Privacy Policy

Effective date: October 7, 2026

MYL Instruments Inc. and its affiliates (“MYL,” “we,” “us,” or “our”) are committed to protecting personal information and handling it responsibly.

This Privacy Policy explains how MYL collects, uses, communicates, retains, and protects personal information in connection with our website, business activities, products, and services.

When MYL provides services to a hospital, health system, surgical facility, or other organization, additional privacy, security, data-processing, contractual, or regulatory requirements may apply. In those circumstances, the applicable agreement and authorized instructions of the institution govern MYL’s processing on its behalf.

1. Information We May Collect

The information processed by MYL depends on how an individual interacts with us and, for institutional deployments, on the services and configuration selected by the customer.

Website and Business Information

We may collect information such as:

• name;
• business email address;
• telephone number;
• employer or organization;
• job title or professional role;
• information provided through messages, forms, demo requests, or other communications;
• account and business relationship information; and
• information relating to customer support or commercial discussions.

Technical and Usage Information

When our website, applications, or services are used, we may collect technical information such as:

• browser and device information;
• IP address;
• authentication and security information;
• system and application logs;
• dates and times of access;
• diagnostic information; and
• website or service usage information.

We may use cookies and similar technologies for necessary website functions, security, analytics, and related purposes. Where consent is required for optional technologies, appropriate choices will be provided.

Information Processed Through MYL Services

Depending on the service, deployment, configuration, and instructions of the institution using MYL, our systems may process operational, workflow, audiovisual, device, system, or other information generated or received in connection with healthcare operations.

Some information may constitute personal information, sensitive personal information, health information, or other protected information under applicable law.

The categories of information processed, authorized purposes, retention requirements, access rights, and other safeguards may be further limited by the agreement between MYL and the applicable institution.

2. How Information Is Collected

MYL may collect information:

• directly from an individual;
• through our website or forms;
• through communications with MYL;
• from an organization with which an individual is associated;
• through MYL products or services deployed by an institution;
• through systems or sources made available by an authorized customer; and
• automatically through websites, applications, devices, and security systems.

Where MYL processes information on behalf of an institution, that institution may be responsible for determining the purposes of collection and for providing any notices or obtaining any authorizations required by law.

3. How We Use Personal Information

MYL may use personal information, where permitted, for purposes such as:

• providing, configuring, maintaining, and supporting our products and services;
• performing obligations to customers;
• supporting authorized healthcare operational workflows;
• responding to requests, inquiries, and support matters;
• authenticating users and administering accounts;
• maintaining security and preventing unauthorized or improper use;
• investigating incidents;
• monitoring reliability and performance;
• performing testing, quality assurance, and validation;
• complying with legal, regulatory, contractual, audit, and certification requirements;
• maintaining appropriate business and compliance records;
• communicating with customers and prospective customers;
• developing and improving our products and services where permitted by applicable law and contract; and
• other purposes disclosed at the time of collection or otherwise permitted by law.

MYL seeks to limit its collection and use of personal information to what is reasonably necessary for the applicable purposes.

4. Artificial Intelligence and Automated Technologies

MYL develops and uses artificial intelligence, machine learning, computer vision, automation, analytics, and related technologies in certain products and services.

When these technologies process personal information, that information remains subject to the applicable privacy, security, contractual, and access-control requirements.

MYL’s products are not intended to independently diagnose a medical condition, prescribe treatment, or replace the judgment of qualified healthcare professionals.

MYL’s services are not designed to make employment, clinical treatment, or other legally significant decisions concerning an individual based exclusively on automated processing.

If MYL engages in processing that is subject to specific legal requirements concerning automated decision-making, MYL will comply with the applicable transparency and review requirements.

The specific architecture, algorithms, models, infrastructure, processing methods, validation mechanisms, and security implementation used by MYL constitute confidential technical and security information and are not described in this public Policy.

Additional information may be provided to customers, regulators, auditors, certification bodies, or other authorized parties where appropriate or required.

5. De-Identified and Anonymized Information

MYL distinguishes between information that has been de-identified, pseudonymized, masked, or otherwise protected and information that has been anonymized in accordance with applicable legal requirements.

Removing or obscuring direct identifiers does not, by itself, necessarily make information legally anonymous.

Information that remains personal information continues to be protected in accordance with applicable law and contractual requirements.

Where information has been anonymized in accordance with applicable law and applicable contractual requirements, MYL may use that anonymized information for documented serious and legitimate purposes permitted by law.

Such purposes may include:

• research and analysis;
• statistical analysis;
• technological development;
• product development;
• testing and validation;
• quality assurance;
• safety, security, and reliability;
• performance evaluation;
• improvement of products and services; and
• other legitimate purposes permitted by applicable law and contract.

MYL does not consider information legally anonymized merely because direct identifiers have been removed, obscured, or replaced.

Any use of anonymized information remains subject to applicable legal, contractual, and governance requirements.

Nothing in this Policy authorizes MYL to use information in a manner prohibited by applicable law or an applicable customer agreement.

6. Institutional Customers and Authorized Purposes

Hospitals and other institutional customers retain the rights and responsibilities established by applicable law and their agreements with MYL.

When MYL processes personal information on behalf of an institution, it does so in accordance with the applicable agreement, authorized purposes, and legal requirements.

Requirements relating to matters such as:

• data residency;
• access;
• authorized uses;
• retention;
• deletion;
• security; and
• permitted disclosures

may therefore vary depending on the institution, deployment, and jurisdiction.

Deployment-specific requirements are addressed through applicable contractual, privacy, security, and governance documentation rather than through this general public Policy.

7. Communication of Personal Information

MYL may communicate personal information, where necessary and legally permitted, to:

• the customer or institution on whose behalf information is processed;
• service providers supporting functions such as infrastructure, cybersecurity, communications, hosting, business operations, analytics, or support;
• professional advisers such as lawyers, accountants, auditors, insurers, and compliance advisers;
• regulatory authorities, government agencies, courts, or law-enforcement bodies where required or permitted by law;
• parties involved in a financing, reorganization, merger, acquisition, or similar corporate transaction, subject to appropriate safeguards; and
• other parties where authorized by the individual concerned, the applicable institution, contract, or law.

Access by service providers is limited as appropriate to the services they provide and is subject to applicable confidentiality, contractual, and security requirements.

MYL does not sell patient information or protected clinical information to data brokers or advertisers.

8. Processing Outside Québec or Canada

MYL and certain service providers may operate in more than one jurisdiction.

Depending on the type of information and the applicable service, certain information may therefore be processed outside Québec or outside Canada.

Where required by law, MYL assesses the privacy implications associated with communications outside Québec and implements appropriate contractual, organizational, and security safeguards.

Additional data-residency requirements may apply to institutional deployments pursuant to customer agreements or applicable regulatory requirements.

Protected information is handled in accordance with the requirements applicable to the relevant deployment.

Certain business, network, security, technical, or operational information may be processed by service providers in other jurisdictions where legally and contractually permitted.

9. Retention, Destruction, and Anonymization

MYL retains personal information only for as long as reasonably necessary for the purposes for which it was collected or used, or as required by applicable law, contract, audit, security, dispute-resolution, or legitimate recordkeeping requirements.

Retention periods may vary depending on:

• the nature and sensitivity of the information;
• the purpose for which it is processed;
• applicable contractual requirements;
• legal and regulatory obligations; and
• legitimate security, audit, and compliance requirements.

When personal information is no longer required, MYL takes appropriate measures to destroy it or, where permitted, anonymize it in accordance with applicable legal requirements.

Where anonymization is used, MYL maintains governance processes appropriate to the applicable legal requirements, including assessment of re-identification risk where required.

10. Security

MYL maintains administrative, organizational, physical, and technical safeguards designed to protect information against unauthorized access, use, communication, modification, loss, or destruction.

Safeguards are selected according to factors such as the nature, sensitivity, volume, purpose, and context of the information.

Access to protected information is restricted according to authorization and legitimate operational need.

No security system can eliminate all risk. MYL maintains processes for identifying, managing, and responding to privacy and security incidents.

11. Privacy Governance

MYL maintains privacy governance policies and practices appropriate to the nature of its activities.

These include measures relating to:

• roles and responsibilities concerning personal information;
• access and authorization;
• information retention and destruction;
• employee privacy and security training;
• management of service providers;
• privacy impact assessments where required;
• confidentiality and security incident management;
• requests relating to privacy rights; and
• privacy complaints.

MYL’s Privacy Officer oversees these practices.

12. Individual Rights

Depending on applicable law, individuals may have rights relating to their personal information, including rights to:

• request access;
• request correction of inaccurate or incomplete information;
• withdraw consent where processing is based on consent, subject to applicable limitations;
• obtain information concerning the collection, use, or communication of their information;
• raise a concern or complaint; and
• exercise other rights provided by applicable law.

Where MYL processes information solely on behalf of a hospital or other institutional customer, MYL may direct the request to that institution or assist it in responding.

Identity verification may be required before a request is processed.

13. Commercial Communications

Where permitted by law, MYL may use business contact information to respond to inquiries and communicate about its products, services, events, or company developments.

Individuals may request that MYL stop sending promotional communications by using an available unsubscribe mechanism or by contacting us.

14. Website Audience

MYL’s corporate website is intended primarily for healthcare professionals, organizations, business contacts, and other adults interested in MYL.

This does not limit the use of MYL services by authorized healthcare institutions in environments involving pediatric patients or other patient populations in accordance with applicable legal and institutional requirements.

15. Changes to This Policy

MYL may update this Privacy Policy as its activities, products, services, or legal obligations evolve.

Where required, notice of material changes will be provided through the website or by another appropriate means.

The effective date appearing at the beginning of this Policy identifies when the current version became effective.

16. Privacy Officer and Contact Information

Questions, privacy requests, and complaints may be directed to:

Privacy Officer
MYL Instruments Inc.
Email: contact@mylinstruments.com

MYL will review privacy requests and complaints in accordance with applicable law.