MedtronicPrivacy Policy

This section describes how Medtronic uses your personal data (also known as your personal information in certain jurisdictions) collected via our website or the Medtronic app. The information we collect depends on the functionality of the website or the Medtronic app, and how you use it, as detailed below. Unless we need your personal data to comply with laws and regulations, you are not required to provide information to us but, if you choose not to do so, we may not be able to offer you certain services and related features, or to respond to requests that you may have.

Data you provide to us

We may ask that you, your account administration, or any individual authorized by you not to send or disclose any other personal data other than the data that we ask you to provide using our therapies, related services or otherwise to us.

Sensitive data use

Some of the data we collect, and use is considered sensitive under applicable laws, which may include, for example, health- and financial-related data and genetic/biometric data. Our collection and use of sensitive personal data is limited to that which is necessary to provide you with your requested services, including treating your condition. In applicable regions, you can choose to withdraw or withhold your consent, but you may not be able to use certain services or Medtronic app functionality where sensitive data is necessary.

In certain circumstances, Medtronic may process your sensitive data, in particular your health data if relevant, on behalf of your healthcare provider (e.g., to transmit your health data to your healthcare provider). In this case, Medtronic acts as a data processor, service provider, or business associate as those terms are defined under local laws. To the extent that Medtronic processes your sensitive data otherwise, you will be asked to give your explicit consent, to the extent required by law.

Cookies and similar technologies

When you visit our websites or the Medtronic app, we may collect certain information by standard practices, including cookies and similar technologies, such as Flash cookies, local storage, web beacons and pixels, JavaScript, software development kits (SDKs), and device identifiers. While personal data collected through these technologies is not shared for money or other similar compensation, the use of these technologies may be considered personal data sharing under applicable law. The types of technologies, purposes of use, parties involved, and controls available to you, which may vary across Medtronic digital offerings, are detailed in our cookie policy.

What personal data we obtain

Your device information including the IP address, identifiers associated with your devices, device and operating system type and characteristics, language preferences, your interactions with our websites or Medtronic apps (such as the pages you visit, links you click and features you use, dates and times of access to our website or the Medtronic app, the website or source that linked or referred you to our services), and other information about your use of the Medtronic app.

How we use your data

Cookies and similar technologies (“cookies”) are used by Medtronic for several reasons. Cookies are sometimes necessary for our website or the Medtronic app to operate correctly. For example, secure logins may use cookies to work properly, and cookies may also be used to identify any suspicious activities so we can try to protect users from payment fraud and other inappropriate activities. Cookies allow us to collect information about how you use our services (e.g., how you downloaded our Medtronic app or where you downloaded it from) and how the app is used on your mobile device (e.g. what features you use and how well our services work). We may use cookies to collect demographic information (e.g., age, location), count the visitors to our website or the Medtronic app, and learn how they use our website or the Medtronic app and their features. This enables us to continually improve the visitor’s experience. Cookies may also allow us to provide you with enhanced functionality such as video content and show you targeted ads on other sites or social media channels. Depending on your location, some cookies may require your consent. Learn more about our use of cookies and how to manage your cookie settings and preferences.

Telephonic Contact

By disclosing the phone number(s) you provide to Medtronic, we may contact those number(s), including via text, SMS, or voice call, for the purposes defined in this privacy notice, as well as for responding to requests you make of Medtronic. If you provide an additional consent for marketing communications as required by local regulations, Medtronic may then contact you by telephone for marketing, advertising, or offers of sale of Medtronic therapies or related services as well.

When making contact by telephone, we may use automated technologies (including recordings and auto-dialing), and telephone, airtime, message, and data rates may apply. Consent is not a condition for purchase or services. You may opt out of telephonic contact from Medtronic using automated technologies and for marketing communications at any time by texting ”STOP” in reply to a text message or for marketing messages, or by signing into your Medtronic profile and updating your communication preferences.

If you are a United States resident, by providing your phone number(s) and/or consent(s), you certify that (a) you are age 13 and older, (b) the contact information you provide is yours, and (c) you authorize and consent to use of the information provided for Medtronic to contact you.

Secondary Use of Data

With the authorization of your medical institution, or with your explicit consent, if applicable, your data, including relevant health data, may be further used for Medtronic legitimate business purposes, including to improve and develop Medtronic products and services, to conduct benchmarking, business analytics or market research, to train and educate Medtronic personnel or healthcare professionals, or to support regulatory filings and the reimbursement of Medtronic products and services, based on Medtronic legitimate interests to do so. For such purposes, your data will be used in a de-identified, aggregated, or otherwise anonymized manner.

Compliance with Law and Medtronic Policies/Legal rights

In some circumstances, we are obliged to process personal data to comply with applicable legal requirements and our policies, to perform auditing and other internal functions, or for litigation and dispute resolution purposes.

What personal data we obtain

• Your identification and contact information, and any other information as is necessary and relevant to the particular case, e.g., in the event of an (internal) audit, information contained in documents and materials audited, or in the event of litigation, information gathered in the evidence necessary for the litigation.

How we use your data

We will use your information – in an anonymized, de-identified or redacted form, where appropriate – in order to:

• Comply with applicable legal requirements, regulations, court orders or other legal processes.
• Comply with our policies.
• Establish, exercise, or defend our legal rights.
• Conduct (internal) audits, investigations, or due diligence checks for the above reasons.

We will do so as necessary to comply with legal obligations to which we are subject in your country or region, or as needed to fulfil our legitimate interests, in particular in conducting business in compliance with all applicable laws and the highest ethical standards, protecting our rights or property, protect someone’s health, safety or welfare; and asserting or defending legal claims, or with your consent where required by law.

In the ordinary course of business in carrying out the purposes described in this notice, we may share your personal data with certain categories of third parties, including:

Medtronic affiliated companies

Given the corporate structure of Medtronic and its affiliates, your personal data may be shared with other affiliates within the Medtronic group.

Service providers

Medtronic may share personal data with relevant third-party service providers, who act on our behalf to fulfill the activities noted in this privacy notice, including IT providers, providers of communication tools and customer relationship management systems, survey tool providers or platforms, event organization management tool providers, outsourced operations such as email automation tool providers, cloud hosting service providers, and contract management platform providers.

Business partners and other specialists

To the extent relevant of our website or the Medtronic app or our websites, Medtronic may share personal data with external organizations with which it has partnered (such as research partners and partners in co-branded initiatives), established contractual protections or benefits from statutory protections, and with external specialists or professional advisors within a particular field (such as lawyers, consultants, tax advisors, auditors, specialist delivery providers, banks, payment service providers and benchmarking agencies). In cases where those third parties are independently responsible for the processing of your personal data, their privacy notice will apply to their processing of your data.

For legal and other related interests: Medtronic may share personal data where it is:

• Required by law
• Required to disclose and/or share your personal data with regulatory, public, or governmental authorities to comply with any law, regulation, court order, legal or government request
• Allowed or required by law for public health purposes, including reporting complaints and quality issues to medical device regulators
• Needed to protect its own or others vital interests, including the safety of life and property, or for investigating illegal or malicious activities, where allowed by law
• Needed to exercise or defend legal claims
• It is believed that disclosure is necessary or appropriate to prevent physical or other harm or financial loss
• Needed with its corporate affiliates, who have the same privacy requirements
• Needed to fulfill corporate transactions (such as mergers, acquisitions, dissolutions, or divestitures), as well as for to companies with whom Medtronic is working on a potential or pending corporate transaction

Others, per your request: With your consent, we will share your personal data with any other parties you choose, such as your caregivers.

If we share your personal data with third parties, we will require them to sign a data processing agreement or include data protection clauses in the cooperation agreement before proceeding. This ensures that the company assumes the applicable privacy protection obligations and responsibilities.

You may have some of the rights below relating to your personal data, depending on applicable laws. Additional information may be found in the Specific Jurisdictions section

• Access your personal data and confirm how your personal data is being processed
• Transfer or obtain a copy in a structured, machine-readable, or portable format.
• Correct or amend if it is incomplete, inaccurate, or outdated
• Request deletion. Subject to applicable law, we may sometimes deidentify this data.
• Restrict or limit excessive or unlawful processing, where the accuracy of the data is contested
• Object to or opt-out of processing in circumstances where Medtronic claims a legitimate interest in its processing and where your rights outweigh those of Medtronic, such as where that data is used for direct marketing (including email or telephonic marketing)
• Withdraw (or manage) consent where it is the basis for processing, which may include cases where the data is sensitive or on children. Where consent is revoked, we will not further process that data unless required or otherwise permitted by applicable law

How to exercise your rights. You or your authorized agent may exercise these rights at any time or contact us with any inquiries through the methods provided in the “How to contact us” section below.

Process. We will first confirm that we have received your request. For rights requests, we are required to verify your identity, your right to access the information requested, and, as applicable, your authorized agent’s authority to act on your behalf. We may need to ask you for additional information that will help us do so, including government-issued IDs containing your name and address, utility bills containing that same information, and/or unique identifiers like usernames. We will only use that additional information in the verification process, and not for any other purpose.
After the validation of identity and authority (including if we do not receive that information), we will process your request and then contact you with our response to your request, including any data and reasons for rejection as applicable, within the time required by applicable law. If we need more time, we will notify you in accordance with applicable law.

Fees. We may charge a reasonable fee in some geographies to process or respond to your request only if allowed by applicable law, for instance if it is excessive, repetitive, or manifestly unfounded. If a fee is warranted, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Additional Options. Depending on your jurisdiction, you may have additional options if you are dissatisfied with our response:

• You may internally appeal or contact our Data Protection Officer if you disagree with a decision we made about your rights. Please include a copy of or reference to the decision.
• You may also complain to a data protection or regulatory authority if you have further concerns about our data practices or our response to a request. If you need information about which authority may apply to you depending on your location and circumstances, please contact us.
• You will not be discriminated against for your exercise of your rights.

We do not intentionally collect personal data from children (as defined by applicable law) unless we have received verifiable consent (from the parent or the child, depending on the requirements of applicable law) unless a legal requirement or vital interest applies. If you believe we have collected personal data from a child, please contact us using the information found in the “How to contact us” section.

United States of America Supplemental Privacy Notice

United States of America

• Past practices.  The statements in this notice are Medtronic’s data processing activities for the described scope of the notice both as current and within the past twelve months.
• Protected Health Information under HIPAA.  In cases where the Health Insurance Portability and Accountability Act of 1996 (HIPAA) governs the use of your data, our Notice of Privacy Practices will apply. Data governed under HIPAA may be deidentified through either or both the Safe Harbor and Expert Determination methods. While that data is then deidentified, Medtronic does not and will not permit others to reidentify deidentified PHI except as required by applicable law or as directly consented to by the subject of that PHI.
• Sales/Sharing of personal data:  Medtronic does not sell your personal data for money or other consideration, nor share it for direct or behavioral marketing purposes, with unrelated third parties, except as described in the cookies and similar technologies section.
• Right to opt-out or object.  As noted above, you may have the right to opt-out of some processing, such as sharing data with third parties for their own or for cross-contextual marketing, sales of personal data, making certain decisions or profiles about you by automated or artificial means, or certain kinds of automated/prerecorded telephonic messages.
• Right to restrict or limit.  In some jurisdictions you may have the right to restrict some processing if the data is sensitive and used for purposes additional to delivering requested  req goods/services.
• Exercising your privacy rights.  United States residents can file a privacy rights request by sending an email to [email protected] or by calling 1 (866) 639-6907. You do not have to create an account with us to submit a request.

This privacy notice may be updated periodically to reflect changes in our personal data practices. We will indicate at the top of the privacy notice when it was most recently updated.

If you have any questions about this privacy notice you may contact us as follows:

General inquiries (all geographies): By email: [email protected]

US inquiries: By email via the general inquiries email address or phone: +1-866-639-6907. You may also mail our general-purpose corporate mailing address is at Medtronic, Inc. 710 Medtronic Parkway Northeast, Attention: Data Privacy – United States (Mail Stop: LS320),
Fridley, Minnesota 55432-5603, United States.

EMEA (Europe, Middle East and Africa)
For contact details of EEA data protection authorities, see further https://edpb.europa.eu/about-edpb/about-edpb/members_en.

Greater China (China Mainland, Hong Kong, Taiwan, Macau)
Please contact Medtronic China Data Privacy Office:
6-19th Floor, Block B, Qiantan World Trade Center (Phase I), No. 5, Lane 255, Dongyu Road, Pudong New Area, Shanghai. Zip code: 200126 [email protected]