SofMedica SA and Intuitive Surgical Sàrl

Joint Privacy Notice

Effective Date: 5 July 2022

This is a Joint Privacy Notice (“Notice”) by Sof Medica SA (“Distributor”), and Intuitive Surgical Sàrl and its affiliated companies (collectively, “Intuitive”); (Intuitive and Distributor may be collectively referred to as “we”, “our”). This Notice applies to Personal Data that is jointly collected and processed by Distributor and Intuitive in relation to Intuitive Technology, including sales, marketing, maintenance and services (“Joint Scope”).

Intuitive manufactures computer-enhanced medical technology, including the da Vinci Surgical technology and other innovative, minimally invasive robotic-assisted technology (collectively, “Technology”). Sof Medica SA is a distributor of medical devices, including Intuitive Technology.

For the purposes of this Notice, “Personal Data” means any information relating to an identified or identifiable natural person as defined by the European General Data Protection Regulation (“GDPR”). The joint mission and focus of Distributor and Intuitive is to operate transparently, in a way that protects the rights and preserves the trust of everybody whose Personal Data is collected or used by Distributor or Intuitive.

Personal Data covered by this Notice is generally collected for the legitimate business interests of Distributor and/or Intuitive, or it may sometimes be collected based on a contract with you or with your consent. Distributor and Intuitive may additionally provide individual privacy notices for selected services that use Personal Data. If you are a user of such services, please refer to such service specific privacy notices for additional details.

With this objective, the general use and collection of Personal Data by Distributor and Intuitive is guided by the following “principles”:

We comply with all applicable data privacy laws and regulations

We do not sell your Personal Data to anyone

We store data with industry-standard information technology and cloud services, following industry standard practices to maintain confidentiality, integrity and availability.

Contact Details

Distributor and Intuitive are both joint controllers of your Personal Data.

For Distributor:

Principal locations:

Sof Medica SA, Calea Bucurestilor 87 – 91, Otopeni, Ilfov, 075100, Romania

You may find additional contact information here: www.sofmedica.com/contact/

To exercise your rights, to obtain details of our data transfer safeguards, or for any other questions related to Personal Data, you may contact Distributor’s Data Privacy Representative by emailing dataprotection@sofmedica.com. When necessary, Distributor may request identifying information from you to confirm your identity. Distributor will respond to requests in accordance with the applicable data protection law.

For Intuitive:

Intuitive Surgical Sárl, 1 Chemin des Mûriers, 1170 Aubonne, Switzerland

You may find additional contact information here: https://www.intuitivesurgical.com/company/locations-representation/ To exercise your rights, to obtain details of our data transfer safeguards, or for any other questions related to Personal Data, you may contact Intuitive’s Data Privacy Officer by emailing data.privacy@intusurg.com. When necessary, Intuitive may request identifying information from you to confirm your identity. Intuitive will respond to requests in accordance with the applicable data protection law.

Collection and Use of Personal Data

Intuitive Website Users

If you complete web forms on Intuitive websites, on the basis of your express consent or our legitimate interest to manage customer relationships, Intuitive may collect the following information:

Personal identification data like name, contact details, time zone and preferred language.

Professional data like title, role, employer, professional specialty, professional interests and identification number.

And any other information that you choose to provide to us Intuitive may use the Personal Data of Intuitive website users for purposes including:

Creating aggregated statistics on website usage

Responding to your requests you have submitted through our website

Providing you information about our current and future products and services

Conducting market research

Improving our products or services

Providing a general resource for our research and business development

As necessary for network and information security, fraud prevention, reporting suspected criminal acts, and for ensuring compliance with the applicable laws and regulations

Third Party Representatives

Within the Joint Scope, if you are an employee, director, officer, agent, consultant, advisor (“Representative”) of Distributor’s or Intuitive’s customers, suppliers, service providers, consultants, distributors, regulatory agencies and others (“Third Party”) with a professional relationship or an interest related to Intuitive’s or related products or services, we typically collect the following type of Personal Data:

Identification data like name, phone number, email address and postal address

Professional data like employer, work contact information and job title

In addition, depending on your relationship with Distributor or Intuitive, we may also collect other information from you, such as:

Identification data like date of birth and passport number

Personal characteristics like travel and meal preferences (For example, to allow for travel and catering arrangements for events)

Professional data like resume, professional memberships, training and travel records

Financial data like compensation and bank account details (For example, to allow payment for speaking engagements, consulting or other services provided)

Recordings like pictures, audio or video

Profiling data like professional interests

Any other information you choose to provide to us

The purposes for which we may process Personal Data and the legal bases on which we may perform such processing are:

Legal basis for processing	Purposes of processing
Legitimate interests to manage our business, including research, development, sales, training, education, marketing and support for products and services.	Relationship and contract management with customer entities
	Sales, order fulfilment, distribution and invoicing of products and services with customer entities
	Purchasing products and services from vendors
	Coordinating support and preventative maintenance of our products
	Coordinating travel, site visits and other events
	Evaluating and coordinating clinical trials and related studies and projects
	Customer efficiency, cost saving, process and program performance
	Improving our products, services and processes e.g. compensation analysis, budgeting, planning, market research and analysis, surveys, providing performance information, sponsored agreements
	Network security
	Providing a resource for our research and business development.
Consent	Marketing and providing information about our products and services
Consent	Coordinating travel, site visits and other events
Contract	Contracting for services with healthcare professionals or other individuals
	Employee training
	Coordinating travel, site visits and other events
	Evaluating and coordinating clinical trials and related studies and projects
Legal obligation	Complaints handling
	Evaluating and coordinating clinical trials and related studies and projects
	Ensuring compliance with applicable laws and regulations, e.g. legal advice, negotiation, fraud prevention and healthcare compliance

Users of Intuitive Technology

In addition, within the Joint Scope, while being a Third Party Representative, you may also be a User of Intuitive Technology if you are a surgeon, hospital resident or fellow, medical student, proctor or otherwise use, have used, or may use medical devices manufactured by Intuitive. From Users of Intuitive Technology we may collect:

Professional data relevant to the use of our products like professional experience, training related to Intuitive technology, and procedure related information

Ergonomic and other user-defined system settings that are associated with a user-defined identifier

Additional purposes for which we may process Personal Data of Users of Intuitive Technology and the legal basis on which we may perform such processing are:

Legal basis	Purposes of processing
Legitimate interests to manage our business, including research,development, sales, training, education, marketing and support for products and services.	Learning and professional education: course enrollments, training recommendations and management
	Proctoring, speaking engagements and consultancy related interactions
	Procedure reporting

Personal Data transfers and third party access

We may share Personal Data with affiliates of Distributor or of Intuitive. If we transfer your data to another data controller, for example, when signing you up for a training provided by a third party training center, we do that only with your permission. We may also use service providers to process Personal Data on our behalf, for example to provide hosting, communications and logistics services, market research and surveys, database and analytics services, as well as training centers, affiliates within the Intuitive group of companies, attorneys, accountants and banks. We may be required to disclose, and may disclose Personal Data in response to lawful requests as part of a legal proceeding or by public authorities.

Your Personal Data may be transferred to countries where the local legislation provides a different level of protection, including the United States, for your Personal Data and rights. If that is the case, we use appropriate safeguards like Standard Contractual Clauses approved by the European Commission. Further information about our data transfers and the safeguards in place can be requested from our Data Privacy Officers at the contact addresses listed above.

Data Retention

Within the Joint Scope, we keep your Personal Data as long as needed to guarantee our commitments

related to Intuitive Technology and related services, and to maintain the professional relationship over time. We may keep your Personal Data longer if required by applicable law or where we have a legitimate and lawful purpose to do so.

Your Rights

As provided by applicable data protection laws, you may exercise the following rights:

Right of access

Right of data portability

Right of rectification

Right of erasure

Right to restriction of processing

Right to object to processing

If data processing is based on your consent, you may withdraw your consent at any time. Withdrawal of your consent will not affect the lawfulness of processing done before the withdrawal. To exercise your rights, you may contact Distributor’s Data Protection Representative at dataprotection@sofmedica.com ; or Intuitive’s Data Protection Officer at data.privacy@intusurg.com.

If you believe your Personal Data has been processed in violation of an applicable data protection law, you have the right to lodge a complaint with your local data protection authority. Intuitive is registered in the European Union with the French data protection authority (Commission nationale de l’informatique et des libertés; CNIL). You may find CNIL’s contact information at https://www.cnil.fr/en/contact-cnil.

Automated Decision Making

We do not use the Personal Data described herein for automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.

No Requirement to Provide Data

You are not required to provide your Personal Data to us, except, for example when necessary to perform a contract. Some information may be provided by you, your employer or associated hospital under a contract with us. However, not providing some of the information may impact the ability to support your or your employer/hospital’s use of certain product features or functionality, including the use of relevant training materials or metrics.

How We Protect Your Data

The security and confidentiality of your Personal Data is important to us. We store Personal Data with industry-standard information technology and cloud services, following industry standard practices to maintain confidentiality, integrity and availability.

Changes to This Notice

If anything changes, we will update this Notice and the Notice Effective Date