Privacy Policy

Personal Information That We Collect

Information You Provide Directly to Glaukos

We collect Personal Information that you voluntarily submit to us, including when you communicate with us via our Digital Platforms or at in-person events. For example, if you request information about a product or service from us via our “Contact Us” form on a website, information such as your name, email address, phone number, and other contents of your message will be collected. This includes any text characters and any audio, video, and graphic information formats included in the message. If you voluntarily submit Personal Information to us that is sensitive in nature (e.q., health information), that will also be collected and processed for the purposes set out below. If you provide us feedback or contact us via email, we will collect your name and email address, as well as any other content included in the email, to process and respond to your message. We may combine this information with information we collect or receive about you from other publicly and commercially available sources, such as Linkedln and other social media platforms. We may combine all the information we receive about you and use or disclose it in the manner described in this Privacy Policy.

The following are the categories and specific types of Personal Information that we collect:

We may also collect Personal Information on our Digital Platforms at other points that explicitly state that Personal Information is being collected from you through a Privacy Notice. In these circumstances, Glaukos will disclose the purpose of collecting your Personal Information and will only use it for the purposes stated.

Information We May Collect Automatically

Like many companies, Glaukos and its third-party service providers use a variety of automatic detection tools such as cookies, embedded web links, pixel tags, Flash cookies, and web beacons, to passively collect certain information about your use of and visits to our Digital Platforms. For example, we may collect your Internet Protocol (IP) address, your authentication information, the type of device used, the web browser and operating system used to access our Digital Platforms, the time and duration of your visits, your search queries, and information about the content and webpages you view and the features you access on a Digital Platform. This information helps us better understand the use and effectiveness of our Digital Platforms and is in a form that does not, on its own, permit direct association with any specific individual, however, much of this information is considered Personal Information as defined above.

Here is more information about some of tracking technologies, cookies, and how they work:

A cookie is a file containing an identifier that is sent by a web server to a browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. Cookies may not contain any information that personally identifies a user, but Personal Information that we store about you may be linked to the information stored in and obtained from cookies. To the extent that cookies that are not strictly necessary for the provision of the websites, we will ask you to consent to such use of cookies when you first visit the websites.

We use cookies for the following purposes:

• Session – A session cookie contains information that is stored in a temporary memory location and then subsequently deleted after the session is completed or the web browser is closed. This cookie stores information that the user has inputted and tracks the movements of the user within the websites. The session cookie will be deleted when the expiration date is reached or when a user or application manually deletes it.
• Strictly Necessary – Strictly Necessary cookies are used to provide an online service (e.g., our Digital Platform or a service on our websites) which you have requested.
• Performance – These cookies are used specifically for gathering data on how you use the websites, which pages of our websites are visited most often, or if you get error messages on web pages. These cookies only monitor the performance of our websites as users interact with it. These cookies do not collect your Personal Information, which means all the data collected is anonymous and only used to improve the functionality of the websites.

One of the third-party services that we use to track your activity and understand your behavior on our Digital Platforms is Google Analytics. Information that we collect may be combined with other information about you using Google Analytics or other services. We use these technologies, alone or in combination, to understand user behavior (by tracking unique user IDs), and to target and measure the effectiveness of advertisements, help diagnose problems, and facilitate your access to, and use of, the services offered on our Digital Platforms.

Where applicable, we will collect your consent using a cookie banner on the front page of our website prior to using any non-essential cookies.

Information Collected From Other Sources

Glaukos may also collect information about you from other sources to help us correct or supplement our records, improve the quality or personalization of our services to you, and prevent or detect fraud. This includes Personal Information that may be collected via our medical devices, such as our KXL^® System.

Use Of Your Personal Information

We use the Personal Information that we collect and receive for the following purposes:

• To help us develop, operate, deliver, and improve our Digital Platforms and our other products, services, and offerings;
• To provide you with information you request or respond to inquiries we receive from you or your company or organization;
• To analyze how users use our Digital Platforms and related analysis, research, reporting, and troubleshooting as we believe is necessary or appropriate to protect, enforce, or defend legal rights, privacy, safety or property, whether our own or that of employees or agents or others;
• With your consent, to provide you with promotional and marketing materials, relevant content and advertisements, surveys, newsletters, questionnaires, and other materials; and to comply with applicable law; and
• To promote and market our products and services to you based on information obtained from third parties.

Disclosure Of Your Personal Information

We will not disclose any Personal Information we collect from you to any third parties except as indicated below:

• Glaukos and Affiliates. We will share information within Glaukos and with our corporate affiliates for the purposes set out in this Privacy Policy, such as responding to your inquiry and providing you with information that you have requested.
• Website Consultants, Service Providers, and Professional Advisors. Some affiliated and third-party consultants and service providers, such as partners that provide us technical support, information we request processing, data and website hosting, event hosting and registration, customer support, and other services, collect certain information relating to your use of our Digital Platforms, including through the use of cookies, Web beacons, and similar technologies. We may also share your Personal Information with our professional advisors, including legal, accounting, or other consulting services for purposes of audits or to comply with our legal obligations.
• Enforcement of Rights/Security. We may disclose information (i) when required by law or in response to a request for cooperation by a government entity or law enforcement; (ii) to protect and/or enforce the rights, property interests, or safety of us, or any of our respective affiliates, business partners, customers, or employees; or, (iii) to resolve disputes, troubleshoot problems, prevent fraud and otherwise enforce this Privacy Policy and our Terms of Use.
• Reorganization of Glaukos. We may disclose Personal Information to a buyer or successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Glaukos’ assets, whether in the course of doing business or as part of bankruptcy, liquidation, receivership, or similar proceeding in which Personal Information held by Glaukos are among the assets to be transferred.
• With Your Consent. We may share your information when you or your company or organization consent to or request such sharing. Among other things, when you provide information through the “Find a Physician” function on our websites, we may disclose the information to our affiliates or to health care providers in your area in order to put you in touch with clinicians.

Retention Of Your Personal Information

We retain Personal Information for as long as needed or permitted considering the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you;
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period before we can delete them); or
• Whether retention is advisable considering our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Protecting Your Personal Information

The security of your information is important to us. We employ commercially reasonable security controls to protect the Personal Information submitted to us from unauthorized access, loss, interference, misuse, disclosure, alteration, or destruction, both during transmission and once we receive it. Glaukos employees who have access to Personal Information are made aware of and trained on the importance of keeping it confidential.

We care about the security of Personal Information and use various administrative and technological safeguards to preserve the integrity and security of all Personal Information collected through our Digital Platforms. These safeguards vary based on the sensitivity of the Personal Information that we collect, process, and store, and the current state of technology.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we make commercially reasonable efforts to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Digital Platforms. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on our Digital Platforms. If you have any questions about data security and integrity on our Digital Platforms, you can contact us using the details in the “How to Contact Us” section below.

Accessing And Reviewing Your Personal Information

You may review and update the Personal Information we have collected, including your name, phone number, email and postal address, and other information by which you can be personally identified, by contacting us using the details in the “How to Contact Us” section below. If you are emailing us, please place “Information Review Request” in your email subject line. Please note that to protect your privacy and security, we may take reasonable steps to verify your identity before we disclose or make any corrections to such information.

International Transfers (For Non-U.S. Residents)

As Glaukos is a global organization, the Personal Information you provide may be transferred to Glaukos or a third party in the United States, whose laws may not offer the same level of data protection for your Personal Information as in your country. By using our Digital Platforms and providing us with your Personal Information, where applicable law permits, you consent to such transfers, as well as the processing, and storage of such information outside your country of residence.

Links To Other Websites

Our Digital Platforms may contain links or references to third party owned or operated websites or online services. Glaukos is not responsible for the collection of Personal Information or the security or privacy of any such third-party sites or services. Likewise, Glaukos is not responsible for the collection, usage, and disclosure policies and practices (including the data security practices) of any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer, including with respect to any information you disclose to such other organizations through or in connection with our social media pages, any mobile sites, applications, widgets, and other mobile interactive features. We encourage you to review the privacy statements posted on the websites you visit.

Opt-Out Of Marketing Communications

You will only receive information about our products and services and special offers from us if you specifically request it. At any time after making such a request, you can let us know that you no longer wish to receive such information by contacting us using the details in the “How to Contact Us” section below. If you are emailing us, please place “Opt-Out Request” in your email subject line.

Children’s Personal Information (Applies To U.S. Users Only)

Our Digital Platforms are intended to be used by adults and corporate entities interested in Glaukos. It is not intended for children, and Glaukos does not knowingly collect or store Personal Information about anyone under the age of 18 without proper consent, such as the consent of their parent or guardian.

Your California Rights

This section of our Privacy Policy is specifically for California residents and explains how we collect, use, and disclose personal information relating to California residents covered by the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”). The CCPA and CPRA define “personal information” as any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household.

Sale of Personal Information / Do Not Sell or Share

Glaukos does not sell, trade, or rent out personal information for compensation that would constitute a sale under California law, nor have we done so in the preceding 12 months. In the event that Glaukos sells, trades, or rents out personal information that would constitute a sale, Glaukos will provide disclosures in this section of the Policy as well as the option to opt out of the sale and sharing of personal information using global privacy controls (“GPC”) and/or by clicking the “Manage Privacy Settings” link at the bottom of our website found within the cookie banner at the bottom of the website and selecting your preferences.

Our use of tracking technologies may be considered “sharing” under California law. You can opt-out of this sharing and being tracked by these third parties by clicking “Do Not Sell or Share My Personal Information” link at the bottom of our website and selecting your preferences, or by broadcasting the global privacy control signal. Please note that your use of our website may still be tracked by Glaukos and/or our service providers. We do not knowingly sell the personal information of consumers under 16 years of age.

Categories of personal information disclosed that may be considered a “sale” under California law: Personal Identifiers, Device Information and Other Unique Identifiers, and Internet or Other Network Activity.

Categories of third parties to whom personal information was disclosed that may be considered a “sale” under California law include advertisers and marketing partners, data analytics providers, and social media networks.

Categories of Personal Information We Collect and Our Purposes for Collection and Use

You can find a list of the categories of personal information that we collect in Section 1 above. For details regarding the sources from which we obtain personal information, please see Section 1 above. We collect and use personal information for the business or commercial purposes described in Section 2 above.

Sensitive Personal Information We Collect and Our Purposes for Collection and Use

The CPRA’s definition of sensitive personal information includes the following types of information:

• Social security number, driver’s license number, state identification card number, or passport number;
• A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
• Biometric information processed for the purpose of identifying a consumer; and
• Health and medical information

Right to Limit the Use of Sensitive Personal Information

California residents have the right to limit the use of sensitive personal information in some circumstances. Glaukos only collects sensitive personal information, as defined by applicable California law, with your consent and only uses the sensitive personal information for the use disclosed at the time of collection. Glaukos does not use sensitive personal information for inferring characteristics about you. Glaukos will only use your sensitive personal information to provide you with the services you requested. Glaukos does not share your sensitive personal information with third parties.

You can find a list of the categories and specific types of sensitive personal information that we collect in Section 1 above. We only collect and use sensitive personal information to provide you with products and services.

California Privacy Rights

Under the CCPA and CPRA, California residents have certain rights with respect to personal data about them we have collected. California residents are entitled to contact us to request information about whether we have disclosed personal information to third parties for the third parties’ direct marketing purposes.

California consumers have the right to:

• Request disclosure of the categories and specific pieces of personal information that Glaukos has collected about you;
• Request disclosure of the categories of third-party sources, if any, from which Glaukos has collected personal information about you;
• Disclosure of the business or commercial purpose(s) for which your personal information has been collected by Glaukos;
• Receive a list of the categories of third parties with whom Glaukos has shared your personal information;
• Request that Glaukos delete any personal information that it has collected from you (subject to exceptions);
• Request that Glaukos correct inaccurate personal information that Glaukos has about you;
• Request that Glaukos limit the use of sensitive personal information to only that which is necessary for providing products and services;
• Request to opt-out of automated decision-making, including profiling and targeted advertising; and
• Not be discriminated against by Glaukos (e.g., charged different rates, provided different levels of service, denied goods or services, or suggested any of the preceding) for exercising any of the individual rights granted above.

You may submit a verifiable data subject request (see explanation below) to contact@glaukos.com

Before complying with your request, we will need to verify that it is you that is making the request. To accomplish this, you will be requested to confirm specific personal information that we already know about you. California consumers are limited to two requests for Personal Information per twelve (12) month period. Only you or an authorized agent may make a verifiable data subject request related to your personal information. The verifiable data subject request must provide sufficient information and documentation to allow us to verify that you (or an authorized agent with written permission to exercise your rights on your behalf) are the person about whom we collected personal information. We will not provide you with personal information if we cannot verify your identity and/or authority to make the data subject request and confirm the personal information belongs to you or the represented individual. We use personal information provided in a verifiable data subject request solely to verify the requestor’s identity or authority to make the request.

We will respond to a verifiable data subject request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period which is an additional forty-five (45) days. We will deliver our response to electronically at the email address in your request. All disclosures we provide will only cover the twelve (12) month period preceding the verifiable request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable data subject request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Categories of Personal Information Disclosed and Categories of Recipients

We disclose the following categories of personal information for business or commercial purposes to the categories of recipients listed below:

• We share Personal Identifiers with service providers, third-parties, advertising networks, and social media networks.
• We receive Personal Identifiers from service providers, third-parties, advertising networks, and social media networks.
• We share Internet or Other Network Activity with service providers, third-parties, advertising networks, and social media networks.
• We receive Internet or Other Network Activity from service providers, third-parties, advertising networks, and social media networks.
• We share Payment Information with service providers who process payments.
• We share Physical Characteristics with service providers and third-parties.
• We share Health and Medical Information you choose to provide regarding your health conditions or needs with service providers and third-parties.

California Shine the Light

Glaukos does not disclose personal information to third parties for direct marketing purposes. Thus, upon receipt of such a request by a California consumer, and as required by California state law, we will either (a) respond with a confirmation that we have not disclosed any personal information to third parties for direct marketing purposes in the previous calendar year, or (b) if our practices have changed, we will provide the categories of personal information that has been shared for direct marketing purposes in the past twelve (12) months and categories of third parties to whom such personal information was disclosed for such purposes, whichever is relevant.

Retention of Personal Information

In general, we retain your personal information for only as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. In the event that you make a verifiable request to delete your personal information and no exceptions apply, we will no longer retain your personal information. The criteria used to determine our retention periods includes, without limitation:

• The length of time we have an ongoing relationship with you and provide products and services to you;
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Your European Union, European Economic Area, Switzerland, And United Kingdom (“EU”) Rights

This section of the Policy applies only to users who use the Digital Platforms or Services covered by this Policy from a country that is a Member State of the European Union, Switzerland, the United Kingdom (“UK”), or in the European Economic Area (“EEA”) (“EU Users”) and supplements the information in this Policy.

Glaukos Corporation is the data controller for processing of Personal Information or personal data as defined under applicable data protection law. For purposes of this section, Personal Information and personal data are used synonymously.

Legal Basis for Processing

We process Personal Information for the purposes set out in this Privacy Policy, as described above in Section 2. Our legal bases to process Personal Information includes processing that is:

• Necessary for the performance of the contract between you and Glaukos (for example, to provide you with the products and services you request and to identify and authenticate you so you may use the Digital Platforms);
• Necessary to comply with legal requirements (for example, to comply with applicable accounting rules and to make mandatory disclosures to law enforcement);
• Necessary for our legitimate interests (for example, to manage our relationship with you and to improve the Digital Platforms and our products and services); and
• Based on consent by an individual (for example, to communicate with you about our products and services and provide you with marketing information), which may subsequently, unless an exception applies, be withdrawn at any time (by contacting us as specified in the “How to Contact Us” section of this Privacy Policy) without affecting the lawfulness of processing based on consent before its withdrawal.

You are not required, as a necessity, to enter into a contract, to provide us with Personal Information for processing as described above.

International Transfers of Personal Information

As set out above, the Digital Platforms may be hosted in the United States. Also, Glaukos personnel and some of the third-party vendors to whom we disclose Personal Information (as set out above) may be located in the United States and other countries outside of the UK, Switzerland, and the European Economic Area (“EEA”), including in countries that may not provide the same level of data protection as your home country. We take appropriate steps to ensure that recipients of your Personal Information are bound to duties of confidentiality, and we implement measures such as standard data protection contractual clauses to help to ensure that any transferred Personal Information, remains protected and secure. A copy of these clauses can be obtained by contacting us as specified in the “How to Contact Us” section of this Privacy Policy.

Retention of Personal Information

We retain Personal Information for as long as needed or permitted considering the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you;
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Your EU Rights

Under EU data protection law, you have certain rights including:

• Request access to your Personal Information. The right to access, update or delete the information we have on you. Whenever made possible, you can access, update or request deletion of your Personal Information directly within your account settings section. If you are unable to perform these actions yourself, please contact us to assist you. This also enables you to receive a copy of the Personal Information we hold about you.
• Request correction of the Personal Information that we hold about you. You have the right to have any incomplete or inaccurate information we hold about you corrected.
• Object to processing of your Personal Information. This right exists where we are relying on a legitimate interest as the legal basis for our processing and there is something about your particular situation, which makes you want to object to our processing of your Personal Information on this ground. You also have the right to object where we are processing your Personal Information for direct marketing purposes.
• Request erasure of your Personal Information. You have the right to ask us to delete or remove Personal Information when there is no good reason for Us to continue processing it.
• Request the transfer of your Personal Information. We will provide to you, or to a third-party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw your consent. You have the right to withdraw your consent on using your Personal Information. If withdraw your consent, we may not be able to provide you with access to certain specific functionalities of our Digital Platforms or Services.
• To file a complaint to a Supervisory Authority. You have the right to complain to a Supervisory Authority about our collection and use of your Personal Information. For more information, if you are in the European Economic Area (EEA), please contact your local Supervisory Authority in the EEA.

If you are aware of changes or inaccuracies in your Information, you should inform us of such changes so that our records may be updated or corrected.

Exercising Your EU Rights (EU Users)’

You may exercise many of your rights by contacting us using the information below. Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we will try our best to respond to you promptly.

Contact information for Data Protection Officer:

Children

The Digital Platforms are not directed to children under the age of 16, and children under the age of 16 years of age are not eligible to use the Digital Platforms. Protecting the privacy of children is very important to us. We do not collect information from people we know are under 16 years of age, and no part of our Digital Platforms is designed to attract people under 16 years of age. If we later learn that an individual has provided us with their information and they are under 16 years of age, we will promptly take steps to remove that user’s information from our databases.

Changes To This Privacy Policy

Glaukos regularly reviews this Policy and ensures that we process your information in a manner that in compliance with applicable regulations.

We reserve the right to change this Privacy Policy from time to time to reflect changes in our business practices, technological advancements and legal/regulatory environment. Any changes to this Privacy Policy, including information collected and the use and disclosure of that information will be posted here. Following any modification, we will revise the “last updated” date at the top of this Privacy Policy. If you are concerned about how your information is used, you should check our websites periodically. By continuing to use our Digital Platforms following the “last updated” date of any updated Privacy Policy, you are agreeing to be bound by the terms and conditions of such updated Privacy Policy.