Privacy Policy

Mach7 Technologies Limited (ACN 007 817 192)
Privacy Policy — Version 13.0, approved by the Board on 19 December 2025.

Contents

  1. 1. Introduction
  2. 2. Application
  3. 3. Purpose
  4. 4. Applicable Laws
  5. 5. What is Personal Information?
  6. 6. Collection of Personal Information
  7. 7. Use and disclosure of Personal Information
  8. 8. Transfer of Personal Information Overseas
  9. 9. Cookies
  10. 10. Data security
  11. 11. Access and correction
  12. 12. Contact our Privacy Officer
  13. 13. Policy administration
  14. 14. Definitions
  15. 15. Document History

1. Introduction

1.1. Mach7 Technologies Limited (referred to as “Mach7”, the “Company”, “we”, “our”, “us”) recognises the importance of privacy and is committed to protecting the privacy of our shareholders, people who use or interact with our products, people who visit our website, and other related parties (referred to as an “individual” or “you”) when handling your Personal Information.

1.2. It should be noted that all Personal Information about you as an identified, or reasonably identifiable, individual (that is in the Company’s control) is handled and managed with the utmost confidentiality by the Company and in accordance with Applicable Law. We only collect, use, retain, and disclose your information as permitted by Applicable Law and as reasonably necessary and proportionate to achieve the purposes for which your Personal Information is collected or processed, as disclosed in this Policy.

1.3. Mach7 has operations globally, collectively referred to as “Mach7 Subsidiaries”.

2. Application

2.1. This Policy binds and applies to all Mach7 Personnel and anyone who is involved in collection, recording and management of Personal Information on behalf of Mach7.

2.2. Unless a specific exception is expressed, the guidelines defined in this Policy are mandatory across all Mach7 Subsidiaries. When required by Applicable Law, Mach7 Subsidiaries may provide you with a copy of this Policy.

3. Purpose

3.1. This Policy outlines how we process Personal Information in connection with our products and services, in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and with all other Applicable Laws.

3.2. It also explains an individual’s rights in relation to their Personal Information. The Policy explains the ways in which an individual can contact us to exercise those rights or complain about a breach of privacy. To the extent permitted by Applicable Law, by providing personal or sensitive information to us or by using our website, you agree to the terms and conditions of this Privacy Policy.

4. Applicable Laws

4.1. Mach7 is committed to complying with the applicable data protection laws (“Applicable Laws”).

4.2. Depending on the country where you are located or providing Personal Information to Mach7, the collection, processing, use, and disclosure of Personal Information will be subject to the local Applicable Law.

4.3. Certain requirements may vary from one country to another, Mach7 is particularly concerned about your privacy, and this Policy constitutes a standard to which Mach7 is committed.

4.4. In particular, Mach7 is committed to complying with the following Applicable Laws, where applicable:

  1. Australian Privacy Principles (“APPs”) under the Privacy Act 1988 (Cth) which defines how organizations protect the privacy of data subjects.
  2. UK Data Protection Act (“DPA”) which defines general data processing and must be read together with the UK General Data Protection Regulation (“UK GDPR”).
  3. European Union General Data Protection Regulation (“EU GDPR”) which established data privacy rights for EU residents or citizens.
  4. Singapore Personal Data Protection Act (“PDPA”) which defines the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data.
  5. Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”) which is the federal law that governs the data collection, processing, and protection by federal works, undertakings or businesses operating within Canada.
  6. The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the HIPAA Privacy Rules which define the data protections available to patients in the United States and the rules for the electronic processing of health data by covered entities and business associates.
  7. The following comprehensive privacy laws and their implementing regulations which have been enacted to give residents of each respective state certain rights relating to their Personal Information and governs how that Personal Information can be collected and used. Note that some of these laws may not apply to information and entities covered by HIPAA.
    1. Colorado Privacy Act (“CPA”).
    2. California Consumer Privacy Protection Act (“CCPA”).
    3. Connecticut Data Privacy Act (“CTDPA”).
    4. Delaware Personal Privacy Act (“DPDPA”).
    5. Indiana Consumer Data Protection Act (“INDCPA”).
    6. Iowa Consumer Data Protection Act (“ICDPA”).
    7. Kentucky Consumer Data Protection Act (“KCDPA”).
    8. Maryland Online Data Privacy Act (“MODPA”).
    9. Minnesota Consumer Data Privacy Act (“MCDPA”).
    10. Montana Consumer Data Privacy Act (“MTCDPA”).
    11. Nebraska Data Privacy Act (“NDPA”).
    12. New Hampshire Data Privacy Act (“NHDPA”).
    13. New Jersey Data Protection Act (“NJDPA”).
    14. Oregon Consumer Privacy Act (“OCPA”).
    15. Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”).
    16. Tennessee Information Protection Act (“TIPA”).
    17. Texas Data Privacy and Security Act (“TDPSA”).
    18. Utah Consumer Privacy Act (“UCPA”).
    19. Virginia Consumer Data Protection Act (“VCDPA”).
  8. Any other laws which may apply to you and Mach7 from time to time.

5. What is Personal Information?

5.1. Personal Information is information that identifies, relates to, or describes you, or could reasonably identify or be associated with you, whether directly or indirectly. Personal Information does not include de-identified or publicly available information.

5.2. Mach7 processes the following categories of Personal Information:

  1. Identifiers such as name, contact details, and IP address.
  2. Commercial information, including any records of dealing with Mach7.
  3. Internet or other electronic network activity information.
  4. Sensitive Information, as defined below.

5.3. Sensitive Information is Personal Information that is given a higher level of protection by Applicable Law. It includes information about an individual’s health and includes genetic and biometric information processed for the purpose of uniquely identifying an individual, biological data, neural data, and precise geolocation data. Sensitive Information also includes Personal Information revealing an individual’s race or ethnic origin; political opinions; membership in political, professional or trade associations or trade unions; religious beliefs; mental or physical health condition, diagnosis, disability, and/or treatment; sex life, sexual orientation, and/or status as transgender or nonbinary; citizenship or immigration status; criminal record; status as a victim of a crime; financial account number, log-in information, or credit or debit number in combination with a password or credential which would allow access to financial accounts; and a government issued identification number (including a social security number, passport number, and driver’s license number).

Mach7 processes the following categories of Sensitive Personal Information:

  1. Account log-in numbers in combination with any required security or access code, password, or credentials allowing access to an account.

5.4. In this Policy when we talk about Personal Information, we include Sensitive Information, unless otherwise specified. Sensitive Information is only processed as reasonably necessary for the purposes disclosed herein.

6. Collection of Personal Information

6.1. Mach7 collects Personal Information so that we can provide products and services to our customers, administer individuals’ investment in the Company and comply with our legal obligations.

6.2. Mach7 will only collect your Personal Information for the purposes set out in this Policy, unless you are otherwise notified at the time of collection.

6.3. Mach7 collects Personal Information about you through our interactions with you and may use this information for the purposes outlined in this Policy.

6.4. Personal Information may be provided to Mach7 by Mach7 Subsidiaries or our business or commercial partners. In addition to the protections afforded to you in this Policy, if your Personal Information is provided to us by a business or commercial partner, it may also be protected through contracts we enter into with those partners. At no time will those contractually afforded protections be less than those provided in this Policy.

6.5. The business and commercial partners which may provide Mach7 with your Personal Information fall into the following categories:

  1. Resellers and distributors of Mach7 software.
  2. Customers of Mach7.
  3. Other sources such as advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers.

6.6. At times where reasonably necessary for a legitimate business purpose, Personal Information collected may include Sensitive Personal Information such as health and medical procedure information (including photography/images). Examples may be to investigate a product complaint and to support the use of our services for training and education purposes. Upon your request, we will limit, to the extent permitted by Applicable Law, our use of your Sensitive Information.

6.7. Mach7 may collect Personal information in several ways, in the course of:

  1. Providing technical assistance about the products and services that we provide.
  2. Responding to product or service queries (such as via email or telephone).
  3. Fulfilling regulatory obligations for reporting of potential or actual adverse events or regulatory recalls involving Mach7 medical device products.
  4. Sales calls or follow-up meetings with our sales representatives.
  5. Communication with third parties such as our related entities, business or commercial partners (including the Company’s share registry); or
  6. Using our websites, apps, product information or other services, including through use of cookies. Information about your computer hardware and software may be automatically collected by Mach7, including your IP address, browser type, domain names, and access times and referring website addresses. This information is used by Mach7 for the operation of the service, to maintain quality of the service, and to provide general statistics regarding use of the Mach7 website. See also the section titled ‘COOKIES’.

6.8. Mach7 may also collect your Personal Information from third parties in relation to our dealings with you, such as credit reporting bodies or other similar entities. In the event that we receive your Personal Information from a third party, it is under the condition that the third party providing this data has obtained your consent to disclose your Personal Information to Mach7 or to an offshore entity.

6.9. Mach7 will retain your Personal Information until it is deemed no longer commercially necessary for providing business services, up to a maximum of 10 years, unless you request that we delete your Personal Information before that time.

7. Use and disclosure of Personal Information

7.1. Mach7 will process your Personal Information for the purposes outlined in this Policy or otherwise disclosed to you at the time of collection, which generally includes the following:

  1. for our everyday business operations and to interact and carry out transactions with you or your organisation. Only employees who need the information to perform a specific job (for example, billing or customer service) are granted access to Personal Information.
  2. in the course of the sale, distribution or provision of our products and services.
  3. in the course of support service to our products.
  4. to respond to your inquiries and requests providing you information regarding our products and services via email alerts, SMS or post.
  5. any required financial disclosure reporting.
  6. assessment of credit account applications.
  7. for internal business purposes such as improving our products and services offerings and providing you with offerings about products and services that may be of interest to you including digital solutions.
  8. to provide you with access to online resources which we may offer from time to time.
  9. for compliance with regulatory requirements, such as maintaining a record of product queries, complaints, adverse events and recalls relating to our products.
  10. any purposes for which it was requested and any secondary purposes to which you have consented or for which we are lawfully allowed to use your information; and
  11. any other purposes required and permitted by Applicable Laws.

7.2. Mach7 does not collect, use, or sell Personal Information for the purposes of training large language models.

7.3. Mach7 may disclose your Personal Information to the following categories of service providers and contractors (including overseas parties, when permitted by Applicable Law) to enable its provision of products and services:

  1. professional advisers, including lawyers, insurers, financial institutions, accountants and auditors;
  2. government, regulatory and law enforcement authorities when required by Applicable Law.

7.4. Mach7 may disclose the following categories of Personal Information to third parties:

  1. Contact details, such as your name, address, email address, and phone number.
  2. Identification information, including date of birth and government-issued identification numbers.
  3. Transaction records, such as purchase history and product enquiries.
  4. Technical information, including device details and usage data.
  5. Health-related information, where relevant to product queries, complaints, adverse events, or recalls.
  6. Financial information required for billing or payment processing.

The purposes for which Mach7 discloses Personal Information to third parties fall in the following categories:

  1. To enable the provision of products and services, including digital solutions and technical support.
  2. For compliance with regulatory requirements, such as maintaining records of product queries, complaints, adverse events, and recalls.
  3. To professional advisers (e.g., lawyers, insurers, accountants) for business administration and legal compliance.
  4. To government, regulatory, and law enforcement authorities when required by Applicable Law.
  5. To facilitate complaint resolution and servicing of products, including software repair where Personal Information may be contained within the software.
  6. For secure electronic data storage, transmission, and management across borders, as permitted by law.

7.4. To the extent that Personal information is disclosed to a third party, Mach7 commits to enter into an agreement with that third party ensuring that your Personal Information is only disclosed for specified purposes, obligates the third party to comply with Applicable Laws and the protections afforded under this Policy, and gives Mach7 the right to take steps to ensure that the third party’s use of your Personal Information is consistent with the third party’s obligations under the agreement.

7.5. Mach7 does not sell, share, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic means your Personal Information to a third party for monetary or other valuable consideration, process your Personal Information for cross-context behavioural advertising or other targeted advertising, nor process Personal Information for the purpose of profiling in furtherance of decisions that produce a legal or similar effect on an individual., unless you direct us otherwise.

8. Transfer of Personal Information Overseas

8.1. Mach7 may transfer Personal Information across borders on the basis of a genuine business need, and as permitted by Applicable Law, for example:

  1. to Mach7 Subsidiaries as part of our everyday business operations.
  2. to our overseas suppliers and product manufacturers, complaint resolution and technical servicing requirements including where in the event software requires repair or servicing, and it is impossible to separate Personal Information from the software.
  3. to selected third parties to provide Mach7 with support services such as database IT support, where from time to time such third parties may access your Personal Information to enable them to provide those services to Mach7; and
  4. to countries outside country of origin in the course of electronic data storage, transmission and management.
  5. for compliance with regulatory requirements, such as maintaining a record of product queries, complaints, adverse events and recalls relating to our products.

8.2. Mach7 will ensure that the use and disclosure of Personal Information overseas is done in compliance with this Policy and Applicable Laws.

9. Cookies

9.1. A Cookie is a small string of information that a website transfers to your browser for identification purposes. Cookies record information about your visit, including the type of browser and operating system you use, previous sites visited and your server’s IP address.

9.2. Cookies can either be “persistent” or “session” based. Persistent Cookies are stored on your computer, contain an expiration date, and are mainly for the user’s convenience. Session Cookies are short-lived and are held on your browser’s memory only for the duration of your session, they are used only during a browsing session and expire when you quit your browser. Mach7 may use both session and persistent Cookies. This information may be used to personalise your current visit to our website and, for this reason, may be considered Personal Information. Cookies that are considered Personal Information are used for the purposes described in this Policy and are retained for the period of time expressed in this Policy.

9.3. Mach7 does not use Cookies to record any of your Personal Information. If you do not wish to use Cookies, you can adjust your browser settings to reject Cookies or notify you when they are being used.

10. Data security

10.1. Mach7 commits to use reasonable and appropriate physical, administrative, and technical safeguards to protect your Personal Information from loss, misuse, and unauthorised or illegal access, disclosure, alteration, or destruction. We regularly review and update our security practices to mitigate risks.

10.2. Personal Information is stored in a combination of secure computer storage facilities, paper-based facilities and other records including cloud storage.

10.3. Mach7 commits to timely report data breaches to any appropriate parties, consistent with the requirements of Applicable Law. In the event of a data breach or an unauthorised attempt to access Personal Information, Mach7 will take reasonable steps to cure any breach or attempted breach.

11. Access and correction

11.1. You have the following rights in relation to your Personal Information processed by us:

  1. The right to confirm your Personal Information is being processed and to access such Personal Information.
  2. The right to correct inaccuracies in your Personal Information.
  3. The right to delete Personal Information provided by, or obtained about, you.
  4. The right to obtain a copy of your Personal Information in a portable and, to the extent feasible, in a readily usable format that allows you to transfer your Personal Information without hindrance.
  5. The right to obtain a list of third parties to which your Personal Information has been disclosed.

11.2. You may exercise any of these rights by contacting our Privacy Officer using the details below under Section 12. We will comply with a request that we can authenticate using commercially reasonable methods without undue delay, and in accordance with Applicable Laws.

11.3. If you believe that Mach7 has not protected your Personal Information as set out in this Policy or has denied you access to your Personal Information in potential breach of an Applicable Law, you may appeal that decision or lodge a complaint by writing directly to us. We will endeavour to respond to your request within 30 days. All such complaints will be handled with the appropriate discretion.

11.4. If you believe your complaint has not been satisfactorily resolved, you may lodge a complaint with the Federal Privacy Commissioner in Australia, or the relevant local authority body. For more information on privacy, you can contact the Office of the Australian Information Commissioner’s (OAIC’s) hotline service on 1300 363 992 or visit the OAIC’s website at www.oaic.gov.au or your relevant local authority body.

11.5. Upon receipt of a request to review, correct, update, or delete Personal Information, we will verify that the Personal Information being requested belongs to the requesting party by confirming with the requestor they are the individual to whom the information relates. This confirmation may be carried out by requesting appropriate identification documentation, such as a driver's licence, passport, or other government-issued ID, or by verifying key account details or contact information previously provided to us. This process ensures that only authorised individuals are able to access, modify, or delete their Personal Information.

11.6. An authorized agent making a request on behalf of an individual should contact our Privacy Officer. If we receive a request from an authorized agent on behalf of an individual, we will verify the validity of that request with the individual using the methods listed above and by obtaining appropriate evidence of the agent’s authority to act on the individual’s behalf, in accordance with Applicable Laws

12. Contact our Privacy Officer

12.1. If you have a privacy complaint, or wish to review, correct, update, or delete the Personal Information that we hold about you, please contact our Privacy Officer using the following details:

Tel: +61 1300 384 692
E-Mail: cosec@mach7t.com
Web: www.mach7t.com
Toll Free: +1.888.876.2247
Mail: Mach7 Technologies Limited
C/- Vistra (Australia) Pty Ltd
Suite 2, Level 11, 385 Bourke Street, Melbourne, VIC 3000

12.2. If you have questions or concerns about this Policy or our information practices, please reach out to our Privacy Officer using the above information.

13. Policy administration

  1. The Board is responsible for the overall administration of this Policy.
  2. The Board will monitor the implementation of this Policy and will review it at least once every 2 years or as may be required to ensure it is operating effectively. Any recommended changes must be approved by the Board.
  3. Internal control systems and procedures will be audited regularly to ensure that they are effective in minimising the risk of non-compliance with this Policy.
  4. Mach7 may update this Policy from time to time to reflect changes in our practices or legal requirements.
  5. A copy of this Policy will be made available on the Company’s website within a reasonable time after any such updates or amendments have been approved by the Board, and in such other ways as will ensure the Policy is available to individuals whose Personal Information the Company collects or retains.

14. Definitions

14.1 In this Policy the following words or phrases mean the following:

Board means the Board of Directors of the Company.

Company means Mach7 Technologies Limited ACN 007 817 192 and all of its subsidiaries.

Personal Information means information as defined under Section 5.1.

Personnel means all persons acting (whether authorised or unauthorised) on behalf of the Company, and its subsidiaries, at all levels, including officers, directors, temporary staff, contractors, consultants and employees of the Company and its subsidiaries.

Policy means this Privacy Policy.

Sensitive Information means the information as defined under Section 5.3.

14.2 Additional words and phrases are defined in bold throughout the Policy.

15. Document History

VersionSummary of AmendmentsApproved byApproval date
13.0Updated Privacy PolicyBoard19 Dec 2025

Download this Privacy Policy as a PDF — the Board-approved document of record.