p.1

Companies operating in the global economy confront

constant threats to the physical security of their people,

information and assets. Civil unrest, terrorism, cyber-

terrorism, hackers, economic espionage, workplace

violence and the laws designed to control or prohibit

such activities produce a difficult operating environment

for any global enterprise.

A tumultuous world

RIGHT FOR

TODAY.

READY FOR

TOMORROW.

What We Do

p.4

What We Do:

Medical Imaging & IT Scalable solutions for every step of diagnostic imaging–from exam ordering, image

capture and diagnosis to results distribution, billing and beyond.

• Digital choices for medical imaging—from general radiography to specialty practice

applications

• Integrated RIS/PACS and information management solutions that combine images and

patient information for processing, diagnosis, sharing and smart archiving

• Flexible CR and DR solutions that solve workflow, budget and space challenges while

reducing procedure times

• Market-leading laser imagers for printing medical images of all types: CT, MRI, ultrasound,

CR, DRA

• A broad range of professional services including project and remote management, as well

as specialized training

p.5

What We Do:

Integrated Dental Solutions Innovative imaging products and practice management software that enable the

dental practitioner to capture, process, view, store and send images and

information.

Our strategy is to lead globally in oral health imaging and IT by offering a complete

suite of integrated products:

• A full line of innovative, easy-to-use 2D and 3D digital imaging equipment designed to

meet the diagnostic needs of any practice

• Easy-to-use practice management software to help run a more efficient and profitable

dental or specialty practice

• Traditional analog imaging, dental film and accessories to create and display high

quality radiographic images

p.6

Public

© 2011, Carestream Health

What We Do:

Non-Destructive Testing

Innovative products used for material inspection in a wide range of industries

including Chemical/Petrochemical, Aerospace, Power Generation, Transportation,

Foundries, Automotive, Military/Defense and Museums to name a few.

• HPX-1 Computed Radiography System with Industrex® Imaging Software. Improved

productivity and image flexibility without chemical processing.

• Full range of Phosphor Imaging Plates.

• System diagnostic tools and specialty plate carrier.

• Traditional Films, Chemicals, and Processors.

• World-class global support services including system set up onsite, training, customer

service and technical assistance.

p.7

Public

© 2011, Carestream Health

What We Do:

Advanced Materials

Applying world-class precision thin-film coating capabilities and nanomaterials

science expertise:

• Ideal for high technology, high growth printed electronics applications including touch

panel, photovoltaics, and organic LED lighting/displays

• Innovative nanomaterial featuring high flexibility and superior durability compared to

existing materials

• First product: Flexx transparent conductive films

p.8

Public

© 2011, Carestream Health

What We Do:

Women’s Healthcare

Accurate breast cancer detection is mammographers’ goal.

Providing powerful solutions is ours.

• A full line of Women's Healthcare solutions for every step of the

imaging chain

• Market-leader with over 60% market share for Mammography film

• Facilitate a more confident diagnosis with high resolution imaging

through our screening and diagnostic CR solutions

• Improve productivity with customizable multi-modality, multi vendor

PACS and RIS solutions

• Deliver superb image quality with high performance laser imagers

p.9

What We Do:

Service & Support

Professional Services guide and support implementation of healthcare solutions and

drive improvements in clinics, hospitals, and health enterprise’s workflow &

processes.

• Service personnel are trained and located for quick response to maintain products and

operations at peak performance

• Compliment the on-site capabilities with our lifecycle solutions, certified staff and smart

technologies to improve imaging performance, innovate as needs change and optimize

budget and resources

• Our global service team includes 1,400+ service engineers with a global infrastructure for

remote service, parts distribution, and performance information systems

AT A GLANCE

Local service

presence in 40

countries

Three Service

Centers of

Excellence for

training and

technical support

Full portfolio of

professional

services, training,

upgrades, and

break/fix services

p.10

Where We Are

A global company with 17 manufacturing and R&D locations, including 3 Technology & Innovation Centers

Technology &

Innovation Centers

Rochester, New York

Genoa, Italy

Shanghai, China

R&D and

Manufacturing Sites

Paris, France

Rochester, New York

Ronkonkoma, New York

Shanghai, China

Yokneam, Israel

R&D Sites

Atlanta, Georgia

Baltimore, Maryland

London, England

Oakdale, Minnesota

Ra’anana, Israel

Woodbridge, Connecticut

Manufacturing Sites

Berlin, Germany

Guadalajara, Mexico

White City, Oregon

Windsor, Colorado

Xiamen, China … supporting sales in 161 countries

p.11

Public

© 2011, Carestream Health

Government investigations

Labor Issues

Litigation

Internal Complaints

External Complaints

Brand Reputation

Challenges of a global workforce

p.12

Public

© 2011, Carestream Health

In many EU countries, monitoring of electronic communication in the

workplace (namely monitoring is e-mail and internet use monitoring) raises questions concerning privacy in the workplace. Unfortunately, the 1995 Data Protection Directive does not deal with any

specific aspect of employment relationships. It neither provides rules on

employee monitoring, nor on monitoring in general. Instead, it sets out

general provisions on the collection and processing of personal data.

p.13

Public

© 2011, Carestream Health

p.14

Public

© 2011, Carestream Health

Guidance from the Article 29 Working Party (“WP29”) Due to its complexities, the issue of employee monitoring has been extensively

discussed at the EU level. The WP29, a network composed of the Member State

data protection authorities, issued an opinion on the processing of personal data in

the employment context in 2001. •The WP29 observed that monitoring of e-mails and internet access involves

processing of personal data and thus falls under the scope of the EU Data

Protection Directive and related Member State implementing legislation.

•According to the WP29, monitoring must be proportionate, not excessive for the

intended purposes, and carried out in the least intrusive way possible. Before

implementing monitoring policies, employers should consider whether monitoring

is necessary and proportionate, and whether the same results could be obtained

through traditional methods of supervision.

•Employees’ rights to privacy in the workplace must be balanced with the

legitimate rights and interests of the employer, such as business efficiency or the right to protect the employer from harm caused by employees’ actions. The WP29

generally recommends that monitoring should be avoided unless there is a specific

and important business need.

p.15

Courts in Germany are moving toward finding employer monitoring of corporate e-mail

systems to be lawful since an employer is not a "service provider" that must respect the

privacy of emails under the Telecommunications Act - "service providers" are persons

who, on a commercial basis, provide telecommunications services or contribute to the

provision of such services, and employers are not usually captured by this definition since

they do not often demand payment from employees to use the corporate e-mail system

and the telecommunications services are not provided to third parties (employees are

considered internal to the company, not external third parties). Until there is absolute legal

certainty as to whether employers need to comply with telecommunications privacy, there

are 3 options - strictly ban private use of corporate email accounts (frequently not

realistic), allow private emails to be sent solely via webmail providers (to prevent the

mixing of business and private emails), or allow private usage with clear conditions on

how the corporate system is to be used (employees must label private emails as "private",

authorization for private use can be revoked, communications that constitute a criminal or

administrative offence are prohibited, and employees must consent to the circumstances

in which monitoring is permitted as a condition of private email use); a review of employee

emails in non-compliance with the Data Protection Act can be punished by up to

€300,000.

p.16

Currently, there is no specific law in Turkey regarding personal data protection.

There has been a Draft Law on the protection of individuals with regard to processing of personal

data pending before the Turkish Parliament. It is anticipated that the Draft Law shall be enacted in

the near future.

The Draft Law stipulates personal data may be processed only if:

the data subject has given his/her explicit consent

processing is necessary for compliance with a legal obligation to which the controller is subject

processing is necessary in order to protect the life or physical integrity of the data subject or

another where the data subject is incapable of giving his/her consent

processing is necessary for the execution or performance of a contract to which the data subject is

party

processing of data that has been disclosed/published by the data subject or is available in the

public domain

processing is necessary for the purposes of the legitimate interests pursued by the controller or by

the third party or parties to whom the data are disclosed, except where such interests are

overridden by the interests for fundamental rights and freedoms of the data subject

Even in the absence of statutes Courts interpret

p.17

In an order dated May 13, 2002 by the Tribunal of Milan, which dealt with to the use of Internet and email.

According to this judgment, an employer who monitors the emails that an employee receives in his or her company

mailbox is not guilty of violating the employee's privacy.

The judge stated that:

simply because an email address is personal (name.surname@employer.com) does not automatically imply that it is

private;

the employee is not entitled to exclusive use of his work computer or of the company's electronic mailbox, because the

company is the sole owner of the computer and the email address. As such, the employer is entitled at any time to log

onto the computer and read emails received or sent by its employees;

the employer does not exercise prohibited control over employees by reading their emails, since both the computer

and the company email addresses are tools through which work activities are performed. They thus remain at the

employer's disposal; and

an employee must provide the employer with all his or her passwords, so that the employer can log onto the relevant

computers and read the employee's emails at any time.

This judgment is very important, as it allows employers to ensure that their employees are utilizing company tools in a

correct and lawful manner.

A more recent case from August 1, 2013 (decision No. 18443) indicates that the position of the Courts on this matter

remains the same as in 2002. It is important however that, in presence of suspicious wrongdoings, the employer

considers if monitoring is absolutely necessary or whether there are alternative and less intrusive measures. Also, any

monitoring should not be systematic.

p.18

p.19

Sending personal data outside the European Economic Area The EU Data Protection Directive states that …

•The EU Commission has decided that certain countries have an adequate

level of protection for personal data.

•Although the United States of America is not included in the European

Commission list, the Commission considers that personal data sent to the US under the voluntary “Safe Harbor” scheme is adequately protected.

•Companies can also refer to the European Commission approved model

contractual clauses (Standard Contractual Clauses).

•Companies can also get their Binding Corporate Rules approved by a duly

authorized data protection authority.

p.20

Workplace Safety

p.21

Public

© 2011, Carestream Health

Canada

p.22

Norway

p.23

China

p.24

p.25

Workplace Violence Awareness Training Classes (1 Hour)

Studies concerning workplace violence arrive at several common

conclusions including: no business is immune to these terrible acts and

awareness training can greatly minimize the occurrence of a traumatic,

life threatening incident. Behaviors of Concern are the focus of the

Workplace Violence Awareness training program. These behaviors can

be caused by a number of reasons such as layoffs, stress at work, work-

related conflicts, and domestic or financial issues. Though some

businesses have a greater risk for serious violence in the workplace,

most incidents are non-life threatening and can happen in any type of

work environment. Our workplace can be made safer when people are

knowledgeable about Behaviors of Concern.

Training and Awareness

p.26

Protection of Intellectual Property Assets

It is a changing world

p.27

1990

p.28

2014