This CooperSurgical Single Sign-On Portal (“Portal”) Privacy Policy outlines when, why and how we collect, use and otherwise handle (collectively “process“) personal data about users of our Portal (“you”). We provide the Portal to clinics and hospitals (Customers) (including for use by their employees / personnel).

In this Privacy Policy, references to “we”, “us” or “our” means CooperSurgical, Inc., and may also include our affiliates.

Personal Data or Personal Information means any information relating to an identified or identifiable natural person as defined under the applicable privacy and data protection laws of your jurisdiction.

We offer a range of services, including those related to, but not limited to, providing a wide range of medical solutions, billing services, pre-implementation genetic services and testing. We refer to all these services collectively, together with any other CooperSurgical products, as “Services” in this Privacy Policy.

We may process your Personal Data, as described in this Privacy Policy and as described when we collect data from you. Our Privacy Policy must be read together with any other legal notices or terms and conditions provided to you when we collect data from you (or at a later stage) or that are available on other pages of our website.

We take your privacy very seriously and ask that you read this Privacy Policy carefully, as it contains important information about our processing of your Personal Data and your rights.

We may change this Privacy Policy from time to time. A current version is available on the Portal. Please visit the Portal regularly and inform yourself about the applicable data protection provisions.

B. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

We, CooperSurgical, are the data controller of your Personal Data. We can be contacted at [email protected]. Where CooperSurgical shares personal data with CooperSurgical affiliates, the affiliates are also data controllers as explained in this Privacy Policy.

C. WHAT pERSONAL DATA DO WE PROCESS AND WHY?

The types of information that we may process about you, and the purposes of processing, include:

Type of information	Purposes of processing	Legal basis of processing
Your name Your (business) email address Your organization details Unique user ID Your service region MFA tokens User terms and conditions acknowledgement log Your username or login name Your password Your device’s IP address Information about the operating system or app you are using Your unique device identifiers Your online identifiers Website visit information Your preferences and settings Your location information collected by a browser or inferred by IP addresses, mobile device signals Your Internet Service Provider and top-level domain name	To provide, operate and secure the Platform Authenticate users and enable secure access to connected applications Enforce multi factor authentication for enhanced security Maintain audit logs for compliance and security monitoring To perform our obligations under our agreements with our Customers To administer our systems To communicate with you, send you non-marketing materials To conduct marketing activities To contact you about our Company, Services or other news Review, develop and improve the Platform To personalize your experience with us To enable your use of our Services To identify where you are contacting us from To measure certain traffic patterns on our website, such as the number of visits, average time spent on the website, pages viewed, etc. To conduct aggregated statistical analyses To link your profile on a third-party site or platform with any account(s) with us Other business purposes (see below this table for further information)	Where we need to comply with a legal or regulatory obligation under and in accordance with any applicable law Where it is necessary for our pursuit of legitimate interests Your consent

Our business purposes – we may also use your Personal Data for our internal business purposes such as:

complying with applicable laws, lawful requests, and legal process;
record keeping, statistical analysis, internal reporting;
to host, maintain and otherwise support the operation of our websites, applications and other communication platforms, including to customize various aspects of our websites, applications and other platforms to improve your experience;
to perform marketing analytics and business improvement;
detecting, preventing and addressing technical issues;
to investigate, resolve or otherwise address any complaints you make;
to provide evidence in any disputes or anticipated disputes between you, your patients and us;
for the detection and prevention of fraud, other criminal offences and for risk management purposes;
for business and disaster recovery (e.g., to create back-ups);
to ensure network and information security;
for data retention/storage;
to protect the rights, property, and/or safety of CooperSurgical, Inc., any of its affiliates, its personnel and others.

Provision of Personal Data. In certain circumstances, the provision of Personal Data is a statutory requirement, a contractual requirement, or a requirement necessary to enter into a contract with us. If you do not provide the Personal Data required in those circumstances, we may be unable to enter into or perform a contract with you, provide requested products or services, or comply with our legal obligations.

D. HOW AND WHEN DO WE SHARE pERSONAL DATA WITH THIRD PARTIES?

a) Data sharing with other CooperSurgical Affiliates

We may share your Personal Data with our affiliates where necessary for business operations, including but not limited to provide and improve our Services, to support marketing operations and to conduct marketing activities, to manage our relationship with you, for administrative and operational purposes, to comply with legal and regulatory requirements, or otherwise as permitted by applicable law.

b) Data sharing with service providers

We also share your Personal Data with our third-party service providers, whom we engage to provide various services, which include but are not limited to:

Website services (e.g., hosting and maintaining our websites); and
IT services and solutions (e.g., providing data storage, assisting us with database management).

c) Data sharing with other recipients

We may also share your Personal Data with:

your organization for legitimate business purposes (e.g., provision of services);
our accountants, auditors, lawyers or similar advisers when we ask them to provide us with professional advice;
any other third party if we are under a duty to disclose or share your Personal Data in order to comply with any legal obligation, or to protect the rights, property and/or safety of CooperSurgical, any of the affiliates, its personnel and others;
any other third party for the purposes of acting in accordance with the requirements of a court, regulator or government agency, for example, complying with a court order or acting in accordance with an applicable law or regulation; or
Law enforcement agencies in connection with the prevention and detection of crime.

E. INTERNATIONAL TRANSFERS OF PERSONAL DATA

We and our affiliates are located in various countries worldwide. We may also use third party suppliers and / or service providers located in different jurisdictions. As a result, your Personal Data may be transferred to countries other than the country in which it was originally collected where it will be stored and processed for the purposes set out in this Privacy Policy. Where we transfer personal data across borders, we will seek to implement appropriate and suitable safeguards to ensure that such Personal Data will be protected as required by applicable data protection law. Such safeguards may include, where appropriate, standard contractual clauses, inter-company agreements or similar approved transfer mechanisms or other legally recognized measures intended to provide an adequate level of protection for Personal Data.

F. HOW LONG DO WE STORE PERSONAL DATA?

It is our policy to retain your Personal Data for the length of time required for the specific purpose or purposes for which it was collected. However, we may be obliged to store some Personal Data for a longer time, taking into account factors including:

legal obligation(s) under applicable law to retain data for a certain period of time (e.g., compliance with regulatory requirements);
the establishment, exercise or defence of legal claims (e.g., for the purposes of a potential dispute).

G. HOW DO WE PROTECT YOUR PERSONAL DATA?

We have implemented technological and operational measures in order to protect your Personal Data from loss, misuse, or unauthorized alteration or destruction. Such measures include the use of firewalls, encryption (where appropriate), proper access rights management processes, careful selection of processors and other technically and commercially reasonable measures to provide appropriate protection for your Personal Data. Where appropriate, we may also make backup copies and use other such means to prevent accidental damage to or destruction of your Personal Data.

While we take reasonable measures to protect your Personal Data, no method of transmission over the internet is completely secure. Therefore, although we strive to safeguard your Personal Data, we cannot guarantee its absolute security.

H. YOUR RIGHTS

Your privacy and data protection rights may vary depending on your country, state, or jurisdiction. While this Privacy Policy describes our global approach to handling Personal Data, the availability, scope, and exercise of specific rights—such as access, correction, deletion, restriction, portability, objection —are determined by applicable local laws.

For the avoidance of doubt, we are required to fulfill and will honor only those rights that are granted to you under the laws of the relevant jurisdiction, and we are not obliged to, nor will we, provide or apply rights where they are not recognized or required by applicable law. Where local data protection and privacy laws provide additional rights or impose stricter requirements, those local laws will apply and may override or supplement this Privacy Policy.

The right to be informed – you may have the right to be provided with clear and easily understandable information about how we use your Personal Data. This is why we are providing you with the information in this Privacy Policy.
The right of access – You may have the right to receive a copy of your Personal Data that we hold about you, subject to certain exemptions. Any access request is generally free of charge. However, where permitted by applicable law, we may charge a reasonable fee. We may require further information in order to respond to your request (for instance, evidence of your identity or information to enable us to locate the specific Personal Data you require).
The right to rectification – You may have the right to ask us to correct your Personal Data that we hold where it is incorrect or incomplete.
The right to erasure erasure (“Right to be forgotten”) – You may have the right to ask that your Personal Data be deleted in certain circumstances
The right to restrict processing – You may have the right to suspend our use of your Personal Data in certain circumstances.
The right to data portability – You may have the right in certain circumstances to obtain your Personal Data in a structured, commonly used and machine-readable format and for it to be transferred to another organization, where it is technically feasible.
The right to object – You may have the right to object to the use of your Personal Data in certain circumstances.
The right to withdraw consent – You may have the right to withdraw your consent at any time where we rely on consent to use your Personal Data.
The right not to be subject to decisions based on automated processing – You may have the right in certain circumstances not to be subject to a decision which is based solely on automated processing without human intervention.
The right to lodge a complaint with the supervisory authority – You may have the right to complain to the relevant data protection authority, where you think we have not used your Personal Data in accordance with data applicable protection law.

I. STATE PRIVACY RIGHTS

This section provides additional information to residents of particular states pursuant to applicable state privacy laws (collectively the “State Privacy Laws”). The State Privacy Laws may provide residents with some or all of the rights listed below. Please note that not all rights listed below may be afforded to all data subjects and that if you are not a resident of one of the states that provides for such rights, you may not be able to exercise these rights. In addition, we may not be able to process your request if you do not provide us with sufficient detail to allow us to confirm your identity or understand and respond to it. We may decline your request in certain cases as permitted by law. The below may be dependant upon whether your state of residency requires us to do the following:

Information. You may request the following information about how we have collected and used your Personal Information:
- The categories of Personal Information that we have collected.
- The categories of sources from which we collected Personal Information.
- The business or commercial purpose for collecting and/or selling Personal Information.
- The categories of third parties with which we share Personal Information.
- The categories of Personal Information that we sold or disclosed for a business purpose.
Access. You may request a copy of the Personal Information that we have collected about you.
Appeal. You may appeal our denial of any request validly submitted.
Correction. You may ask us to correct inaccurate Personal Information that we have collected about you.
Deletion. You may ask us, subject to certain exceptions, to delete the Personal Information that we have collected from you.
Non-discrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the State Privacy Laws.

Exercising your right to information/know, access, appeal, correction, deletion and limit processing of sensitive Personal Information. You may submit requests to exercise your right to information/know, access, appeal, correction, deletion or limit processing by contacting us at: [email protected].

Exercising your right to information/know, access, appeal, correction and deletion. You may submit requests to exercise your rights through our Privacy Portal.

Verification of Identity, Authorized agents. We may need to verify your identity in order to process your information/know, access, appeal, correction, or deletion requests and reserve the right to confirm your residency. To verify your identity, we may require government identification, a declaration under penalty of perjury, or other information, where permitted by law.

Under the State Privacy Laws, you may be permitted to authorize an authorized agent to make a request on your behalf. However, we may need to verify your authorized agent’s identity and authority to act on your behalf. We may require a copy of a valid power of attorney given to your authorized agent pursuant to applicable law. If you have not provided your agent with such a power of attorney, we may ask you to take additional steps permitted by law to verify that your request is authorized, such as by providing your agent with written and signed permission to exercise your rights on your behalf, the information we request to verify your identity, and confirmation that you have given the authorized agent permission to submit the request.

J. COOKIES

We use only strictly necessary cookies that are required for the secure operation of the Portal and related services. These cookies are primarily provided through our authentication system, and are used to maintain user sessions, support login and authentication processes, enable multi-factor authentication (MFA), and ensure secure access to user accounts and Portal functionality.

These cookies are essential for the website to function properly and cannot be switched off through our systems. We do not use cookies or similar technologies for advertising, marketing, profiling, or user tracking purposes. No information collected through these necessary cookies is used to monitor your browsing activities outside the Website or to build user profiles.

K. USE OF ELECTRONIC COMMUNICATIONS AND RIGHT TO OPT OUT

We may occasionally send you email or contact you by phone about Services that we feel may be of interest to you, or that you have requested. We offer recipients the opportunity to opt out of future marketing communications via our marketing emails or via direct requests. You have the right to opt out of these marketing emails by selecting the “unsubscribe from all future emails” link in the marketing emails we send you or by directly requesting from us at [email protected].

Please note that we may not allow an opt-out option for non-marketing Service emails (for example, emails concerning your privacy policy updates or Service/platform use etc.).

L. THIRD PARTY LINKS

Our websites, Privacy Policy, and/or website terms and conditions may contain links to websites that are not operated by CooperSurgical. Please be aware that we are not responsible for the privacy practices of these sites nor for any adverse consequences that may result from your interaction with such third-party websites. Just because we link to, receive data from, or partner with a particular site or app does not mean that we endorse it or its privacy practices. These other websites and apps have their own terms of use and privacy policies; we encourage you to read those terms and policies when you visit those websites and use those apps.

M. HOW TO CONTACT US

If you wish to exercise any of the above rights, please contact us through our Privacy Portal.

If you wish to request further information or if you have concerns regarding how we have handled your Personal Data, contact our Data Protection Officer at: [email protected]

EFFECTIVE DATE: October 2026