By submitting a request, Clinician acknowledges and agrees that Clinician hereby instructs Medtronic to analyze and generate logfiles reports on the basis of logfiles uploaded through this webpage (“Services”). Clinician acknowledges and understands that logfiles submitted and logfiles reports generated will contain personal data of patients, including health-related data. Clinician warrants and represents that he is duly authorized to request the Services by the healthcare facility treating the concerned patients (“Customer”).

All terms have the meaning as defined in the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or shall be understood to be equivalent terms under other applicable data protection laws. The following clauses relate to the processing of personal data by Medtronic on behalf of Customer as necessary for the provision of the Services. To this end, Medtronic acts as Data Processor on behalf of Customer, which acts a Data Controller.

Medtronic will: - Only process the personal data for as long as needed to perform the Services. Medtronic will at Customer’s choice (i) destroy the personal data or (ii) return personal data and destroy any remaining personal data that are no longer needed for the said purposes, unless a legal or regulatory obligation or a judicial or administrative order prevents Medtronic from doing so or obliges Medtronic to retain copies of any such data;
- Implement the appropriate technical and organizational security measures in order to meet the requirements of the GDPR;
- notify Customer without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal Data transmitted, stored or otherwise processed via the Services, providing at least such information as required under the GDPR;
- Act promptly with any request (in writing) from the Customer requiring Medtronic to amend, transfer, delete, or otherwise dispose of the personal data;
- Reasonably assist Customer in dealing with requests from Data Subjects, and, to the extent permitted, notify Customer if Medtronic receives any such request concerning Medtronic’s processing of personal data on behalf of Customer in relation to the Services;
- Reasonably assist Customer with data protection impact assessments and/or prior consultations that may be required in respect of the data processing carried out under these clauses;
- Make available, upon reasonable request of Customer, the documentation necessary to demonstrate compliance with its obligations as data processor. Medtronic will provide such documentation no more than once per twelve (12) month period;
- Maintain the confidentiality of personal data processed on behalf of Customer and shall reasonably ensure that Medtronic’s staff authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
- Inform Customer if, in its option, instructions contravene applicable data protection laws;
- Not disclose personal data to any third party other than for the purposes of providing the Services. Medtronic shall be generally permitted to engage another processor to perform the Services (“Sub-Processor”). Medtronic and its Sub-Processors will process personal data both in- and outside the EEA, UK and Switzerland, including the United States of America, for the provision of the Services. Medtronic will transfer personal data outside such countries on the basis of appropriate safeguards to ensure an adequate level of data protection under applicable data protection laws, which may include standard data protection clauses (“Model Clauses”), and with regulatory approval in circumstances where required by applicable data protection laws.

As Data Controller, Customer is responsible for complying with applicable data protection laws including for the lawfulness of the processing of personal data. Customer is responsible for informing its patients of the processing of their personal data in context of the Services and for obtaining explicit and valid consent, where required under applicable data protection laws.
Notwithstanding the generality of the foregoing, Medtronic may also process personal data contained in the logfiles for the purpose of complying with its legal and regulatory obligations as manufacturer of medical devices in context of its health-vigilance, adverse events and product complaint handling activities.
I Agree

Medtronic will process personal data contained in the logfiles for the purpose of complying with its legal and regulatory obligations as manufacturer of medical devices in context of its health-vigilance, adverse events and product complaint handling activities.
I Agree