Whistleblowing System

1. Scope

The whistleblowing system is open for the confidential reporting of violations identified in a professional context at MiraNext GmbH. It covers, in particular, violations of:

• applicable Swiss law and any foreign or EU requirements relevant to the company,
• rules on data protection and information security (revFADP), product and patient safety (in particular the MedDO), anti-corruption and anti-money-laundering, occupational safety, tax and competition law,
• internal policies, codes of conduct and contractual obligations of MiraNext GmbH.

2. Protected Persons

This is addressed to all persons who have gained knowledge of a violation in a professional context, in particular:

• active and former employees as well as interns,
• applicants in an ongoing application process,
• contractors, suppliers, business partners and their personnel,
• persons who support whistleblowers or are close to them.

3. Relationship to the Employee Duty of Loyalty

Employees are subject to the duty of loyalty under Art. 321a CO. According to the case law of the Federal Supreme Court, a report should as a rule first be made internally, then to the competent authority if that is unsuccessful, and only as a last resort to the public (graduated approach / proportionality).

The internal reporting channel provided here is intended to enable this first stage and to ensure that reports are handled confidentially and without detriment to the reporting person.

4. Internal Reporting Channel

Internal reports can be addressed confidentially to our internal reporting office:

• Email: support@miranext.ai
• In person or by telephone: on request, an appointment is arranged within 7 days; initial contact is made via support@miranext.ai.
• Anonymous reports are possible; they are handled in the same way as reports made by name.

5. External Points of Contact

Independently of the internal channel, reporting persons may contact the respective competent authority. The following are in particular relevant:

• the competent criminal prosecution authorities for matters of criminal relevance,
• the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) for data protection violations,
• Swissmedic for safety-relevant reports concerning medical devices (MedDO).

6. Procedure

Our voluntary procedure follows good corporate practice:

• Acknowledgement of receipt: as a rule within 7 days of receipt of the report.
• Plausibility review and follow-up: by the internal reporting office or an independent internal investigation.
• Feedback to the reporting person: as a rule within 3 months, to the extent this does not compromise the ongoing investigation.
• Documentation: all reports are documented confidentially; personal data are deleted once the processing purpose no longer applies.

7. Confidentiality

The identity of the reporting person and of all persons named in the report is treated as strictly confidential. Disclosure occurs only where mandatorily required by law (e.g. in the context of criminal proceedings) and after prior information of the person concerned, where permissible.

8. Protection Against Detriment

MiraNext prohibits detrimental treatment of persons who report in good faith or who support such a report. A termination in reaction to a justified, proportionate report may be abusive under Art. 336 CO and trigger the corresponding legal consequences.