Pulmonx U.S. Privacy Policy

Introduction

Pulmonx Corporation and its affiliated companies (“Pulmonx” or “we”, “our”, “us”) value the privacy of our customers and users. This privacy policy (“Privacy Policy”) explains how we collect, use, and disclose the information PulmonX collects from and about you, whether online or offline, wherever this Privacy Policy appears or is referenced. This includes information we collect in connection with your use or interaction with our website(s), mobile applications, phone, chat or text message communication programs, social media pages, services, and/or products (collectively, the “Services”) and how you can exercise your applicable privacy rights. By accessing, visiting, browsing, using, submitting information through, or otherwise interacting with any of these Services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. This Privacy Policy does not apply to information we collect when we act as a service provider to health care providers.

Information We Collect About You and How We Collect It

Information you provide directly to Pulmonx. Pulmonx collects information that you enter into data fields in connection with your use of any of the Services. Pulmonx collects a variety of information that may qualify as personal information under various laws, including but not limited to the California Consumer Privacy Act (“CCPA”). We may collect the following categories of personal information from consumers through your use of the Services:

• Identifiers such as:
  • Name (first and last).
  • Zip code.
  • Internet Protocol address.
  • Date of Birth.
  • Phone Number.
  • Email address.
  • Other similar identifiers.
• Characteristics of protected classifications under state/federal law (e.g., age, race, sex, disability status, veteran status, medical condition, etc.).
• Medical information.
• Health insurance information.
• Financial Information.
• Biometric information (e.g., height, weight, BMI, medical history, or other data that contain identifying information).
• Internet or other electronic network activity information (e.g., browsing history, interaction with our website, computer and connection information such as browser type and version, operating system, and platform, the full Uniform Resource Locator (URL) clickstream to, through, and from the website, including date and time, cookie identifier and related cookie information, information you viewed or searched for, your mobile carrier and device type, etc.).
• Geolocation data.
• Audio, electronic, visual, or similar information (e.g., call recordings).
• Professional, employment-related, or other similar information.
• Information that may be considered sensitive personal information under certain state or local laws (for example, information that reveals citizenship status, race, ethnicity, religion, or trade union status, or precise geolocation information).
• Other types of personal information that may be notified to you (e.g. as set out in the terms of service, consent form or patient authorization form for the relevant Service).

Information Pulmonx Automatically Collects Certain information may be automatically collected (that is, gathered without you actively providing the information) using various technologies, such as cookies, Internet tags, web beacons, local storage objects, and navigational data collection (log files, server logs, clickstream). We may process your personal information when using these tools for purposes such as to ensure our network and IT security, accelerate loading times and improve operational efficiency. Our purposes for collecting your personal information are set out under the “How We Use Your Information” section below. More information about our use of cookies can be found under the “Cookies” section below. We will retain each category of personal information specified above as described in the “Information Retention” section below.

Categories of Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from individuals’ interactions with us, including with the website, desktop and mobile applications, online chat service, by email and phone, and through our patient call center. When you engage with our patient call center, we may record the call, and such conversation and your contact information may be stored by us.
• Web browsers.
• Advertising, marketing, and analytic service providers.
• Mailing list providers.
• Technology service providers.
• Publicly available sources.
• Insurance providers.
• Organizations with whom we partner to provide services to consumers.
• Human resources service providers.

To protect your privacy, you should not provide Pulmonx with any information that is not specifically requested.

How We Use Your Information

We use the personal information we collect for our operational purposes and for one or more of the following business purposes:

• To develop, provide and improve the Services and our other products and services.
• To respond to consumer requests.
• To provide customer service.
• To connect you with medical providers when you request this.
• To contact individuals through phone calls, emails, SMS (Short Message Service), or messaging apps, with information that might be of interest to them, including information about Pulmonx’s products and services.
• For advertising and marketing.
• For analytical purposes and to research, develop, and improve programs, products, services and content.
• For activities described to consumers when collecting their personal information or as otherwise permitted under applicable law.
• To ensure the website and other Services function as intended, including debugging and repairing, and to conduct audits and perform troubleshooting activities of our websites, products, and services.
• To detect and protect against security incidents and deceptive, malicious, fraudulent, criminal or other unlawful activity.
• For verifying customer information.
• For human resources purposes, employment application and hiring, and employee-related activities. When you submit an inquiry about a job through a Pulmonx website, we may use the information you provide to match your experience and preferences with the job openings we have, and someone from Pulmonx may contact you about a possible employment opportunity. Please note that by submitting your information regarding employment opportunities with Pulmonx, you authorize us to transmit and store your information in our recruitment database.
• For training purposes.
• To comply with a law or regulation, court order or other legal process or to protect our rights or property, including without limitation to enforce this privacy policy and other terms and conditions regarding your use of the Services.
• If you are enrolled in a clinical study, as described in the clinical study informed consent.

Disclosure of Your Information

We may disclose information that does not identify you or any other individual (e.g., aggregated or deidentified information) without restriction, including for purposes described above. Personal information that identifies you, or could reasonably be used to identify you, may only be disclosed as described below and is subject to applicable restrictions:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support the Services. These may include marketing and advertising service providers, technology service providers, security service providers, analytics service providers, mailing and shipping providers, and employee-related service providers. These parties cannot use such data for their own purposes, only to provide the relevant services.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Pulmonx’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Pulmonx is among the assets which may be transferred.
• To comply with any court order, law, legal process, or regulatory requirement, including to respond to any government or regulatory request and to comply with FDA regulations.
• To enforce or apply our Terms and Conditions and any other agreements with you.
• To conduct our business, including managing our contractual relationships, monitoring access to our websites, and managing safety and security risks.
• With health care providers to assist or aid in your treatment in accordance with applicable law.
• For other reasons we may describe to you or as permitted or required by law.

Information Retention

We will retain each category of personal information specified above for as long as reasonably necessary to carry out the business and commercial purposes described in this Privacy Policy or any other notice provided at the time of data collection, as necessary to provide our services, and as necessary to comply with our legal obligations, resolve disputes, protect and defend our legal rights, and enforce our agreements.

Categories of Information We Sell or Share for Advertising Purposes

We do not sell personal information, as that concept is traditionally understood; however, some of our disclosures of personal information may be considered “selling” or “sharing” for cross-context behavioral advertising, or processing for targeted advertising, under certain state laws. For purposes of this section, “sell” means the sale, rental, release, disclosure, dissemination, availability, transfer, or other oral, written, or electronic communication of your personal information to an outside party for monetary or other valuable consideration, subject to certain exceptions in applicable law. For purposes of this Section, “share” means transferring, making available or otherwise disclosing your personal information to another party for purposes of sending advertising to you based on your personal information obtained from your activities across distinctly-branded sites. We may “sell” or “share” (as described above) the following categories of personal information: identifiers and contact information; personal characteristics or traits; commercial information; internet and other electronic network usage information; and inferences. We may “sell” or “share” these categories of personal information to or with the categories of third parties described in the “Disclosure of Information” section above. We do so for the commercial or business purposes described in the “How We Use Your Information” section above. You can request that we not sell or share your personal information to a third party by following the instructions in the “Exercising Your Rights” section below.

Cookies

Like many websites, we may use cookie technology to collect additional website usage data and to improve our Services. When we use cookies on our website, we will ask you for your consent when you first visit the website via a pop-up banner. By continuing to use our website, you are consenting to the use of cookies technology on such website in accordance with your selection and your Internet browser settings. We use the following cookies on our website:

• Essential cookies: Essential cookies are required to enable basic website functionality. Without these cookies, we would not be able to offer you a reliable and secure experience and some functions of our website would be significantly limited.
• Analytics cookies: Analytics cookies allow us to understand how our website performs, how you interact with our website, and determine whether there may be any technical issues. These cookies usually do not collect personally identifiable information.
• Performance cookies: Performance cookies allow the website to remember the choices you make / information you provide (such as your username, language and the region you are in, information you have entered into our webforms) in order to personalize and enhance your experience on the website.
• Marketing / Targeting cookies: Marketing cookies are used to deliver advertising which is more relevant to you and your interests. They may also be used to limit the number of times you see a particular advertisement, as well as used to measure the effectiveness of advertising campaigns.

Children

Protecting the privacy of children is very important to us. For that reason, our website(s) and the Services do not solicit, collect, or maintain personal information from users we actually know are under age 18. If you are a parent or guardian, please contact us if you believe information regarding a child has been collected by us through the Services.

For CALIFORNIA Residents

If you are a California resident, you can make the following requests with respect to your personal information subject to limitations and exceptions set forth in applicable law:

• Access: You can request that we disclose to you the categories and/or the specific pieces of personal information that we collect about you, the categories of sources from which we collected the personal information, the categories of personal information we sold or disclosed, our business or commercial purpose for collecting, selling or sharing the personal information, and the categories of third parties to whom we disclosed the personal information.
• Deletion: You can request that we delete the personal information that we collected from you, subject to certain exceptions.
• Correction: You can request that we correct inaccurate personal information that we maintain about you, subject to certain exceptions.
• Do Not Sell or Share My Personal Information: You can request that we not sell or share your personal information to a third party. We do not knowingly sell or share the personal information of minors under 16 years of age.

We will not discriminate against you because you exercised any of these rights. A California resident can exercise the rights described above by following the instructions in the “Exercising Your Rights” section below. In addition to the above, if you reside in California, you also have the right to ask us one time each year if we have disclosed personal information to third parties for their direct marketing purposes. To make a request, please send us an email, or write to us at the address listed below. Indicate in your letter that you are a California resident making a “Shine the Light” inquiry.

For Residents of Other States

Depending on the state in which you reside, you may have the right to make some or all of the following requests with respect to your personal information in accordance with applicable law and subject to exceptions set forth in such applicable laws:

• Access: You may have the right to request to confirm whether we process your personal information. Subject to certain exceptions, you may also have the right to request a copy of your personal information, or to request that we provide a list of third parties to which we disclosed personal information as set forth under applicable law.
• Deletion: You may have the right to request that we delete personal information we have from or about you, subject to certain exceptions.
• Correction: You may have the right to request that we correct inaccurate personal information we maintain about you, subject to certain exceptions.
• Opt-Out of Sale: We may “sell” personal information as the term is defined under applicable state laws. You may have the right to request to opt out of the sale of your personal information to a third party.
• Opt-Out of Targeted Advertising: We may use personal information obtained (or in some instances inferred) from your activities across unaffiliated sites to send more relevant advertising to you. You may have the right to request that we stop using your personal information for such targeted advertising.

You can request to exercise these rights by following the instructions in the “Exercising Your Rights” section below. Note that for purposes of these rights under this Section, personal information does not include information about job applicants, employees and other of our personnel or information about employees and other representatives of third-party entities we may interact with.

Exercising Your Rights

Submit a Request. To submit a request to know the personal information we have about you, to correct your personal information, or to delete your personal information, please email [email protected]. When you submit a request to know, correct, or delete, you must provide your first name, last name, and email address. Authorized Agent. You may in some instances have the right to designate an authorized agent to make a request on your behalf. To be able to act, authorized agents must submit proof that they are authorized to act on your behalf. We may deny requests from claimed authorized agents who do not submit adequate proof that they are authorized to act on your behalf. Verifying Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before complying with your requests. For example, for requests to know, correct, or delete, we will attempt to match your identity to the information stored in our files. If we cannot, we will ask you to provide additional identifying information. We will use information you provide in your request for the purpose of verifying your identity or authority to make the request. Opt-Out of Selling and Sharing. You may opt-out of selling and sharing, or processing of your information for targeted advertising, by clicking “Do Not Sell or Share My Personal Information”. Note that if you would like to opt out of sales or our targeted advertising through certain cookie-based tracking for advertising purposes, you will need to separately set your cookie preferences as described above or broadcast an opt-out preference signal recognized by Pulmonx, such as a Global Privacy Control signal, on browsers or browser extensions that support such a signal. Please keep in mind that your settings are specific to the Site you were on when you set your preferences. You can also visit www.aboutads.info/choices and https://optout.privacyrights.info to opt out of certain uses of cookies for advertising purposes. Your cookie-related selections are specific to the device, website, and browser you are using. Your selections are deleted whenever you clear your cookies or browser’s cache. Denials. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate customer requests. If we deny your request, we will explain why your request was denied and how to appeal our decision, as required by applicable law. After receiving our explanation, if you would like to appeal our decision, you may do so as further detailed in our communication back to you. For questions, you may also contact us using the information below.

Contact for Pulmonx

If you have questions about our use of personal information, please contact us by any of the following: Emailing us at [email protected].

Privacy Policy Changes

Pulmonx reserves the right to amend this privacy policy without prior notice for any reason including without limitation to reflect technological advancements, legal and regulatory changes, and good business practices. Please check back periodically, and especially before you provide any personal information.