Privacy Statement

Privacy Policy

Last updated: May 30, 2024

This Privacy Policy governs the privacy practices for Carbon Medical Technologies, Inc., a Minnesota corporation (“we”, “us”, or “our”) and describes how we collect, use, and share personal information when you access our website, www.carbonmed.com (the “Site”). This Privacy Policy specifies:

What personal information we collect about you through our Site.
How personal information is used and with whom it may be shared.
What choices are available to you regarding the use of your personal information.
What our security practices are to protect the misuse of your personal information.
How you can correct any inaccuracies in your personal information.

Information We Collect

We only have access to and/or collect information that you voluntarily provide us via our Site, any email you send us, or other direct contact from you. For purposes of this Privacy Policy, “Personal Information” includes all personally identifiable information that is specific to you, such as name, address, phone number, email address, etc. Except has specifically noted herein, we do not provide any Personal Information to any unaffiliated third party.

Contact Information: When you contact us through the contact form on the Site, we collect certain Personal Information, including your name and email address.
Payment Information: We also collect certain financial information related to sales orders, including name, billing address, shipping address, and debit card, or credit card number.
Usage Information: We may collect information about you through your use of our Site with software application tools and data files (such as cookies and web log files), IP addresses, device state information, unique device identifiers, device hardware and OS information (“Usage Information”). You may be able to control such Usage Information through the control settings on your device or browser; however removing such Usage Information tools may impact the convenience to use or the functionality of the Site. Please see our Cookie Policy for more information about how we use cookies, which can be found here.
Location Information: We may collect and process information through our Site about the location of your device using GPS or other location technologies, such as sensor data from your mobile device providing information about nearby Wi-Fi access points and cellular network towers (“Location Information”). We use Location Information solely as necessary to analyze and improve our Site. You have the ability to control access to Location Information through the control setting on your device.
Protected Health Information: We are not a covered entity subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), however, if we are provided access to protected health information, as defined under HIPAA, we will comply with our obligations under HIPAA (which may include entering into a business associate agreement with a covered entity).

How We Use Your Information

We may use your Personal Information, Usage Information, or Location Information we collect or you provide to us, in order to:

Respond to any questions you ask or to respond to the reason you contacted us.
Enhance, improve and develop new services and products and for overall customer support.
Monitor usage and interaction statistics on our Site, and/or through responses to our communications.
Perform data analytics for our internal business purposes.
Allow us to respond quickly and efficiently to your questions and your requests for information.
Communication with you either directly or indirectly through our marketing service providers to send you special offers, or marking information related to our products and services.
Communicate with you to request feedback or to notify you of changes to our Privacy Policy.
Track use of our Site, investigate suspicious activity, and enforce our terms and policies, to measure and improve the operation and security of our Site, and your Personal Information.
Allow us to disclose your information to the extent permitted or required by law.
We use Usage Information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Site (for example, by generating analytics about how our customers browse and interact with the Site, and to assess the success of our marketing and advertising campaigns). We may also use Usage Information to process automatic crash reporting which collects reports of crashes, other technical issues, and information relating to how our Site is functioning.
We may use Location Information to customize products or information specific to your region.

Sharing Your Personal Information

We do not share Personal Information with third parties for their direct marketing use. However, we may share your Personal Information with Third Party Providers (as defined below) as necessary to provide our Site and related functionality and to offer our services and products. Our “Third Party Providers” may include software development providers, application and data hosting providers, wireless network services providers, payment processors, and any digital analytics or marketing services. For example, we use Google Analytics to help us understand how our customers use the Site. You can opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout. In our agreements with Third Party Providers, we limit such Third Party Providers’ access to Personal Information solely as necessary for the Third Party Providers to provide the services to us. We are responsible for ensuring that these Third-Party Providers comply with the terms of this Privacy Policy.

Except for Third-Party Providers, we will not share Personal Information, Usage Information, or Location Information with an unaffiliated third party without your prior authorization, unless doing so is necessary: (1) to enforce this Privacy Policy, to comply with law, regulation or other legal processes, or to protect the rights, property, or safety of us or others; (2) to comply with a valid order or process from a public authority; (3) to protect against misuse or unauthorized use of our Site; (4) to detect or prevent criminal activity or fraud; and/or (5) in the event that we or substantially all of our assets are acquired by one or more third parties as a result of an acquisition, merger, sale, reorganization, consolidation or liquidation, in which case such information may be one of the transferred assets.

Your Rights

Depending on where you live, you may have certain legal rights under applicable law. For example, you may have the following rights:

Right to Access – means you can ask us for a copy of any Personal Information we have about you, if any.
Right to Correct – if you believe that any of the Personal Information we hold about you is incorrect or out of date, you have the right to correct such Personal Information by providing us with the correct up-to-date Personal Information.
Right to Delete – means you may ask us to delete any Personal Information we have about you and we will be happy to do so unless we are required to retain such information by law or regulation or we have a right to retain subject to a user agreement for our internal business purposes.
Right to Portability – means you may request a copy of your Personal Information, in a commonly used and machine readable format, be provided to you or to a third party you specify.
Right to Limit – means you have the right at any time to unsubscribe to any marketing communication and any other ancillary use of your Personal Information.

You may contact us (see the Contact Us section below) at any time about any of these rights or any concern or question you have about our use of your Personal Information. See also the specific laws addendum for more information regarding your rights.

Security

We take precautions to protect your Personal Information, including reasonable physical, administrative, and technical safeguards. When you submit Personal Information via our Site, your Personal Information is transmitted using secure sockets layer (SSL) encryption technology. We restrict access to your Personal Information to our authorized personnel and/or Third Party Providers as appropriate and necessary to provide our Site. However, no website, database or system is completely secure or “hacker proof.” You are also responsible for taking reasonable steps to protect your Personal Information against unauthorized disclosure or misuse.

Third-Party Websites

Our Site may contain links to, or appear on third party websites. Any access to and use of such third party websites is not governed by this Privacy Policy, but instead is governed by the privacy policies of those third party websites, and we are not responsible for the information practices of such third party websites.

Data Retention

We keep your Personal Information as long as necessary to process your requests, to operate our business, and to provide our Site, or as long as we are legally required to do so. You have the right to ask us to delete your Personal Information at any time. Please note that deletion of your Personal Information may affect your right to use our Site. While we will use reasonable efforts to delete your Personal Information, we may be required to retain such Personal Information as required by our systems or our legal requirements. Until we have deleted all of your Personal Information, we will continue to honor our privacy and security obligations related to your Personal Information.

Please note that in the event that we elect to de-identify your Personal Information, such de-identified information is no longer your Personal Information, and we may use such de-identified information, alone or in an aggregated basis to analyze our Site, or as we deem appropriate.

Children’s Online Privacy Protection Act

In compliance with the Children’s Online Privacy Protection Act, 15 U.S.C. § 6501.06 and 16 C.F.R. §§ 312.1 – 312.12, we do not knowingly collect information from children under the age of 13, nor does our Site target children under the age of 13. By using our Site, you represent that you are not younger than 13. Please contact us as noted below if you know or suspect that we have collected information from children under the age of 13, and we will take prompt measures to remove such information.

Changes

By accessing and using our Site, you agree to the information use and collection terms of this Privacy Policy. We have the right to revise this Privacy Policy at any time. We may not notify users individually if we change this Privacy Policy. Any changes will be effective when posted. We encourage you to check this Privacy Policy frequently to stay informed regarding how we collect, use, share and process Personal Information.

Contact Us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at info@carbonmed.com.

Specific Laws Addendum

Depending on where you are located, we will comply with all local laws. Please contact us using the contact information in the Privacy Policy for any questions or concerns.

United States

The following additional terms may apply to you depending on where you reside in the United States. To the extent of any inconsistency, these terms take precedence over the terms in our Privacy Policy in relation to Personal Information that is collected and/or held in the United States.

In addition to the rights you have noted in the Your Rights section in the Privacy Policy, California, Colorado, Connecticut, Virginia, and Utah require that we identify the categories of Personal Information we have collected or disclosed about you in the last twelve (12) months, the categories of sources for such information, and the categories of third parties with whom we have shared such information.

As described further in our Privacy Policy, in the preceding twelve (12) months, we or our Third-Party Providers may have collected the below categories of Personal Information for business or commercial purposes:

Identifiers (such name, email address, address, and phone number);
Personal Information described in subdivision (e) of Section 1798.80 (e.g. name, address, telephone number, bank account number, credit card number, debit card number, or any other financial information).
Internet or other network activity (such as IP address, unique device, advertising ID, browsing history or other usage data);
Geolocation information (general location, and, if you provide permission, precise GPS location);
Sensory information (such as audio recordings if you call our customer service);
Inferences about your preferences and traits through your use of the Site;
Professional or employment-related information; and
Sensitive personal information (such as financial account, debit card or credit card number with any required security or access code, password or credentials allowing access to an account, and precise geolocation).

We collect the categories of Personal Information identified above from the following sources: (1) directly from you; (2) through your use of the Site; (3) affiliates; and (4) Third-Party Providers.

We collect the categories of Personal Information identified above for the following purposes: (1) providing our Site and products; (2) updating and improving our Site; (3) personalizing content; (4) marketing and advertising; (5) communicating with you; (6) analyzing your use of our Site; (7) preventing, detecting, investigating, and responding to fraud, unauthorized access/use of our Site, breaches or potential breaches of terms and policies; and/or (8) internal training of our personnel.

We may share the categories of Personal Information identified above with our affiliates and Third-Party Providers.

Nevada also has a right of consumers to opt-out of the sale of Personal Information. We do not sell your Personal Information, which is why we do not have an opt-out of such sale / sharing, (i.e., “Do Not Sell or Share My Personal Information” link).

Residents of Illinois may have certain rights under the Biometric Information Privacy Act. Please note that while we may record customer service calls and/or training videos; we do not digitally analyze any such data for any biometric identification purposes.

Metrics

California law may require us to compile the following metrics for the previous calendar year: the number of rights requests received, complied with, and denied, as well as the median number of days within which we responded to those requests. To the extent this obligation applies to us, we will update this section.

California Shine the Light

If you are a California resident, you may ask for a list of third-parties that have received your information for direct marketing purposes during the previous calendar year. If we have shared your information, this list will contain the types of information shared, and we will provide this list at no cost. To make such a request, see the Contact Us section above.

California Do-Not-Track Disclosure

We are committed to providing you with meaningful choices about the information collected on our Site for third-party purposes. However, we do not currently recognize or respond to browser-initiated Do-Not-Track signals, as the Internet industry is currently still working on Do-Not-Track standards, implementations, and solutions.

EU/EEA

The following additional terms apply to you if you reside in the European Union/European Economic Area (EU/EEA). To the extent of any inconsistency, the following terms take precedence over the terms in our Privacy Policy in relation to personal data that is collected and/or held relating to individuals (i.e., data subjects) residing in the EU/EEA.

The EU/EEA’s General Data Protection Regulation (GDPR) governs our processing (as defined under the GDPR) of your personal data, as well as your rights regarding the same. As used in this Addendum, the following terms have the following meanings:

“Breach”, “data controller”, “data processor”, “Data Protection Authority”, “data subject”, “data subject rights”, “Member State”, “personal data”, “personal data breach”, “processing” (and “process”) (regardless of whether capitalized herein) have the meanings given to them in GDPR.

“Standard Contractual Clauses”, for purposes of our Privacy Policy, means the template agreement contained in the Annex of the European Commission’s Implementing Decision of 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, and any replacement, amendment or restatement of the foregoing issued by the European Commission.

Data controller; processing

We are a data controller of your personal data. GDPR sets forth specific obligations of a data processor and data controller in each of these roles.

Lawful Basis for our Processing of Your Personal Data.

As the data controller, we are responsible for establishing a lawful basis for the processing of your personal data. We rely on our legitimate interests under GDPR Article 6 in order to engage in the processing of your personal data. This means that we have a legitimate interest in receiving and processing your personal data in order to provide our Site. We may, in some cases, also rely on obtaining your consent under GDPR Article 6 as the lawful basis of their processing of your personal data. If so, this means that we have requested your explicit consent (or “opt-in”) to their processing of your personal data.

Data Protection Officer.

We have appointed a Data Protection Officer (DPO).

Individual Rights

As also noted in our Privacy Policy, you may make the following requests from us as the data controller. In each case these rights are subject to restrictions and/or exceptions as specified in the GDPR. The following is a summary of your rights:

The right of access, enabling you to receive a copy of your personal data
The right to rectification, enabling you to correct any inaccurate or incomplete personal data we hold about you
The right to erasure, enabling you to ask us to delete your personal data in certain circumstances
The right to restrict processing, enabling you to ask us to halt the processing of your personal data in certain circumstances
The right to object, enabling you to object to us processing your personal data on the basis of our legitimate interests (or those of a third party), and
The right to data portability, enabling you to request us to transmit personal data that you have provided to us to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible.

Under GDPR, a data subject also has the right to lodge a complaint with a Data Protection Authority, in particular in the Member State of the data subject’s residence, place of work or place of an alleged infringement, if the data subject considers that the processing of the personal data infringes the GDPR.

If you wish to exercise any of these rights, please contact us using the contact information provided in our Privacy Policy. Please note that the GDPR specifies when the data controller may refuse your request where there is a basis to do so in law, or if your request is manifestly unfounded or excessive.

Special Categories of Personal Data

Our Site does not require the collection or processing of any sensitive personal data or sensitive information, as defined in applicable data protection laws (e.g., racial, ethnical origin, political opinions, religious beliefs, etc.). We may nevertheless collect such sensitive personal data about you or we may collect it incidentally if you provide such data to us. By providing any sensitive personal data or by providing information by a recording, you consent to our collection of such information, however, we do not require or use such data to provide our Site.

International Transfers of Data

Personal Information originating in the EU/EEA may be accessed and/or processed in a limited manner outside of the EEA. We adhere to the GDPR where it applies to our Site. Where your personal data is processed outside of the EEA, we will put in place appropriate safeguards. Where appropriate, we may enter into Standard Contractual Clauses with importers or processors and/or other relevant third parties for the transfer of your personal data and may carry out a risk assessment and/or take necessary security measures in order to fulfill our obligations under GDPR.

If we determine we are unable to provide equivalent protection of your personal data, including by entry into the Standard Contractual Clauses, we may seek to rely on derogations authorized by the GDPR, including the derogation of consent/contract/request of data subject. If relying on your consent, we will seek your explicit consent in advance.