Effective: April 2024

Introduction

This Applicant, Contract Worker & Former Employee Privacy Policy (“Policy”) describes the practices of Recor Medical Inc. (“Recor,” the “Company,” “us,” “we,” or “our”) concerning Personal Information (as defined below) of all current and former applicants (“Applicants”) as well as contract workers who work or worked at the company’s facilities (“Contract Workers”), and former employees of the company (“Former Employees”). Applicants, Contract Workers, and Former Employees are also referred to in this Policy as “you” or “your”. Respecting your privacy is an essential part of the Company’s privacy program and we are committed to the proper handling of Personal Information collected or processed in connection with an Applicant’s application for employment, a Contract Worker’s work or a Former Employee’s employment at Recor.

This Policy describes what Personal Information of Applicants, Contract Workers and Former Employees the Company Collects (or has Collected), how the Company uses, discloses, Sells and Shares the Personal Information it Collects in connection with such relationships, the purposes for which your Personal Information is used, how long your Personal Information will be stored, and your rights in relation to your Personal Information, including how you can access, correct, limit the use, and if needed request deletion of your Personal Information. This Policy also provides other disclosures required by California law.

If you are from outside the United States, please note that the United States has data protection laws that may not be consistent with those of your country and other countries and that information collected about you will be processed in accordance with United States law.

As used in this Policy, initial capped terms have the meaning given to them in this Policy, including those found in the Definitions section at the end of this Policy.

Changes to This Policy

This Policy is found on the Company’s website www.recormedical.com. When we make material changes to this Policy, we will notify you by posting an updated Policy on www.recormedical.com and listing the effective date of such updates. This Policy creates no additional privacy rights or expectation of privacy except for those provided by law. Data privacy, monitoring, and processing requirements may vary from jurisdiction to jurisdiction in the United States.

Collection & Processing of Personal Information

1. Applicants

We, and our Service Providers, may have Collected and Processed the following categories of your Personal Information in the past 12 months for the business purposes described in this Policy. 

Additionally, we may have disclosed to our Service Providers and Third Parties the following categories of your Personal Information in the past 12 months for the business purposes described under “Purposes of Collecting, Processing and Disclosing Personal Information.”

We expect to Collect and Process and may disclose the following categories of your Personal Information to Service Providers in the future for the business purposes described under “Purposes of Collecting, Processing and Disclosing of Personal Information.” 

1 The California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (collectively, the “CCPA”), gives California residents (including employees) certain rights and requires businesses to make certain disclosures regarding their Collection, use, and disclosure of Personal Information.

2. Contract Workers

We, and our Service Providers, may have Collected and Processed the following categories of your Personal Information in the past 12 months for the business purposes described in this Policy. 

Additionally, we may have disclosed to our Service Providers and Third Parties the following categories of your Personal Information in the past 12 months for the business purposes described under “Purposes of Collecting, Processing and Disclosing Personal Information.”

We expect to Collect and Process and may disclose the following categories of your Personal Information to Service Providers and Third Parties in the future for the business purposes described under “Purposes of Collecting, Processing and Disclosing Personal Information.”

3. Former Employees

We, and our Service Providers, may have Collected and Processed the following categories of your Personal Information in the past 12 months for the business purposes described under “Purposes of Collecting, Processing and Disclosing Personal Information.”

Additionally, we may have disclosed to our Service Providers the following categories of your Personal Information for the business purposes described under “Purposes of Collecting, Processing and Disclosing Personal Information.” 

We retain each of the categories of Personal Information set forth in this Policy until you request that we delete your Personal Information, or for the duration of your relationship with us, as applicable, and longer as may be required by applicable laws or necessary for our legitimate business purposes. 

Sale of Personal Information

We do not sell or share the Personal Information of Applicants or Contract Workers and have not done so in the past 12 months. We do not Sell or Share Personal Information of California individuals under 16 years of age and have not done so in the past 12 months.

We do not Share the Personal Information of Former Employees. However, in the past 12 months, if you were an employee of Recor, we may have provided benchmarking companies with your salary and benefit information tied to title and location (but not any other Personal Information) for purposes of benchmarking the compensation and benefits afforded to Employees.  Such benchmarking agencies may combine that data with other identifiable information in their possession for purposes of providing their benchmarking services to others; therefore, the provision of such data for benchmarking purposes may be considered to have been a sale.

Right to Opt-out of Sales And Sharing

You have the right to direct us to not sell or share your Personal Information. To exercise the right to opt-out, you (or your authorized representative) may submit a request to us through this webform.

Purposes of Collecting, Processing and Disclosing of Personal Information

We and our Service Providers Collected, Processed, and disclosed (and may Process and disclose) the Personal Information of our Employees for the following business purposes:

Applicants:

• To evaluate your application, including your potential as an employee of Recor. 
• To maintain and further a diverse and equitable workplace.
• To communicate with you, including to contact and communicate with you regarding your potential employment, interview sessions, or in the event of a natural disaster or other emergency.
• For legal and safety purposes, including to provide reasonable accommodations when required by applicable law; to comply with applicable laws and regulations, including: to monitor, investigate, and enforce compliance with and potential breaches of Company policies and procedures and legal and regulatory requirements; to comply with and respond to civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and to exercise or defend the legal rights of Company and its employees, affiliates, customers, contractors, and agents; to protect the Company’s rights and property or the rights, property, and safety of others; to comply with legal obligations; to maintain the security of our customers, employees, and property; and to pursue remedies available to us and limit our damages.

Contract Workers:

• To manage your contract worker relationship with us, including for personnel planning, productivity monitoring, and evaluation purposes; contract worker education, training, and certification purposes; assessing your working capacity or the diagnosis, treatment or care of a condition impacting your fitness for work, and other preventative or occupational medicine purposes (including work-related injury and illness reporting).
• To communicate with you.
• To provide you access while working at the Company, including to create badges that allow your entrance into the Company facility where you will be working; and to authenticate your identity and verifying your access permissions.
• For legal and safety purposes, including to provide reasonable accommodations when required by applicable law; to comply with applicable laws and regulations, including: to monitor, investigate, and enforce compliance with and potential breaches of Company policies and procedures and legal and regulatory requirements; to comply with and respond to civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and to exercise or defend the legal rights of Company and its employees, affiliates, customers, contractors, and agents; to protect the Company’s rights and property or the rights, property, and safety of others; to comply with legal obligations; to maintain the security of our customers, employees, and property; and to pursue remedies available to us and limit our damages.

We and our Service Providers Collected, Processed and disclosed (and may Process and disclose) the Personal Information of our Former Employees for the following business purposes:

Former Employees:

• To manage your employment relationship with us, including while employed: to manage our workforce and your performance; for personnel planning, productivity monitoring, and evaluation purposes; for workforce development, education, training, and certification; for compensation, payroll, tax, and benefits planning, enrollment, and administration purposes; to arrange, confirm, and monitor work-related travel, events, meetings, and other activities; to assess your working capacity or the diagnosis, treatment or care of a condition impacting your fitness for work, and for other preventative or occupational medicine purposes (including work-related injury and illness reporting). 
• To maintain and further a diverse and equitable workplace.
• To provide you access while employed, including while employed: to provide you access to Company systems, networks, databases, equipment, and facilities; to create employee badges that allow access to our facilities; to allow use of Company provided technology; and to authenticate your identity and verifying your access permissions.
• To communicate with  your or your designated emergency contacts, designated beneficiaries and dependents, including to contact and communicate while employed with you regarding your employment, job performance, compensation, and benefits, working conditions or in the event of a natural disaster or other emergency; to contact and communicate with your designated emergency contacts in the event of an emergency, illness, or absence; and to contact and communicating with you and your dependents and designated beneficiaries in the event of an emergency or in connection with your benefits.
• To provide you with requested assistance or products, including to help you in your dealings with benefits providers; correcting information in the systems we use; or while you were an employee, to process orders for our products placed by you as an employee.
• For business purposes, including to monitor, maintain, and secure Company systems, networks, databases, equipment, and facilities; to record meetings held via Microsoft Team in which you participated; to confirming any agreements made with you; and with your consent, to use your photos in Company materials.
• For legal and safety purposes, including to providing reasonable accommodations when required by applicable law; to comply with laws and regulations, including (without limitation) applicable tax, health and safety, anti-discrimination, immigration, labor and employment, and social welfare laws; to monitor, investigate, and enforce compliance with and potential breaches of Company policies and procedures and legal and regulatory requirements; to comply with and respond to civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and to exercise or defend the legal rights of Company and its employees, affiliates, customers, contractors, and agents; to protect our rights or the rights, property, and safety of others; to comply with legal obligations; to maintain the security of our customers, employees, and property; and to pursue remedies available to us and limit our damages.

Note that Recor may combine any of the Personal Information noted in this Policy with any other data we collect to accomplish this or any of the other purposes indicated in this Policy, where permitted by law.

Sources From Which We Collect Personal Information

We Collect Personal Information:

• Directly from you. For example, from your resume, from you job application, from your emails to us and from your communications with us.
• Indirectly from you. For example, from your LinkedIn page.
• Service Providers and Third Parties. For example, from public databases; providers of demographic data; publications; professional organizations; educational institutions; government entities; social media platforms; and Service Providers and Third Parties when they disclose information to us, including those that help us locate applicants, screen and onboard individuals for hiring purposes, and train and develop employees, staffing agencies that provide us with contract workers, accounts payable software  which you provide your information to, or for compliance purposes.

Categories of Entities to Whom We Disclose Personal Information

• Affiliates & Service Providers. We may disclose each of the categories of Personal Information to our affiliates and Service Providers for the purposes described in this Policy. Our Service Providers provide us with hiring services, payroll and payment services, benefits and wellness services, travel services, training and development services, benchmarking services, website services, as well as other products and services, such as web hosting, data analysis, customer service, infrastructure services, technology services, email and other communication delivery services, research and analytic services, fraud and security services, compliance services, legal services, and other business support services. We grant our Service Providers access to Personal Information only to the extent needed for them to perform their functions and require them to protect the confidentiality and security of such information.
• Third Parties. For each category of Personal Information identified in this Privacy Policy, we may disclose such Personal Information to the following categories of Third Parties:
  • At Your Direction. We may disclose your Personal Information to any Third Party with your consent or at your direction.
  • Benchmarking Companies. We may have disclosed certain of your Personal Information to Third Party Benchmarking Agencies as described above under the heading “Sale or Sharing of Personal Information”.
  • Business Transfers or Assignments. We may disclose your Personal Information to other entities as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
  • Legal and Regulatory. We may disclose your Personal Information to law enforcement, government authorities, including regulatory agencies and courts, as reasonably necessary for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.

Collection and Processing of Sensitive Personal Information

We, and our Service Providers, Collect and Process the Sensitive Personal Information described in this Policy only for the below purposes that are authorized by the CCPA and its implementing regulations:

• Performing the services or providing the goods reasonably expected by an average Applicant, Contract Worker or Former Employee who requests those goods or services;
• Ensuring security and integrity to the extent the use of the Employee’s Personal Information is reasonably necessary and proportionate for these purposes;
• Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted your Personal Information;
• Resisting malicious, deceptive, fraudulent, or illegal actions directed at the Company and prosecuting those responsible for those actions;
• Ensuring the physical safety of natural persons;
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of an Employee’s current interaction with us; provided that we will not disclose an Employee’s Sensitive Personal Information to a Third Party and/or build a profile about the Employee or otherwise alter the Employee’s experience outside the current interaction with the Company;
• Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying Employee’s information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf;
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured by, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us; and
• Collecting or processing Sensitive Personal Information where such collection or processing is not for the purpose of inferring characteristics about an Employee.

Your Rights

Depending on where you live, you may have certain rights regarding your Personal Information, subject to certain exceptions.  These may include (and if you are a California resident include), again subject to certain exceptions:

• Right To Know: You may request that we provide you with the following information:
  • The categories of Personal Information we Collected about you;
  • The categories of sources from which we Collected such Personal Information;
  • The business or commercial purpose for Collecting, Selling, or Sharing Personal Information about you;
  • The categories of Personal Information that we have Sold or Shared about you and the categories of Third Parties to whom the Personal Information was Sold or Shared;
  • The categories of Third Parties with whom we disclosed such Personal Information; and
  • The specific pieces of Personal Information we have Collected about you, in a format that is easily understandable and commonly used.
• Right to Correction: You may request that we correct any inaccurate Personal Information we maintain about you.
• Right to Restriction: You may have the right to restrict the use of your Personal Information in certain circumstances, subject to applicable law.
• Right to Objection: You may have the right to object to certain collection, use, and disclosure of your Personal Information.
• Right to Deletion: You may request that we delete any Personal Information about you that we Collected from you.

Exercising Your Rights

If you would like to exercise your right, please contact us by completing this webform, by email at DPO@RecorMedical.com, or by calling (844)-441-9869. You may also designate an agent to submit a request on your behalf, and the authorized agent may do so via the above-listed submission methods.

To submit a request, we require that you explain your relationship with us, specify your request type, and provide your name, email address, country, home address, the details of your request, and your date of birth. We use this information to identify responsive records and in certain cases to verify your identity. To the extent we verify your identity, we may use a Service Provider who may ask additional questions to verify your identity, including the last four digits of your social security number, and questions about physical addresses or locations that you have been associated with.  Your request should include sufficient detail that allows us to properly understand, evaluate, and respond to it. Please note that we may require additional information from you to verify your identity and process your request.

If you choose to use an authorized agent to submit a request on your behalf, you must provide the agent written permission to do so and the agent must verify their own identity directly with us, in addition to the steps we would take if we processed your request directly. If the agent does not submit proof that they have been authorized by you to act on your behalf, we may deny the request.

In some instances, we may decline to honor your request if an exception applies under the CCPA, including if deleting the information may impact our ability to provide you employment, infringe on someone else’s privacy rights, or impede our legal obligations. We will respond to your request consistent with applicable law.

We will not discriminate against you by taking adverse action against you if you choose to exercise your privacy rights. 

Contact Us

If you have any questions or concerns regarding this Policy, please contact us by email at DPO@RecorMedical.com or by phone at (844)-441-9869.

Definitions

• Personal Information: Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. Personal Information includes Sensitive Personal Information but does not include protected health information covered by the Health Insurance Portability and Accountability Act (“HIPAA”), nonpublic Personal Information under the Gramm-Leach-Bliley Act (“GLBA”), Publicly Available Information, or any other information which is exempt from the CCPA.
• Publicly Available Information: Information that is lawfully made available from federal, state, or local government records, or information that the Company has a reasonable basis to believe is lawfully made available to the general public by the individual or from widely distributed media, or information made available by a person to whom the individual has disclosed the information if the individual has not restricted the information to a specific audience. “Publicly Available Information” does not mean biometric information collected by a business about an individual without the individual’s knowledge.
• Sensitive Personal Information: Includes Personal Information that reveals, among other things, social security number, driver’s license number, state identification card number, passport number, racial or ethnic origin, union membership, or the contents of an individual’s mail, email, and text messages, unless Company is the intended recipient of the communication. Sensitive Personal Information also includes information concerning the individual’s health or sexual orientation.
• Sale and Share: a “Sale” (and its conjugates, such as “Sell”) is the disclosure of Personal Information to a Third Party for monetary or other valuable consideration, and a “Share” (and its conjugates, such as “Shared”) is the disclosure of Personal Information to a Third Party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.
• Collect: “Collects” (and its conjugates, such as “Collected”) means buying, renting, gathering, obtaining, receiving, or accessing any Personal Information pertaining to an individual by any means.
• Process: “Process” (and its conjugates such as “Processing”) means any operation or set of operations that are performed on Personal Information or on sets of Personal Information, whether or not by automated means.
• Service Provider: a person that processes Personal Information on behalf of the Company and that receives from or on behalf of the Company an individual’s Personal Information for a business purpose pursuant to a written contract, provided that the contract contains the provisions required by California law.
• Third Party: A person who is not any of the following: (i) the business with whom the individual intentionally interacts and that collects Personal Information from the individual as part of the individual’s current interaction with the business; (ii) a Service Provider to the Company; or (iii) a contractor as such term is defined under California law.