Privacy Policy

1. Scope of This Policy

XENIX Medical (“XENIX,” “we,” “our,” or “us”) respects your privacy. This Privacy Policy explains what personal information we collect through xenixmedical.com and any other website or online form that links to this Policy (together, the “Site”), how we use and disclose that information, and the choices and rights available to you.

By using the Site, you acknowledge that you have read this Policy. If you do not agree with it, please do not use the Site or submit information to us.

What this Policy does not cover. This Policy applies only to information collected through the Site and to related offline interactions described below. It does not apply to:

• Protected Health Information (“PHI”) governed by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), or information covered by other medical privacy laws, in any circumstance in which XENIX acts as a covered entity or business associate. XENIX does not operate the Site as a covered entity, and the Site is not intended for the submission of PHI. See Section 2.
• Clinical study data. If you participate in a XENIX-sponsored or XENIX-supported clinical study, the informed consent document you sign for that study governs how your information is processed. The information provided to you for your specific study controls, not this Policy.
• Employee and contractor information. Information we process about our employees, former employees, and independent contractors in the employment context is addressed in separate internal notices. Job applicant information submitted through the Site is addressed in Section 16.
• Third-party websites. See Section 19.

We may issue supplemental or more specific privacy notices for particular products, services, programs, or geographies. Where a supplemental notice applies, it governs to the extent it conflicts with this Policy.

2. Important — Do Not Send Health Information Through This Site

The Site is intended for healthcare professionals, hospital and health system personnel, distributors, suppliers, investors, and job applicants. It is not intended for patients to submit medical information, and it is not a secure channel for health information.

Please do not submit patient names, medical record numbers, diagnoses, images, operative notes, or any other individually identifiable health information through any form, email address, or chat function on the Site.

If you need to report a product complaint or a device-related adverse event, use the dedicated process described in Section 15 rather than a general contact form.

If you are a patient with a question about a XENIX product, please contact your surgeon or treating physician. XENIX cannot provide medical advice. See Terms of Use, Section 3.

3. Information You Provide to Us

We collect the information you choose to give us. Depending on how you interact with the Site, this may include:

• Identifiers and contact details — your name, title or professional role, employer or organization, business mailing address, business email address, and telephone number.
• Professional and credentialing information — your specialty, practice or facility, National Provider Identifier (“NPI”) where you provide it, state license number where you provide it, and areas of clinical interest.
• The content of your message — anything you include in an inquiry, request for information, sales inquiry, or other free-text field.
• Product and complaint information — where you report a product issue: the product involved, lot or serial number, date of use, and a description of the issue. See Section 15.
• Job application information — where you apply for a position: your résumé or CV, employment and education history, and any other information you submit. See Section 16.
• Business diligence information — where you engage with us as a distributor, sales agent, consultant, or supplier. See Section 17.
• Communication preferences — including whether you have asked to receive or stop receiving communications from us.

You are not required to provide any of this information. If you choose not to provide information we reasonably require, it may limit our ability to respond to you or to provide the information you have requested.

4. Information Collected Automatically

When you visit the Site, certain information is collected automatically by our servers and by the analytics tools described in Section 9:

• Internet Protocol (“IP”) address and general geographic location inferred from it
• Browser type and version, operating system, device type, and screen resolution
• Pages and content viewed, time spent on pages, and navigation paths through the Site
• Date and time of your visit
• The referring website or search term that brought you to the Site
• Whether you opened or clicked a link in an email we sent you, where you have consented to receive our emails

We use this information in aggregate to understand how the Site is used, to diagnose technical problems, to maintain security, and to improve the Site. We do not attempt to identify individual visitors from it.

5. How We Use Information

We use personal information for the following business purposes:

• To respond to your inquiries, requests for information, and sales inquiries
• To provide information about our products, technologies, indications, and clinical evidence
• To provide technical support, training, and surgeon education
• To receive, log, and investigate product complaints and to meet our medical device reporting and post-market surveillance obligations, including field corrective actions and recalls
• To monitor the safety and performance of XENIX products
• To manage our relationships with hospital and health system customers, distributors, sales agents, consultants, and suppliers
• To conduct due diligence on prospective business partners and to meet our obligations under anti-corruption, anti-kickback, sanctions, and transparency reporting laws
• To evaluate job applications and manage recruitment
• To send you marketing or educational communications where you have asked to receive them, and to measure whether those communications are useful
• To operate, secure, maintain, and improve the Site, and to detect and prevent fraud, abuse, and unauthorized access
• To comply with applicable law, regulation, subpoena, court order, or government or regulatory request, including reporting obligations to the US Food and Drug Administration and comparable authorities
• To establish, exercise, or defend legal claims, and to enforce our Terms of Use

We will not use your personal information for a materially different, unrelated, or incompatible purpose without providing notice to you.

6. Sensitive Personal Information

The Site is not designed to collect sensitive personal information as that term is defined under California and other state privacy laws.

We do not collect sensitive personal information for the purpose of inferring characteristics about you. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use and disclosure under applicable state law.

If sensitive information reaches us incidentally — for example, because a complaint report contains patient details that we did not request — we handle it under Section 15 and retain it only as required to meet our regulatory obligations.

7. We Do Not Sell or Share Your Personal Information

XENIX does not sell personal information for monetary or other valuable consideration.

XENIX does not share personal information for cross-context behavioral advertising or targeted advertising purposes. We do not operate advertising or retargeting pixels on the Site.

XENIX does not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, and does not engage in automated decision-making of that kind.

We have not sold or shared personal information for these purposes in the preceding twelve months.

8. How We Disclose Information

We disclose personal information only in the following circumstances:

• Service providers. To vendors that perform services on our behalf — website hosting, content delivery, email delivery, customer relationship management, analytics, applicant tracking, background screening, IT support, and professional services. These vendors are permitted to use the information only to perform services for us, are bound by contract to protect it, and are prohibited from using it for their own purposes.
• Affiliates. To XENIX subsidiaries and affiliated entities, for the purposes described in this Policy.
• Business partners. To distributors, sales agents, and consultants who need the information to respond to your inquiry or support your account in your territory.
• Regulatory authorities. To the US Food and Drug Administration and other government, regulatory, or notified bodies where required for medical device reporting, post-market surveillance, field actions, inspections, or transparency reporting.
• Professional advisors. To our attorneys, auditors, accountants, and insurers, where reasonably necessary.
• Legal compliance and protection. Where we believe in good faith that disclosure is required by law, regulation, subpoena, court order, or other legal process, or is necessary to investigate suspected fraud, protect the safety of any person, protect our rights or property, or enforce our Terms of Use.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, liquidation, receivership, or similar transaction or proceeding, in which case personal information may be transferred as a business asset. We will use reasonable efforts to ensure that the recipient honors this Policy or provides notice of any material change.
• With your direction or consent. Where you ask us to, or otherwise consent.

9. Cookies and Analytics

The Site uses cookies and similar technologies. A cookie is a small text file placed on your device that allows a website to recognize your browser across pages and visits.

We use two categories:

• Strictly necessary cookies, which are required for the Site to function — for example, to maintain your session, balance server load, or protect against automated abuse. These cannot be disabled through our Site.
• Analytics cookies, which help us understand how visitors find and use the Site so that we can improve it.

Analytics providers. We use third-party analytics services to measure how the Site is used. These providers collect information about your visit and process it on our behalf, under contracts that limit their use of that information to providing services to us. Some analytics providers make their own opt-out mechanism available, such as a browser add-on or an opt-out page; where one is offered, you may use it to prevent that provider from using your data. You can also limit analytics collection through your browser’s cookie controls, described below.

We do not use advertising, retargeting, or social media tracking pixels on the Site.

Your cookie choices. Most browsers let you refuse new cookies, delete existing cookies, or alert you when a cookie is set. Those controls are found in your browser’s settings or preferences menu. If you disable cookies, you can still use the Site, but some features may not function correctly.

Opt-out preference signals. Because we do not sell or share personal information, there is nothing for a Global Privacy Control or “Do Not Track” signal to opt you out of. We nonetheless honor Global Privacy Control signals with respect to analytics cookies where your browser or extension transmits one.

10. How Long We Keep Information

We keep personal information only as long as reasonably necessary for the purposes described in this Policy, and generally for the shortest period that satisfies our legal, regulatory, and business obligations.

In determining the appropriate retention period for a category of personal information, we consider:

• The volume, nature, and sensitivity of the information
• The potential harm from unauthorized use or disclosure
• The purposes for which we process it, and whether those purposes can be achieved another way
• Applicable legal, regulatory, accounting, and reporting requirements — including medical device recordkeeping requirements, which for complaint and adverse event records are substantially longer than for general business correspondence
• Whether there is a pending or reasonably anticipated complaint, investigation, audit, dispute, or litigation

Where there is a specific legal requirement to keep information longer — for example, a product complaint record, a device history record, or a matter in which we reasonably anticipate litigation — we retain it for that longer period.

We may retain de-identified or aggregated information indefinitely. Once information has been de-identified so that it can no longer reasonably be associated with you, we do not attempt to re-identify it.

11. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, and loss. These include access controls limiting personal information to personnel who need it for their role, encryption of the Site in transit, vendor security diligence, and contractual security obligations on our service providers.

No system is perfectly secure. Transmission of information over the internet is not completely secure, and no method of electronic storage can be guaranteed to be absolutely secure. While we use commercially reasonable measures to protect personal information, we cannot guarantee its security, and any transmission is at your own risk.

If you believe your interaction with us is no longer secure, please contact us immediately using the details in Section 21.

12. Your Choices

Marketing communications. If you receive marketing or educational emails from us, you may unsubscribe at any time using the link in any such email, or by contacting us at privacy@xenixmedical.com. We will process your request promptly and at no charge. Please note that even after you unsubscribe from marketing communications, we may still contact you for non-marketing purposes — for example, to respond to an inquiry you submitted, to address a product complaint, or to communicate a safety or field action notice.

Correcting your information. You may ask us to correct inaccurate information we hold about you at any time using the contact details in Section 21.

Cookies. See Section 9.

13. Your State Privacy Rights

Twenty states currently have comprehensive consumer privacy laws in effect: California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. As additional states enact such laws, we will extend the corresponding protections to their residents.

Not every one of these laws applies to XENIX, and their requirements differ. Where a state privacy law applies to us, we will honor the rights that law gives you. Where no such law applies, we will still consider — and, where reasonably practicable, accommodate — requests of the kinds described below, subject to applicable law and to our legal, regulatory, and recordkeeping obligations. Nothing in this section is intended to grant rights beyond those provided by applicable law.

14. Additional Notices for California Residents

Shine the Light. California Civil Code § 1798.83 permits California residents to request certain information about disclosure of personal information to third parties for their direct marketing purposes. XENIX does not disclose personal information to third parties for their own direct marketing purposes, so there is nothing to report. You may confirm this by writing to privacy@xenixmedical.com.

Do Not Track. California Business and Professions Code § 22575(b)(5) requires us to disclose how we respond to “Do Not Track” signals. Because we do not track visitors across third-party websites for advertising purposes, we do not alter our practices in response to a Do Not Track signal. We do honor Global Privacy Control signals as described in Section 9.

HIPAA and CMIA. For purposes of the California Consumer Privacy Act, “personal information” does not include health or medical information governed by HIPAA or the California Confidentiality of Medical Information Act, clinical trial or other qualifying research data, or information governed by certain sector-specific federal laws.

15. Product Complaints and Adverse Event Reporting

XENIX is a medical device manufacturer. We are required by law to receive, log, evaluate, and where applicable report to regulatory authorities information about product complaints and adverse events involving our devices. This obligation is independent of your privacy rights and, where the two conflict, our regulatory obligations prevail.

How to report. To report a product complaint, a device malfunction, or an adverse event, contact us at:

• Telephone: (888) 594-8633
• Email: COMPLAINTS@XENIXMEDICAL.COM

Please do not report complaints or adverse events through the general Site contact form.

Information we may collect. To investigate and report, we may need to collect information including the reporter’s name and contact details, the healthcare facility and treating clinician, the product and its lot or serial number, the date of the procedure, a description of the event, and clinical details about the patient’s condition and outcome. Where the report concerns patient harm, applicable law may require us to collect and report patient information, including age, sex, and a description of the event and its outcome.

How we handle it. Complaint and adverse event information is handled under our quality management system, is accessible only to personnel who need it for complaint investigation, regulatory reporting, or post-market surveillance, and is retained for the periods required by applicable device regulations. We may disclose it to the US Food and Drug Administration and other regulatory authorities, to notified bodies and auditors, and to our professional advisors and insurers.

You may also report directly to the FDA. You are not required to report through XENIX. Healthcare professionals, patients, and consumers may report adverse events involving medical devices directly to the FDA through MedWatch at www.fda.gov/medwatch or by calling 1-800-FDA-1088.

16. Job Applicants

If you apply for a position with XENIX through the Site, we collect the information you submit — your name and contact details, résumé or CV, employment and education history, professional licenses and certifications, and any other information you choose to provide — and use it to evaluate your application, communicate with you about it, and administer our recruitment process.

We may use an applicant tracking system and, where a conditional offer is made and you consent, third-party background screening and reference checking services. Any background check will be conducted in accordance with the Fair Credit Reporting Act and applicable state law, and you will receive the separate disclosures those laws require.

We retain unsuccessful applicant information for the period required by the applicable federal and state employment, civil rights, and equal opportunity recordkeeping laws that govern us, and for a reasonable period afterward so that we can consider you for other openings. The applicable period depends on the laws of the state in which you applied and on our obligations as an employer, and it may be extended where a charge, claim, audit, investigation, or litigation is pending or reasonably anticipated — in which case we retain the information until that matter is finally resolved.

If you would prefer that we not keep your application on file for future openings, write to privacy@xenixmedical.com and we will remove it from consideration, subject to any records we are legally required to retain.

If you are hired, your information becomes subject to our internal employee privacy notices rather than this Policy.

17. Distributors, Sales Agents, Consultants, and Suppliers

If you engage with XENIX as a distributor, independent sales representative, consultant, healthcare professional advisor, or supplier, we process information about you and your organization in order to enter into and manage that relationship, to maintain quality control, and to satisfy our compliance obligations.

Because we operate in a regulated industry, this may include due diligence appropriate to the risk presented, which may involve processing names, business contact details, employment and professional background, ownership and beneficial ownership information, financial and creditworthiness information, sanctions and debarment screening, publicly available media and professional profiles, and — where permitted by applicable law and relevant to the role — criminal background information. We conduct this diligence to meet our obligations under the federal Anti-Kickback Statute, the Foreign Corrupt Practices Act, applicable sanctions and export control laws, and comparable requirements.

If you are a healthcare professional who receives a payment, honorarium, royalty, research grant, travel reimbursement, or other transfer of value from XENIX, we may be required to report your name, business address, NPI, state license number, and the nature and amount of that transfer to the Centers for Medicare & Medicaid Services under the Physician Payments Sunshine Act, and to comparable state and foreign transparency programs. That reported information becomes publicly available through the CMS Open Payments database. We cannot withhold a required transparency report at your request.

18. Children’s Privacy

This Site is not intended for children under the age of 18. XENIX does not knowingly collect personal information through this Site from children under the age of 18. If XENIX becomes aware that it has inadvertently collected such information, we will promptly delete or destroy it upon becoming aware of the collection.

Some XENIX medical devices and products are intended for use in children or minors. In those cases, XENIX collects minors’ personal information relating to the use of those products for the purposes described in this Policy and with the informed consent of a parent or legal guardian. If that consent is revoked, XENIX will cease processing and will destroy or delete the child’s personal information in accordance with the terms of the informed consent and applicable law.

If you believe a child under 18 has provided personal information through this Site, contact us at privacy@xenixmedical.com.

19. Links to Other Websites

The Site may contain links to websites and resources operated by others, including professional societies, journals, and conference organizers. We provide these links for convenience only. A link is not an endorsement. We do not control these websites and are not responsible for their content, security, or privacy practices. We encourage you to review the privacy policy of any website you visit before providing information to it.

20. Visitors Outside the United States

The Site is operated from the United States and is intended for users located in the United States. If you access the Site from outside the United States, understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your country. By using the Site or submitting information to us, you acknowledge this transfer.

21. Changes to This Policy

We may update this Policy to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the “Last Updated” date at the top and post the updated Policy on the Site. If we make a material change, we will provide more prominent notice — for example, a notice on the Site’s home page or, where we have your address and it is appropriate, by email.

We encourage you to review this Policy periodically. Your continued use of the Site after an update takes effect means you are aware of the current Policy.

22. Contact Us

Questions, requests, and complaints about this Policy or our handling of personal information:

XENIX Medical
Attn: Privacy
149 West Michigan Street
Orlando, FL 32806

Email: privacy@xenixmedical.com

General inquiries: info@xenixmedical.com

Telephone: (888) 594-8633