This privacy notice applies to how the Medtronic mobile application (the “Medtronic app”), which links to this privacy notice, uses information about you (“personal data”) in connection with the activities described below, including when you install or download the Medtronic app to your electronic device, when personal data is shared through the Medtronic app, or when you contact Medtronic customer service for support in connection with the Medtronic app.

Unless set out otherwise below, the Medtronic company responsible for processing your personal data is Medtronic, Inc. (together “Medtronic,” “we," or "us”).

In this privacy notice, we’ll tell you what personal data we obtain about you when you use the Medtronic app, how we use that information, with whom we share it, what rights you have regarding your information, and how to contact us to exercise these rights. 

This privacy notice does not apply when you have been notified that an alternative privacy notice applies (for example on other Medtronic websites) or where Medtronic processes your personal data on behalf of your medical institution or healthcare professional in connection with your medical treatment. Your medical institution and/or healthcare professional is solely responsible for the processing of your personal data for the provision of your medical treatment and care. In such instance, your data is subject to your medical institution’s own data policies and privacy notices. When we obtain your data this way, we’ll use it only based on the instructions of your medical institution, unless we are required to do so to comply with our regulatory obligations, or your medical institution has authorized us to further use your data, as described below.

The Medtronic app may contain links to other apps or websites. Some of those websites or apps may be operated by Medtronic and some may be operated by third parties. Medtronic and its affiliates, including our international affiliates, also operate other websites. This privacy notice does not apply to any other application or website, even if operated by Medtronic. When you leave the Medtronic app, please read the privacy notice at each place you visit to see how that location processes your data. In addition, some sections of this privacy notice only apply to certain geographies, as described further below.

This section describes how Medtronic uses your personal data (also known as your personal information in certain jurisdictions) collected via the Medtronic app. The information we collect depends on the functionality of the Medtronic app and how you use it, as detailed below. Unless we need your personal data to comply with laws and regulations, you are not required to provide information to us but, if you choose not to do so, we may not be able to offer you certain services and related features, or to respond to requests that you may have.

In using a Medtronic app, you may need to engage in the set-up process, registration, and/or account creation to take full advantage of the Medtronic app functionality. 

What personal data we obtain

  • Identification information, such as your name, user ID number, date of birth or age, profile picture (optional), authentication/verification codes, and account verification questions/answers
  • Location data, such as your country/region and language preference
  • Login credentials, such as your username/email address and password

How we use your data

  • To register your device 
  • To create and manage your account, including to authenticate you and ensure account security
  • For multi-factor authentication and authorization to provide additional security for your accounts
  • To personalize your profile based on your preferences or selections you made

We’ll do so with your consent or based on our agreement to deliver services to you, if applicable.

Depending on the functionality of the Medtronic app that you are using, we may collect or process certain personal data as part of delivering that functionality to you. The types of personal data, how we use it, and the way we collect it may vary depending on the specific Medtronic app or features you are using, your location, and applicable laws.

What personal data we obtain

Such data may include, to the extent relevant:

  • Identification information, such as your name, user ID number, date of birth or age, profile picture
  • Location data, such as your country/region and language preference
  • Device information including device description, device model and manufacturer, version of your operating system, unique device ID, platform, date of registration, device location, third-party data, and any other data you choose to provide
  • Login credentials, such as your username/email address and password 
  • If the Medtronic app needs to access or use your camera, microphone, or other restricted functions on your mobile device, you will be presented with a choice to provide your permission. Such access will only be used to enable the Medtronic app to deliver specific services as part of the app

 

How we use your data

Depending on the functionality of the Medtronic app, we may use your data to:

  • Request permission or access to certain features from your mobile device, including your mobile device microphone, mobile device camera, storage, and other related features
  • Request permission to track location-based information from your device to offer or provide location-based services
  • Detect and authenticate the identity of the user trying to access the Medtronic app
  • Send push notifications regarding your account or the Medtronic app
  • Allow the Medtronic app to save files and documents on to your device’s memory card or external storage 
  • Authorize data sharing, only with your consent, and if you connect to third-party applications
  • Track the Medtronic app usage data and account transactions (if applicable) to check and protect you from any fraudulent, suspicious, and/or unusual activities

You can opt-out or control and manage your preferences by using your mobile device’s settings at any time. We will use your data for the above reasons based on your consent or our legitimate interests, including our interest in the security of our services and in defending our legal rights.

To the extent relevant to the functionality of the Medtronic app, we may collect and process your personal data to communicate with you about your treatment, therapies, or services, including at your request.

What personal data we obtain

  • Your contact information, such as name, email address, postal address, telephone number, geographic location, language, date of birth, communication preferences, and optional profile pictures and third-party login information 
  • Dates of birth and death, legal guardianship, emergency contact status and information, and names and contact information of authorized persons named by you
  • Information about your medical device or treatment, including medical device name, device identifiers (such as model number, manufacturer, medical device serial number, IMEI/MEID, unique device ID), implant date (if applicable), and your health data related to treatment
  • Information about your care team, healthcare professional, hospital/facility name, address, and phone number

How we use your data

  • Recording your preferences, including for communications from us 
  • If you are a patient, to transmit data to your health care provider
  • Communicating with you about your condition or treatment, including information about your condition, treatment, or device pre- and post-trial and permanent implant
  • Communicating with you about your device, including notifications about device configuration and status, as well as safety or quality issues if they arise 
  • To provide services to you through the Medtronic app, including services to manage your health condition, responding to your questions, concerns, requests, complaints, or comments
  • Provide you with information on products, services, therapies, or suggestions you requested via the Medtronic app
  • Customize or improve the content, recommendations, and offers that we display to you on the services
  • Email you regarding your account, any updates, newsletters, or promotions
  • To develop records, including records of your personal health information
  • Fulfilling your requests for information from us

We may collect aggregated information through our chat services using cookies and through other means as described in this privacy notice. We will use your data for the above reasons based on our need to perform the contract we may have with you (if you are an existing customer), or to take pre-contractual steps at your request, our legitimate interests, including training our personnel, improving our services to you and defending our legal rights, or our need to comply with our legal obligations.

Some of the data we collect and use is considered sensitive under applicable laws, which may include, for example, health- and financial-related data and genetic/biometric data. Our collection and use of sensitive personal data is limited to that which is necessary to provide you with your requested services, including treating your condition. In applicable regions, you can choose to withdraw or withhold your consent, but you may not be able to use certain services or Medtronic app functionality where sensitive data is necessary.

In certain circumstances, Medtronic may process your sensitive data, in particular your health data if relevant, on behalf of your healthcare provider (e.g., to transmit your health data to your healthcare provider). In this case, Medtronic acts as a data processor, service provider, or business associate as those terms are defined under local laws. To the extent that Medtronic processes your sensitive data otherwise, you will be asked to give your explicit consent, to the extent required by law.

We may ask that you, your account administrator, or any individual authorized by you not to send or disclose any other personal data other than the data that we ask you.

When you visit our websites or Medtronic apps, we may collect certain information by standard practices, including cookies and similar technologies, such as Flash cookies, local storage, web beacons and pixels, JavaScript, software development kits (SDKs), and device identifiers. While personal data collected through these technologies is not shared for money or other similar compensation, the use of these technologies may be considered personal data sharing under applicable law. The types of technologies, purposes of use, parties involved, and controls available to you, which may vary across Medtronic digital offerings, are detailed in our cookie policy.  

What person data we obtain

Your device information including the IP address, identifiers associated with your devices, device and operating system type and characteristics, language preferences, your interactions with the Medtronic app (such as the pages you visit, links you click and features you use, dates and times of access to the Medtronic app, the website or source that linked or referred you to our services), and other information about your use of the Medtronic app.  

How we use your data

Cookies and similar technologies (“cookies”) are used by Medtronic for several reasons. Cookies are sometimes necessary for our sites or Medtronic apps to operate correctly. For example, secure logins may use cookies to work properly, and cookies may also be used to identify any suspicious activities so we can try to protect users from payment fraud and other inappropriate activities. Cookies allow us to collect information about how you use our services (e.g., how you downloaded our Medtronic app or where you downloaded it from) and how the app is used on your mobile device (e.g. what features you use and how well our services work). We may use cookies to collect demographic information (e.g., age, location), count the visitors to the Medtronic app, and learn how they use the Medtronic app and their features. This enables us to continually improve the visitor’s experience. Cookies may also allow us to provide you with enhanced functionality such as video content and show you targeted ads on other sites or social media channels. Depending on your location, some cookies may require your consent. Learn more about our use of cookies and how to manage your cookie settings and preferences.

By disclosing the phone number(s) you provide to Medtronic, we may contact those number(s), including via text, SMS, or voice call, for the purposes defined in this privacy notice, as well as for responding to requests you make of Medtronic. If you provide an additional consent for marketing communications as required by local regulations, Medtronic may then contact you by telephone for marketing, advertising, or offers of sale of Medtronic therapies or related services as well. 

When making contact by telephone, we may use automated technologies (including recordings and auto-dialing), and telephone, airtime, message, and data rates may apply. Consent is not a condition for purchase or services. You may opt out of telephonic contact from Medtronic using automated technologies and for marketing communications at any time by texting ”STOP” in reply to a text message or for marketing messages, or by signing into your Medtronic profile and updating your communication preferences.

If you are a United States resident, by providing your phone number(s) and/or consent(s), you certify that (a) you are age 13 and older, (b) the contact information you provide is yours, and (c) you authorize and consent to use of the information provided for Medtronic to contact you.

With the authorization of your medical institution, or with your explicit consent, if applicable, your data, including relevant health data, may be further used for Medtronic legitimate business purposes, including to improve and develop Medtronic products and services, to conduct benchmarking, business analytics or market research, to train and educate Medtronic personnel or healthcare professionals, or to support regulatory filings and the reimbursement of Medtronic products and services, based on Medtronic legitimate interests to do so. For such purposes, your data will be used in a de-identified, aggregated, or otherwise anonymized manner.

In some circumstances, we are obliged to process personal data to comply with applicable legal requirements and our policies, to perform auditing and other internal functions, or for litigation and dispute resolution purposes. 

What personal data we obtain

  • Your identification and contact information, and any other information as is necessary and relevant to the particular case, e.g., in the event of an (internal) audit, information contained in documents and materials audited, or in the event of litigation, information gathered in the evidence necessary for the litigation.

How we use your data

We will use your information, in an anonymized, de-identified, or redacted form, where appropriate, in order to: 

  • Comply with applicable legal requirements, regulations, court orders, or other legal processes
  • Comply with our policies
  • Establish, exercise, or defend our legal rights
  • Conduct (internal) audits, investigations, or due diligence checks for the above reasons

We will do so as necessary to comply with legal obligations to which we are subject in your country or region, or as needed to fulfil our legitimate interests, including conducting business in compliance with all applicable laws and the highest ethical standards, protecting our rights or property, protect someone's health, safety or welfare; and asserting or defending legal claims, or with your consent where required by law.

In the ordinary course of business in carrying out the purposes described in this privacy notice, we may share your personal data with certain categories of third parties, including:

  • Medtronic affiliated companies: Given the corporate structure of Medtronic and its affiliates, your personal data may be shared with other affiliates within the Medtronic group.
  • Service providers: Medtronic may share personal data with relevant third-party service providers, who act on our behalf to fulfill the activities noted in this privacy notice, including IT providers, providers of communication tools and customer relationship management systems, survey tool providers or platforms, event organization management tool providers, outsourced operations such as email automation tool providers, cloud hosting service providers, and contract management platform providers.
  • Business partners and other specialists: To the extent relevant of the Medtronic app, Medtronic may share personal data with external organizations with which it has partnered (such as research partners and partners in co-branded initiatives), established contractual protections or benefits from statutory protections, and with external specialists or professional advisors within a particular field (such as lawyers, consultants, tax advisors, auditors, specialist delivery providers, banks, payment service providers and benchmarking agencies). In cases where those third parties are independently responsible for the processing of your personal data, their privacy notice will apply to their processing of your data.
  • To others for legal and related interests: Medtronic may share personal data where it is:
    • Required by law
    • Required to disclose and/or share your personal data with regulatory, public, or governmental authorities to comply with any law, regulation, court order, legal or government request
    • Allowed or required by law for public health purposes, including reporting complaints and quality issues to medical device regulators
    • Needed to protect its own or others vital interests, including the safety of life and property, or for investigating illegal or malicious activities, where allowed by law
    • Needed to exercise or defend legal claims
    • It is believed that disclosure is necessary or appropriate to prevent physical or other harm or financial loss
    • Needed with its corporate affiliates, who have the same privacy requirements
    • Needed to fulfill corporate transactions (such as mergers, acquisitions, dissolutions, or divestitures), as well as for to companies with whom Medtronic is working on a potential or pending corporate transaction
  • Others, per your request: With your consent, we will share your personal data with any other parties you choose, such as your caregivers. 

If we share your personal data with third parties, we will require them to sign a data processing agreement or include data protection clauses in the cooperation agreement before proceeding. This ensures that the company assumes the applicable privacy protection obligations and responsibilities.

In some cases, Medtronic may transmit or store personal data collected with affiliates, vendors, or sites in other countries (including the United States). We will only transfer personal data as allowed by applicable law to further the purposes set out in this privacy notice. Where personal data is transferred to another country, we take administrative and technical measures to ensure adequate safeguards and protections are applied as provided for by applicable law. In cases where personal data is transmitted to other countries, we will ensure that safeguards equivalent to those required by applicable data protection laws are in place. For more information on the safeguards implemented by Medtronic, please email us at rs.globaldataprivacyoffice@medtronic.com.

For more information on Medtronic affiliates (including those affiliates to whom personal data may be transferred), please consult Exhibit 21 of the most recent annual 10-K filing, available on our SEC Filings page. 

We will only keep your personal data for so long as necessary to fulfill the purposes for which we are allowed to use them, as set out in this privacy notice, or as required by law.

You may have some of the rights below relating to your personal data, depending on applicable laws. Additional information may be found in the specific jurisdictions section.

  • Access your personal data and confirm how your personal data is being processed.
  • Transfer or obtain a copy in a structured, machine-readable, or portable format.
  • Correct or amend if it is incomplete, inaccurate, or outdated.
  • Request deletion. Subject to applicable law, we may sometimes deidentify this data.
  • Restrict or limit excessive or unlawful processing, where the accuracy of the data is contested.
  • Object to or opt-out of processing in circumstances where Medtronic claims a legitimate interest in its processing and where your rights outweigh those of Medtronic, such as where that data is used for direct marketing (including email or telephonic marketing).
  • Withdraw (or manage) consent where it is the basis for processing, which may include cases where the data is sensitive or on children. Where consent is revoked, we will not further process that data unless required or otherwise permitted by applicable law.

Exercising your rights

Process: We will first confirm that we have received your request. For rights requests, we are required to verify your identity, your right to access the information requested, and, as applicable, your authorized agent’s authority to act on your behalf. We may need to ask you for additional information that will help us do so, including government-issued IDs containing your name and address, utility bills containing that same information, and/or unique identifiers like usernames. We will only use that additional information in the verification process, and not for any other purpose. 

After the validation of identity and authority (including if we do not receive that information), we will process your request and then contact you with our response to your request, including any data and reasons for rejection as applicable, within the time required by applicable law. If we need more time, we will notify you in accordance with applicable law.

Fees: We may charge a reasonable fee in some geographies to process or respond to your request only if allowed by applicable law, for instance if it is excessive, repetitive, or manifestly unfounded. If a fee is warranted, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Additional options: Depending on your jurisdiction, you may have additional options if you are dissatisfied with our response: 

  • You may internally appeal or contact our Data Protection Officer if you disagree with a decision we made about your rights. Please include a copy of or reference to the decision. 
  • You may also complain to a data protection or regulatory authority if you have further concerns about our data practices or our response to a request. If you need information about which authority may apply to you depending on your location and circumstances, please contact us.
  • You will not be discriminated against for your exercise of your rights. This does not necessarily include, depending on applicable law in your jurisdiction, cases where a difference in price or services offered is reasonably related to the value provided by your data, or where you consent to participate in a voluntary loyalty or similar incentive program.

We do not intentionally collect personal data from children (as defined by applicable law) unless we have received verifiable consent (from the parent or the child, depending on the requirements of applicable law) unless a legal requirement or vital interest applies. If you believe we have collected personal data from a child, please contact us using the information found in the “How to contact us” section.

United States of America
 

  • Past practices. The statements in this privacy notice are Medtronic data processing activities for the described scope of the privacy notice both as current and within the past 12 months.
  • Protected health information under HIPAA. In cases where the Health Insurance Portability and Accountability Act of 1996 (HIPAA) governs the use of your data, our applicable notice of privacy practices or your provider’s applicable notice of privacy practices will apply. Data governed under HIPAA may be deidentified through either or both the Safe Harbor and Expert Determination methods. While that data is then deidentified, Medtronic does not, and will not permit others to, reidentify deidentified PHI except as required by applicable law or as directly consented to by the subject of that PHI.
  • Sales/sharing of personal data. Medtronic does not sell your personal data for money or other consideration, nor share it for direct or behavioral marketing purposes, with unrelated third parties, except as described in the cookies and similar technologies section.
  • Right to opt-out or object. As noted above, you may have the right to opt-out of some processing, such as sharing data with third parties for their own or for cross-contextual marketing, sales of personal data, making certain decisions or profiles about you by automated or artificial means, or certain kinds of automated/prerecorded telephonic messages.
  • Right to restrict or limit. In some jurisdictions you may have the right to restrict some processing if the data is sensitive and used for purposes in addition to delivering requested goods/services.

 

This privacy notice may be updated periodically to reflect changes in our personal data practices. We will indicate at the top of the privacy notice when it was most recently updated.

If you would like to exercise your privacy rights or if you have any questions about this privacy notice you may contact us as follows:

General inquiries (all geographies)
rs.globaldataprivacyoffice@medtronic.com

Asia-Pacific inquiries
If you have a complaint about how we have handled your personal data or have questions about this privacy statement, please email us at rs.globaldataprivacyoffice@medtronic.com.

U.S. inquiries
By email via the general inquiries email address rs.globaldataprivacyoffice@medtronic.com or by phone: +1 866-639-6907.
Send mail to our general-purpose corporate mailing address at: Attention: Data & Privacy — United States, Medtronic, Inc., 710 Medtronic Parkway, Fridley, Minnesota 55432-5604, United States

EMEA inquiries
Medtronic International Trading Sárl, Route du Molliau 31, 1131 Tolochenaz, Switzerland
Tel: +41 21 802 70 00
rs.privacyeurope@medtronic.com
Data protection officer may be contacted at rs.europeanDPO@medtronic.com. 

Canada inquiries
Medtronic Canada ULC, 99 Hereford, Brampton, LY6 OR3 Ontario, Canada
rs.canadaprivacy@medtronic

China inquiries
6-19th Floor, Block B, Qiantan World Trade Center (Phase I), No. 5, Lane 255, Dongyu Road, Pudong New Area, Shanghai, 200126
上海市浦东新区东育路255弄5号前滩世贸中心(一期)B座6-19楼. 邮编：200126
rs.gcdataprivacyoffice@medtronic.com

LATAM inquiries
 If you have a complaint about how we have handled your personal data or have questions about this privacy statement, please contact us as follows: