Business Analyst (Medical Management sphere)

Privacy Policy for Job Applicants Last modified: 01/01/2023 As part of the recruitment process at Coherent Solutions Inc and below indicated Coherent Solutions subsidiaries (collectively “Coherent Solutions”, “Coherent”, “we”, “us” or “our”), we collect and process your personal data following the principles of transparency and confidentiality. Therefore, we have prepared this Privacy Policy for Job Applicants (hereinafter “Privacy Policy”) with the purpose of explaining how information about you is collected, used and disclosed depending on the processing purposes described in this Privacy Policy. The principles established by this Privacy Policy are based on European data protection and privacy laws, taking into account the requirements of the EU General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, (hereinafter “GDPR”), California Consumer Privacy Act and California Privacy Rights Act (hereinafter “CCPA/CPRA”), and on applicable local laws.

1. Who is the Data Controller and How to Contact Us Coherent Solutions Inc, together with Coherent Solutions subsidiaries, is the personal data Joint Controller (“Controller”) and is responsible for compliance with the provisions of the GDPR, CCPA/CPRA and applicable local laws. You can exercise any of your rights listed in para. 7 below by contacting us at [email protected]. Coherent Solutions group of companies includes the following companies which act as joint controllers in relation to your personal data: • Coherent Solutions Inc, USA • Coherent Solutions UAB, Lithuania • Coherent Solutions Ltd, Bulgaria • Coherent Solutions Romania SRL, Romania • Coherent ISSoft SRL, Republic of Moldova • Coherent Solutions Sp. z.o.o, Poland • ISsoft Solutions Ukraine Limited Liability Company, Ukraine • Foreign Production Unitary Enterprise ISSOFT SOLUTIONS, Belarus • Coherent Solutions Issoft Georgia LLC, Georgia • Issoft Coherent Solutions Mexico S de RL de CV, Mexico 2. What Personal Data We Collect and Why 2.1 Purpose of processing When you submit your application on our website, we collect, store and process the personal data in your CV. We process this data with the purpose to evaluate your professional skills, and to assess your qualification and experience in relation to current open positions with a view of potential employment as well as to future open positions that may become available. 2.2 Personal data we collect During the recruitment process, we collect, use and store the information which is necessary for the purpose described above. This information includes the following: • Name and Surname (for the purpose of identification of a candidate), • E-mail address and telephone number (for the purpose to contact a candidate), • CV, resume, cover letter and other attachments you provide to us, like certificates, diplomas, recommendation (for the purpose to get relevant information about your educational background and professional skills), Job position you have applied for (for the purpose to direct your CV to the relevant recruiter), • Link to LinkedIn profile, GitHub profile, if any (for the purpose of collecting more relevant information about your professional experience), • Name of a referee in the Company, if any (for the purpose of a Corporate Referral Program), Interview notes about candidate (for the purpose of a proper assessment of professional experience and skills), • Notes of a candidate from recruitment agency (for the purpose of a proper candidate’s assessment in case external recruitment agency is engaged), • Testing task results (for the purpose of a proper evaluation of candidate’s performance and skills), • Desired salary and other job-related preferences (for the purpose of understanding the candidate’s expectations and suitability for the open position), • Relevant information about the candidate, which is publicly available on the Internet, • Other information, which is provided by job applicants on a voluntary basis. You are not obliged to provide us with the personal information as listed above. However, if you refuse to submit us all necessary information, we will not be able to evaluate your candidacy for the open vacancy and, consequently, will not be able to proceed with your potential employment with us. 2.3 Please, note, that we do not require and do not collect any sensitive categories of personal data, as defined under Art. 9 GDPR, which includes racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. 3. What is the Legal Ground for Collecting Your Personal Data When collecting and processing your personal data, we rely on one of the following legal grounds as stated below. • When candidate is submitting a CV to us, expressing the interest in potential employment in the Company, we process CV application relying on a legitimate interest legal basis (Art. 6.1 (f)). • When storing information about the candidate and contacting about future relevant job openings within 3 (three) years after receiving CV, we rely on a consent (Art. 6.1 (a)), in order to give the candidate the possibility to work with us in the future, even though currently we are unable to make a job offer. • When a candidate has submitted to us additional informational voluntary, we store and process information on a consent legal basis (Art.6.1 (a)). • When processing is based on a legitimate interest (Art.6.1 (f)) in case: • we contact you via LinkedIn or other professional networks with an information about our open positions, • you get involved in a dispute with us or we otherwise need to defend, enforce, exercise, and uphold our rights. • When processing is necessary for compliance with legal obligations (Art. 6.1 (c)) in case we receive a data subject request, or you decided to object contacting you with information about new job openings. 4. With Whom We Share Your Personal Data 4.1 Within Coherent Solutions group As Coherent Solutions group of companies consists of many different subsidiaries, we may share your personal data across companies in the Coherent Solutions group of companies, as listed in para. 1 above. Data sharing within the group of our companies is conditioned by decentralized organizational structure of business functions in the field of recruiting and is necessary to support ongoing business activities and to achieve business continuity. 4.2 Outside Coherent Solutions group We can also share your personal data with the following categories of external recipients only to the extent permitted by law and if necessary for the purposes described in para. 2.1 above: • maintenance and technical services, IT security and communications services for the purpose to protect the security and confidentiality of personal data we process and to help make our services available and functional, • attorneys, attorney assistants, legal advisors for the purpose to defend, enforce, exercise, and uphold our rights if you get involved in a dispute with us, • recruiting agencies in case such agencies assist us with recruiting process, • clients and their representatives in case evaluation and/or approval of your candidacy for the open position by client is necessary due to job-related functions, • academic institutions, former employer, referee with a purpose to verify your educational background, professional experience or to get a recommendation about you, • supervisory authority, government departments and agencies, police, regulators, courts in case we are legally obliged to share your personal data. 4.3 Outside EEA Some of the external recipients may be established outside the European Economic Area, which may result in your data being transferred to third countries. We share your personal data with recipients outside the EEA only when this is permitted by law and is necessary for the purposes outlined in para. 2.1 above. In this case you can expect the same level of protection of your personal data, since we ensure that any external data recipient that we engage with has adopted adequate data protection and security measures to safeguard your personal data. 5. How Long We Keep Your Personal Data We only retain your personal data for as long as necessary for the recruiting process. If you have become an employee, we will retain your application information along with other personal data required by local legislation to enter an employment relationship with us. In this case, your personal data will be stored during the employment period and after 5 (five) years after the employment contract termination unless a longer period is established in the applicable local law. If you have not been selected for the applied position, we will store your application information: • for a period of 6 (six) months after the last interaction with you, unless another period is established by local law, for the purpose of preparation, filing or defense of legal claims, • for a period of 3 (three) years since the application date with a purpose to contact you about future openings unless you object contacting you for this purpose. You can object contacting you about future job openings anytime by contacting us via [email protected]. In this case we will not contact you about future open positions. 6. Security of Your Personal Data When collecting, processing and storing your personal data, the Company is committed to the principles of integrity and confidentiality. Therefore, we take all reasonable technical and organizational measures to ensure that the personal data you are providing to us is in secure. The Company imposes the same obligations on external data processors outside the EEA, including on Greenhouse Software, Inc, recruitment software service provider, by signing a proper Data Processing Agreement. 7. What are Your Privacy Rights According to the General Data Protection Regulation, you have the following rights in relation to personal data you have submitted to us: • Right to information. You may at any time request from us information about what categories of your personal data we store and for what purposes (Art. 15 of GDPR) • Right of consent withdrawal. If you have provided us with your consent to process your personal data, you can withdraw your consent at any time without giving any reasons. Withdrawal of the consent shall not affect the lawfulness of the processing of personal data based on the consent before its withdrawal. (Art. 7 of GDPR). • Rectification right. If your personal data processed by Coherent Solutions is incorrect (inaccurate), you can ask us to correct it at any time (Art. 16 of GDPR). • Erasure and restriction of processing rights. You have the right to obtain the deletion of your personal data that Coherent Solutions processes or obtain restriction of processing. Deletion can be done at any time by contacting us. If deletion is due to legitimate reasons, instead of deletion, only restriction of your data may take place (Art. 17 and 18 of GDPR). After deleting your data, it is no longer possible for us to recover it. • Right to data portability. If you require us to provide you with your personal data, we will transfer the data to you or another controller in a structured, widely used and machine-readable format (Art. 20 of GDPR). • Right of objection. You have the right at any time and without giving any reason to object to our processing of your data (Art. 21 of GDPR). If you decide to object us to processing your personal data, we will no longer be able to proceed with your job application. • Advanced rights in automated data processing, including profiling. Coherent Solutions does not perform automated data processing, including profiling. Notwithstanding the above, with respect to automated data processing, including profiling, you have the additional right to request human intervention from the Controller, the right to challenge the decision and the right to express your point of view (Art. 22 of GDPR). We will respond to all your requests related to the implementation of your, as the data subject, rights without undue delay and no later than within 1 (one) month after receiving the request. That period may be extended by 2 (two) further months by informing you in advance. You also have the right to lodge a complaint with a supervisory authority against the processing of personal data if you believe that your personal data protection rights have been violated. 8. Contact details If you have any questions about collection, processing and storage of your personal data as a part of recruitment process, or regarding exercising your rights, please contact our Data Protection Officer at [email protected]. You can also send the request to the address: Coherent Solutions Inc 1600 Utica Ave S, Ste 120 Minneapolis MN 55416, USA Attention: DPO Coherent Solutions UAB Konstitucijos ave. K29, Vilnius, 08105, Republic of Lithuania Attention: DPO 9. Changes to this Privacy Policy The Company reserves the right to update this Privacy Policy for Job Applicants. The updated version of this Privacy Policy will be made available by publishing on a website.