Mobile Applications Privacy Statement

Please read this privacy statement carefully.

MEDTRONIC MOBILE APPLICATIONS PRIVACY STATEMENT

INTRODUCTION

This Privacy Statement tells you how we protect and use information that we gather through Medtronic Mobile Applications (the “Application” or “App”). This Privacy Statement is intended for a global audience.

For users in Europe, please refer to the privacy statements specific to your geography that are referenced in your App.

This Privacy Statement was last revised on December 10, 2019. We may change the Privacy Statement at any time and for any reason.

Please read the End User Licensing Agreement (EULA) for your Application to understand the general rules about your use of the Application. Except as written in any other disclaimers, policies, terms of use, or other notices in an Application, this Privacy Statement and the EULA are the complete agreement between you and Medtronic with respect to your use of the Application. By using Medtronic Mobile Applications (the “Application” or “App”), you agree to the terms of the most recent version of this Privacy Statement. You may be subject to additional terms that may apply when you access particular services or materials on certain areas in this Application, or by following a link from this Application.

The Applications are owned and operated by Medtronic. Medtronic is the name we use to refer to our whole business, including Medtronic plc. and any of the companies that it controls, such as its subsidiaries and affiliates. When we use the words "we" or "our," we mean Medtronic. The information we receive, and how we use it, depends on what you do when using the Application.

We collect and use both personal information (information that is identifiable to you personally) and non-personal information about you through the application. Please see below for a definition of personal and non-personal information, and how Medtronic may use them.

WHAT IS PERSONAL INFORMATION?

Personal information is information that we can use to specifically identify you, such as your:

name
address
telephone number
Email
date of birth
account name
for U.S. healthcare providers, a National Provider Identifier# (NPI), and/or a state license number, or
other similar identifiers
medical device serial number
implant date
model number
medical device name
mobile device identifiers, such as model number, manufacturer, serial number, or IMEI/MEID
geolocation information
health condition
hospital/clinic name, address and phone number
IP (Internet Protocol) address when such address is associated to a specific user,
information about how you use the App, such as links or functions you may access within the App

In some places on the App you have the opportunity to send us personal information about yourself, to elect to receive particular information, or to participate in an activity. For example, you may fill out a registration form, a survey, or an e-mail form and you may elect to receive educational material about our products and therapies.

How Does Medtronic Keep and Use Personal Information?

We may collect and use personal information from you through this App to provide you with access to the App. You may choose not to provide us with this information, but then you may not be able to access and utilize the App. In addition, we may keep and use your personal information:

if you are a Patient, to transmit data to your Health Care Provider
to provide services to you through the App
to send you notifications
to respond to your requests
to develop records, including records of your personal information
to contact you with information that might be of interest to you, including information about clinical trials and about products and services of ours and of others
to analyze how people use our App and to research, develop, and improve programs, products, services, and content
for U.S. healthcare providers, to link your name, National Provider Identifier (NPI), state license number, and/or your IP address to web pages you visit, for compliance, marketing, and sales activities
to create a set of data that has only non-personal or de-identified information. In this case, we would remove your personal identifiers (your name, email address, biometric data, etc.) and we may treat it like other non-personal or de-identified information.
to enforce this Privacy Statement and other rules about your use of this App
to protect our rights or property
to protect someone's health, safety or welfare
to comply with a law or regulation, court order or other legal process

DOES MEDTRONIC EVER SHARE PERSONAL INFORMATION WITH THIRD PARTIES?

Medtronic will not share your personal information collected from the App with an unrelated third-party without your permission, except as otherwise provided in this Privacy Statement. Medtronic may share personal information with any member of our corporate group, including parent companies, subsidiaries, and affiliates for purposes that are consistent with those identified in this Privacy Statement.

In the ordinary course of business, we will share some personal information with companies that we hire to perform services or functions on our behalf. In all cases in which we share your personal information with a third-party, we will not authorize them to keep, disclose or use your information with others except for the purpose of providing the services we asked them to provide.

We may be legally compelled to release your personal information in response to a court order, subpoena, search warrant, law or regulation. We may cooperate with law enforcement authorities in investigating and prosecuting Application users who violate our rules or engage in behavior which is harmful to other visitors (or illegal). In addition, we may keep, disclose, and use your personal information in order to comply with U.S. FDA and other governmental guidance, directions, regulations, and laws.

We may disclose your personal information to third parties if we feel that the disclosure is necessary to:

enforce this Privacy Statement and the other rules about your use of the App
protect our rights or property
protect someone's health, safety or welfare
fulfill obligations relating to a corporate sale, merger, dissolution, or acquisition
comply with a law or regulation, court order or other legal process

TRANSFERS BETWEEN COUNTRIES

For China users: As part of a global company, please be aware that your personal information may be transferred to, stored, and processed in China or any other country in which Medtronic (including its Affiliated Companies), contractors or agents maintain facilities offshore. The countries to which we are likely to transfer personal information may include the United States, Singapore, Switzerland, the Philippines, and the Netherlands. By using the App, you consent to any transfer, processing, or storing of information outside China. Medtronic ensures that the use and disclosure of the personal information transferred is dealt with in accordance with this policy and the safeguards under PRC privacy laws.
For Japan Users: Medtronic Japan may engage and delegate all or part of business operations including handling personal information to other Medtronic parties located outside of Japan to the extent it is necessary for achieving purposes of use described at Japan Privacy Policy. Medtronic Japan may also share personal information described at Japan Privacy Policy among other Medtronic parties located outside of Japan for purposes of use described at Japan Privacy Policy. In that case, Medtronic ensures that the use and disclosure of the personal information transferred or shared is dealt with in accordance with this policy and the safeguards under Japan Personal Information Protection law.
For Australian and New Zealand users: As part of a global company, please be aware that your personal information may be transferred offshore. The countries to which we are likely to disclose personal information may include the United States, Singapore, Switzerland, the Philippines, and the Netherlands. Medtronic ensures that the use and disclosure of the personal information transferred is dealt with in accordance with this policy and the safeguards under ANZ privacy laws.
For Canada Users: Medtronic is located outside of Canada, and may also use third-party service providers that are located outside of Canada. Accordingly, your personal information may be transmitted to, processed in, and stored within the United States and other foreign jurisdictions, and may be accessible to law enforcement or other authorities within those jurisdictions.
For Latin America, Russia, Central Asian Users, and Middle East and North Africa Users: By accepting this, you are giving us authorization to receive, process, and use your personal information, including sensitive data, and also transfer the data out of your country to our affiliates and subsidiaries internationally, or third parties hired by Medtronic to manage the App.

WHAT DOES MEDTRONIC DO WITH NON-PERSONAL INFORMATION?

Non-personal information is information that cannot identify you. We are always looking for ways to better serve you and improve this App. We will use non-personal information from you to help us make this App more useful to visitors. We also will use non-personal information for other business purposes. For example, we may use non-personal information or aggregate non-personal information to:

create reports for internal use to develop programs, products, services or content
share it with or sell it to third parties
provide aggregated information on how visitors use our site, such as 'traffic statistics' and 'response rates,' to third parties

WHAT ABOUT PRIVACY ON OTHER APPLICATIONS?

This web site may contain links to other apps or websites. Some of those web sites or apps may be operated by Medtronic, and some may be operated by third parties. We provide the links for your convenience, but we do not review, control, or monitor the privacy practices of web sites operated by others. This Privacy Policy does not apply to any other web site or app, even if operated by Medtronic. We are not responsible for the performance of applications or web sites operated by third parties or for your business dealings with them. Therefore, whenever you leave this Application, we recommend that you review each application or web site's privacy practices and make your own conclusions regarding the adequacy of these practices.

DOES MEDTRONIC EVER COMMUNICATE DIRECTLY WITH VISITORS TO THIS APPLICATION?

We may contact you periodically by e-mail, mail or telephone if you agree to that. contact to provide information regarding programs, products, services and content that may be of interest to you. In addition, some of the features on this Application allow you to communicate with us using an online form. If your communication requests a response from us, we will send you a response via e-mail. The e-mail response or confirmation may include your personal information, including personal information about your health, your name, address, etc. We cannot guarantee that our e-mails to you will be secure from unauthorized interception.

COOKIES

Apps that link to, or connect with, websites may include cookies, pixel tags/web beacons, and similar technologies. This helps us to provide you with a good experience when you use the App or browse the websites, and also helps us to improve the App and our website. For further detailed information about cookies and the purposes for which we use them, please see the section of our website privacy statement that discusses cookies.

ARE THERE SPECIAL RULES ABOUT CHILDREN'S PRIVACY?

We care about protecting the online privacy of children. We will not intentionally collect any personal information (such as a child's name or e-mail address) from children under the age of 13. If you think that we have collected personal information from a child under the age of 13, please contact us. For Middle East and North Africa users, please notify us regarding children under the age of 18.

WHAT ABOUT APPLICATION SECURITY?

Security is very important to us. We also understand that security is important to you. We take reasonable steps to protect your personal information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. You should keep in mind that no Internet transmission is ever 100% secure or error-free. You acknowledge that the App may not be password protected, and that you are responsible for maintaining the confidentiality and security of any of your data available via the App on your mobile device, by using an ID and password credentials for your mobile device.

HOW TO CONTACT MEDTRONIC

If you have questions or comments about this Privacy Statement, please contact us here.

You may use the Contact Us form on our Application to exercise your rights to access, rectify, update, and/or eliminate your personal information or ask for non-disclosure. Elimination may not be possible if it can cause damage to third parties or if preserving your personal information is required by any law or regulation.

Disclaimer: This page may include information about products that may not be available in your region or country. Please consult the approved indications for use. Content on specific Medtronic products is not intended for users in markets that do not have authorization for use.

STATE-SPECIFIC PRIVACY NOTICES

CALIFORNIA

Supplemental Privacy Notice for California Residents

This notice for California residents supplements the information contained in our Privacy Statement and applies solely to residents of the State of California. We adopt this Supplemental Notice to comply with the California Consumer Privacy Act of 2018 (CCPA) and any terms defined in the CCPA have the same meaning when used in this Supplemental Notice. Under the California Consumer Privacy Act (“CCPA”), you have certain rights in relation to some of your personal data, including the right to certain disclosures and explanations of rights. This section explains your rights under California law.

CALIFORNIA 'DO NOT TRACK' DISCLOSURES

California law (CalOPPA) requires Medtronic, plc to let you know how we respond to web browser 'Do Not Track (DNT) signals'. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not honor Do Not Track requests at this time.

CALIFORNIA CONSUMER PRIVACY ACT OF 2018

Categories of Personal Information We Collect

Medtronic collects information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household (“personal information”). We may have collected the following categories of personal information from consumers through our websites, apps, services, devices, or other services within the twelve (12) months preceding the effective date of this Privacy Statement:

Personal Information Category

Identifiers such as
- Name
- Address
- Unique personal identifier (e.g., device ID, online identifier)
- Internet Protocol address
- Email address
- Account name
- Social security number
- Driver’s license number, or
- Other similar identifiers
Characteristics of protected classifications under California/federal law (e.g., age, race, sex, medical condition, etc.)
Medical information
Health insurance information
Financial information, including credit card numbers
Biometric information (e.g., imagery of the iris, retina, fingerprint, face, or other data that contain identifying information)
Commercial information (e.g., purchase history)
Internet or other electronic network activity information (e.g., browsing history, interaction with our website, etc.)
Geolocation data
Audio, electronic, visual, thermal, olfactory, or similar information (e.g., call recordings)
Professional, employment-related, or other similar information

“Personal information” under the California Consumer Privacy Act does not include information that is

publicly available from government records,
de-identified or aggregated consumer information,
health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data, or
certain personal or financial information covered under certain sector-specific privacy laws.

For additional information, please see How Does Medtronic Keep and Use Personal Information.

Categories of Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

Directly from consumers’ interactions with us, including with our devices, applications, websites, services, and representatives
Publicly available sources
Customers, including health care providers and insurance providers
Organizations with whom we partner to provide services to consumers

Use or Disclosure of Personal Information

In the past 12 months, we have used or disclosed the personal information we collect for our operational purposes and for one or more of the following business purposes:

To provide products and services to consumers
To respond to consumer requests
To improve and personalize consumer access to and experience on our website, for example, by telling consumers about new features, products, or services that may be of interest to them
To develop records, including records of consumers’ personal information
To contact consumers with information that might be of interest to them, including information about clinical trials and about products and services of ours and of others
For analytical purposes and to research, develop, and improve programs, products, services and content
For activities to monitor and maintain the quality or safety of our products and services
For activities described to consumers when collecting their personal information or as otherwise permitted under CCPA
For U.S. healthcare providers, to link name, National Provider Identifier (NPI), state license number, and/or IP address to web pages they visit, for compliance, marketing, and sales activities
To conduct audits and perform troubleshooting activities of our websites, products, and services
To detect and protect against security incidents and deceptive, malicious, or fraudulent activity
To ensure our website, products, apps, and services function as intended, including debugging and repairing
To comply with a law or regulation, court order or other legal process

Please see How Does Medtronic Keep and Use Personal Information in our Privacy Statement for more information.

How We Share Personal Information

Medtronic will not share consumers’ personal information with an unrelated third party without permission, except as described below. Medtronic may share personal information with any member of our corporate group, including parent companies, subsidiaries, and affiliates, and other companies in which we have an ownership or economic interest for purposes that are consistent with those identified in our Privacy Statement and this Notice.

In the ordinary course of business, we will share some personal information with companies that we hire to perform services or functions on our behalf. In all cases in which we share consumers’ personal information with a third party, we will only allow them to keep, disclose, or use consumers’ information to provide the services we asked them to provide.

We may be required to release consumers’ personal information in response to a court order, subpoena, search warrant, law, or regulation. We may cooperate with law enforcement authorities in investigating and prosecuting users who violate our rules or engage in behavior which is harmful to other users or illegal. In addition, we may keep, disclose, and use consumers’ personal information in order to comply with U.S. FDA and other governmental guidance, directions, regulations, and laws.

Categories of Personal Information We Sell

We do not sell personal information of California consumers.

This does not include disclosures that are not a “sale” under the CCPA, including when

consumers instruct us to disclose their personal information,
a consumer instructs us to interact with a third party that does not sell that information,
we use or share consumers’ personal information pursuant to a written contract with a service provider that is necessary to perform a business purpose, where our contract prevents the provider from using, keeping, or disclosing consumers’ personal information for any purpose other than the reason supplied in the contract, or
consumers’ personal information is transferred as part of a transaction in which the third party assumes control of all or part of our business.

Personal Information on Minors

We do not sell personal information of California consumers, including minors.

Rights under California Law

Right to Access. If you are a California consumer, you have the right to ask us to send you the following information up to two times in a twelve-month period:
- The categories of personal data we have collected about you.
- The categories of sources from which we collected the personal data.
- Our business or commercial purpose for collecting personal data.
- The categories of third parties with whom we share personal data.
- What categories of personal data we disclose about you for business purposes.
- What categories of personal data we sell or exchange for consideration about you.
- The specific pieces of personal information we have collected about you.
Right to Delete. If you are a California consumer, you have the right to ask us to delete the personal data about you we have collected. We may deny the request if the information is necessary to:
- complete a transaction, including providing a requested or reasonably anticipated good or service, or fulfill a contract between the consumer and Medtronic;
- detect and protect against security incidents, malicious, deceptive, fraudulent, or illegal activity, or take against those responsible for such activity;
- debug to identify and repair errors impairing intended functionality;
- exercise free speech or another right provided for by law;
- comply with the California Electronic Communications Privacy Act;
- engage in research in the public interest adhering to applicable ethics and privacy laws where the consumer has provided informed consent;
- enable solely internal uses reasonably aligned with the consumer’s expectations based on the consumer’s relationship with Medtronic;
- comply with a legal obligation; or
- otherwise use the information internally in a lawful manner compatible with the context in which the consumer provided the information.
Right to Opt-out. If a business sells personal information to third parties, California consumers have the right, at any time, to opt out of the sale or disclosure of their personal information to third parties. Medtronic does not sell personal information to third parties.

Right to non-discrimination. The CCPA grants California consumers the right not to be discriminated against for exercising your privacy rights. If you exercise your privacy rights, we will not discriminate against you, for example, by denying you access to our online services or chargingyou different rates or prices for the same online services, unless that difference is reasonably related to the value provided by your data.

Submitting a Request or Inquiry

For US data subject rights requests contact us via email at rs.globaldataprivacyoffice@medtronic.com or call us at our toll-free number 866-639-6907.

Your request will be confirmed within ten days of receipt and we will respond within 45 days, unless shorter periods are required by law. If we need more than 45 days, we will notify you that your request is being delayed.

We can only respond to your request if it is verifiable. This means we are obligated to take reasonable steps to verify your identity or your authorized agent’s authority and your right to access the information you request. In the process of verifying your request, we may contact you to ask for additional information that will help us do so, including government-issued IDs containing your name and address, utility bills containing that same information, and/or unique identifiers like usernames. We will only use that additional information in the verification process, and not for any other purpose. Once we have received and verified the requested information from you, we will contact you with our response to your request, including any data, if applicable. If we do not hear from you or are unable to verify your identity for the request, we will contact you to inform you that we cannot process your request because we cannot verify your identity.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.