Align Global Websites and Apps Privacy Notice

Where required by applicable law, we will determine the legal basis for processing your personal information, as defined in our Binding Corporate Rules, for each purpose of processing, which can include:

➢ Legitimate interests: It can be sometimes necessary for us to do certain activities, in our own interest or the interest of a third party. In each case, we balance our legitimate interest with your rights and interests. Our legitimate interest can include (non-exhaustive):

• Gaining insights on your use of our websites, apps, products, or services;

• Developing and improving our websites, apps, products, and service offerings;

• Enabling us to enhance, customize, or modify our communications;

• Informing you about products and services we believe are relevant to you;

• If you have made a transaction with us and have not opted-out from such communications;

• Informing our marketing strategy;

• Improving our data security and keeping our records updated.

➢ Your consent: If we process your personal information in reliance on your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

➢ Contract: Where processing your personal data is necessary for performing a contract you have with us (such as our terms and conditions), or where you have asked us to take specific steps before entering into that contract.

➢ Compliance with a legal or regulatory obligation: To comply with our legal obligations under applicable law (for example, our transparency obligations under the US or French Sunshine Act, our complaints handling and investigation obligations under applicable medical device regulations, court orders, etc.).

➢ Judicial or administrative procedures: Exercise of rights in judicial or administrative procedures.

➢ Other legal bases: Other legal bases as permitted under local law.

• Group Members: we may share your personal information with companies of Align for the purposes, and based on the legal bases, above.

• Online advertiser partners: we may work with social media platforms and digital advertising platforms to show you advertisements for our products and services on other websites and social media platforms. For instance, if you show an interest in, or buy, a product, we may advertise products we think may be of interest to you which you may see on other websites and on your social media feeds. To do this, we share information with our social media and digital advertising partners about you, which may include your purchase, age, gender and interests.

• Law enforcement, regulators, government agencies, courts, or other third parties, if legally required or allowed.

• In the event of an actual or potential merger, acquisition, debt financing, sale of company assets, insolvency, bankruptcy, receivership, or similar transaction, we may share your personal information (such as with third parties, their agents, or advisors) strictly to the extent necessary to facilitate the transaction and as permitted under applicable law.

• We may also share personal information with third parties not listed above if given your consent.

Our websites and applications may use cookies or similar technologies such as, but not limited to, web beacons, pixel tags, and Flash Objects (“Cookies”). Some of these Cookies are essential for our websites and apps to function. Other Cookies provide us with analytical data about your visit, or help us understand users’ interactions with our systems, or they allow us to enhance functionality or to tailor our advertising messaging to you. You can find detailed information about the types of Cookies we use, whether they are first or third party Cookies, what they do and how long they are stored on your device, and your preferences, on the website you are accessing. Where applicable, you can accept or reject certain Cookies.

In certain circumstances, we will need to keep some or all of your personal information after our contractual relationship has ended to comply with required retention durations and surviving regulatory obligations applicable in your country and/or state; for example, to handle and resolve requests and complaints or for litigation or regulatory matters.

When we have no ongoing legitimate need or legal justification to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

You may have some or all of the following rights, or additional rights, as provided under applicable law:

• To request access to, copies of, correction of, updating of, or deletion of your personal information.

• To object to the processing of your personal information, ask us to cease or restrict processing of your personal information.

• To request data portability.

• To complain to your local data protection authority.

Align, by law, will not discriminate in response to any privacy requests you make. To ensure that a request is genuine, we may need to take steps to verify your identity, or the identity of an agent making a request on your behalf. To exercise your data privacy rights, please submit a request here.

Our websites and apps may contain links to other websites merely as a convenience. Align is not responsible for the privacy practices or the content of such other websites, and inclusion of links does not mean we endorse the information or company. This means that if you connect to another website or app through our Align websites and apps, we are not responsible for, and we cannot control, what they do with your information.

Also, you may have the opportunity to share your information with other websites, such as social media websites. We may provide a convenient link to let you do this easily, but we are not responsible for, and we cannot control, their website or your posts/sharing. You are encouraged to review the privacy policies and information collection practices of these other websites and social media websites.

Align provides you the opportunity to request to stop receiving electronic communications from either Align or our partners (as applicable) by withdrawing your consent or opting out. If you do not want to receive communications from us, please tell us when we collect your information or, at any time, use the unsubscribe feature included with emails or contact us. Please allow us enough time to process your request.

Keep in mind, this withdrawal of consent does not apply to necessary communications, such as responding to an inquiry. Withdrawing your consent does not prevent you from providing your consent in the future.

You may also have the ability to contact local data authorities to complain about our privacy practices or about our collection and use of your personal information in a manner prescribed by local data protection laws. Certain supervisory authorities will require that you exhaust our own internal complaints process before they will investigate your complaint.

Where required, Align has appointed a Data Protection Officer. Please use the contact details outlined below to contact Align's Data Protection Officer. Privacy Office: privacy@aligntech.com

Support: 1-888-822-5446 or the phone numbers indicated here: https://www.aligntech.com/contact_us

Locations

Global Headquarters
Align Technology, Inc.
410 North Scottsdale Road
Suite 1300
Tempe, Arizona 85288

USA West Coast Headquarters
Align Technology, Inc.
2820 Orchard Parkway
San Jose, California 95134

Americas Region Headquarters
Align Technology, Inc.
3030 Slater Road
Morrisville, North Carolina 27560

EMEA Region Headquarters
Align Technology Switzerland GmbH
Suurstoffi 22
6343 Rotkreuz, Switzerland

APAC Region Headquarters
Invisalign Singapore Pte Ltd
128 Beach Road
#22-01
Guoco Midtown
Singapore 189773

LATAM Region Headquarters
Align Technology do Brasil Ltda
Avenida Brigadeiro Faria
Lima, 4509, 7th Floor,
Itaim Bibi
04538-133
Sao Paulo, SP, Brazil

Se você tiver alguma dúvida sobre esta Política de Privacidade, entre em contato com:

ALIGN TECHNOLOGY DO BRASIL LTDA.

Rua Santa Justina, nº 660, Conjuntos 71 a 74 – Vila Olímpia – CEP: 04542-042 São Paulo/SP – Brasil

privacidade@aligntech.com

Para saber mais ou exercer qualquer um dos seus direitos de privacidade de dados pessoais, acesse este.

This notice summarizes how Align Technology (Chengdu) Healthcare Management Co., Ltd. (with its registered office at Unit 716, Floor 7, No. 1577 Middle Section Tianfu Avenue, Chengdu High-Tech Zone, China (Sichuan) Pilot Free Trade Zone) and its affiliates ("Align" or "we") processes patients’ Sensitive personal information collected and used for the purpose of provision of products and/or services for collaborated health care professionals in China ("Doctor") in accordance with the Invisalign Doctor Site Privacy Policy.

Sensitive personal information refers to the personal information once disclosed, illegally provided or misused, is likely to infringe personal dignity of a natural person or endanger personal, property safety, including biometrics, religious beliefs, specific identities, medical and health, financial accounts, whereabouts and other information, as well as personal information of minors under the age of fourteen.

For processing methods of personal information of minors under the age of fourteen, specific methods are as following:

Our products and services are aimed at adults and teenagers. Without parents or guardians’ consent, we will not collect children’s information.

We will only use or publicly disclose children’s personal information collected with parents or guardians’ consent if permitted by law, consent of parents or guardians are obtained, or it is necessary for protecting children.

Although the definition of children varies according to local laws and custom, we treat anyone under 14 years old as children.

If we find that we collect children’s personal information without prior consent of verifiable parents or guardians, we will try to delete such information as soon as possible.

We understand that you have signed a separate informed consent prior to Doctor’s providing us with sensitive personal information of the patient, which authorizes you to provide us with and manage your Sensitive personal information and allow us to use, process, share, transfer, store and protect the Sensitive personal information of patient in ways as described in this notice and the Invisalign Doctor Site Privacy Policy.

Collection and Use of Sensitive Personal Information

The sensitive personal information you need provide to Doctor in the course of receiving Invisalign treatment include:

1. Medical images: photographs of the patient (including but not limited to photographs of the patient’s teeth and face), x-ray photographs, plaster models, impressions of teeth, or intra-oral scans;

2. Health information: clinical category information and treatment plan based on the patient’s information. We collect and use your sensitive Personal Information that you provide, if any, for the following purposes:

   1. to manufacture customized products (such as aligners, retainers) for you and provide relevant services according to the treatment plan Doctor has made for the patients;

   2. to provide TPS service in accordance with Doctor’s informed consent and authorization;

   3. to conduct internal audit, data analysis and studies to improve our products or services;

   4. other purposes permitted by law.

Collecting and using the patients' sensitive personal information above is necessary to enable us to provide you with our products and/or services. If you refuse to provide Doctor with these sensitive personal information or if you do not consent to our collection and use of such information, we will not be able to provide products and/or services to Doctor.

Processing, Sharing, Transfer and Publicly Disclosure of Sensitive Personal Information

To improve the efficiency of our services, we may delegate third parties to process the personal information you provided on our behalf. We will sign a data processing agreement with third parties whom we entrust to process personal information, require them to process the personal information you provided in accordance with the agreement, this notice, and the requirements of relevant data laws and regulations in China. We will not share, transfer, publicly disclose any sensitive personal information that you provide with any company, organization or individual other than Align, except for the following:

1. obtained your separate consent by Doctor or us;

2. in accordance with the provisions of laws, regulations or mandatory requirements of competent governmental authorities;

3. entrust our affiliates and authorized partners for the purpose of providing products and/or services;

4. transfer of sensitive personal information in merger, acquisition, insolvency and liquidation.

Storage of Sensitive Personal Information

In principle, patients’ sensitive personal information collected and generated within People’s Republic of China will be stored within the territory of People’s Republic of China. Since we operate globally, upon meeting requirements of Chinese laws and regulations, the patients’ sensitive personal information provided by you may also be stored on our servers which may be located outside China(for example, received by Align Technology Inc., with its contact information at privacy@aligntech.com). If the patients’ sensitive personal information could be shared/transferred to outside of People’s Republic of China, we will undertake necessary compliance obligations as required by applicable laws and regulations.

We will only retain the sensitive personal information provided by Doctor for the minimum period of time required to achieve the purposes stated in this notice, unless applicable legislation has a mandatory retention requirement. And the criteria for the aforementioned deadlines include:

1. Complete the service purpose related to information subject, maintain the corresponding service and business records, and respond to your possible inquiries or complaints;

2. Guarantee the safety and quality of the services we provide to Doctor;

3. Whether you agree to retain a longer retention period;

4. Whether there are other special agreements for the retention period.

After the sensitive personal information provided by you exceeds the retention period, we will delete the sensitive personal information or stop the processing other than storage and necessary security protection measures under applicable laws.

Protecting Sensitive Personal Information

We store patients’ sensitive personal information with security controls such as encryption etc.

We implement security protection measures in accordance with applicable industry standards, including establishing proper standard operational procedures, adopting security controls to prevent patients’ sensitive personal information from unauthorized access or alteration in order to avoid the destroy or loss of the sensitive personal information.

Once there is a leakage of patients’ sensitive personal information, we will inform Doctor or you of the incidents via email, letter, phone or notice etc subject to applicable legal requirements. Should it is hard to inform Doctor or you one by one, we’ll issue a notice in a reasonable and effective manner.

Your Rights

According to the general practice of the related legislation, regulation, standard of China and other countries or regions, we ensure you and patients will have the following rights regarding the your sensitive personal information provided: right of access, right of correction, right of deletion, right to change your scope of consent, right of deregistration, right to obtain the copy of the sensitive personal information.

For more details regarding the principles of how we process the sensitive personal information, please consult your Doctor.

If you have any questions, opinions or suggestions, you can contact us by following methods.

Name: Align Technology (Chengdu) Healthcare Management Co., Ltd.

Address: Unit 716, Floor 7, No. 1577 Middle Section Tianfu Avenue, Chengdu High-Tech Zone, China (Sichuan) Pilot Free Trade Zone

Email address: privacy@aligntech.com

TRANSFER OF PERSONAL INFORMATION ABROAD

In principle, the personal information we collect and generate in the People's Republic of China will be stored in the People's Republic of China, except where cross-border transmission is permitted in accordance with the provisions of applicable laws.

As we operate internationally, the personal information you provide may be transferred and stored on servers outside the jurisdiction of your place of residence after meeting the requirements of Chinese laws and regulations. We provide information outside of China only when necessary and only for the purposes indicated in this policy.

This Notice and the collection and processing of personal information in accordance with this Notice shall be governed by and construed in accordance with the laws of the People's Republic of China. We will take reasonable steps to protect the privacy of the personal information you provide to us wherever we transfer, store or process it.

You are not required, by law, to provide us with any personal data and do so (or avoid doing so) at your own free will. However, please note that if you decide not to provide your personal data, we may not be able to offer the full functionality of the Align websites and apps or ensure the best possible user experience.

If you prefer not to share your personal data or have it processed, we ask that you avoid providing it and refrain from visiting or using the Align websites or apps. You can also exercise your rights by submitting a request, as described above.

For the purposes of Israel’s Protection of Privacy Law, Align Technology Inc. serves as the “Database Controller” responsible for the personal data processed in Israel in connection with the Align websites and apps, and may be contacted at privacy@aligntech.com.

Handling of Personal Information

Align acquires personal information about patients (“personal information about patients”) associated with orthodontic treatment, such as name, sex, age, address, and examination records, including X-ray photographs and intraoral photographs. Align uses personal information about patients for the following objectives of use and appropriately manages such information in accordance with laws and regulations such as the Act on the Protection of personal information.

1. Must be used in order to provide orthodontic treatment using the Invisalign system.

2. Must be provided to other dentists, orthodontists, or groups to which dentists or orthodontists belong, or to Align (headquarter: located in Arizona state in the US) or Align’s group companies (including overseas group companies located in China, Singapore, Mexico and Costa Rica) for the purpose of analyzing and reconsidering the treatment history, as needed for orthodontic treatment using the Invisalign system.

3. Must be used for the objective of training or research and development.

Align and its group companies have taken substantially the same level of measures required of business operator handling personal information in Japan for handling personal data.

In addition to when it is required by laws or regulations, this institution may provide acquired personal information about patients for 2) above to third parties, in order to provide orthodontic treatment using the Invisalign system.

[Exhibit]【Summary of Data Protection Legislation in Republic of Costa Rica】

Invisalign Korea Yuhan Hoesa (hereinafter “we” or “Align”) protects the personal information of data subjects in accordance with Article 30 of the personal information Protection Act and ensures that complaints related thereto are handled quickly and smoothly. We establish and disclose the personal information processing policy as follows.

Article 1 (Purpose of processing personal information) Align processes personal information for the following purposes. The personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, necessary measures will be taken, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Collection Purpose: Common

   1. Homepage (hereinafter including apps and related websites including mobile and PC) membership registration and management and customer management: Confirmation of intention to join the website, identification and authentication of person according to provision of membership service, maintenance and management of membership qualification, prevention of illegal use of service, When processing the personal information of children under the age of 14, the personal information is processed for the purpose of confirming the consent of the legal representative, various notices and notices, and handling grievances.

   2. Provision of goods or services: personal information is processed for the purposes of product delivery, service provision, contract/invoice sending, content provision, customized service provision, identity verification, age verification, bill payment, settlement, and debt collection.

   3. Grievance handling: personal information is processed for the purposes of verifying the identity of the complainant, confirming the complaint, contacting and notifying for factual investigation, and notifying the result of processing.

Article 2 (Processing and retention period of personal information) Align processes and retains personal information within the personal information retention and use period pursuant to laws and regulations or within the personal information retention and use period agreed upon when collecting personal information from the information subject. The processing and retention periods for each personal information are as follows.

1. Website membership registration and management and customer management: Until withdrawal from our website. However, in the case of the following reasons, until the relevant reason ends.

   1. If an investigation or investigation is in progress for violation of relevant laws and regulations, until the investigation or investigation is completed.

   2. If any claims/debt relationships remain due to use of the website, until the relevant claims/debt relationships are settled.

2. Provision of goods and related services: Until the supply of goods and related services is completed and fee payment/settlement is completed. However, in the following cases, until the end of the relevant period.

   1. Records of transactions, such as labeling, advertising, contract details and performance, in accordance with the Act on Consumer Protection in Electronic Commerce, etc.

      1. Records of labeling and advertising: 6 months

      2. Records of contract or subscription cancellation, payment, supply of goods, etc.: 5 years

      3. Records of Consumer complaints or dispute resolution: 3 years

   2. Storage of communication confirmation data in accordance with the 「Communication Secrets Protection Act」

      1. Computer communication, internet log records, access point tracking data: 3 months

      2. Marketing: 2 years from the date of receiving consent (excluding cases where the recipient confirms whether or not they have agreed to receive an extension every 2 years pursuant to Article 50 of the Information and Communications Network Act)

      3. However, if personal information must be retained to comply with laws such as the Medical Device Act, the applicable laws will apply.

Article 3 (Provision of Personal Information to Third Parties) Align processes the personal information of the information subject only within the scope specified in Article 1 (Purpose of Processing Personal Information), and requires the consent of the information subject, special provisions of the law, etc. personal information is provided to third parties only in cases that fall under Articles 17 and 18 of the Personal Information Protection Act.

Article 4 (Entrustment of Personal Information Processing) For smooth personal information processing, Align entrusts personal information processing as follows.

1. All affiliates of Invisalign Korea Limited

   1. Persons receiving personal information: All affiliates of Invisalign Korea Limited (HERE)

   2. Purpose of use of personal information of the recipient: customer management, goods, new product development and marketing

   3. Personal information items provided: Each item of personal information collected by Align

   4. Retention and use period by the recipient: When the purpose of consignment is achieved

   5. Date and method of provision: Online transfer at regular intervals

   6. Information manager of all affiliates: GLOBAL PRIVACY COUNSEL & DATA PROTECTION OFFICER Email: privacy@aligntech.com

      1. Headquarters
         Align Technology, Inc.
         410 N Scottsdale Road, Suite 1300
         Tempe, AZ 85288
         USA

      2. EMEA Headquarters
         Align Technology Switzerland
         GmbH Suurstoffi 22
         6343 Risch-Rotkreuz
         Switzerland

2. Customer Management (Align Global Sub-processors)

   1. Entrusted party (trustee): Alorica, Amazon Web Services, Heroku, Microsoft Azure, Salesforce.com (SFDC), Salesforce Marketing Cloud, Savvis (Century Link), SAP SE, Tata Consulting Service (refer to disclosure on headquarters website: Align Technology, Inc. Subprocessors)

   2. Contents of entrusted work: provision of personal information storage server, transaction history management, product delivery

   3. Entrusted party (trustee): Salesforce.com Inc and Salesforce Marketing Cloud

   4. Contents of entrusted work: Providing a storage server for personal information, sending event information texts and emails, managing attendees at product briefing sessions, and providing notification text services related to Invisalign products

3. Consumer marketing progress

   1. Entrusted person (trustee): Shortcut Creative

   2. Contents of entrusted work: Brand marketing promotion, marketing campaign effectiveness evaluation, customer service, email and DM sending service, product delivery according to event progress

4. Storage and delivery of goods

   1. Entrusted party (trustee): DHL Supply Chain Korea

   2. Contents of entrusted work: Freight transportation brokerage, agency and related service industry, warehousing industry

   3. Entrusted person (trustee): Ilyang Logis

   4. Details of entrusted work: Delivery business

   5. Entrusted person (trustee): LogiCare Co., Ltd.

   6. Contents of entrusted work: Freight transportation brokerage, agency, and related services

5. When Align entrusts the processing of personal information in accordance with Article 26 of the Personal Information Protection Act, it is processed in accordance with a document containing the following contents (including Data Protection Binding Corporate Rules Processor Policy and Data Protection Binding Corporate Rules Processor Policy).

   1. Matters pertaining to the prohibition of processing personal information other than for the purpose of performing consignment work

   2. Matters related to administrative and technical protection measures for personal information

   3. Matters related to safety management of personal information

   4. Matters concerning the purpose and scope of consignment work and restrictions on re-entrustment

   5. Matters related to supervision, such as checking the management status of personal information held in relation to consignment work

   6. Matters pertaining to liability for damages in case of violation of obligations to be observed by the trustee

6. If the details of the entrusted work or the trustee changes, we will disclose it through this personal information processing policy without delay.

Article 5 (Rights, obligations and exercise methods of information subjects and legal representatives)

1. Information subjects can exercise their rights to view, correct, delete, or suspend processing of personal information at any time against Align.

2. You can exercise your rights pursuant to Paragraph 1 against Align through a personal information protection rights application pursuant to Article 41, Paragraph 1 of the Enforcement Decree of the personal information Protection Act , and Align will take action without delay.

3. The exercise of rights under Paragraph 1 may be done through an agent, such as the information subject's legal representative or a person authorized to do so. In this case, you must submit a power of attorney in accordance with the form in Annex No. 11 of the “Notice on personal information Processing Methods (No. 2020-7).”

4. Requests to view and suspend personal information processing may limit the information subject's rights pursuant to Article 35, Paragraph 4 and Article 37, Paragraph 2 of the Personal Information Protection Act.

5. Requests for correction or deletion of personal information cannot be requested if the personal information is specified as the subject of collection in other laws and regulations.

6. Align verifies whether the person making the request, such as a request for viewing, a request for correction or deletion, or a request for suspension of processing, is the person or a legitimate agent in accordance with the information subject's rights.

Article 6 (Personal Information items to be processed) Align processes the following personal information items.

1. Managing homepage

   1. Required items: name, phone number, area of residence, ID, address, phone number, email address.

   2. For health care workers: hospital name, hospital address, phone number, mobile phone number, ID, password, medical license number, graduation year.

2. Provision of goods and related services

   1. Required items: name, date of birth, ID, password, address, phone number, email address, credit card number, bank account information, hospital name, hospital address, business registration number

3. Marketing:

   1. Optional items: name, email, phone number, residence area

4. The following personal information items may be automatically created and collected during the use of Internet services.

   1. IP address, cookie, MAC address, service use record, visit record.

5. Like social media, data subjects may have the opportunity to share their personal information with other websites. We may post links for the convenience of such sharing, but the website is not responsible for the posting/sharing of the information by the subject, and we cannot control it. It is advisable to review the privacy policies and personal information collection practices of websites and social media websites.

Article 7 (Destruction of Personal Information) Align will immediately destroy the personal information when the purpose of collecting and using personal information has been achieved or when there is a request to withdraw consent. However, if there is a need to preserve the personal information of the information subject pursuant to other laws, the provisions of the applicable laws will be followed. The procedures and methods for destroying personal information are as follows.

1. Destruction Procedure: Align selects the personal information for which a reason for destruction has occurred and destroys the personal information with the approval of the head of the personal information processor's department.

2. Method of Destruction: It is our policy to retain personal information only for as long as necessary to achieve the aforementioned purposes. When this necessary period has elapsed, we will immediately destroy such personal information through a series of procedures, and electronic files containing personal information will also be permanently deleted using technical methods that render the files unduplicable, and other records and printed materials will also be deleted. , documents, and all other recording media will be shredded or incinerated so that personal information cannot be recovered or copied.

Article 8 (Measures to ensure the safety of Personal Information) Align is taking the following measures to ensure the safety of personal information.

1. Management measures: Company regulations (including Data Protection Binding Corporate Rules Processor Policy and Data Protection Binding Corporate Rules Processor Policy), regular employee training, etc.

2. Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, etc., installation of security programs.

Article 10 (Personal Information Protection Manager) Align is responsible for the overall management of personal information processing, and appoints a personal information protection manager as follows to handle complaints and provide relief for damage from information subjects related to personal information processing.

1. Personal Information Officer:
   GLOBAL PRIVACY COUNSEL & DATA PROTECTION OFFICER
   Email: privacy@aligntech.com

2. The information subject may contact the personal information protection manager or department in charge regarding all personal information protection-related inquiries, complaint handling, damage relief, etc. that arise while using Align's products and related services.

Article 11 (Standards for determining additional use and provision) Align takes into account matters pursuant to Article 14-2 of the Enforcement Decree of the Personal Information Protection Act in accordance with Article 15, Paragraph 3 and Article 17, Paragraph 4 of the Personal Information Protection Act. Personal information may be additionally used and provided without the consent of the information subject. Accordingly, Align has considered the following matters in order to allow additional use and provision of information without the consent of the information subject.

1. Whether the purpose of additional use and provision of personal information is related to the original purpose of collection

2. Whether there is a foreseeability of additional use and provision of personal information in light of the circumstances in which personal information was collected or processing practices.

3. Whether the additional use and provision of personal information unfairly infringes on the interests of the information subject

4. Whether necessary measures were taken to ensure safety, such as pseudonymization or encryption.

Article 12 (Request to view Personal Information) The information subject may request to view personal information pursuant to Article 35 of the Personal Information Protection Act to the department below. Align will endeavor to promptly process the information subject's request to view personal information.

1. Personal Information Officer:
   GLOBAL PRIVACY COUNSEL & DATA PROTECTION OFFICER
   Email: privacy@aligntech.com

Article 13 (Methods for Relief from Rights Infringement) If there are inquiries due to personal information infringement, the information subject may receive relief in the following ways.

1. Request relief for rights infringement from Align

   1. Contact the personal information officer specified in Article 10

   2. Email: privacy@aligntech.com

2. If the problem cannot be resolved through contacting Align or providing damage relief, you can apply for dispute resolution or consultation to the personal information Dispute Mediation Committee or the Korea Internet & Security Agency's Personal Information Infringement Reporting Center.

   1. Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (www.kopico.go.kr)

   2. Personal Information Infringement Reporting Center: (without area code) 118 (privacy.kisa.or.kr)

   3. Supreme Prosecutors' Office: (without area code) 1301 (www.spo.go.kr)

   4. National Police Agency: (without area code) 182 (cyberbureau.police.go.kr)

Article 14 (Changes to Personal Information Processing Policy) This personal information processing policy is effective as of the Last Updated date at the top of this notice.

You can check the previous privacy policy: Applicable from May 20, 2018 to August 17, 2021

Certain states in the United States have passed legislation granting consumers legal rights regarding personal information, like California, Colorado, Utah, Virginia, Oregon, Montana, Texas, Tennessee, Indiana, Iowa, Tennessee, Delaware and Connecticut. Additionally, several other states currently have bills working through the legislative process. Align is continually monitoring these processes to ensure we are treating consumer data fairly. Common across these laws, are the right to know, delete, correct, limit, and opt-out of certain processing of personal information, with some legal exceptions. Align, by law, will not discriminate in response to any privacy requests you make. We do our best to extend these rights to everybody, but some patient data we receive as part of services we provide to dental providers. In those cases, we are required by law to forward your request to the business, covered entity, or controller (i.e., the dental provider) for processing.

BIOMETRIC INFORMATION

Biometric identifiers is a category of information that generally refers to data derived from unique biological, or traits used to identify an individual (such as retina or iris scan, fingerprint, voiceprint, scan of hand or face geometry, or similar examples). Align does not capture, retain, use or require biometric identifiers to access or operate apps, systems, or generally in our interactions with you.