Privacy Policy

1. Background

1.1. This employee privacy policy (“Privacy Policy”) sets out the principles and procedures adopted by Articulus Surgical Private Limited (“Company”, “we”, “us”) for the lawful collection, receipt, storage, use, processing, transfer, disclosure, and protection of personal information and sensitive personal data or information (“SPDI”) relating to its employees, job applicants, interns, consultants, and other individuals engaged in an employment-like capacity (“Employees”), by us.

1.2. This Policy is formulated in accordance with the Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).

1.3. This Privacy Policy applies to all stages of the employment lifecycle, including recruitment, onboarding, active employment, and post-employment record management, and extends to data relating to job applicants, interns, consultants, and other individuals engaged in a similar capacity. It is intended solely for internal use and shall not be interpreted as applying to the personal information of a customer, a vendor, a patient, or any other third party, or to information collected through the Company’s website. Such information is governed by separate privacy and data protection policies adopted by the Company that can be accessed here: Privacy Policy – Articulus Surgical.

2. Definitions

2.1. For the purposes of this Privacy Policy, the following expressions shall have the meanings assigned to them below. Words and expressions not defined herein shall have the meanings ascribed to them under the IT Act and the SPDI Rules.

(a) “Applicable Law” refers to the IT Act, the SPDI Rules, and any directions or standards issued thereunder that apply to the Company in relation to the handling of Personal Information or SPDI.

(b) “Grievance Officer” means the person designated by the Company under Rule 5(9) of the SPDI Rules to address discrepancies and grievances in respect of the processing of Personal Information or SPDI.

(d) “Personal Information” means any information that relates to a natural person which, either directly or indirectly, in combination with other information available or likely to be available, is capable of identifying such person.

(e) “Processing” means and includes the collection, recording, storage, use, transfer, disclosure, retention, destruction, or any other operation performed on Personal Information or SPDI.

(f) “SPDI” includes information relating to:

(i) passwords;

(ii) financial information such as bank account, credit or debit card, or other payment instrument details;

(iii) physical, physiological and mental health condition;

(iv) medical records and history;

(v) biometric information; and

(vi) any detail relating to the above categories of information, that is provided to, received, or processed by the Company for a lawful purpose under a contract of employment or engagement.

3. Categories of Information collected by Us

3.1. The Company collects and processes only that Personal Information and SPDI which is relevant and necessary for legitimate employment purposes or for compliance with Applicable Law. The types of information that may be collected and processed include the following:

(a) Identification and contact details: including an Employee’s name, date of birth, gender, residential and correspondence address, personal and official email address, mobile and alternate contact numbers, emergency contact information, and government-issued identifiers such as Permanent Account Number (“PAN”), Aadhaar number, or any other identification issued by the Central Government of India under Applicable Law

(b) Financial information: including details required for salary disbursement, reimbursements, tax deduction and remittance, provident fund or gratuity contributions, and other lawful payroll or accounting purposes.

(c) Biometric information: including fingerprints or facial scans collected through attendance or access-control systems, used solely for identity verification, access management, and record-keeping purposes.

(d) Medical information: including pre-employment medical records, health insurance or medical benefit details, vaccination records, and fitness or medical certifications necessary for employment, insurance, or workplace safety compliance.

(e) Employment-related information: including qualifications, professional history, references, background verification results, performance records, disciplinary proceedings, and information concerning training, career development, or other employment administration.

(f) System and network information: including login credentials, access logs, device identifiers, or other data generated through the Employee’s use of Company systems, networks, or communication tools, which may be required for IT, security, or audit purposes.

(g) Any other information: that may be voluntarily provided by an Employee or lawfully requested by the Company in connection with employment administration, statutory compliance, or the discharge of any contractual or legal obligation.

3.2. The Company does not collect or process any Personal Information or SPDI beyond what is necessary for legitimate business or employment purposes.

3.3. Where the Company collects SPDI, such collection is undertaken for a lawful purpose connected with the employment relationship, is necessary for that purpose, and is carried out with the knowledge and consent of the Employee in accordance with the requirements of the SPDI Rules.

We collect SPDI only when it is required for lawful employment purposes and always with the Employee’s knowledge and consent. Such information is collected to support legitimate HR, administrative, and compliance functions or fulfilling statutory obligations. We ensure that Employees are informed of the purpose for which their SPDI is collected and that it is used only for that specific purpose or any other use permitted under Applicable Law.

3.4. We collect Personal Information and SPDI primarily from Employees themselves, during recruitment, onboarding, and the course of employment. Where necessary and lawful, we may also obtain such information from authorised third parties. All such collection is carried out in

accordance with Applicable Law and this Privacy Policy.

3.5. The Company does not knowingly collect or process Personal Information or SPDI from any individual below eighteen (18) years of age. In the event that any such information is inadvertently collected, the Company shall ensure that it is permanently deleted from all systems and records without undue delay and shall not retain, use, or process such information for any purpose whatsoever.

4. Purpose of Collection and Use

4.1. We collect, receive, and process Personal Information and SPDI only for lawful purposes connected with the employment relationship or to comply with Applicable Law.

4.2. The information collected from Employees is used for purposes including:

(a) Employment administration: assessing candidates, issuing employment offers, maintaining personnel records, managing onboarding, and administering the terms of employment or engagement.

(b) Payroll and benefits: processing salaries, reimbursements, and incentives; deducting taxes and statutory contributions; and managing benefits such as provident fund, gratuity, insurance, and medical or wellness schemes.

(c) Performance and conduct management: maintaining attendance and leave records, reviewing performance, handling grievances or disciplinary matters, and facilitating promotions, transfers, or other employment actions.

(d) Legal and regulatory compliance: meeting obligations under labour, tax, and social security laws; responding to lawful requests from authorities; and maintaining records for audit or regulatory purposes.

(e) Health, safety, and workplace security: ensuring a safe work environment, implementing access control and surveillance where appropriate, and managing medical or emergency information for occupational safety.

(f) Technology and network administration: providing and managing system access, ensuring compliance with information-security protocols, preventing cyber incidents or misuse of Company resources, and conducting internal IT audits.

(g) Internal operations and communication: facilitating internal communications, project coordination, and other administrative or operational functions necessary for the effective conduct of our business.

4.3. We will not use or process Personal Information or SPDI for any purpose other than those specified above, unless required or authorised under Applicable Law or carried out with the Employee’s prior consent.

4.4. Once the purpose for which any Personal Information or SPDI has been collected has been fulfilled, we will discontinue its use and ensure that it is retained or deleted in accordance with this Privacy Policy.

5. How We Protect Your Information

5.1. We implement reasonable security practices and procedures that include managerial, technical, operational, and physical safeguards commensurate with the nature of the Personal Information and SPDI we handle and the risks associated with our business. These measures are designed to prevent unauthorised access, alteration, disclosure, or destruction of such information.

5.2. Our security controls include restricted access to employee information, password-protected systems, secure servers behind firewalls, data encryption where appropriate, and regular reviews of access rights. Storage systems are monitored and maintained by authorised IT personnel, and access to sensitive databases is strictly limited to those who require it for legitimate business or compliance purposes

5.3. We also adopt secure data collection, storage, and transmission practices to protect information shared within the organisation or with authorised third parties. All employees who handle Personal Information or SPDI are trained on data security protocols and are bound by confidentiality obligations.

5.4. While we take appropriate technical and organisational measures to protect Employee information, no system or network is completely immune to security risks. We therefore cannot guarantee that information will remain fully secure against all potential threats, and we continuously review and update our practices to mitigate evolving risks.

5.5. Any suspected or actual incident of unauthorised access, loss, or disclosure of Personal Information or SPDI must be reported immediately to our designated Grievance Officer at corporate@articulussurgical.com or to the IT security team for assessment and corrective action, in accordance with our incident-response procedures.

6. Consent and Employee Rights

6.1. We collect and process SPDI only with the knowledge and consent of the Employee. By providing Personal Information or SPDI to us, whether during recruitment, onboarding, or in the course of employment, the Employee acknowledges that such information is being collected and processed for the lawful purposes described in this Privacy Policy.

6.2. At the time of collection, we inform the Employee of the fact that the information is being collected, the purpose for which it is being collected, the categories of persons or entities with whom it may be shared, and the name and contact details of the department or agency responsible for collecting and retaining such information.

6.3. Employees may at any time request access to, or review of, their Personal Information or SPDI held by us. Where any information is found to be inaccurate or incomplete, we will, upon verification, take reasonable steps to correct or update it.

6.4. An Employee may withdraw consent previously given for the collection or processing of SPDI by submitting a written request to the designated Grievance Officer at corporate@articulussurgical.com.

6.5. Where SPDI is necessary for us to comply with statutory or contractual obligations, including those relating to payroll, taxation, or employment administration, withdrawal of consent may restrict or prevent our ability to continue the employment relationship or to provide certain benefits or services to the Employee.

6.6. We will respond to any request to review, correct, or withdraw information within a reasonable time and, in any event, within one month of receiving the request, in accordance with the SPDI Rules.

7. Employee Obligations on Accuracy of Data

7.1. Employees are expected to ensure that the Personal Information or SPDI they provide to the Company is accurate, complete, and up to date. Any change in personal, financial, or contact information that may affect employment, payroll, benefits, or statutory compliance must be promptly communicated to the IT Head or HR management at hr@articulussurgical.com.

8. Disclosure and Transfer of Information

8.1. We may disclose or share Personal Information and SPDI internally within the organisation to those departments or personnel who have a legitimate business or compliance need to access such data, including HR, finance, legal, IT, and administrative teams.

8.2. Personal Information and SPDI may also be shared externally with third-party service providers, consultants, insurers, auditors, background-verification agencies, or other professional advisers who assist us in employment-related functions or compliance activities.

8.3. We ensure that any such third-party recipient processes the information only for the specific and lawful purpose for which it is disclosed, and that they are bound by written confidentiality and data-protection obligations consistent with this Privacy Policy and the SPDI Rules.

8.4. We may disclose Personal Information or SPDI to governmental, judicial, or regulatory authorities where such disclosure is required under Applicable Law, a lawful direction, or a court order.

8.5. We do not publish, sell, or otherwise disclose Employee data to any third party except as described in this Privacy Policy or as authorised by the Employee.

8.6. If we transfer any Personal Information or SPDI to a person or entity located in another country,we will ensure that the recipient provides the same level of data protection that is adhered to under Applicable Law and that such transfer is necessary for the performance of a lawful contract or is otherwise permitted under Applicable Law.

8.7. Any internal or external disclosure of Personal Information or SPDI of an Employee shall be recorded and monitored by the relevant HR or IT team to ensure compliance with this Privacy Policy and with Applicable Law.

9. Retention and Disposal of Information

9.1. We retain Personal Information and SPDI only for as long as necessary to fulfil the lawful purposes for which it was collected, to meet our legitimate business requirements, or to comply with legal or contractual obligations.

9.2. Once the purpose for which Personal Information or SPDI was collected has been fulfilled, we take reasonable steps to delete or anonymise such information from our records and systems.

9.3. However, we may retain certain Personal Information or SPDI for limited periods where such retention is necessary for our legitimate business interests, including maintaining employment and human resource records, complying with tax, accounting, or audit requirements, detecting or preventing fraud, or ensuring workplace safety and security.

9.4. We may also retain and use Personal Information or SPDI where required to comply with Applicable Law, such as obligations relating to taxation, legal reporting, labour law compliance, or the resolution of disputes.

9.5. All disposal or deletion of Personal Information and SPDI shall be undertaken securely and in accordance with our information-security and record-management procedures, to prevent unauthorised access, recovery, or misuse of such data.

10. Grievance Redressal

10.1. We are committed to addressing any concerns, discrepancies, or grievances that Employees may have regarding the processing of their Personal Information or SPDI.

10.2. We have designated a Grievance Officer to handle employee concerns and ensure that any issues relating to the collection, use, or protection of Personal Information and SPDI are addressed promptly and fairly.

10.3. For the purposes of this Privacy Policy, the Company has designated Mr. Vaibhav Bansal as its Grievance Officer (the “Grievance Officer”)

10.4. Employees may contact the Grievance Officer in writing at:

Name: Vaibhav Bansal

Designation: Software Engineer

Email Id: vaibhav@articulussurgical.com

10.5. When raising a grievance or complaint, Employees are requested to include the following details in their communication to enable timely review and resolution:

(a) a clear description of the information or matter forming the subject of the grievance;

(b) a statement indicating whether the information relates to Personal Information or SPDI;

(d) a declaration that the information contained in the grievance is accurate and that the matter being raised pertains to the Employee.

10.6. The Grievance Officer will acknowledge receipt of the grievance, investigate the matter, and take appropriate steps to resolve it within a reasonable period.

10.7. The Grievance Officer will maintain records of all grievances received, the actions taken, and the manner in which each matter was resolved. Material or recurring concerns will be escalated to senior management for review.

11. Employee Acknowledgement

11.1. All Employees are expected to read, understand, and comply with this Privacy Policy. Continued employment with the Company shall be deemed to constitute acknowledgement of and agreement to the terms set out herein.