In accordance with the provisions of the Regulation (EU) 2016/679 679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”), and the Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (“LOPDyDD”) we inform you below of our data protection policy.

1. Data Controller’s details; about Ankyras’ and personal data collected

1.1 Data Controller details:

Mentice Spain SL: Mentice Spain SL

ID number: CIF - B72624646

Postal address: Rambla Catalunya, 53 4 - H Barcelona 08007

Phone: (+34) 93 328 39 64

Email: ankyras@mentice.com

Contact details of the Data Protection Officer (DPO): ankyras@mentice.com

1.2 About Ankyras

ANKYRAS is a medical software intended to assist healthcare professionals in the selection of a proper braided device for treatment of intracranial aneurysms, also allowing them to assess the fit of each particular braided device in the patients’ anatomy. The software allows the prediction of the final position of the device after being placed inside the vascular patient anatomy, the changes in the braided device geometry after being placed inside the vascular patient anatomy and the geometrical characteristics of the braided device such as the radial expansion and the local surface porosity.

It is intended for use by qualified medical professionals experienced in examining and evaluating 3D rotational angiography images, for the purpose of obtaining diagnostic information as part of a comprehensive diagnostic decision-making process.

ANKYRAS is intended to be used with 3D rotational angiography (3DRA) images and magnetic resonances (MR).

1.3 Personal data collected

ANKYRAS collects the following personal data when the users first sign up on Ankyras :

Name

E-mail address

Institution affiliation

Country where the institution is located

User’s role in the institution

Telephone number (optionally)

ANKYRAS does not collect special categories of data, such as, information regarding your race, political opinion, religion or sexual orientation, nor use it for marketing analysis.

Your personal data is used to assign you with a unique identification number (ID number) that allows to identify and provide you with the Ankyras’ services detailed in section 1.2 above. The ID number will uniquely identify you if you sign up using the same account on a new device.

We also inform you that, as data processor, Mentice Spain SL will also have access to the case data (patient data) uploaded by you in Ankyras, in your condition as data controller of such personal data.

2. Purpose, legitimacy of processing and period of data retention

Below you will find a table identifying the purpose of the treatment of your personal data, that is, the reason why ANKYRAS treats your personal data, the legal basis that allows the treatment for the indicated purpose and the period of data retention.

Purpouse	Legitimacy	Period of data retention
Managing your registration as a user of the Ankyras’ application, owned by Mentice Spain SL, in order to give you access to it.	Execution of the agreement consisting in the user’s registration in the Ankyras’ application.	As long as the users do no express their willingness to unsubscribe as an Ankyras’ application user.
To manage your profile as a user of the referred Ankyras’ application, give you access to the information – case data – uploaded by your side and, therefore, provide you with the Ankyras’ services.
Management, where appropriate, of your rights as an interested party.	The fulfilment of a legal obligation applicable to Mentice Spain SL.	During the time necessary to resolve requests and/or complaints.

In the event that Mentice Spain SL treats your personal data for a purpose other than those listed in the above table, Mentice Spain SL will inform you prior to processing and provide you with any additional relevant information in accordance with applicable law, and shall request your consent, if applicable, if such consent is necessary to justify lawful processing.

Likewise, we inform you that, apart from the aforementioned retention periods, we will keep your personal data during the statute limitation period in order to fulfil our legal obligations, to exercise our legal rights (to lodge or defend a claim). Likewise, the provisions of the corporate regulations relating to archiving and retention of documentation periods shall apply.

3. Recipients of the personal data: assignees and data processors

We inform you that your personal data will not be communicated to third parties, unless legally obligated to do so.

Additionally, we inform you that, in certain cases, we may provide access to your personal data to third parties (Data Processors) which provide us with application maintenance or hosting services, among others, and which help us to manage our Ankyras’ application, properly, efficiently and within the legal framework. In this regard, we inform you that Mentice Spain SL stores its data on a server located in Germany owned by Hetzner GmbH

The processing of personal data by these Data Processors, with whom a contract has been concluded under Article 28 of the GDPR and Article 33 of the LOPDyDD, may be carried out both within and outside the European Union territory. Processing carried out outside the European Union territory is undertaken on the basis of an adequacy decision (third country or international organization guaranteeing an adequate level of protection).

4. Data subject right

We hereby inform you that, in relation to the processing of your personal data, you have the right:

To obtain confirmation as to whether or not Mentice Spain SL is processing your personal data.

To request access, rectification of inaccurate or incomplete data and, where appropriate, the deletion of your data when, among other reasons, they are no longer necessary for the purposes for which they were collected.

In certain circumstances, you may:

request a restriction on the processing of your personal data, in which case we will only retain it for the purpose of lodging or defending claims;

for reasons related to your particular situation, object to the processing of your personal data, in which case Mentice Spain SL will cease to process it except for compelling legitimate reasons, or to lodge or defend any claims; and, if you have given your consent for a particular purpose.

To receive the personal data which concerns you, and which you have provided to Mentice Spain SL, in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance from Mentice Spain SL. In this regard, you may request Mentice Spain SL to transmit your personal data directly, if technically feasible, to the new controller indicated in your communication.

To withdraw your consent if you have given your consent for a particular purpose. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to withdrawal.

You may exercise your rights at any time and free of charge by:

A digitally signed request (electronic ID card or other recognized certificate) to Mentice Spain SL via e-mail to ankyras@mentice.com, or

Through written communication addressed to Mentice Spain SL MEDICAL SL, with registered office at c/ París, nº 179, 2º2ª, 08007 Barcelona (Ref. GDPR).

The content of the application must include: your name and surname; a photocopy of your national identity card, passport or other valid document identifying you and, if necessary, the person representing you, as well as the electronic document or instrument accrediting such representation; detail of the request made, address for service, date and signature of the applicant; and supporting documents for the request you make, if necessary. Additional information about your rights can be found here.

If you consider that the processing of personal data concerning you infringes applicable legislation or you are simply not satisfied with the exercise of your rights, you have the right to file a complaint before the Spanish Data Protection Agency, by any of the following means: (i) by calling +34 901 100 099, or +34 912 663 517; (ii) by electronic means, by visiting the website https://sedeagpd.gob.es/sede-electronica-web ; (iii) in person, at Calle Jorge Juan, 6, 28001 Madrid.