Data Protection Policy

Last update: October 2025

PRIVACY NOTICE REGARDING THE USE OF THE “Dräger Companion med” APP

With this privacy notice, we would like to inform you about the basis on which and for what

purposes for which we process personal data that we collect from you or that you provide to us,

if you use the “Dräger Companion med” app (the “App”). We would also like to inform you about the

and other general conditions of data processing.

The app is a classified medical device for the European Economic Area and fulfills the

Requirements of Regulation (EU) 2017/745 (Medical Devices Regulation – MPV).

For more information, please refer to the app’s Terms of Use.

The app will process your personal data in strict confidence and for specific purposes in accordance with the information provided at

.

1. Who is responsible for data processing, and who can I contact?

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (

, DSG) is:

Dräger Safety AG & Co. KGaA (“Dräger”)

Revalstrasse 1

23558 Lübeck

jointly responsible with

BAYOOCARE GmbH (“BAYOOCARE”)

Europaplatz 5

64293 Darmstadt

You can reach the company data protection officers of the responsible parties at the aforementioned

Contact details and by e-mail: dataprivacy(at)draeger.com and dataprivacy(at)bayoocare.com.

The essence of the division of responsibilities between the responsible parties results from the

following tabular overview. For the avoidance of doubt, this in no way affects your legal rights.

legal positions under data protection law against both or one of the controllers.

2. What data do we process?

When you use the app, the following personal data about you is processed:

− Name

− (Shipping) address

− Email and password

− Breath alcoholmeasurement results and times

− Images taken during measurements

− Usage data, which is used in anonymized form to ensure the proper operation

of the app and to improve it (such as “crashes” or other

Bugs)

− Your therapist’s and/or doctor’s master data

3. Where do we store your personal data?

Your personal data is initially stored exclusively on your smartphone. If you choose

to share your data with your therapist and/or doctor, it will also be stored for this purpose

on servers maintained by Dräger (“back-end”). In any case, it is ensured

that the servers used to store your data are located exclusively within the European Union

.

4. For what purpose do we process your data, and on what legal basis?

We process personal data in accordance with the provisions of the GDPR and the Federal Data Protection Act (

, DSG):

4.1. To fulfill contractual obligations (Art. 6(1)(b) GDPR, Art. 6 DSG)

We process the data covered by the contract in order to provide and allocate the contractually agreed services to you

and to make the data available to the correct recipients.

4.2. Processing of personal health data based on your consent (Art. 6(1)(

(a) GDPR, Art. 9(2)(a) GDPR, Art. 6 DSG)

When you start the app for the first time, you consent to the processing of your health data by activating

of a switch. Based on your consent, we process your health data in order to provide you with

to be able to provide relevant app services.

4.3. To exercise or defend legal claims (Art. 9(2)(f) GDPR, Art. 6 DSG)

If necessary, we may process your data for the establishment, exercise or defense of legal claims.

legal claims.

4.4. To comply with legal obligations (Art. 9(2)(i) of the GDPR, Art. 83(3)(e) and (f) of the MPV, Art. 9 of the DSG)

Finally, we process data insofar as this is necessary to fulfill our legal obligations to

is required in the field of vigilance of medical devices.

5. To whom is my personal data disclosed?

To provide the services included in the app, we disclose your data to your therapist and/or

doctor, provided you use this feature.

Furthermore, in principle, only those individuals who require the data to fulfill our

contractual and, where applicable, legal obligations are granted access to it. Service providers and

agents engaged by us may also be granted access to data for these purposes; such as in connection with outsourced

IT services (e.g., hosting). In such cases, we ensure through binding agreements with these

service providers that the data protection requirements for their involvement

are fully complied with.

Furthermore, we do not disclose any personal or personally identifiable data about you to third parties without your

express prior consent.

You are free to export the results generated via the app in the form of a PDF report and

then forward them to third parties yourself.

6

. Is the provision of personal data required by law or contract?

You are not obligated to provide us with the aforementioned personal data.

Please note, however, that the provision of incorrect or incomplete data prevents

from properly providing services within the scope of the app.

7. How long will my data be stored?

You can delete data yourself at any time within the app. Otherwise, Dräger will delete data stored in the back end

immediately upon termination of the respective user relationship (no later than within 60

days).

Please note that we may need to retain certain categories of data for a longer period; for example, due to

mandatory tax or social security requirements regarding financially relevant billing data.

The same applies in the event of other circumstances that justify a longer retention period—for example, until the expiration of the

standard statute of limitations, if claims for damages are pending, or until the expiration of regulatory

deadlines, if a retention period under medical device law applies.

8. Your Rights as a Data Subject

As a data subject, you have the right of access under Article 15 of the GDPR and Article 25 of the DSG, the right to

rectification under Article 16 of the GDPR and Article 32, para. 1 of the DSG, the right to erasure under Article 17 of the GDPR

and Article 32, para. 2, lit. C of the DSG, as well as the right to restriction of processing under Article 18 of the GDPR

and Article 32, para. 2, lit. B of the DSG.

Details on whom to contact and how to exercise these rights can be found in Section 1 above.