LEGAL

Privacy Policy

This Privacy Policy explains how Galactic Medical, LLC handles information collected through our website, our password-protected rep portal, and our related business operations.

Effective date: June 23, 2026  ·  Last updated: June 23, 2026

1. Who We Are

Galactic Medical, LLC ("Galactic Medical," "we," "us," or "our") is a Florida-based authorized distributor of Paragon 28® foot and ankle orthopedic products. We operate this website and an internal, password-protected portal used by our sales representatives. In this Policy, "you" refers to any visitor to our website or authorized user of our rep portal.

We are the controller responsible for the personal information described in this Policy. If you have questions, contact us using the details in Section 15.

2. Scope

This Policy applies to information we collect:

• On our public website at galacticmedical.com (the "Site");
• Through our authenticated rep portal (the "Portal"); and
• In the course of operating our distribution business, including communications you send us.

This Policy does not apply to third-party websites, products, or services that we link to or integrate with, each of which is governed by its own privacy policy (see Section 13).

3. Information We Collect

Information you provide to us

• Contact and inquiry information — such as your name, email address, phone number, organization, and the contents of any message you submit through a contact form or send to us by email.
• Rep portal account information — for authorized sales representatives, this includes your name, work email, assigned territory, role, and account credentials managed through our authentication provider.
• Business records — information generated in the ordinary course of our relationship with reps and accounts, such as commission statements, quotes, and hospital pricing files made available within the Portal.

Information collected automatically

• Log and device data — IP address, browser type, operating system, referring pages, and timestamps, collected by our hosting provider for security and reliability.
• Cookies and similar technologies — used to keep you signed in to the Portal and to operate the Site. See Section 5.

Information from third parties

We may receive information from service providers that support our operations (for example, authentication, hosting, and accounting providers) as described in Section 7.

4. How We Use Information

We use the information we collect to:

• Respond to your inquiries and provide requested information;
• Operate, secure, and maintain the Site and the Portal, and authenticate authorized users;
• Administer rep accounts and provide commission statements, pricing, and quoting tools;
• Operate our business, including accounting, reconciliation, and compliance;
• Detect, prevent, and address security incidents, fraud, or misuse; and
• Comply with legal obligations and enforce our Terms of Use.

We rely on legal bases including your consent, performance of a contract, our legitimate business interests, and compliance with law, as applicable.

5. Cookies & Analytics

We use a small number of cookies and similar technologies that are necessary to operate the Site and to maintain authenticated sessions in the Portal. We may also use privacy-respecting analytics to understand how the Site is used so we can improve it. You can control cookies through your browser settings; disabling necessary cookies may prevent the Portal from functioning.

6. Financial Data & Accounting Integrations

We use third-party accounting software, including Intuit® QuickBooks® Online, to manage our bookkeeping, commissions, and financial reconciliation. With proper authorization, our internal tools may access financial data from these systems through the provider's official application programming interfaces (APIs).

7. How We Share Information

We do not sell your personal information. We share information only as follows:

• Service providers / processors — companies that perform services on our behalf, such as website hosting, authentication and database services, file storage, and accounting software. These providers may process information only on our instructions and under appropriate confidentiality and security obligations. Our current key providers include Vercel (hosting), Supabase (authentication, database, and file storage), and Intuit (accounting).
• Manufacturer and business partners — where reasonably necessary to fulfill our role as an authorized distributor (for example, Paragon 28), limited to the information required for that purpose.
• Legal and safety — when required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Galactic Medical, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

8. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction. These include encrypted connections (HTTPS), authentication and access controls, row-level access restrictions in the Portal so reps see only their own data, and secure handling of credentials and access tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this Policy, to operate our business, and to comply with our legal, tax, and accounting obligations. When information is no longer needed, we take reasonable steps to delete or de-identify it.

10. Your Rights & Choices

Depending on your location, you may have rights to access, correct, update, or delete personal information we hold about you, to object to or restrict certain processing, or to withdraw consent. To exercise any of these rights, contact us using Section 15. We will respond consistent with applicable law. You may also opt out of non-essential email communications at any time by following the unsubscribe instructions in those messages.

11. No Protected Health Information

Our Site and Portal are intended for business and informational use and are not designed to collect protected health information (PHI) or to function as a healthcare service. Please do not submit patient information or any individually identifiable health information through our forms or the Portal. Information about products is provided for use by qualified healthcare professionals and is not medical advice.

12. Children's Privacy

Our Site and Portal are directed to businesses and healthcare professionals and are not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

13. Third-Party Links & Services

Our Site may link to third-party websites and services, including Paragon 28 and Paragon 28 Medical Education. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Site or Portal after an update constitutes acceptance of the revised Policy.

15. Contact Us

If you have questions or requests regarding this Privacy Policy or your information, contact:

• Galactic Medical, LLC
• Email: joel.rodriguez@galacticmedical.com
• Website: galacticmedical.com