to you at the time when we collect your data. For example, if you subscribe to our newsletters or want to be informed about upcoming deals and promotions. Such notices will govern how we process the information you provide at that time.

WHEN DOES THIS PRIVACY NOTICE APPLY?

This Privacy Notice applies to the Personal Data managed by ProSomnus as a Data Controller. This is Personal Data ProSomnus collect and process for our own purposes. For example, the Personal Data of prospective customers representatives, customers representatives, suppliers, business partners, and other individuals.

This Privacy Notice does not in principle apply when we process data on behalf of our customers as a Data Processor. For example, when we handle patient data to complete an order for a customer, their privacy policies will apply. If your healthcare provider uses our services, please contact them for details about how they handle your data. We are not responsible for our customers’ privacy or data security practices, which may be different from ours. The only exception is the Data Privacy Framework (‘DPF’) section which does also cover situations where we receive Personal Data in the role of a Data Processor.

The capitalized words in this Privacy Notice have the meanings ascribed to them in this Privacy Notice and the definitions provided below.

DEFINITIONS

Personal Data: Any information directly or indirectly relating to an identified or identifiable natural person, such as a name, email address, telephone number or online identifiers.

Data Controller: Natural or legal entity that determines the purpose and means for the processing of Personal Data. In the context of this Privacy Notice, this is ProSomnus Sleep Technologies Inc. and its affiliates.

Data Processor: Natural or legal entity processing Personal Data on behalf of the Data Controller. These are third party service providers or agents ProSomnus may engage to support our business purposes.

Special Categories of Personal Data: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning an individual’s sex life or sexual orientation.

Data Protection Legislation: Data Protection Legislation refers to the applicable laws that govern the protection of Personal Data and data privacy. This includes for example the legislation applicable to the processing of Personal Data in the European Economic Area (‘EEA’), United Kingdom and the United States such as the General Data Protection Regulation (‘GDPR’), the UK GDPR and the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (‘CCPA’), as well any national or state laws implemented in connection with the aforementioned legislation.

HOW CAN YOU CONTACT US?

Name: ProSomnus Sleep Technologies, Inc.
Address: 5675 Gibraltar Drive, Pleasanton, CA 94588, USA
Email: [email protected]

WHAT PERSONAL DATA DO WE COLLECT AND WHY?

What categories of Personal Data do we collect?

We limit the collection of Personal Data to what is necessary for our intended purposes and in accordance with the Data Protection Legislation. This includes the following primary categories:

Contact Information Data: When you contact us, or when you create an account with us, or place orders we process your name, delivery and/or invoice address, clinic name, telephone number(s), email address and city state (rare).
Order and Financial Data: We process your Personal Data for ordering and invoicing purposes to ensure accurate billing and maintain financial records in compliance with legal requirements. This information includes company bank account number, billing country, details relating to your order and sums due.
Technical and Behavioral Data: We may process this information when you visit our website.

How do we collect your Personal Data and why?

In most instances we collect Personal Data directly from you, for example through registering for an event, subscribing to marketing emails, using our contact form or establishing a commercial relationship. In some cases, we may collect Personal Data indirectly from publicly available sources or via referrals and recommendations.

Below are the purposes for which we process Personal Data:

Website experience and optimization: We implement strictly necessary, functional, analytics cookies to ensure the seamless operation, personalized experience, and informative content delivery across our website. You can reject cookies by following the directions provided in your Internet provider’s “help” file. If you reject cookies, you may still visit the website but may not be able to use some areas and/or functionality of the website. We do not collect directly identifiable Personal Data but if you’ve provided us with additional Personal Data, we may be able to indirectly identify a website visitor. This processing is necessary to for the website to function properly and to help ProSomnus learn and improve the service.
To send marketing communications: We use contact details for the purpose of sending marking content including newsletters to prospective customers or and customers who would like to stay up to date. This processing is necessary to help ProSomnus keep prospective customer and existing customers up to date with the latest news and promotions. You will have the opportunity to opt-out or unsubscribe of any subsequent email you receive for this purpose.
Lead generation: To identify and attract potential customers who may be interested in a ProSomnus products or services, ultimately aiming to convert them into a new customer. This processing is necessary to help ProSomnus promote the service and establish new commercial relationships.
Events: To collect and manage attendee information, ensuring smooth organization and communication for the event while also providing opportunities for marketing and engagement. This processing is necessary to help ProSomnus promote the service, share knowledge and establish new commercial relationships.
Customer contract management: When you place an order in our portal, we collect and process Personal Data. This information is necessary to fulfil your order, process payments, and arrange for the delivery of the device, and services you have purchased.
Product Service Messaging: To inform customers about important updates, changes, or information related to a product or service they are using, ensuring a seamless user experience and ongoing customer satisfaction.
To process payments: Depending on the payment method we may use your Personal Data to securely handle payments.
To send solution surveys: We may use your provided contact information to seek feedback regarding your satisfaction using our solution and/or services.
Customer Care: To provide support and assistance to customers, ensuring their needs and concerns are addressed promptly and effectively to maintain a positive customer experience. This may include sending SMS updates to resolve questions. We do not use SMS for cold calls or as a sales tool.
To share customer testimonials and reviews: We may showcase customer / end user testimonials and reviews on our website to highlight your experiences with our solutions, and/or services. These testimonials may include written content and, if willingly provided, pictures of customers or contact persons of our reseller partners.
Supplier Contract Management: To identify, evaluate, and onboard external vendors and service providers.
Compliance: We process Personal Data to ensure compliance with legal, regulatory, and corporate governance requirements. This may include monitoring, auditing, reporting, and implementing policies to adhere to applicable laws, industry standards, and internal guidelines.

ProSomnus will not use your Personal Data for purposes materially different from those that it was originally provided for. If at any point we intend to use it in a way that is materially different from the original purpose, we will notify you in advance and provide you with a clear and easy way to opt out of such use.

Special Categories of Personal Data

In our capacity as a Data Controller, we do not actively collect Special Categories of Personal Data for any of the purposes described in this Privacy Notice. If for whatever reason we need to collect such data, you will be informed at the time of collection, and it will only be done so with your explicit consent or in line with other lawful purposes under the Data Protection Legislation.

Children

Our website and service is directed at adult customers and potential customers. We do not knowingly collect Personal Data from children through the website. We encourage parents and legal guardians to monitor their children’s internet usage and instruct their children to never provide personal information through any website without their permission. If you have reason to believe that a child has provided Personal Data to us through the website, please contact us, and we will endeavor to delete that information from our databases.

LEGAL BASES FOR PROCESSING

If you are an individual in the European Economic Area (EEA), UK or Switzerland we collect and process information about you only where we have legal bases for doing so under applicable laws.

The legal bases depend on the services you use and how you use them. This means we collect and use your information only where:

We need it to provide you with the services under the performance of contract;
It satisfies a legitimate interest (which is not overridden by your data protection interests), such as for research and development, to market and promote the Services and to protect our legal rights and interests;
You give us consent to do so for a specific purpose; or
We need to process your data to comply with a legal obligation.

HOW DO WE STORE AND RETAIN YOUR PERSONAL DATA?

We retain your Personal Data securely to provide high-quality service. We keep it as long as needed for the purposes we collected, including legal, accounting, and reporting obligations.

When deciding how long to keep your data, we consider factors like its nature, amount, sensitivity, and risks of misuse or disclosure. We also think about whether we can achieve our purposes through other means.

WHO MIGHT WE SHARE YOUR DATA WITH?

We may disclose Personal Data to certain third parties in order to operate our business, deliver our services and fulfill legal obligations, including the specific purposes described above. These third parties may include the following types of recipients:

Service Providers: We engage trusted third-party vendors to perform functions on our behalf. These third-party vendors who are typically Data Processors may include services such as mailing systems, online events platforms, ordering platforms, online forms, customer care platforms and services involving processing customer payments.
Business Partners and Affiliates: We might share Personal Data with business partners, subsidiaries and affiliates in order to deliver joint services and facilitate internal business operations.
Professional Advisors and Legal Obligations: We may disclose information to legal counsel, auditors, banks, insurance companies or other professional advisors for legitimate business purposes, such as compliance, auditing, risk management, or dispute resolution. Additionally, we may share Personal Data with public authorities or government bodies in response to lawful requests or as required by applicable law.
Corporate Transactions: In the event of a merger, acquisition, or sale of all or a portion of our assets, Personal Data may be transferred as part of that transaction, under appropriate confidentiality and security terms.

Whenever we grant third parties access to your Personal Data, we make sure to put in place the necessary contractual and organizational measures. These measures ensure that your Personal Data are processed only to the extent that it is both legitimate and necessary, pursuant to the Data Protection Legislation, and only in accordance with our instructions.

We do not sell, rent, or otherwise share your Personal Data with third parties for their own purposes. If at any point we intend to disclose your Personal Data to a third party for purposes that are materially different from the original purpose, we will notify you in advance and provide you with a clear and easy way to opt out of such use or disclosure.

INTERNATIONAL TRANSFERS OF PERSONAL DATA

Where necessary for the processing purposes described above or where required by law, we may transfer your Personal Data outside of the EU/EEA/UK to countries not deemed by the European Commission (as relevant), UK Supervisory Authority or Swiss Supervisory Authority to provide an adequate level of personal information protection. In such cases any Personal Data transfer will be based on safeguards that allow us to conduct the transfer in accordance with the Data Protection Legislation, such as adequacy decisions or the specific contractual clauses approved by the European Commission the UK and Swiss Supervisory Authority as relevant to provide adequate protection of personal information.

EU-U.S. Data Privacy Framework (‘DPF’) the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF)

ProSomnus commits to comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. ProSomnus has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. ProSomnus has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF.

Our certification under the DPF applies specifically to customer data originating from the EU, UK and Switzerland that is shared with us as part of our services. This includes end-user data, such as patient information provided by healthcare service providers established in the EU, UK or Switzerland.

If there is any conflict between the terms in this Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit the Data Privacy Framework website.

Pursuant to the DPF Principles, ProSomnus commits to the following:

ProSomnus is responsible for the processing of Personal Data it receives under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF (together, the “DPFs”) and subsequently may transfer it to third parties acting as agents on its behalf. ProSomnus complies with the DPF Principles for all onward transfers of Personal Data from the EU in reliance on the EU-U.S. DPF, from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S., and from Switzerland in reliance on the Swiss-U.S. DPF. In certain situations, ProSomnus may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
ProSomnus is committed to ensuring Personal Data collected from individuals is accessible to them as part of their individual rights when ProSomnus is the controller of the Personal Data.
In compliance with the DPFs, ProSomnus commits to resolving DPF Principles-related complaints about our collection and use of your Personal Data. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the DPFs we encourage you to first contact us using the contact details listed in the contact details section above.
You may also lodge a complaint with your local data protection authority. In compliance with DPFs, ProSomnus commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the DPFs.
The services of DPAs (including the ICO, GRA and FDPIC) are provided at no cost to individuals. If any request remains unresolved, Individuals may, under certain circumstances, have a right to invoke binding arbitration under DPF; for additional information, see: https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf.
If you have any questions regarding which supervisory authority is applicable to your situation, please contact us via the contact details
The Federal Trade Commission has jurisdiction over ProSomnus’s compliance with the DPFs.

Should this adequacy decision lapse or become otherwise invalidated, ProSomnus may rely on the standard contractual clauses, including supplementary measures as necessary for transfers to the United States.

WHAT SECURITY MEASURES DO WE IMPLEMENT?

We attach great value to your privacy. To that point, we have implemented generally accepted standards of technology and operational security in order to protect your Personal Data from loss, misuse, alteration, or destruction. Only authorized ProSomnus personnel are provided with access to Personal Data and these employees are contractually or statutory obliged to ensure confidentiality of your data.

ProSomnus will implement appropriate contractual, technical, and organizational measures to ensure that the processing of your personal data is performed in accordance with the Data Protection Legislation, in particular ensuring an appropriate level of security.

To help keep your information safe please do not send confidential information such as social security or account numbers to us via an unsecured e-mail.

WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?

The rights available to you regarding your Personal Data depend on the Data Protection Legislation that apply in your location and situation. Depending on applicable local laws, you may have certain rights, such as:

Right to be informed about our collection and use of Personal Data

You have the right to be informed about the collection and use of your Personal Data. We ensure that this right is upheld through our internal data protection policies and reinforced through this and other Privacy Notices. These are subject to regular review and updates to ensure their accuracy and alignment with our data processing activities.

Right of access

You have the right to access the information we process about you.

Right to rectification

You have the right to have incorrect or outdated information about yourself corrected.

Right to be forgotten (right to erasure)

In certain exceptional cases you have the right to have information about you deleted prior to the conclusion of the designated retention period.

Right to restrict processing

In some cases, you have the right to have the processing of your Personal Data restricted. If you exercise this right, we may only process your Personal Data with your consent, or for the purpose of establishing, asserting, defending, protecting, a significant public or private interest, except when we process your data for storage.

Right to object

In certain cases, you have the right to object to our otherwise lawful processing of your Personal Data.

Right to transfer your information (data portability)

In certain cases, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and to have that Personal Data transferred to separate Data Controller without hindrance.

Right to withdraw your consent

You have the right to withdraw your consent at any time in the circumstances where you have previously granted us consent to process your Personal Data.

Rights in relation to automated processing

An automated decision is one that is made by our systems rather than a person. You have the right to express your concerns and object to a decision taken by purely automated means under some laws such as the GDPR. You also have a right to request that a person review that decision. This right is unlikely to be relevant to ProSomnus ’s use of your data, as any automated processing we may carry out is unlikely to make decisions and would include human intervention.

EXERCISING YOUR RIGHTS

You can invoke any of the above rights by reaching out to us using the contact details provided above. We will respond to your request as soon as possible, but at the latest within one month.

How to Submit a Privacy Request

When submitting a request using the contact details above, please ensure you send the request from the email address that you used when establishing a relationship with us and include the following information:

Location Information: Country and, if applicable, state/province of residence.
Nature of Your Request: The specific right you wish to exercise (e.g., access, correction, deletion, restriction, data portability, objection, withdrawal of consent). A clear description of your request, including details of the data concerned (if applicable).
Additional Information for Processing: Any supporting documentation (e.g., proof of inaccurate data for correction requests)
Authorized Representatives (if applicable): If you are making a request on behalf of someone else, we require written authorization from the individual

Verification and Security Measures

To protect your personal data from unauthorized access, we may request additional verification, such as confirming details of past interactions with us. If we are unable to verify your identity or authority, we may be unable to process your request.

QUESTIONS AND CONCERNS

If you have any questions about how we handle your personal data, feel free to reach out to our Privacy Officer using the contact details above. We’d really appreciate the chance to address any concerns or complaints you might have directly- your satisfaction truly matters to us, and we’ll do our best to help. Of course, if you’re not fully satisfied with how we handle things, you also have the right to contact your local data protection authority.

CHANGES

ProSomnus reserves the right to modify or amend this Privacy Notice at any time. The effective date will be displayed below.

Thank you for taking the time to read our Privacy Notice.

June 2025

PRO3-394-C