Pursuant to Legislative Decree No. 196 of June 30, 2003, as amended (the "Privacy Code") and the European Regulation No. 679 of 2016 (the "Privacy Regulation"), MIR - Medical International Research S.p.A. aims to inform you and all users and/or visitors of the website (respectively "Users" and the "Website") about the use of personal data, log files, and cookies collected through the Website.

1. Data Controller, Data Processors, and Data Protection Officer

The Data Controller of personal data is MIR - Medical International Research S.p.A., with registered office in Rome 00173, Viale Luigi Schiavonetti 270, tax code and VAT number 04564101006, telephone +39 06 227547777, and email mir@spirometry.com.

(hereinafter the "Controller").

The updated list of designated Data Processors can be provided upon request by interested parties and/or Users.

The contact details of the designated Data Protection Officer (pursuant to Article 37 of the Privacy Regulation) are available on the Company’s website.

2. Information Automatically Collected by the Website and Cookies

a) Information Automatically Collected

Like all websites, our Website uses log files, where information collected in an automated manner during your visits is stored. The computer systems and software procedures used to operate the Website automatically acquire certain information during use, the transmission of which is implicit in the use of Internet communication protocols.

The collected information includes:

• Internet Protocol (IP) address or the domain name of the device you used;
• Type of browser and device parameters used to connect to the Website;
• URI (Uniform Resource Identifier) addresses of the requested resources or the method used to submit the request to the server;
• Internet service provider (ISP) name;
• Date and time of the visit;
• Referral webpage and exit page of the User;
• Possibly the number of clicks;
• Size of the file obtained in response;
• Numerical code indicating the server response status (success, error, etc.);
• Other parameters related to the operating system and environment of your device.

This information is processed in an automated form and collected exclusively in aggregate form to verify the correct functioning of the Website.

b) Cookies

Cookies are used on the Website. Cookies are text files stored on a computer that allow recording some parameters and data communicated to the computer system through the browser you use. These tools allow analyzing your habits in using the Website for different purposes: performing computer authentications, session monitoring, storing information about specific configurations regarding users accessing the server, storing preferences, etc.

Cookies are distinguished into:

3. Technical cookies: used to perform navigation or provide a service you requested. Without these cookies, some operations could not be completed or would be more complex and/or less secure.

4. Profiling cookies: used to track your navigation and create profiles on your tastes, habits, choices, etc. This way, advertising messages can be sent to your device in line with your preferences expressed during previous online navigation.

This site does not use profiling cookies: none of the personal data collected during user navigation is used to send advertising messages reflecting the user's preferences expressed during Internet navigation.

During Website navigation, you may also receive cookies sent by different sites or web servers (hereinafter "Third Parties"). The Third Parties that use cookies on our Website are:

• Google Analytics, a service provided by Google Inc. (“Google”), whose policy can be found at https://marketingplatform.google.com/about/?hl=en. You can refuse the installation of cookies used by Google Analytics by selecting the corresponding settings in your Google browser options; specifically, the Google Analytics service described above uses the following cookies:
  • _GA: These cookies are used to collect information on how visitors use the website. The information is used to prepare reports that help us improve the website. Cookies collect information in an anonymous form, including the number of visitors to the website, the websites from which visitors have arrived, and the web pages visited within the website.
  • _GAT / _GID: For more information on the collection, storage, and use of personal data by Google, as a Third Party under the Regulation, please refer to Google's privacy policy at the following link: https://policies.google.com/privacy?hl=en

By using the Website, you accept the use of technical cookies and consent to the processing of data collected by Third Parties.

3. Social Network Plug-ins

The Website may contain plug-ins from social networks (e.g., Facebook, X, etc.). If you access one of our web pages equipped with such a plug-in, the internet browser connects directly to the social network's servers, and the plug-in is displayed on the screen thanks to the connection with the browser. The plug-in communicates to the social network server which pages you have visited. If a social network user visits our web pages while logged into their social account, their personal data could be associated with the social account.

Even if you use the plug-in functions (e.g., by clicking the “Like” button or posting a comment), the information will be associated with your social network account. If you do not wish to associate the use of the Website with your social network account, you must log out of the social network before visiting it. Further information on the collection and use of data by social networks, as well as the rights and methods available to protect your privacy in this context, can be found on the social networks' pages.

4. Personal Data You Provide Using the Website: Purpose of Processing

Your data is needed to allow you to:

• access the Website and navigate it
• register/sign up and access the services offered therein (e.g., contacts, newsletters, etc.) as requested by you

Your data is processed for the following purposes:

(i) compliance with legal obligations

(ii) technical management of the Website

(iii) sending information requested by the User

(iv) updating, with express consent, on all our promotional and direct marketing initiatives, including sending advertising and/or promotional material through automated and/or traditional contact methods, such as push notifications, emails (the "Newsletter") and/or SMS, MMS (the "Marketing Services").

In accordance with the "Guidelines on Promotional Activities and Spam Prevention" of July 4, 2013, we highlight that any consent you give for sending commercial, promotional, and marketing communications through automated tools will also extend to traditional contact methods.

The data you provide will be processed mainly by electronic means under the authority of the Data Controller, by persons specifically appointed, designated, and instructed to process data, in accordance with Articles 28 and 29 of the Privacy Regulation. We inform you that appropriate security measures are observed pursuant to Articles 5 and 32 of the Privacy Regulation to prevent data loss, unlawful or incorrect use, and unauthorized access.

5. Nature of Data Provision and Legal Basis of Processing

For the purposes set out in points (i), (ii), and (iii) of Article 4 above, providing your personal data is necessary as without it you cannot use the services offered by the Website. Consequently, for the purpose set out in point (i), the legal basis of the processing is compliance with legal obligations pursuant to Article 6(1)(c) of the Privacy Regulation, while for the purposes set out in points (ii) and (iii), the legal basis of the processing is the performance of the services provided through the Website and requested by you, pursuant to Article 6(1)(b) of the Privacy Regulation.

For the purpose set out in point (iii), providing data is optional and the refusal to provide it and give consent will prevent the company from proceeding with the marketing activities indicated therein.

The newsletter is sent by email to those who request it by entering their email address in the subscription form. Providing data is optional. Refusal to provide data makes it impossible to obtain the newsletter service and any promotional communications for which specific and separate consent is required.

6. To Whom and Where We Can Transmit Your Data

Your data may be communicated within the EU to structures, subjects, and external companies (including consultants and service providers) used by the Data Controller for the management of the Website and for the performance of activities related to, instrumental to, or consequent to the execution of the services offered by the Website. Further details regarding the above are contained in specific information provided or displayed on the Website and prepared for the related services upon request.

Further details regarding the above are contained in specific information provided or displayed on the Website and prepared for the related services upon request.

7. Your Rights

You can exercise your rights under Articles 15 et seq. of the Privacy Regulation at any time, for access, rectification, transformation, blocking, deletion, restriction of processing, in the manner and within the limits established by Article 12 of the Privacy Regulation.

The complete model for exercising rights is available at the link Model for exercising rights in matters of personal data protection with instructions for filling it out and sending it to the Data Controller.

In the event of a delayed or inadequate response from the company, or if you believe a violation of the Privacy Code and/or Privacy Regulation exists, you can file a complaint with the Data Protection Authority at: www.gpdp.en - www.garanteprivacy.en, Email: garante@gpdp.it, Fax: (+39) 06.69677.3785, Telephone switchboard: (+39) 06.69677.1.

8. Duration of Processing

Subject to legal obligations, personal data will be retained for a limited period, based on criteria related to the nature of the services provided.

The data provided may be retained for marketing purposes for no more than 24 months from their registration unless they are anonymized in a way that does not allow identification, even indirectly or by linking other databases.

Data necessary for sending the Newsletter will be processed in an "OPT-OUT" management model, i.e., until the data subject exercises the right to unsubscribe from the service.

9. Security Measures

Your data is processed through the Website in compliance with applicable law and using appropriate security measures in accordance with the current regulations, including Articles 5 and 32 of the Privacy Regulation.

In this regard, it is confirmed, among other things, the adoption of appropriate security measures to prevent unauthorized access, theft, disclosure, unauthorized modification, or destruction of your data.

10. Changes to the Privacy Policy

The Data Controller reserves the right to make changes to this Privacy Policy. In such a case, you will be promptly informed when you use the Website again.

Model for Exercising Rights in Matters of Personal Data Protection

To access the document regarding the exercise of rights in matters of personal data protection, please follow this link: Model for exercising rights in matters of personal data protection.