Privacy Policy PARI Study Connect App
December 2024

PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING THE APP.

With the following information, we would like to inform you about data processing in connection
with the use of the PARI Study Connect App.

PARI Pharma GmbH is based in the EU and therefore the data transfer is covered by the
European regulations on data privacy. Depending on the country you are located, the legal
basis for the processing is either your consent or scientific research in public interest, as set
forth in the participation documents you signed to participate in the clinical study.

For users in UK: The legal basis of the processing is scientific research in public interest.

We have, among others, adopted the Australian Privacy Principles (APPs) contained in the
Privacy Act 1988 (Cth) (the Privacy Act). The APPs govern the way in which we collect, use,
disclose, store, secure and dispose of your Personal Information.
A copy of the Australian Privacy Principles may be obtained from the website of The Office of
the Australian Information Commissioner at https://www.oaic.gov.au/.

If you have any queries or complaints about our Privacy Policy please contact your study center
with any questions or concerns you may have.

1 Controller

The study sponsor who is organizing the study you are participating acts as the data controller.
PARI acts as commissioned data processor. Please contact your study center with any
questions or concerns you may have.

2 Data Protection Officer

You will usually find the contact details of the data protection officer/s responsible for the study
in the study participation documents or you will receive them from your study center.

3 The Type of Personal Information we Collect and Purpose

The purpose of the processing is to document and transfer data on inhalations using the eTrack
Controller during the course of the clinical study. The purpose of the clinical study is explained
in the study participation documents you signed.

Via the app we currently collect and process the following information:

− the serial number of the inhalation device (eTrack Controller);
− the date and time of the start of nebulization and the duration of nebulization;
− the number and total duration of pauses;
− additional technical data of your inhalation device (e.g. shut-off criteria, ID for counting

nebulizations, error codes).

This personal information is transferred to the PARI cloud and is available to the study

personnel via a web portal.

The pseudonymous data collected during the use of the PARI Study Connect App is used for
the purposes of the clinical study and may be used for the purpose of monitoring and analyzing
the technical performance of the nebulizer system as well as for aggregated statistical
presentation on the efficacy and usefulness of the PARI Study Connect App.

If you have given your consent within the scope of the participation documents in the study to
process your personal data, processing will only take place in accordance with the purposes
and to the extent agreed in the declaration of consent.

4 Legal Basis of the Processing

PARI Pharma GmbH is based in the EU and therefore the data transfer is covered by the
European regulations on data privacy. Depending on the country you are located, the legal
basis for the processing is either your consent or scientific research in public interest, as set
forth in the participation documents you signed to participate in the clinical study.

For users in UK: The legal basis of the processing is scientific research in public interest.

5 Recipients of the Data

Within the study, access to your study data is granted to those persons that need it to fulfill their
study-related tasks and are authorized to process this data.

Your personal data is processed in IT systems. Suitable technical and organizational measures
protect the data against unauthorized access and data loss. Furthermore, a technical transfer
of data to processors may be possible in individual cases on the basis of contractual
agreements.

For the technical implementation and management of the PARI Study Connect App and access
to the PARItrack Dashboard as well as for support, the data processor is PARI Pharma GmbH,
Moosstraße 3,82319 Starnberg, Germany, who processes the data within the EEA.

The study sponsor and PARI Pharma GmbH have concluded a Data Processing Agreement in
accordance with Art. 28 (UK-)GDPR.

6 Transfer to Third-Countries or international organization

In the course of our relationship, your personal data may be transferred or disclosed to third
party companies. These may also be located outside the European Economic Area (EEA) or
the UK, i.e. in third countries. Such processing takes place exclusively for the fulfillment of
contractual and business obligations and to maintain your relationship with us.

Some third countries are certified by the European Commission and UK as having a level of
data protection comparable to the EEA and UK standard through so-called adequacy
decisions. However, in other third countries to which personal data may be transferred, there
may not be a consistently high level of data protection due to a lack of legal provisions. If this
is the case, we ensure that data protection is adequately guaranteed. This is possible via
binding company regulations, standard contractual clauses of the European Commission for
the protection of personal data pursuant to Art. 46 (1), (2) lit. c GDPR as well as the ICO,
certificates or recognized codes of conduct.

PARI Pharma GmbH uses additional sub-processors for the provision of the app services.
These are:

− Affiliated companies of the PARI group of companies (PARI GmbH, PARI Medical
Holding GmbH);

− Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855
Luxembourg ("AWS") and

− only for the Android version of the app: Google Ireland Limited ("Google"), Gordon
House, Barrow Street, Dublin 4, Ireland - "Google Analytics Firebase" for app crash
reports.

If you have activated the sharing of iPhone analysis data with Apple Inc. and its subsidiaries in
your iPhone settings, we may also be given the opportunity to access anonymized crash reports
from Apple Inc., but no personal data.

7 Duration of Storage

In case you are located in a country where the legal basis for the processing is scientific
research in public interest (as particularly for users in the UK), we process and store your
personal data until it is no longer necessary for the fulfillment of the purposes mentioned in
Section 3.
In case you are located in a country where the legal basis for the processing is your consent,
we process and store your personal data until you have withdrawn your consent to the
processing or until it is no longer necessary for the fulfillment of the purposes mentioned in
Section 3, depending on what occurs first.
You may withdraw your consent to participate in the clinical study at any time, and no new
personal data about you will be collected.
In each of these cases, PARI will continue to process your personal data collected up to the
date of your withdrawal, in accordance with your study participation documents.

8 Your Rights

You have the following rights as a "data subject" whose data we process:

− Right of access;
− Right to rectification;
− Right to erasure ("right to be forgotten");
− Right to restriction of processing;
− Right to data portability;
− Right to object in special cases.

These rights may be limited because the processing of your data is done in the framework of
a clinical study, as further explained in the study participation documents.

Insofar as processing is carried out on the basis of your consent, you have the right to
withdraw your consent at any time. Upon receipt of your withdrawal, we will not process
any new data about you but may require continued processing of the data already
collected for the purposes for which you gave your consent, and in accordance with the
study participation documents. The lawfulness of the processing prior to receipt of your
withdrawal remains unaffected. You can inform your study doctor/study center of the
revocation in text form. Please note that the withdrawal may lead to the fact that study
participation is no longer possible.

In case of scientific research in public interest (as particularly for users in the UK), your rights
as a data subject may be limited if these are likely to render impossible or seriously impair the
realization of the research and the restriction is necessary for the fulfilment of the research.
This applies to your right to information, your right to rectification, your right to restriction of
processing and your right to object.

If you believe that the processing violates data protection rules, you also have the right to
complain to a data protection supervisory authority. If you have any queries or complaints about
our Privacy Policy please contact your study center with any questions or concerns you may
have.