This service (hereinafter "App") is provided by Brainlab AG, on behalf of its affiliate Level Ex, Inc. (hereinafter "we" or "us" or ”Brainlab”) as the controller within the meaning of the applicable data protection law.

The App is an educational app that allows you, the user, to deepen your knowledge on spinal pathologies and advance your competence in surgical treatments of the spine.

When you use the App, we process personal data about you. Personal data means any information relating to an identified or identifiable natural person. Because the protection of your privacy when using the App is important to us, we would like to provide you with the following information about which personal data we process when you use the App and how we handle this data. In addition, we will inform you about the legal basis for processing your data and, if processing is necessary to protect our legitimate interests, also about our legitimate interests.

You can access this privacy policy at any time within the App under the menu item "Menu > Options > Privacy Policy".

Contact details of the controller and the Data Representative in the EU for GDPR Compliance

The responsible party within the meaning of the General Data Protection Regulation (GDPR) is:

Brainlab AG
Olof-Palme-Straße 9
81829 Munich
E-Mail: legal@brainlab.com

personal/confidential
Katharina Ruhenstroth
c/o intersoft consulting services AG
Beim Strohhause 17
20097 Hamburg
www.intersoft-consulting.de

E-Mail: legal@brainlab.com

Certain information is already processed automatically as soon as you use the App. We have listed

exactly which personal data is processed for you below:

3.1 Information collected when downloading the App

When you download the App, no personal data is processed by us.

3.2 Information collected when using the App

3.2.1 Information that is collected automatically

When you use the App, we automatically collect certain technical information that is required for the use of the App.

This includes: IP address, device identifiers, in particular the make and model of your mobile device, the operating system, its version and information about App usage.

This data is processed automatically.

The data processing is necessary to provide you with the service and the associated functions and also serves to improve the functions and features of our App.

The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the functionality anderror-free provision of the App for you as a user.

3.2.2 Creation of a user account (registration) and login

Your instructor will create an account for you and send you a link to your e-mail address. We use your access data (e-mail address, first name, surname and password) to grant you access to your user account and to manage it ("mandatory data").

We use the mandatory information to authenticate you when you log in and to follow up on requests to reset your password. We process and use the data during registration or login (1) to verify your authorization to manage the user account; (2) to contact you to send you technical or legal information, updates, security messages or other messages relating to the management of the user account.

This data processing is justified by the fact that (1) the processing is necessary for the performance of the contract between you as the data subject and your employer pursuant to Art. 6 para. 1 lit. b) GDPR for your further training and the use of the App, (2) we have a legitimate interest in ensuring the functionality and error-free operation of the App within the meaning of Art. 6 para. 1 lit. f) GDPR.

3.2.3 Processing of Personal Data During Game Usage

When you use our mobile learning application, certain personal data is processed. In particular, your game performance and results are stored. This information is used to monitor and evaluate your learning progress. Please note that your instructors will have access to this data in order to monitor your progress and improve your learning experience.

The data processing is justified by the fact that (1) the processing is necessary for the performance of the contract between you as the data subject and your employer pursuant to Art. 6 para. 1 lit. b) GDPR for your further training and the use of the App, (2) we have a legitimate interest in providing the basic functions of the App within the meaning of Art. 6 para. 1 lit. f) GDPR.

3.2.4 Access authorizations in the context of using the App

When you use our App, we use your data. In doing so, the App accesses certain functions of your cell phone, provided that you have previously consented to this access.

The App requires the following authorizations:

• Internet access: This is required to save your data on our servers.

• The delivery of push notifications for the purpose of receiving messages. (optional)

Usage data is processed and used to provide the service. The legal basis for the data processing that is necessary for the function of the App and thus ensures the proper functioning of the App is our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR.

The legal basis for such data processing that is not required for the function of the App and whose access can be optionally determined by you is your consent in accordance with Art. 6 para. 1 lit. a) GDPR. The access authorizations and thus your consent to the data processing is requested when using the App at the appropriate point that requires access to the functions.

Your personal data will only be passed on, without your express prior consent, and in addition to the cases explicitly mentioned in this privacy policy, if it is legally permissible or necessary. This may be the case, for example, if the processing is necessary to protect the vital interests of the user or another natural person. Before you are redirected to websites of other providers, you as a user will be clearly informed of this.

Data recipient is Level Ex Inc., 180 N. LaSalle, Suite 500, Chicago, IL 60601, USA, a subsidiary of Brainlab AG, which developed the APP and provides support on behalf of Brainlab AG.

4.1 Snowflake

This App uses Snowflake, an analytics service provided by Snowflake Inc., Suite 3A, 106 East Babcock Street, Bozeman, Montana 59715, USA. This service is intended for carrying out analyses of mobile apps and can collect various information about the user device.

The use of the service provider allows us to monitor and analyze traffic and track user behavior for IT security or troubleshooting purposes. In addition, the data is necessary to provide feedback to the instructor portal so that progress and scores can be monitored by the instructor.

For information on data processing by Snowflake, please refer to the provider’s privacy policy: www.snowflake.com/privacy-policy/

The legal basis for the data processing for IT security purposes is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the smooth and secure operation of our App. You have the right to object to the processing pursuant to Art. 21 GDPR. Whether the objection is successful must be determined in a balancing of interests.

The data processing to track your progress is justified by the fact that (1) the processing is necessary for the performance of the contract between you as the data subject and your employer pursuant to Art. 6 para. 1 lit. b) GDPR for your further training and the use of the App, and (2) we have a legitimate interest in providing the basic functions of the App within the meaning of Art. 6 para. 1 lit. f) GDPR.

4.2 PlayFab

This App uses PlayFab, an analytics service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. This service is intended for carrying out analyses of mobile apps and can collect various information about the user device.

The use of the service provider allows us to monitor and analyze traffic and track user behavior for IT security or troubleshooting purposes. In addition, the data is necessary to provide feedback to the instructor portal so that progress and scores can be monitored by the instructor.

For information on data processing by PlayFab, please refer to the provider’s privacy policy: https://privacy.microsoft.com/de-DE/

The legal basis for the data processing for IT security purposes is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the smooth and secure operation of our App. You have the right to object to the processing pursuant to Art. 21 GDPR. Whether the objection is successful must be determined in a balancing of interests.

The data processing to track your progress is justified by the fact that (1) the processing is necessary for the performance of the contract between you as the data subject and your employer pursuant to Art. 6 para. 1 lit. b) GDPR for your further training and the use of the App, and (2) we have a legitimate interest in providing the basic functions of the App within the meaning of Art. 6 para. 1 lit. f) GDPR.

4.3 Crash reports

In the event the App crashes or you, as the user, experience any malfunctions or issues while utilizing the App, please reach out to Xplore Spine support at the following for assistance, xplore.spine@level-ex.com

We generally only store personal data until the respective purpose for which the data was collected has been achieved. In the context of a business relationship with you, we store your personal data for as long as the business relationship lasts; this also includes the initiation and execution of a contract as well as the regular limitation period. In addition, we store the data if and insofar as we are subject to statutory retention obligations.

If you have given us your consent for a processing operation, the data associated with the granting of consent will be stored until revoked or at the latest for the duration of the processing operation and after termination of the same within the scope of the statute of limitations.

We generally delete contact requests that you have sent us in the context of using the App after five (5) years.

You have the following rights vis-à-vis us with regard to your personal data:

6.1 General rights

You have the right to information, rectification, erasure, restriction of processing, objection to processing and data portability. If processing is based on your consent, you have the right to withdraw this consent with effect for the future.

6.2 Rights in data processing according to the legitimate interest

In accordance with Art. 21 para. 1 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 e GDPR (data processing in the public interest) or on Art. 6 para. 1 f GDPR (data processing to protect a legitimate interest); this also applies to profiling based on this provision. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

6.3 Rights in direct advertising

If we process your personal data for direct marketing purposes, you have the right under Art. 21 (2) GDPR to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for the purposes of direct marketing, we will no longer process your personal data for these purposes.

6.4 Right to lodge a complaint with a supervisory authority

You also have the right to complain to a competent data protection supervisory authority about the processing of your personal data by us.

7.1 Governing Law

If you are a resident of the United States, any dispute between you and Brainlab arising out of or relating to this Privacy Policy, the website or its content shall be governed by, and will be construed in accordance with, the laws of the States of New York, without regard to choice of law principles. You irrevocably agree that the courts located in or for the State of Illinois, Cook County, are the sole and exclusive forum and venue for any dispute, as the most convenient and appropriate to address any disputes, and you agree to submit to the jurisdiction and venue of such courts.

7.2 Use and Transfer of Non-Personally Identifiable Information

Non-Personally Identifiable Information refers to data that is anonymously stored in a log file, collected by cookies or similar technology, and any other information that does not personally identify the individual to whom the information relates, such as information that is aggregated by Brainlab or a third party, or information that is not linked to any individual’s personally identifiable information.

In addition to the uses described above, Brainlab may use and disclose non-personally identifiable information in a variety of ways, so long as Brainlab uses such information in its de-identified form. These uses may include, but are not limited to, uses for administering the App; analyzing App trends and how the App is used; improving App navigation; analyzing App performance and diagnosing problems; improving the services we offer; analyzing and developing advertisements and advertising campaigns; analyzing the demographics, interests and preferences of App users.

Brainlab may also use your non-personally identifiable information to present you with targeted content and advertisements (including on third party websites and apps) based on your nonpersonally identifiable information collected by us and third parties over time, to optimize and determine the effectiveness of content and advertisements, to analyze your interactions with content and advertisements and how those interactions relate to your visits to the Site. Some of our third party partners may participate in the Digital Advertising Alliances Self-Regulatory Program for Online Behavioral Advertising and provide consumers with the ability to opt out of targeted advertising based on web activity tracking. For more information about the foregoing, please visit http://www.aboutads.info/choices/. Please note that even if our third party partners participate in this program and you opt out of targeted advertising based on web activity tracking, you may still receive standard ads from us and targeted ads from third parties.You may need to click on the link again and follow the instructions provided if you delete cookies or similar technologies or use a different computer, device or browser.

7.3 Links

You may have the opportunity to follow links in the App to other websites that may be of interest to you. Neither Brainlab nor its affiliates are responsible for the privacy practices of any other sites, or the content provided thereon. Therefore, the privacy policies with respect to other sites may differ from those applicable to the website. We encourage you to review the privacy policies of each other site.

7.4 No Medical Advice

Brainlab is not a healthcare institution or medical facility and neither Brainlab nor the App provides any medical advice. You are solely responsible for all medical decisions, including any diagnosis, use of medical professionals, treatment or treatment plan, made by you as the result of the use of the website or any communications with Brainlab, regardless of any referral or suggestion made by Brainlab.

7.5 Changes to this Privacy Policy

Any revisions to this Privacy Policy will be effective immediately upon posting. Any material changes in the way we use personally identifiable information will apply only to information collected thereafter, unless we provide notice or have other communications with you, such as a pop-up notification banner. Each time you access or use the App, provide information to Brainlab online, or click on Brainlab’s digital advertisements on third party websites or applications, you signify your acceptance of the then-current Privacy Policy. If you do not accept this Privacy Policy, you are not authorized to access, use or browse the Website, provide information to Brainlab, or click on Brainlab’s digital advertisements on third party websites or applications.