Privacy Policy

Introduction

Comen and its affiliates and subsidiaries ("Comen", "we", "our", "us") respect your privacy rights and personal data protection rights. We appreciate your interest in our company, products and services by visiting our website (e.g., www.comen.com) or other communication channels (including but not limited to our social media pages, platforms, mobile applications and/or blogs, collectively "Comen Pages"). This Privacy Statement applies to all personal information collected online and offline by Comen during your interactions with us, such as when you visit Comen Pages, use our products or services, make purchases, subscribe to newsletters, or contact our customer support (whether as visitor, customer, potential customer, or representative of supplier or business partner).

We may also provide you with separate privacy notices regarding how we collect and process your personal information in specific contexts (e.g., for certain products, services or programs). Unless otherwise stated or agreed, in case of any conflict between separate privacy notices and this Privacy Statement, the separate notice shall prevail.

Personal Information We Collect

Unless otherwise specified by applicable laws in your jurisdiction, "personal information" under this Privacy Policy refers to information that can identify specific individuals either directly or when combined with other information. Where required by applicable laws, personal information shall also include sensitive personal data. We recommend keeping your personal settings and information complete and up-to-date.

To provide our services, we need you to provide information necessary for using such services. We only collect information for specific, explicit and legitimate purposes that is necessary to achieve such purposes, and ensure such information will not be further processed in ways incompatible with those purposes. You may choose whether to provide requested information, but in most cases, if you refuse, we may be unable to provide corresponding services or respond to your issues.

Types of Personal Information We May Collect:

(1) Personal Information Involved in Website Browsing/Usage

You may visit and browse this website anonymously. For basic website operations, most browsers collect certain necessary information including:

• Browsing history: Our page views, visitor numbers, average session duration etc.;
• Log information: Network request information related to your use of website functions and browsing information, standard system logs, error/failure information, and timestamps of service usage;
• IP address: Automatically assigned by your ISP. When visiting our website, servers automatically identify and record IP addresses along with access times and pages viewed.

We commit to using such information only for routine network operations, improving network operation quality, or providing references for website usage rate, management, maintenance and server diagnostics. Notably, standalone device/log information cannot identify specific individuals and thus does not constitute personal or sensitive information. However, if combined with other information to identify individuals, such non-personal information will be treated as personal information during combination, and we will fulfill legal notification/consent requirements.

(2) Information Actively Provided by You

When using specific services or functions we provide, you may need to provide personal information to enable such services/functions. For example, if purchasing or using our products, you may need to provide contact details (name, email, company, phone, address, feedback) - this is necessary for us to contact you via company email.

We commit to using such information only for the stated specific services/functions, with prior notice or consent obtained during collection. Basic browsing/searching services do not require such information.

To ensure accuracy and security, you must provide true, correct, up-to-date and complete information in registration forms, and promptly update registration details to avoid errors, inaccuracies, outdated, incomplete or misleading information. If providing third parties' personal information, you must obtain their lawful consent/authorization beforehand.

(3) Information Generally Not Required

We do not require ID cards, passports, driver's licenses or other official documents, nor biometric, financial, health, religious belief, communication record or location trail information. You should avoid sending such sensitive information to us, or notify us when sending to enable our fulfillment of legal protection obligations. If Comen Medical staff request such information, you may report to us via contact methods in "How to Contact Us" section.

How We Use Personal Information

We may use collected personal information to:

Process your inquiries or requests regarding equipment and services, e.g., answering customer questions, sending system/application notifications, managing contests/sweepstakes you participate in.

Conduct relevant promotions, e.g., providing promotional materials and updates (you may opt-out via unsubscribe links in emails where legally permitted).

Internal purposes, just like data analysis, R&D, and generating statistics to improve our products/services.

Administer promotions, if you participate in contests/sweepstakes via our social media platforms, we may use provided information to deliver rewards.

Store and maintain your information for business operations (e.g., business statistics) or legal compliance.

Provide customer service related to purchased products/services, e.g., responding to inquiries, fulfilling requests, product repairs/replacements, service improvements, dispute resolution, and staff training.

Legal Basis for Collection and Use of Personal Information

(1) Under currently effective laws and regulations of China, Comen Medical may collect/use your personal information without consent in any of these circumstances:

• Necessary for fulfilling legal obligations or responsibilities under applicable laws;
• Related to national security, national defense or state secrets;
• Necessary to respond to public health emergencies or protect life/health/property safety in emergencies;
• Processing within reasonable scope for public interest purposes like news reporting/public supervision; Necessary for contract performance, including processing your information as first step to fulfill your service requests.

(2) For personal information collection/use beyond "Information Involved in Website Browsing/Usage", we may be exempt from notifying purpose/method/categories in these cases:

• When laws/regulations require confidentiality or exempt notification
• In emergencies where notification cannot be timely provided to protect life/health/property safety (we will notify after emergency resolves).

(3) Under current laws, if we apply comprehensive technical/organizational measures to anonymize personal information (making recipient unable to re-identify individuals or reconstruct data), such anonymized data use requires no additional notification/consent.

Sharing of Personal Information

Except as described herein or at collection, we do not sell or disclose your personal information. We may share it within Comen group for purposes stated in this Privacy Statement.

• We may share with service providers (for website hosting, IT infrastructure, cloud services, order fulfillment, customer service, email delivery, auditing etc.) under contractual data protection obligations.
• With third parties for marketing communications if you consent to receive them.
• With business partners when necessary for joint product offerings/services.
• When we believe in good faith it's necessary to: (a) comply with laws (including outside your country), respond to government requests or cooperate with law enforcement; (b) enforce our terms; (c) protect our/affiliates'/your/others' rights, privacy, safety or property.
• In connection with any reorganization, merger, sale, joint venture, transfer or disposition of all/part of our business/assets/stock (including bankruptcy), we may share with relevant third parties (e.g., agents, auditors).

Your Rights and Choices

Under applicable laws, you may have these rights regarding your personal information: Access, correct, delete, restrict processing, object to processing, withdraw consent and data portability Submit requests to access certain personal information we maintain about you; request updates, corrections, modifications, deletions or processing restrictions. Where legally permitted, you may withdraw previously given consent or object to processing based on legitimate grounds. Beyond opt-out options on Comen Pages (e.g., unsubscribe links in promotional emails), contact us directly as shown in "How to Contact Us".

We will respond per applicable laws and may require identity verification. Note we may decline certain requests if legally restricted (e.g., mandatory data retention).

In requests, please specify: Which personal information you want to access/change; whether you want information restricted in our database; any other processing restrictions you wish to impose.

How We Protect Your Personal Information

We comply with the ISO/IEC 27001 Information Security Management System (ISMS) and ISO/IEC 27701 Privacy Information Management System (PIMS), employing various technical and organizational measures as well as operational procedures to protect your personal information. For example, we implement access control mechanisms, utilize firewalls and secure servers, and apply de-identification, anonymization, or encryption to certain types of data (such as financial information and other sensitive data). Additionally, we regularly test and evaluate the effectiveness of our technical and organizational measures to ensure the security of your personal information. You are responsible for keeping your account credentials and password secure.

Please be aware and understand that the internet is not an absolutely secure environment. If you discover that your personal information has been compromised, please contact us immediately using the contact details provided in the "How to Contact Us" section of this Privacy Policy so that we can take appropriate action.

In the event of accidental incidents, force majeure, or other circumstances leading to the leakage of your personal information, we will strive to control the situation, promptly inform you of the incident’s cause, the security measures we have taken, and the protective measures you can actively adopt, among other relevant details. Should a security incident involving personal information occur, we will, in accordance with applicable laws and regulations, report to the relevant authorities, promptly investigate the issue, and take emergency response measures.

Children's Personal Information

While Comen Pages generally don't target users under 18, our policy requires obtaining parental/guardian consent before collecting/using/disclosing minors' personal information as legally required. If we discover collecting minors' information, we will delete it immediately.

Parents/guardians should monitor children's online activities. If you find your child has provided personal information without consent, contact us via "How to Contact Us" for deletion/processing per your request after verification.

Retention of Personal Information

To the extent permitted by applicable laws, we will retain the personal information we collect about you for as long as (1) such information remains necessary for the purposes for which it was obtained under this Privacy Policy, or (2) we have another lawful basis (as stated in this Privacy Policy or at the time of collection) to retain the information beyond the period required to fulfill the original purpose of collection.

Generally, we store your personal information collected within China within the country. If we need to transfer your personal information overseas, we will comply with the procedures required by relevant laws and regulations and ensure that your personal information receives protection standards no lower than those stipulated by applicable data protection laws.

• We will store the personal information we collect from you to fulfill our legitimate business needs (e.g., providing services to you or meeting legal, tax, and financial obligations).
• When we no longer have a legitimate business need to process your personal information or when the retention period required by applicable laws expires, we will delete your personal information or anonymize it.

Changes to This Privacy Policy

This Privacy Policy may be updated periodically. Depending on the significance of the updates, we will notify you through appropriate means to reflect changes in our information practices. The most recent revision date will be indicated at the top of this Privacy Policy.

How to Contact Us

If you have any questions, comments, concerns, or complaints regarding your personal information held by us, or wish to exercise any data privacy-related rights, please contact us at privacy@szcomen.com. Please note that this email address is dedicated solely to handling privacy-related inquiries.Alternatively, you always have the right to submit a request or complaint to the relevant data protection authority.