Declaration of Elise S. Frejka, Cipp/Us

Summary

Declaration of Elise S. Frejka, CIPP/US, in Support of Entry of the Proposed Sale Orders, filed in the Vyaire Medical, Inc. chapter 11 case, Case No. 24-11217 (BLS). The declarant identifies as a licensed attorney, member at the law firm Frejka PLLC, and special counsel to the Debtors, and describes a bankruptcy practice and privacy credentials including appointments as consumer privacy ombudsman. The declaration is submitted in support of the proposed order approving the Zoll Asset Purchase Agreement [Docket No. 399] and the proposed order approving the Trudell Asset Purchase Agreement [Docket No. 401]. The text ends with a Vyaire privacy notice that states it was last updated in May 2024.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

IN THE UNITED STATES BANKRUPTCY COURT
FOR THE DISTRICT OF DELAWARE

)

In re:
)
Chapter 11

)

VYAIRE MEDICAL, INC., et al.,1
)
Case No. 24-11217 (BLS)

)

Debtors.
)
(Jointly Administered)

)

DECLARATION OF ELISE S. FREJKA, CIPP/US,
IN SUPPORT OF ENTRY OF THE PROPOSED SALE ORDERS

I, Elise S. Frejka, CIPP/US, declare under penalty of perjury:
1.
I am a licensed attorney, member at the law firm Frejka PLLC, and special counsel
to the above-captioned debtors and debtors in possession (collectively, the “Debtors” or
the “Company”).  I have been practicing law since 1990, after graduating, cum laude, from New
York Law School where I was awarded the James P. Kibbey Award for Excellence in Commercial
Law.  My practice is almost exclusively in the area of bankruptcy and bankruptcy litigation.  I am
admitted to practice before the courts of the State of New York, the Supreme Court of the United
States, the Second and Federal Circuit Courts of Appeal, and the Southern, Eastern, and Northern
Districts of New York.
2.
Following my judicial clerkship for the Honorable Prudence Carter Beatty, United
States Bankruptcy Judge, Southern District of New York (Retired), I spent the next two decades
working in the bankruptcy and restructuring departments of major law firms including Kramer
Levin Naftalis & Frankel LLP (Special Counsel, 2009–2015), Dechert LLP, as successor to

1
A complete list of each of the Debtors in these chapter 11 cases and each such Debtor’s federal tax identification
number
may
be
obtained
on
the website of the
Debtors’
claims
and
noticing agent
at
https://omniagentsolutions.com/Vyaire.  The location of Debtor Vyaire Medical, Inc.’s principal place of business
and the Debtors’ service address in these chapter 11 cases is 26125 North Riverwoods Boulevard, Mettawa,
Illinois, USA 60045.
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 1 of 25

2
Swidler Berlin Shereff Friedman LLP (Associate, 1999–2009), Togut Segal & Segal LLP
(Associate, 1998 – 1999), and Curtis Mallet-Prevost, Colt & Mosle LLP (Associate, 1994–1998).
In March 2015, I left big law and founded Frejka PLLC.
3.
I am a Certified Information Privacy Professional (CIPP/US) credentialed by the
International Association of Privacy Professionals and have been appointed the consumer privacy
ombudsman by the United States Trustee Program in In re Oberweis Dairy, Inc., No. 24-05385
(DDC) (Bankr. N.D.Il. Apr. 12, 2024); In re Endo International plc, No. 22-22549 (JLG) (Bankr.
S.D.N.Y. Aug. 16, 2022); In re Fred’s Inc., No. 19-11984 (CSS) (Bankr. D. Del. Sept. 9, 2019);
In re uBiome, Inc., No. 19-11938 (LSS) (Bankr. D. Del. Sept 4, 2019); In re Insys Therapeutics,
Inc., No. 19-11292 (JTD) (Bankr. D. Del. June 10, 2019); In re Ditech Holding Corporation,
No. 19-10412 (JLG) (Bankr. S.D.N.Y. Feb. 11, 2019); In re Sears Holdings Corporation,
No. 18-23538 (RDD) (Bankr. S.D.N.Y. Oct. 15, 2018); In re Hooper Holmes, Inc., No. 18-23302
(RDD) (Bankr. S.D.N.Y. Aug. 27, 2018); In re Wall Street Languages Ltd., No. 18-11581 (SHL)
(Bankr. S.D.N.Y. May 24, 2018); In re Avaago, Inc., No. 17-12926 (MKV) (Bankr. S.D.N.Y.
Oct. 19, 2017); In re Toys “R” Us, Inc., No. 17-34665 (KLP) (Bankr. E.D. Va. Sept. 18, 2017);
In re Bristlecone, Inc., No. 17-50472 (BTB) (Bankr. D. Nev. Apr. 18, 2017); In re Marbles
Holdings LLC, No. 17-03309 (TAB) (Bankr. N.D. Ill. Feb. 3, 2017); In re The Wet Seal, LLC,
No. 17-10229 (CSS) (Bankr. D. Del. Feb. 2, 2017); In re VoicePulse, Inc., No. 16-25075 (MBK)
(Bankr. D.N.J. Aug. 5, 2016); In re SFX Entm’t, Inc., No. 16-10238 (MFW) (Bankr. D. Del.
Feb. 1, 2016); In re The Great Atlantic & Pacific Tea Co., Inc., No. 15-23007 (RDD) (Bankr.
S.D.N.Y. July 19, 2015); In re Health Diagnostic Laboratory, Inc., No. 15-32919 (KRH) (Bankr.
E.D. Va. June 7, 2015); and In re RadioShack Corp., No. 15-10197 (BLS) (Bankr. D. Del. Feb. 5,
2015).  I was special counsel to the debtors and filed declarations in support of proposed sale
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 2 of 25

3
processes in In re PGX Holdings, Inc., No. 23-10718 (CTG) (Bankr. D. Del. June 4, 2023) [Docket
No. 68], In re Express, Inc., No. 24-10831 (KBO) (Bankr. D. Del. Apr. 22, 2024) [Docket No.
128], In re Le Tote, Inc., No. 20-33332 (KLP) (Bankr. E.D. Va. Feb. 17, 2020) [Docket No. 27],
In re Rite Aid Corporation, No. 23-18993 (MBK) (Bankr. D.N.J. Oct. 16, 2023) [Docket No. 34],
In re Bed Bath & Beyond Inc., No. 23-13359 (VFP) (Bankr. D.N.J. Apr. 23, 2023) [Docket No.
29], In re Pier 1 Imports, Inc., No. 20-30805 (KRH) (Bankr. E.D. Va. Feb. 17, 2020) [Docket No.
36], and In re Destination Maternity Corp., No. 19-12256 (BLS) (Bankr. D. Del. Oct. 25, 2019)
[Docket No. 107].  In addition, while at Kramer Levin Naftalis & Frankel LLP, I represented the
purchaser of the ecommerce business and customer data in In re Circuit City Stores, Inc.,
No. 08-35653 (KRH) (Bankr. E.D. Va. Nov. 11, 2008) and actively participated in the consumer
privacy ombudsman process.
4.
I am a member of numerous professional associations, including the International
Association of Privacy Professionals, American Bankruptcy Institute, International Women’s
Insolvency & Restructuring Confederation, Turnaround Management Association, and the
National Association of Legal Fee Analysis.  In addition, I have served as a presenter or panelist
on consumer privacy issues at numerous conferences and seminars.  Finally, for the past seven
years I have been a guest lecturer at New York University School of Continuing and Professional
Studies for the Bankruptcy, Workout and Reorganizations class where I frequently lecture on the
intersection of privacy and bankruptcy.
5.
I submit this declaration (this “Declaration”) in support of the (a) the proposed
Order (I) Approving the Zoll Asset Purchase Agreement and Authorizing the Sale of Certain
Ventilation Assets of the Debtors Outside of the Ordinary Course of Business, (II) Authorizing the
Sale of Assets Free and Clear of All Liens, Claims, Interests, and Encumbrances, (III) Authorizing
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 3 of 25

4
the Assumption and Assignment of Executory Contracts and Unexpired Leases in Connection
Therewith, and (IV) Granting Related Relief [Docket No. 399] (as may be modified or
supplemented, the “Vents Sale Order”) and (b) the proposed Order (I) Approving the Trudell Asset
Purchase Agreement and Authorizing the Sale of Certain Respiratory Diagnostics Assets of the
Debtors Outside the Ordinary Course of Business, (II) Authorizing the Sale of Assets Free and
Clear of All Liens, Claims, Interests, and Encumbrances, (III) Authorizing the Assumption and
Assignment of Executory Contracts and Unexpired Leases in Connection Therewith, and (IV)
Granting Related Relief [Docket No. 401] (as may be modified or supplemented, the “RDx Sale
Order” and, together with the Vents Sale Order, the “Sale Orders”).2  Except as otherwise noted
herein, the facts set forth in this Declaration are based upon my personal knowledge and
independent investigation, review of relevant Company policies, website caches of the Debtors’
websites available on the “waybackmachine” (the “Waybackmachine”) at www.archive.org, other
information prepared by me or collected for me by the Debtors’ employees, information received
from the Debtors’ advisors, and my review of the Declaration of John Bibb, Group Chief Executive
Officer of Vyaire Medical, Inc. in Support of Chapter 11 Petitions and First Day Motions [Docket
No. 15] (the “First Day Declaration”).
6.
If I were called upon to testify, I could and would competently testify to the facts
set forth herein based upon my personal knowledge, review of documents, or information available
to me. I am authorized to submit this declaration on behalf of the Debtors.

2
Capitalized terms used but not otherwise defined shall have the meaning ascribed to them in the Motion of Debtors
for Entry of an Order (I) Approving Bidding Procedures in Connection with the Sale of Substantially All of the
Debtors’ Assets, (II) Authorizing the Debtors to Enter Into a Stalking Horse Agreement and Provide Bid
Protections, (III) Approving the Form and Manner of Notice Thereof, (IV) Scheduling an Auction and Sale
Hearing, (V) Approving Procedures for the Assumption and Assignment of Contracts, (VI) Approving the Sale of
Debtors’ Assets Free and Clear, and (VII) Granting Related Relief [Docket No. 16] (the “Bidding Procedures
Motion”) and the Sale Orders, as applicable.
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 4 of 25

5
The Company’s Businesses
7.
As described in the First Day Declaration and the Bidding Procedures Motion,
Vyaire Medical, Inc., together with its direct and indirect subsidiaries (collectively, “Vyaire” or
the “Company”), is the only global company focused exclusively on respiratory solutions,
offering capital and consumable products, and related services, for the diagnosis, treatment,
and monitoring of various breathing conditions. Vyaire, building on over seventy years of legacy
product offerings, has streamlined its corporate structure around two operationally lean ventilation
and respiratory diagnostics business units to support its state-of-the-art product line and services.
8.
Vyaire operates two3 business segments: ventilation and respiratory diagnostics.
The Debtors’ ventilation business (“Ventilation”) focuses on helping patients breathe by offering
products, and related services, that mechanically pump air in and out of ailing lungs.  See First Day
Declaration at ¶ 7.  The Debtors’ respiratory diagnostics business (“Respiratory Diagnostics”)
develops, manufactures, and commercializes devices to diagnose pulmonary and cardiopulmonary
diseases.  Id.  Vyaire produces medical devices for use by healthcare professionals, none of which
are sold directly to consumers.  Id.¶ 6.
9.
Critically, the Company’s customers are not individuals but rather the hospitals,
health centers, and private practices delivering life-enhancing products and services to their
patients.  For the avoidance of doubt, for purpose of this Declaration, “consumers” are natural
persons, and “customers” are business entities that are not natural persons, unless expressly
provided otherwise.

3  In May 2023, Vyaire completed the sale of its consumables business which provided leading airway management
and operative care technology.
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 5 of 25

6
The Company’s Privacy Policy and Data Processing
10.
As part of the diligence process, I explored the myriad of ways the Company could
potentially process personally identifiable information (“Personally Identifiable Information”)4
and protected health information (“Protected Health Information”)5 of consumers, and I have
concluded that, with very limited exceptions (discussed below), the Company does not collect,
record, or store Personally Identifiable Information or Protected Health Information and, in
virtually every scenario, the information processed is not owned or controlled by the Company.
Moreover, it is virtually impossible for a consumer to provide the Company with Personally
Identifiable Information or Protected Health Information directly, despite the Company’s very
broad and permissive privacy policy.6  For these reasons, and as discussed in further detail in this
Declaration, based upon my investigation of the facts and circumstances surrounding the

4  Pursuant to 11 U.S.C. § 101(41(A)), Personally Identifiable Information means—
(A) if provided by an individual to the debtor in connection with obtaining a product or a service from the debtor
primarily for personal, family, or household purposes—
(i) the first name (or initial) and last name of such individual, whether given at birth or time of adoption, or
resulting from a lawful change of name;
(ii) the geographical address or a physical place of residence of such individual;
(iii) an electronic address (including an e-mail address) of such individual;
(iv) a telephone number dedicated to contacting such individual at such physical place of residence;
(v)  a social security account number issued to such individual; or
(vi) the account number of a credit card issued to such individual[.]
11 U.S.C. § 101(41A).
5  The privacy of a consumer’s individually identifiable health information is regulated by the Health Insurance
Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and
Clinical Health Act (“HITECH Act”), 45 C.F.R. § 164.504, and various regulations promulgated under those laws,
including the Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the
Health Information Technology for Economic and Clinical Health Act and the Genetic Information
Nondiscrimination Act; Other Modifications to the HIPAA Rules (the “Omnibus Rule”), 78 Fed. Reg. 5566 (Jan.
25, 2013).  The term Protected Health Information is defined in the Privacy Rule issued under HIPAA to mean any
health information that identifies, or reasonably could be used to identify, an individual, and that relates to physical
or mental health or condition of the individual, the provision of health care to the individual, or the payment for the
provision of health care to the individual, in each case if maintained or transmitted by a healthcare provider or other
“Covered Entity,” other than certain limited exceptions.  45 C.F.R. § 160.103.
6  The only interactive link on the Vyaire website is the “Contact” radio button.
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 6 of 25

7
Company’s collection and processing of Personally Identifiable Information and Protected Health
Information, I do not believe the appointment of either a consumer privacy ombudsman or a patient
care ombudsman is necessary or required in these Chapter 11 Cases as HIPAA and its state law
equivalents have mandatory protections in place.
11.
The Company’s collection, use, and sharing of personal information is governed by
a privacy policy.  A copy of the privacy policy is attached hereto as Exhibit A.  The Company
overhauled its privacy policy in May 2024 and explicitly adopted the now-common practice of
permitting the transfer of Personally Identifiable Information to an unaffiliated third-party as part
of a larger business transaction,7 made clear that the Company processes data for its customers
who use its products and services to provide medical testing and treatment to their patients,8 and
incorporated various state law data protection law requirements.  According to the Company, many
of the consumer-related changes were intended to provide optionality to allow for corporate growth
into consumer products or direct to consumer sales and align with current privacy policy trends
and not to address the current use and disclosure of Personally Identifiable Information.9

7  “If we sell or buy any businesses or assets or merge any business into or with that of another person, in which case
we may disclose your personal data to the prospective counterparty in such transaction and such data may be one
of
the
assets
transferred
in
such
transaction”.
VYAIRE.COM,
https://web.archive.org/web/20240601103203/https://www.vyaire.com/privacy-policy (last visited June 19, 2024)
8  “This Privacy Notice does not apply to the Personal Data we process as a Service Provider or Data Processor on
behalf of our customers, who, in this instance, are the Data Controllers of your personal data. Vyaire’s customers
are medical facilities who use our products and services to provide medical testing and treatment. In order for us to
provide our products and services, Vyaire processes personal data in accordance with the instructions defined in the
agreements we have in place with our customers. If you have any questions about the personal data you have
provided to one of our customers or wish to exercise any of your rights regarding your personal data, please contact
the
customer
directly.”

VYAIRE.COM,
https://web.archive.org/web/20240601103203/https://www.vyaire.com/privacy-policy (last visited June 17, 2024)
9  I have not included an analysis of prior privacy policies because earlier versions were rudimentary and focused
entirely on information collected from the Company’s website, via email, or other direct contact with the Company.
Importantly, these prior iterations did provide that the Company may sell or rent the information collected with third
parties.  See VYAIRE.COM, https://web.archive.org/web/20240204104743/https://www.vyaire.com/privacy-policy
(last visited June 17, 2024). There were 34 captures of the Company’s privacy policy on the Waybackmachine
between May 10, 2020 and June 1, 2024, and until the major overhaul of the Company’s privacy policy in May
2024, the Company’s privacy policy was static.
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 7 of 25

8
Moreover, the Company has entered into business associate agreements10 with its customers to
protect the Protected Health Information of its customer’s patients.
12.
Certain of the Company’s products capture Protected Health Information for the
benefit of the Company’s customers.  For example, ventilators record clinical data that can be
synchronized with a health care facility’s records management software or other clinical resources
to assist with diagnostics and patient management.  This data recycles, or is overwritten, such that
none of the ventilators collect, process, store, or forward Protected Health Information and the
only information available in the ventilator is the ventilator settings and ventilator and patient
monitored values and alarms associated with a specific ventilator ID and not a specific named
patient.  This Protected Health Information is not available to the Company and, to the extent there
are adverse ventilator-associated events that are brought to the attention of the Company, it is
retrospective and generally anonymized such that only critical de-identified data elements are
shared with the Company for service and support.  The Company does not provide patient care
and does not need Protected Health Information to support its products.  The Company also offers
software products to its customers to help clinicians improve respiratory care processes using
proprietary software.  The customer’s patient’s Protected Health Information is processed and
managed using this technology and while the Company does have access to this information for
support and maintenance purposes, the Company is a business associate of the customer, and
HIPAA defines and governs the relationship.  Similarly, the Company offers respiratory
diagnostics support services to its customers including technical support, education and training,
field service, and other workflow improvements that are complimentary to the Company’s

10 A Business Associate Agreement is a legally binding agreement that a HIPAA “Covered Entity,” such as a hospital,
and a business associate, such as the Company, must enter into to protect Protected Health Information.  It is
mandated by the HIPAA Security Rule, 45 C.F.R. Part 160.  Unlike a nondisclosure agreement, a Business Associate
Agreement is specifically entered into to ensure the protection of Protected Health Information.
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 8 of 25

9
products but that do not implicate Personally Identifiable Information or Protected Health
Information.  In each of these examples, the Company’s access to Protected Health Information is
ancillary to the product provided to the health care facility and the Company does not
independently engage with patients or provide patient care.
A Consumer Privacy Ombudsman is Not Required
13.
Section 332 of the Bankruptcy Code requires the appointment of a consumer
privacy ombudsman only when a debtor seeks to sell or transfer Personally Identifiable
Information in contravention of the debtor’s privacy policy with respect to the transfer of such
Personally Identifiable Information.  See 11 U.S.C. § 363 (b)(1)(A).
14.
Based upon my investigation of the facts and circumstances surrounding the
Company’s collection and processing of Personally Identifiable Information owned and collected
by the Company, all consumers have consented to the transfer of their Personally Identifiable
Information to third parties as part of a sale.  The universe of this data is extremely limited, and all
available iterations of the Company’s privacy policy contemplated a possible sale of such data.
As such, I do not believe the appointment of a consumer privacy ombudsman is necessary or
required.
A Patient Care Ombudsman is Not Required
15.
Section 333(a)(1) of the Bankruptcy Code provides: “If the debtor  . . . is a health
care business, the court shall order, not later than 30 days after the commencement of the case, the
appointment of an ombudsman to monitor the quality of patient care and to represent the interests
of the patients of the health care business unless the court finds that the appointment of such
ombudsman is not necessary for the protection of patients under the specific facts of the case.” 11
U.S.C. § 333(a)(1).
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 9 of 25

10
16.
The Company is not a health care business11 and does not provide patient care.  As
such, to the extent the Company has access to Protected Health Information it is as a business
associate of a health care business and the relationship is subject to, and governed by, HIPAA. As
such, I do not believe the appointment of a patient care ombudsman is necessary or required.
Pursuant to 28 U.S.C. § 1746, I declare under penalty of perjury that the foregoing
statements are true and correct to the best of my knowledge, information, and belief.
Dated:  August 21, 2024
/s/  Elise S. Frejka

Name: Elise S. Frejka, CIPP/US

11 Pursuant to 11 U.S.C. §101(27A)
The term “health care business”—
(A) means any public or private entity (without regard to whether that entity is organized for profit or not
for profit) that is primarily engaged in offering to the general public facilities and services for—
(i) the diagnosis or treatment of injury, deformity, or disease; and
(ii) surgical, drug treatment, psychiatric, or obstetric care; and
(B) includes—
(i) any—
(I) general or specialized hospital;
(II) ancillary ambulatory, emergency, or surgical treatment facility;
(III) hospice;
(IV) home health agency; and
(V) other health care institution that is similar to an entity referred to in subclause (I), (II), (III), or
(IV); and
(ii) any long-term care facility, including any—
(I) skilled nursing facility;
(II) intermediate care facility;
(III) assisted living facility;
(IV) home for the aged;
(V) domiciliary care facility; and
(VI) health care institution that is related to a facility referred to in subclause (I), (II), (III), (IV), or
(V), if that institution is primarily engaged in offering room, board, laundry, or personal assistance
with activities of daily living and incidentals to activities of daily living.
11 U.S.C. § 101(27A).  See also Voluntary Petition for Non-Individuals Filing for Bankruptcy, Question 7 [Docket
No. 1].
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 10 of 25

Exhibit A – Vyaire Privacy Policy

Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 11 of 25

Vyaire Privacy Notice

1

Vyaire Medical, Inc. and its domestic and international subsidiaries (“Vyaire” or “we” or “our”) are
committed to respecting the privacy of all individuals, including visitors to our offices and website,
(www.vyaire.com or www.intl.vyaire.com, depending on your location), and our current and
prospective customers and suppliers.

This Privacy Notice is intended for people who are our customers and agents or who use or visit our
website or premises.  Your visit to our website or our premises is subject to the following Privacy
Notice (“Notice”).  Please note that this Privacy Notice does not cover:
• The Personal Data we collect if you work for us. This is set out in our Employee Privacy
Notice available on our intranet.
• The personal data we collect if you apply for a job with Vyaire. This is covered in our Applicant
Privacy Notice, which is available to employees on the Careers page.

If we update this Notice, we will post the updated document on our websites. Any such changes will
be effective upon posting. We urge you to review the Notice each time you visit our website or one
of our offices. If you do not agree with any provision of the Notice, you should not use our website
or visit our offices.

If you are a resident of the EU (this includes the countries that have adopted GDPR into their local
legislation, such as the UK and/or Switzerland), this Privacy Notice also provides you with certain
information that must be provided to you under the European General Data Protection Regulation
(GDPR). You can find more information about your rights and additional disclosure under the GDPR,
in the section titled ‘Your Rights’.

If you are a resident of California, the California Consumer Privacy Act (CCPA) requires businesses
to give consumers certain notices explaining their privacy practices. You can find more information
about your rights and additional disclosures as mandated under the CCPA in the section titled
‘Additional Information For California Consumers’.

When we refer to “Personal Data” or “your Data” in this Notice, we mean any information about you
from which you can be identified. It does not include data where your identity has been removed (also
known as anonymous data).

This Notice sets out:

• The types of personal data that Vyaire collects, including from customers, individuals visiting
our website, visiting our offices, and interacting with us in the normal course of our business;
• The purposes and legal basis for our processing and use of individuals’ personal data;
• Information regarding our marketing and individuals’ ability to withdraw their consent or
otherwise object to marketing;
• How we may process, disclose or use individuals’ personal data;
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 12 of 25

Vyaire Privacy Notice

2

• How we transfer personal data outside of the European Union (“EU”), Switzerland and
United Kingdom (“UK”); and
• Individuals’ rights with respect to our processing, use or disclosure of their personal data.
Queries regarding how (1) our policies may apply to your personal data; (2) to exercise your right to
question or object to our use of your personal data, in accordance with applicable laws; or (3) to access,
correct, or delete your personal data, should be sent to privacy@vyaire.com.

For the purposes of applicable data protection law, Vyaire may be deemed to be a data controller of
your personal data, including your personal data processed in the course of customer transactions.

This Privacy Notice does not apply to the Personal Data we process as a Service Provider or Data
Processor on behalf of our customers, who, in this instance, are the Data Controllers of your personal
data. Vyaire’s customers are medical facilities who use our products and services to provide medical
testing and treatment. In order for us to provide our products and services, Vyaire processes personal
data in accordance with the instructions defined in the agreements we have in place with our
customers. If you have any questions about the personal data you have provided to one of our
customers or wish to exercise any of your rights regarding your personal data, please contact the
customer directly.

This Notice describes Vyaire’s policies and procedures with respect to personal data. Any personal
data collected, held, used, or processed by Vyaire is also subject to the relevant provisions of applicable
local laws. We store personal data in the United States and in other countries that may not have data
protection laws as protective as those in your location.

Personal Data We Collect
We may collect and process the following personal data from you:

• Identification information: such as name, business name, identification number, date of
birth, job title and function.
• Contact information: including phone number(s), email address, mailing address.
• Billing, Financial and Payment Data: including records of services obtained or considered,
bank and other financial account information and other information necessary for processing
payments, billing and invoicing, as well as fraud prevention.
• Event registration or mailing list data: such as marketing and communications preferences
and interests, subscriptions, downloads, dietary requirements, and preferences (which may
reveal information about your health and/or religious background).
• Legal and regulatory compliance data: as required for purposes such as know your
customer, anti-money laundering, and market abuse regulations requirements, or as part of
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 13 of 25

Vyaire Privacy Notice

3

our customer, distributor, vendor and supplier onboarding process, which may include
passport or other identification and due diligence data.
• Technical Information: including information collected during your visits to our website(s),
the Internet Protocol (IP) address, browser type and version, device type, time zone setting,
browser plug-in types and versions, operating system and platform. To learn more about our
use of cookies please refer to our Cookie Policy.
• Audio, electronic, visual, or similar information: including photographs and CCTV
footage.
• Physical Access Data: relating to details of your visits to our offices.
• Sensitive or regulated personal data: In the course of your relationship with us, we may
collect and process certain sensitive or regulated personal data or information that is protected
under applicable law relating to you when relevant to the basis of our interaction.
• Any other personal data that you provide to us relevant to the provision or receipt of products
or services, including in relation to any of your employees, customers, or vendors.
We may supplement the information that you provide to us with information that we receive or obtain
from other sources, such as from our personnel, customers, advisers, partners, and agents, third parties
with whom we interact and publicly available sources.

We may collect personal data about:

• our current and prospective customers and their staff and employees;
• our service providers and business partners and their staff and employees;
• individuals who attend, or express interest in attending, our events or subscribe to newsletters
and other email updates we provide;
• third parties in connection with customer or supplier transactions (for example, information
about the staff of a company that will perform a service for a customer); and
• visitors to our website and offices.

Sources of Personal Data
We obtain personal data from a number of sources, including through our website (including website
analytics, see Cookies and Similar Technology below), online questionnaires and forms, and other
information provided directly to us, including by email or in conversation with our employees, legal
or other advisers, consultants, correspondents and enquirers, and suppliers and service providers of
any of the above, as well as directly from you. In addition, we obtain personal information from third-
party sources, such as our customers, service providers, and governmental entities.

Information About Other People: If you provide information to us about any person other than
yourself, such as your employees, suppliers, shareholders or directors, you must ensure that they
understand how their information will be used and disclosed, and that they have given their permission
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 14 of 25

Vyaire Privacy Notice

4

for you to disclose it to us and for you to allow us, and our outsourced service providers, to use and
disclose it as set forth above.

Processing of Personal Data
The laws in certain jurisdictions require organizations to disclose the legal ground they rely on to use,
process, or disclose personal data. To the extent those laws apply, our legal grounds are as follows.
We process the personal data referred to above for the following purposes and on the below legal
bases:

• We use identifiers (name, email address, telephone number, physical address), sensitive
personal information (financial account), employment information (employer name), and legal
and regulatory compliance data to fulfil a contract, or take steps linked to a contract, including:

o providing sales and services to our customers and agents;
o verifying your identity;
o processing payments from you; and
o communicating with you regarding the legal services provided to Vyaire.

• We use identifiers (name, email address, telephone number, physical address), sensitive
personal information (financial account), legal and regulatory compliance data, internet and
other network activity information (information collected during your visits to our website(s),
the Internet Protocol (IP) address, browser type and version, device type, time zone setting,
browser plug-in types and versions, operating system and platform) , data recording of your
visual information (a recording of your appearance on CCTV), and sensitive or regulated
personal data as required to conduct our business and pursue our legitimate interests, in
particular:
o providing sales and services to our customers, and responding to any comments,
feedback or complaints they may send us;
o promoting our services to customers and potential customers, advising them of news
and product and industry updates, and hosting or administering events;
o monitoring use of our website, to help us improve and protect our services and
website, both online and offline;
o protecting the security of and managing access to our physical premises;
o investigating any complaints about our website or our services; and
o in connection with legal claims, and for compliance, regulatory and investigative
purposes.

• We use identifiers (name, email address, telephone number, physical address), marketing and
communications preferences and interests, subscriptions, downloads, sensitive personal
information (dietary requirements and preferences (which may reveal information about your
health and/or religious background)) and internet and other network activity information
(information collected during your visits to our website(s), the Internet Protocol (IP) address,
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 15 of 25

Vyaire Privacy Notice

5

browser type and version, device type, time zone setting, browser plug-in types and versions,
operating system and platform) where you give us consent:
o we may send you direct marketing in relation to our products and services;
o we may use cookies and similar technologies in accordance with the information below
and the information provided to you as to when those technologies are used; and
o we will use personal data that you give us solely for the purpose we explain at the time
you give us such consent.

• We use identifiers (name, email address, telephone number, physical address), sensitive
personal information (financial account), legal and regulatory compliance data, internet and
other network activity information, data recording of your visual information (a recording of
your appearance on CCTV), and sensitive or regulated personal data to comply with applicable
laws in the local jurisdictions where we operate, regulations, subpoenas, legal process,
governmental investigations or inquiries, including:
o undertaking compliance checks on current and potential customers and other third
parties as part of our legal and regulatory obligations (including anti-money laundering
and other compliance obligations);
o as necessary or appropriate to protect the rights, property, security, and safety of us,
our employees, our consumers, our information systems, and the public; and
o to cooperate with government or law enforcement authorities conducting an
investigation.

• Participate in social media. When you interact with our social media pages on social
networking websites, such as Facebook, X, LinkedIn, Instagram, and YouTube (each a
“Social Media Page” and collectively, “Social Media Pages”), we collect basic engagement
metrics and use it to tailor content and marketing and use it to improve user experience as set
forth in this section. Please note that we do not control the use or storage of the information
that you have posted to any social networking websites. This information is collected and
processed by the social networking websites for their own purposes, including marketing. For
more information on how Facebook, LinkedIn, and Instagram use your personal information,
please see Facebook’s Privacy Policy, LinkedIn’s Privacy Policy, and Instagram’s Privacy
Policy. The Social Media Pages may process personal information in the United States where
the laws may be less protective than in your country of residence. For example, in accordance
with U.S. laws, in certain circumstances, courts, law enforcement agencies, regulatory agencies,
or security authorities in other countries may be entitled to access your personal data.

o Social Media Pages. When interacting with our Social Media Pages, we collect, from
you, your personal identifiers (first and last name) and visual information (photograph
(i.e., profile picture)), as well as any information that you provide when interacting
with our Social Media Pages (e.g., commenting, sharing, and rating). We use this
information to advertise our products, for events and invitations, and to communicate
with users via the contribution and comment function. Because our Social Media Pages
are publicly accessible, when you use them to interact with other users, for example by
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 16 of 25

Vyaire Privacy Notice

6

posting, leaving comments or liking or sharing posts, any personal information that
you post in them or provide when registering can be viewed by others or used by them
as they see fit. The content posted on our Social Media Pages or other public areas of
social networking websites can be deleted in the same way as other content that you
have created. If at any time you want content posted to be deleted, please email your
request to us at privacy@vyaire.com.

o Community Management. We collect, from you, your contact, including "likes",
shares, messages and other interactions with the content, in order to analyze and
evaluate how our content is perceived, to learn from it, and to improve our public
relations efforts. If you object to this processing of your personal information and
believe you have an overriding interest, you can submit your objection via email to
privacy@vyaire.com.

o Events and Photos. When you register for an event on our Social Media Pages, we
collect, from you, your personal identifiers (first and last name, email address,
telephone number, physical address, and any other information you provide). We use
this information to create and manage the event (e.g., to create the guest list,
accreditation and admission control, room and personnel planning, planning the
catering) as well as to send you your invitation and notifications about the event. We
also use this information for prevention of fraud and defense against legal claims.  At
events for which you have registered, photos and video recordings may be made
(possibly by a photographer commissioned by us), in which you may also be shown.
If you are the central subject of a recording, the photographer will ask you before the
recording/taking the photo whether you agree and consent. We use the photos for
our public relations and marketing on our various media/digital media outlets. If you
object to this processing of your personal information and believe you have an
overriding interest, you can submit your objection via email privacy@vyaire.com.

o Page Insights. When you visit our Social Media Page, the applicable Social Network
records your IP address and other information about your usage behavior on our
Social Media Page. The Social Network collects this information through trackers in
the browser of your device or via the advertising ID (IDFA from Apple or GAID
from Google), when you open the Social Network app through your mobile device
(e.g., smartphone or tablet). The Social Network uses this information to provide us
with statistical evaluations of the use of our Social Media Page. We receive this
information directly from Social Network, in the form of aggregated data and
anonymous statistics regarding certain data points, such as: age; gender; city/country;
device; inquiries from fans about other Social Media Pages; region and language
settings of the users; proportion of men and women; the number of people reached;
clicks on posts, "likes” and reactions; comments and shared content; and total video
views. We use this information to analyze and improve the advertising campaigns we
conduct through our Social Media Pages. We do not collect or process any other
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 17 of 25

Vyaire Privacy Notice

7

personal information in connection with Social Network “Page Insights” function. We
do not retain this information independently. For information on data protection and
the storage period on the Social Network in relation to its Insights function, see the
Social Network privacy policy linked above. It has been contractually agreed with the
Social Network that the Social Network is responsible for providing you with
information about the processing for Page Insights.

• Information Processed Solely by Social Networks. We do not know how the Social
Networks use personal information for its own purposes, how long the personal information
is stored on the Social Network or whether the Social Network data is passed on to third
parties. If you are currently logged in to a Social Network as a user, the Social Network
automatically collects, through trackers on your device, your Social Network ID or a link
between the Social Network ID and the advertising ID (IDFA from Apple or GAID from
Google) when you open the Social Network app through your mobile device (e.g., smartphone
or tablet). This enables the Social Network to understand that you have visited our Social
Network Fan Page along with other Social network pages that you have clicked on, whether
you clicked on Social Network buttons integrated into websites that partner with the Social
Network, and other online interactions that report user data to the Social Network. Based on
this data, content or advertising tailored to you can be offered. You can find more information
about the Personal Information collected by Social Networks, how it is used and how long it
is stored by visiting the Social Network’s privacy policies, linked above.

•
Analyze website usage through cookies.  When you visit our website, we use cookies,
pixels, web beacons, and other similar technologies to: (i) enable the website to function
properly; (ii) track you within the website; (iii) enhance user experience; (iv) conduct analytics
to improve the website; (v) prevent fraudulent use of the website; (vi) effectively market to
you, and (vii) diagnose and repair technical errors with the website and, in cases of abuse,
track and mitigate the abuse.  Thus, cookies might store information about you, your
preferences, or your device, such as:

•
Usage information. We use cookies to collect information about your interaction
with our website and online content, such as pages visited, frequency of access, time
spent on each page, and referring website details. We use this information for
analytics and marketing purposes.

•
Location Information. We use cookies to collect information about your location,
which may be determined through your IP address. You can adjust your consent to
providing location information in your browser settings.

•
Device information. We use cookies to collect certain information about the device
you use to access the website, such as hardware model, operating system, browser,
and device preferences. We use this information for analytics and marketing
purposes.
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 18 of 25

Vyaire Privacy Notice

8

• More information about the cookies we use can be found here: Vyaire Cookie Policy.

In general, to disable cookies and limit the collection and use of information through them, you can
set your browser to refuse cookies or indicate when a cookie is being sent. When you opt-out, an opt-
out cookie will be placed on your device. The opt-out cookie is browser and device specific and will
only last until cookies are cleared from your browser or device. To opt out of targeted advertising,
please visit Do Not Sell or Share My Personal Information. Certain third parties also offer broad
cookie opt out options such as:

• Association of National Advertisers opt-out registration: https://dmachoice.thedma.org/;
• Network Advertising Initiative (NAI) Opt-Out:
https://www.networkadvertising.org/managing/opt_out.asp;
• Digital Advertising Alliance (DAA) Opt-Out: https://optout.aboutads.info.

Vyaire may also use the personal information collected for the above purposes to comply with the law
and for other limited circumstances as described in the “Disclosure of Your Personal Data” section.
We use also use this information, in the aggregate, to conduct internal analytics and benchmarking.

In certain circumstances, we will not be able to enter into commercial or other relationships if we are
not provided with all relevant personal data.

Marketing Communications and Withdrawing Consent
We may contact you with information about services or events that might be of interest to you. Where
necessary in compliance with applicable law, at the time that you provide your personal data to us, you
will be given the opportunity to indicate whether or not you agree for us to use your personal data to
tell you about such services and events.

You will always be able to withdraw your consent to allow us to process your personal data, although
we may still have other legal grounds for processing your data, such as those set out above. In some
cases, we are able to send you marketing materials without your prior consent, where we rely on our
legitimate interests, but you have an absolute right to opt-out of receiving future marketing materials
at any time. You can do this by following the instructions in the email communication you receive, or
by contacting us at privacy@vyaire.com.

Disclosure of Your Personal Data
We sometimes need to disclose your personal data with certain, trusted third parties who provide
services to us, so that they can provide those services. In the past 12 months, we have disclosed the
following information to the following types of service providers:

• Business partners, suppliers and sub-contractors in connection with the performance of any
contract we enter into with them or you. We take reasonable steps to ensure that our personnel
protect your personal data and are aware of their information security obligations; and
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 19 of 25

Vyaire Privacy Notice

9

• We have disclosed your internet or other electronic network information to our IT support to
detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and
to identify and repair website errors that impair functionality.
• We have disclosed your internet or other electronic network information, commercial
information to our IT support and data analytics provider to maintain, improve, and upgrade
Vyaire’s website.
• We have disclosed identifiers, employment data, commercial information, financial account
and payment information, and internet and electronic network activity to the following
categories of recipients: customers, cloud service providers, consultants, data analytics
providers, internet service providers, data storage providers, legal or other advisers,
consultants and other professional experts, correspondents and enquirers, and suppliers and
service providers of any of the above, and each of their associated businesses, potential/actual
purchasers of our business assets and operating systems, and platforms that perform services
on our behalf. We also disclosed professional and employment-related information, education
information and certain sensitive personal information to customers, cloud service providers,
potential/actual purchasers of our business assets and consultants.

These third parties process your personal data on our behalf, and we have agreements with them to
ensure they process your data only on our instructions and with appropriate security in place.

We may also share your personal data with (or transfer your personal data to) third parties if we have
a belief in good faith that it is reasonably necessary:

• If we sell or buy any businesses or assets or merge any business into or with that of another
person, in which case we may disclose your personal data to the prospective counterparty in
such transaction and such data may be one of the assets transferred in such transaction;
• To comply with applicable laws, regulations, subpoenas, legal process, governmental
investigations or inquiries, to cooperate with law enforcement, to assert or defend legal claims,
and to protect our and others’ rights, property, or safety we may share data with the
appropriate law enforcement, regulatory or government agency; and
• For the purposes of crime and fraud prevention and remediation we may share data with law
enforcement, regulatory or government agencies and/or independent regulatory bodies.

When we share your personal data, we ensure that we only share the minimum amount of information
that is necessary.

For a Sale/Sharing
Vyaire uses advertising partners such as Google Ads, Facebook Ads, and LinkedIn on its Websites.
These ads services deploy cookies which collect your internet and other electronic network activity
and share it with the cookie provider. This use of your personal information is considered a sale under
the California Consumer Privacy Act. To opt out of these cookies, follow the instructions in the “Your
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 20 of 25

Vyaire Privacy Notice

10

Consumer Rights as a California Consumer” section or visit Do Not Sell or Share My Personal
Information.

Data Protection Officer
We have appointed Calligo (UK) Limited to be our data protection officer.

For German residents, we have appointed Bechtle to be our data protection officer.

Please note that any correspondence you have with us in relation to this Privacy Notice will be shared
with Calligo so that they can advise us on it. Calligo’s privacy notice is available here –
https://calligo.cloud/privacy-policy/.

Transfers of Personal Data Outside the EEA, Switzerland, and UK
Vyaire is a global medical device manufacturer with multiple subsidiaries and offices across a number
of global jurisdictions. As such, personal data may be transferred to a country which may not provide
the same protections to personal data as the country in which you reside. In particular, personal data
from the EU, Switzerland or UK will be transferred to, and processed in or shared across computer
networks or otherwise with our offices in the United States and, in certain instances, where necessary
to provide our services or conduct operations in a given instance, it may be shared with individuals in
our other offices as necessary. We have agreements in place with all of our group entities to ensure
that personal data is handled in compliance with applicable data protection requirements, including
EU Standard Contractual Clauses and UK International Data Transfer Addendum Clauses where
necessary.

Your Rights
If you are a resident in Europe or a country that has adopted GDPR into their local legislation, such
as the UK and/or Switzerland, you will have certain rights and we are obliged to provide you with
specific information about how we use your data. Please note that there are exceptions to some of
these rights, so that requests may be denied if, for example, making the information available to you
would reveal personal data about another person, or if we are legally prevented from disclosing such
information.

These right are:
Access: You have the right to request a copy of the personal data that we hold about you. You are
entitled to see the personal data held about you. If you wish to do this, please contact us at
Privacy@vyaire.com.

Accuracy: We aim to keep your personal data accurate, current, and complete. We encourage you to
contact us at Privacy@vyaire.com  to let us know if any of your personal data is not accurate or if it
changes and we will update it accordingly.

Objecting/Deletion: You may also have the right to object to processing of your personal data and
to ask us to block, delete or restrict your personal data subject to certain exceptions. If this right
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 21 of 25

Vyaire Privacy Notice

11

applies, once we receive your request and verify your identity, we will delete (and direct our service
providers to delete) your personal information from our records, unless an exception applies under
applicable law.

Portability: You may have the right to request that your personal data is provided to you, or to
another data controller, in a commonly used, machine-readable format.

Complaints: If you believe that your data protection rights may have been breached, you have the
right to lodge a complaint with the supervisory authority in the EU Member State where you are
resident or where you work. Please click here for a list of the data protection authorities in the EU
member states.
The relevant supervisory authorities for the EU, UK and Switzerland are set out below and their
website contain the relevant contact details:
• Germany – Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) whose details can be
viewed here https://www.lda.bayern.de
• United Kingdom – the Information Commissioner’s office whose details can be viewed here
– Contact us | ICO
• Switzerland – the Federal Data protection and Information Commissioner whose details can
be viewed here - Contact (admin.ch)

To exercise the access, accuracy, data portability, objection and deletion rights described above, please
submit a request to us by emailing us at privacy@vyaire.com.

Please note that there may be exceptions to these rights under applicable law.

Only you, or a person that you authorize to act on your behalf, may make a request related to your
personal information. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about
whom we collected personal information or an authorized representative of such person.
• Describe your request with sufficient detail that allows us to properly understand, evaluate,
and respond to it.

We may be unable to comply with your request or provide you with personal information if you do
not take the foregoing actions. Making a request does not require you to create an account with us.
We will use personal information provided in a request only to verify your identity or authority to
make the request.

No Fee Usually Required
You will not have to pay a fee to access your Data (or to exercise any of the other rights). However,
we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
Alternatively, we could refuse to comply with your request in these circumstances.
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 22 of 25

Vyaire Privacy Notice

12

Time Limit to Respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer
than a month if your request is particularly complex or you have made a number of requests. In this
case, we will notify you and keep you updated.

How Long We Keep Your Personal Data For
We retain personal data for as long as is necessary to provide sales and service support, conduct
operations and in accordance with our data retention policies, unless we have deleted personal data in
response to a request to delete. We use the following criteria to determine whether it remains
reasonably necessary to retain your personal information for one or more disclosed operational
purpose, or a service provider or contractor’s operational purpose(s): (i) whether there is a retention
period required by statute or regulations; (ii) the existence of actual or threatened litigation for which
we are required to preserve the information; (iii) the statutes of limitations for potential legal claims;
and (iv) generally accepted best practices in our industry, including related to safety and security of
our properties and assets. When we determine that it is no longer reasonably necessary to retain your
personal information for one or more disclosed operational purposes based on the above criteria, we
will delete your personal information. We may also retain personal data in a deidentified or aggregated
form so that it can no longer be associated with an individual person

When we process personal data for marketing purposes or with your consent, we process the data
until you ask us to stop and for a short period after this (to allow us to implement your requests). We
also keep a record of the fact that you have asked us not to send you direct marketing or to process
your data so that we can respect your request in future.

Your Consumer Rights as a California Consumer
The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights
Act (“CPRA”) (collectively, “CPRA”) entitles California residents to certain rights. If our processing
of your personal information is subject to the CPRA, you are entitled to the following rights:

•
Right to Access/Know. You have the right to request what personal information we have
collected, used, disclosed, and sold about you, unless doing so proves impossible or would involve
disproportionate effort. You may only make a request for access twice within a 12-month period.

•
Right to Deletion. You have the right to request the deletion of your personal information
that we collect or maintain, subject to certain exceptions. For example, if we are required by law to
retain the information that you are asking to be deleted, we would not be able to delete the information
until we are legally permitted to delete it.

•
Right to Correct. You have the right to correct inaccurate personal information that we collect
or maintain.

Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 23 of 25

Vyaire Privacy Notice

13

•
Right to Opt Out of Sale/Sharing. Except as otherwise provided herein, we do not sell
personal information or share this information with third parties for targeted advertising purposes.

•
Right to Non-Discrimination. You have the right to not receive discriminatory treatment if
and when you exercise your rights to access, delete, opt out, correct, or limit use of sensitive personal
information under the CPRA.

•
Right to Limit Use of Sensitive Personal Information. You have the right to limit the use of
your sensitive personal information when such use goes beyond that which is necessary for providing
the Services or certain other permissible purposes like fraud, customer service or quality control.
Sensitive information includes Social Security number (or country-specific equivalent), driver’s license
number, biometric information, precise geolocation, and racial and ethnic origin. However, Vyaire
does not process sensitive personal information in a manner which gives rise to this right.

To exercise your privacy rights, you may submit a request by completing our webform or by contacting
us toll-free at 800-231-2466. To opt out of the sale or sharing of your personal information via cookies,
please visit Do Not Sell or Share My Personal Information or utilize the opt out preference signal to
instruct us to not sell or share any of your personal information collected online. The opt out
preference signal will apply to the device, platform, or browser in which you utilize it. You can utilize
the opt out preference signal by turning on the signal in your device, platform, or browser settings.

For requests submitted via telephone, you must provide us with sufficient information that allows us
to reasonably verify you are the person about whom we collected the personal information and
describe your request with sufficient detail to allow us to properly evaluate and respond to it. In doing
so, we will take steps to verify your request by matching information provided by you with the
information we have in our records. If we are not able to verify your identity for access and deletion
requests with the information provided, we may ask you for additional pieces of information.

Only you, or a person that you authorize to act on your behalf may make a request related to your
personal information. If you are an authorized agent making a request on behalf of another individual,
you must provide us with signed documentation that you are authorized to act on behalf of that
individual.

Rights of Nevada Residents
If you are a consumer in the State of Nevada, you may request to opt-out of the current or future sale of your
personal information. You may submit a request to opt-out of future sales by contacting us at privacy@vyaire.com
regarding the sale of such information. Please include “Opt-Out Request Under Nevada Law” in the subject line
of your message.

Changes to our Privacy Notice
Any changes we may make to our Notice in the future will be posted on this page and/or, where
required by law or regulation, notified to you by e-mail.

Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 24 of 25

Vyaire Privacy Notice

14

Do Not Track
Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online
services you visit. We do not monitor or take action with respect to “Do Not Track” signals. For more
information on “Do Not Track,” visit http://www.allaboutdnt.com.

Governing Law and Forum
To the extent required by applicable data protection laws, this Notice shall be governed by the laws
of the applicable jurisdiction and any dispute relating to this Notice shall be resolved in the applicable
courts. In all other cases, the laws of the State of Illinois, USA govern this Notice and any dispute
relating to this Notice shall be resolved in the state or federal court with competent jurisdiction in
Cook County, Illinois, USA. If any provision of this Notice is held to be unenforceable, such provision
will be reformed only to the extent necessary to make it enforceable.

How to Contact Us
If you have any questions or comments about this Notice, you can email us at privacy@vyaire.com or
write to us at Privacy, Vyaire Medical, Inc., 21625 N. Riverwoods Blvd., Mettawa, IL 60045, USA.

Last updated: May 2024
Case 24-11217-BLS    Doc 403    Filed 08/21/24    Page 25 of 25

File and source

File

gov.uscourts.deb.193283.403.0.pdf

Size

647,326 bytes

SHA-256

5f4f433bf852c6ee3ccf73f2490b11033e10ee8f1d5b8d6743f7db674fbd3d8d

Our copy

gov.uscourts.deb.193283.403.0.pdf

Original

PACER (login required)