Privacy notice for Neuromodulation and Pelvic Health therapies and related services in the United States

This privacy notice applies to how personal data is collected and processed by Medtronic and its affiliates for Neuromodulation and Pelvic Health therapies and related services in the United States.

This notice does not apply to situations where you have been notified that an alternative privacy notice applies (for example on other Medtronic websites). Please read the notice at each place you visit to see how that location processes your data. In addition, some sections of this notice are labeled for certain geographies and apply only to those locations.

Please note that it does not apply to data processing activities specifically relating to current or former Medtronic employees or applicants – the relevant notice may be requested by contacting AskHR@Medtronic.com.

Unless otherwise set out below, the Medtronic company responsible for processing your personal data is Medtronic Inc.

 

This section describes how Medtronic uses your personal data to provide you with therapies and related services. Unless we need your personal data in order to comply with laws and regulations, you are not required to provide information to us but, if you choose not to do so, we may not be able to offer you certain services and related features, or to respond to requests that you may have.

Account management

We may collect and process your personal data to create and manage your account with us, or when you request information about therapies or related services.

Types of personal data

  • Credentials. Username, password, authentication/verification codes, and account verification questions/answers.
  • Contact information. Name, email address, postal address, telephone number, geographic location, language, date of birth, communication preferences, and optional profile pictures and third-party login information.
  • Family information. Marital status, family and household contact, relationship, and health data, dates of birth and death, legal guardianship, emergency contact status and information, and names and contact information of authorized persons named by you.
  • Device/network information. Your device, browser, and operating system version and type, device identifiers, IP address, authentication data, and your interactions with our services, including timestamped logs of resources requested, accessed, and interacted with.

Purposes of use

  • Creating and maintaining your account, including through verifying your contact and authentication information through welcome communications.
  • Authentication.
  • Registering your device.
  • Recording your preferences, including for communications from us.
  • Authorizing your delegates/emergency contacts to access your account as needed.

(Back to top)

Communicating with you about your treatment

We may collect and process your personal data to communicate with you about your treatment, including at your request.

Types of personal data

  • Contact information. Name, email address, postal address, telephone number, geographic location, language, date of birth, communication preferences, and optional profile pictures and third-party login information.
  • Family information. Marital status, family and household contact, relationship, and health data, dates of birth and death, legal guardianship, emergency contact status and information, and names and contact information of authorized persons named by you.
  • Information about your medical device or treatment, including device identifiers and your health data related to treatment.

Purposes of use

  • Recording your preferences, including for communications from us.
  • Registering your device.
  • Communicating with you about your condition or treatment, including information about your condition, treatment, or device pre- and post- trial and permanent implant.
  • Communicating with you about your device, including notifications about device configuration and status, as well as safety or quality issues if they arise.
  • Fulfilling your requests for information from us.

(Back to top)

Providing treatment to you

We may collect and process your personal data to treat and care for your medical condition and device.

Types of personal data

  • Contact information. Name, email address, postal address, telephone number, geographic location, language, date of birth, communication preferences, and optional profile pictures and third-party login information.
  • Family information. Marital status, family and household contact, relationship, and health data, dates of birth and death, legal guardianship, emergency contact status and information, and names and contact information of authorized persons named by you.
  • Your medical device, including device ID, telemetry, and model/serial number, device usage data, user-generated content, and product use data.
  • Your medical device treatment history, including implantation details.
  • Your medical record and history, including your conditions, general health status, disabilities, family medical history, sex/gender, age, prescriptions and medications, procedure information (including IDs, videos, duration, and dates), medical practitioners, and lab/telemetry results.
  • Your medical status, including vitals, symptoms, condition reports, image, and device telemetry/monitoring.
  • Volunteered information, including communications you send to us or other data you choose to provide.

Purposes of use

  • Recording your preferences, including for communications from us.
  • Registering your device.
  • Communicating with you about your condition or treatment, including information about your condition, treatment, or device pre- and post- trial and permanent implant.
  • Monitoring your device, including for issues with and the efficacy of the device or your health or condition.
  • Communicating with you about your device, including notifications about device configuration and status, as well as safety or quality issues if they arise.
  • Servicing your device, including by updating or upgrading it, diagnosing and resolving issues, and optimizing its configuration.
  • Improving our treatments, products, and services, such as through surveys about specific health conditions or device performance/feedback.
  • Fulfilling your requests for information from us.

(Back to top)

Coordinate treament with your care team

We may collect, process, and disclose your personal data to coordinate and work with your care team to treat and care for your medical condition and device.

Types of personal data

  • Contact information. Name, email address, postal address, telephone number, geographic location, language, date of birth, communication preferences, and optional profile pictures and third-party login information.
  • Family information. Marital status, family and household contact, relationship, and health data, dates of birth and death, legal guardianship, emergency contact status and information, and names and contact information of authorized persons named by you.
  • Your medical device, including device ID, telemetry, and model/serial number, device usage data, user-generated content, and product use data.
  • Your medical device treatment history, including implantation details.
  • Your medical record and history, including your conditions, general health status, disabilities, family medical history, sex/gender, age, prescriptions and medications, procedure information (including IDs, videos, duration, and dates), medical practitioners, and lab/telemetry results.
  • Your medical status, including vitals, symptoms, condition reports, image, and device telemetry/monitoring.
  • Volunteered information, including communications you send to us or other data you choose to provide.

Purposes of use and disclosure

  • Coordinating with your care team when you request an appointment with a health care practitioner who will be treating your condition or managing your device, including your implanting and continuing care physicians.

(Back to top)

Accounting and payment processing

We may collect and process your personal data for accounting and payment purposes.

Types of personal data

  • Contact information. Name, email address, postal address, telephone number, geographic location, language, date of birth, communication preferences, and optional profile pictures and third-party login information.
  • Health payer and claims information, including information on your provider, health condition and services rendered, health payer and your group, subscriber, account/member, and similar numbers or identifiers, claims history, financial assistance data, invoices, receipts, and payment information.

Purposes of use and disclosure

  • Submitting to your care provider or payer for payment for your health care services and products.
  • Accounting activities, including audits, investigations, insurance requirements, and general bookkeeping.

(Back to top)

Analysis, research, and development

We may collect and process your personal data for research and development purposes, such as improving the quality, safety, and efficacy of devices, services, interfaces, and treatments.

Types of personal data

  • Your medical device, including device ID, telemetry, and model/serial number, device usage data, user-generated content, and product use data.
  • Your medical device treatment history, including implantation details.
  • Your device/networking information, including system generated user ID, system log including system events and error logs, machine data, system configuration, system generated procedure ID, device ID, other data collected during your interaction with our therapies or related services, and date and time stamps.

Purposes of use

  • Analysis, including event and crash detection, repair, and improvement, and utilization and efficacy reviews.
  • Research, including activities resulting from that research such as developing and improving programs, therapies, related services, and content.

(Back to top)

Marketing material

We may collect and process your personal data for marketing purposes where you have provided your agreement.

Types of personal data

  • Contact information. Name, email address, postal address, telephone number, geographic location, language, date of birth, communication preferences, and optional profile pictures and third-party login information.
  • Your medical device, including device ID, telemetry, and model/serial number, device usage data, user-generated content, and product use data.
  • Customer data, such as transaction, payment, and contract data.
  • Professional status, including employment-related data and affiliations.
  • Volunteered information, including communications you send to us or other data you choose to provide.

Purposes of use

  • Fulfilling your requests for information from us.
  • Assessing the performance of our marketing, including analytics about your use of our services and interactions with us and improving the efficacy of our communications.
  • Contacting you with information that may be of interest, including, as permitted by law, information about clinical trials, educational events, therapies, new devices, or other offerings.

(Back to top)

General

The data collected, discussed in the preceding sections, may be used by Medtronic for general business purposes, including:

  • To fulfill our contract with you when it is our legal duty.
  • When it is in our legitimate interest to:
    • Manage the security of websites, networks, systems, and services Medtronic provides to our customers.
    • Manage websites for healthcare professionals, account access support, verify your personal identity as needed for us to provide our therapies or related services, online support, and related services safely and lawfully.
    • Properly administer our business, therapies or related services.
    • Manage our relationship with you and keep our records up to date.
    • Support and manage our therapies or related services by our service providers and/or business partners.
    • Enforce this privacy notice and other rules about your use of our product or services.
  • With your consent, where required by law or when it is in our legitimate interest to:
    • Ensure our organization runs properly.
    • Protect our organizations systems and software including your personal data.
    • Understand how to improve our therapies or related services.
    • Provide you extended warranty on selected therapies or related services.

(Back to top)

Sensitive data use

Some of the data we collect and use is considered sensitive under applicable laws, which may include, for example, health- and financial-related data and genetic/biometric data. Our collection and use of sensitive personal data is limited to that which is necessary to provide you with your requested services, including treating your condition. You can choose to withdraw or withhold your consent, but, because your sensitive data is necessary to provide you with these services, you will not be able to use these services.

(back to top)

Data you provide to us

We may ask that you, your caregiver, your account administration, or any individual authorized by you not to send or disclose any other personal data other than the data that we ask you to provide using our therapies, related services or otherwise to us.

(Back to top)

Telephonic contact

By disclosing the phone number(s) you provide to Medtronic, we may contact those number(s), including via text, SMS, or voice call, for the transactional purposes defined in this privacy notice, as well as for responding to requests you make of Medtronic. If you provide an additional consent for marketing communications, Medtronic may then contact you by telephone for marketing, advertising, or offers of sale of Medtronic therapies or related services as well.

When making contact by telephone, Medtronic may use automated technologies (including recordings and auto-dialing), and telephone, airtime, message, and data rates may apply. By providing your phone number(s) and/or consent(s), you certify that (a) you are age 13 and older, (b) the contact information you provide is yours, and (c) you authorize and consent to use of the information provided for Medtronic to contact you. Consent is not a condition for purchase or services. You may opt out of telephonic contact from Medtronic using automated technologies and for marketing communications at any time by (i) texting "STOP" in reply to a text message or (ii) for marketing messages, signing into your Medtronic profile and updating your communication preferences.

(Back to top)

Medtronic may publish and collect, or let a third party collect, personal data through digital technologies that may track your activity, including scripts, cookies, application SDKs, and shared libraries and resources, for business purposes including audience and campaign analytics, providing hosted content, functionality, and design, and both first-party and cross-contextual targeted marketing activities, including, in some cases, by building a profile on your activity. While personal data is not shared for money or other similar compensation, the use of these technologies may be considered personal data sharing under applicable law.

The types of technologies, purposes of use, parties involved, and controls available to you, which may vary across our digital offerings, are detailed in our cookie policy.

In the ordinary course of business in carrying out the purposes described in this privacy notice, we may share your personal data with certain categories of third parties, including:

Medtronic affiliated companies

Given the corporate structure of Medtronic, your personal data may be shared with other affiliates within the Medtronic group.

Service providers

We may disclose limited, restricted, and protected personal data to relevant third-party service providers, who act on our behalf to fulfil the activities noted in this privacy notice. Information Technology (IT) and Cloud Service Providers deliver the necessary equipment, hardware, software, storage, networking, transactional services, payment processing services and other technology required to run the services.

Health care providers and regulators

As described above, Medtronic may disclose personal data to your physician to coordinate or manage your health care and related services. This may also include other health care provider(s) who, at your request, become involved with the management of your care, online account, or related services. Medtronic may also disclose your personal data to support the daily activities related to health care and other health oversight agencies such as government agencies to support with audits, investigations, and inspections.

Business and research partners

Medtronic may share personal data with external organizations with which it has partnered (such as research partners and partners in co-branded initiatives), and with external specialists within a particular field (such as lawyers, consultants, tax advisors, specialist delivery services, and benchmarking agencies). In cases where those third parties are independently responsible for the processing of your personal data, their privacy notice will apply to their processing of that data.

For legal and other related interests

Medtronic may share personal data where it is:

  • Required by law.
  • Allowed or required by law for public health purposes, including reporting complaints and quality issues to medical device regulators.
  • Needed to protect its own or others vital interests, including the safety of life and property, or for investigating illegal or malicious activities, where allowed by law.
  • Needed to exercise or defend legal claims.
  • Needed with its corporate affiliates, who have the same privacy requirements.
  • Needed to fulfill corporate transactions (such as mergers, acquisitions, dissolutions or divestitures), as well as for to companies with whom Medtronic is working on a potential or pending corporate transaction.

International transfers

In some cases, Medtronic may transmit, or store personal data collected to affiliates, vendors, or sites in other countries. We will only transfer personal data as allowed by applicable law to further the purposes set out in this document. Where personal data is transferred to another country, we take administrative and technical measures to ensure adequate safeguards and protections are applied as provided for by applicable law. In cases where personal data is transmitted to other countries, we will ensure that safeguards equivalent to those required by applicable data protection laws are in place. For more information on the safeguards implemented by Medtronic, please contact us via email at rs.globaldataprivacyoffice@medtronic.com.

For more information on Medtronic affiliates (including those affiliates to whom personal data may be transferred) please consult Exhibit 21 of the most recent annual 10-K filing, available at https://investorrelations.medtronic.com/sec-filings.

Data retention

We will only keep your personal data for so long as necessary to fulfill the purposes for which we are allowed to use them, as set out in this privacy notice, or as required by law.

You may have some of the rights below relating to your personal data, depending on applicable laws. Additional information may be found in the specific jurisdictions section.

  • Access your specific data, as well as confirm processing, including and purposes of processing, and categories of party to whom we disclose.
  • Transfer or obtain a copy in a structured, machine-readable, or portable format.
  • Correct or amend if it is incomplete, inaccurate, or outdated.
  • Request deletion. Subject to applicable law, we may sometimes deidentify this data.
  • Restrict or limit excessive or unlawful processing, where the accuracy of the data is contested.
  • Object to or opt-out of processing in circumstances where Medtronic claims a legitimate interest in its processing and where your rights outweigh those of Medtronic, such as where that data is used for direct marketing (including email or telephonic marketing).
  • Revoke (or manage) consent where it is the basis for processing, which may include cases where the data is sensitive or on children. Where consent is revoked, we will not further process that data unless required or otherwise permitted by applicable law.

Exercising your rights

Submitting a Request or Inquiry

For US data subject rights requests contact us via email at rs.globaldataprivacyoffice@medtronic.com or call us at our toll-free number +1 (866) 639-6907.
Your request will be confirmed within ten days of receipt and we will respond within 45 days, unless shorter periods are required by law. If we need more than 45 days, we will notify you that your request is being delayed.

We can only respond to your request if it is verifiable. This means we are obligated to take reasonable steps to verify your identity or your authorized agent’s authority and your right to access the information you request. In the process of verifying your request, we may contact you to ask for additional information that will help us do so, including government-issued IDs containing your name and address, utility bills containing that same information, and/or unique identifiers like usernames. We will only use that additional information in the verification process, and not for any other purpose. Once we have received and verified the requested information from you, we will contact you with our response to your request, including any data, if applicable. If we do not hear from you or are unable to verify your identity for the request, we will contact you to inform you that we cannot process your request because we cannot verify your identity.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

We do not intentionally collect personal data from children (as defined by applicable law) unless we have received verifiable consent (from the parent or the child, depending on the requirements of applicable law) unless a legal requirement or vital interest applies. If you believe we have collected personal data from a child, please contact us using the information found in the “Contact Medtronic” section.

 

United States of America

Past practices. The statements in this privacy notice are Medtronic’s data processing activities for the described scope of the privacy notice both as current and within the past twelve months.

Protected Health Information under HIPAA. This notice does not apply to our data processing activities and practices for Protected Health Information (PHI), which is regulated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In those cases, you may have received a Notice of Privacy Practices from Medtronic or your health care provider which will govern that data use.

Data governed under HIPAA may be deidentified through either or both the Safe Harbor and Expert Determination methods. While that data is then deidentified, Medtronic does not, and will not permit others to, reidentify deidentified PHI except as required by applicable law or as directly consented to by the subject of that PHI.

Sales/Sharing of Personal Data. Medtronic does not sell your personal data for money or other consideration, nor share it for direct or behavioral marketing purposes, to unrelated third parties, except as described in the “Digital tracking technologies“ section.

Right to opt-out or object. As noted above, you may have the right to opt-out of some processing, such as sharing data with third parties for their own or for cross-contextual marketing, sales of personal data, making certain decisions or profiles about you by automated or artificial means, or making certain kinds of automated/prerecorded telephonic messages to you.

Right to restrict or limit. In some jurisdiction, you may have the right to restrict some processing if the data is sensitive and used for purposes in addition to delivering requested goods/services.

 

General inquiries. You may contact us with data and privacy questions by emailing rs.globaldataprivacyoffice@medtronic.com (in all geographies) or calling us at +1 (866) 639-6907. Our general-purpose corporate mailing address is at Medtronic, Inc. 710 Medtronic Parkway Northeast, Fridley, Minnesota 55432-5603, USA.

This privacy notice may be updated periodically to reflect changes in our personal data practices. We will indicate at the top of the privacy notice when it was most recently updated.