������Ƶ

The ������Ƶ DPF Entities (defined below) comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. The ������Ƶ DPF Entities have certified to the U.S. Department of Commerce that they adhere to the EU-U.S. Data Privacy Framework ­Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension (UK Extension) to the EU-U.S. DPF. The ������Ƶ DPF Entities have certified to the U.S. Department of Commerce that they adhere to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit . You may find Data Privacy Framework participants here: . ��

As used in this statement, the terms “������Ƶ DPF Entities,” “we,” “us,” and “our” shall mean, collectively, the following U.S.-based entities:

• ������Ƶ Molecular, Inc.
• ������Ƶ Diabetes Care, Inc.
• ������Ƶ Diagnostics Scarborough, Inc.
• ������Ƶ International LLC
• ������Ƶ Laboratories
• ������Ƶ Laboratories, Inc.
• ������Ƶ Laboratories International LLC
• ������Ƶ Point of Care, Inc.
• ������Ƶ Rapid Diagnostics Informatics, Inc.
• ������Ƶ Rapid Dx North America, LLC
• Advanced Neuromodulation Systems, Inc.
• CardioMEMS LLC
• Irvine Biomedical, Inc.
• Lingo US, Inc.
• Pacesetter, Inc.
• St. Jude Medical, Atrial Fibrillation Division, Inc.
• St. Jude Medical, Cardiology Division, Inc.
• St. Jude Medical, LLC
• Standing Stone, LLC

PRIVACY PRINCIPLES

The ������Ƶ DPF Entities adhere to the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF published by the U.S. Department of Commerce (collectively, the “DPF Program”). These privacy principles have been compiled from the EU-U.S. Data Privacy Framework and have been integrated into the ������Ƶ DPF Entities’ data privacy framework. These privacy principles are followed by the ������Ƶ DPF Entities as part of our commitment to using best practices in transferring, processing, and protecting data.

NOTICE

We are committed to the following Data Privacy Framework Principles for all personal data within the scope of the DPF Program. We collect personal data from individuals only as permitted by the DPF Program.

We provide individuals notice regarding the personal data that we collect from them, how we use it, and how to contact us with privacy concerns through this statement and through other agreements or notices provided to the individuals and/or through our direct engagement with the individuals.

For customers, professionals, patients, users and website visitors of the ������Ƶ DPF Entities, more information regarding (1) the types of personal data the applicable ������Ƶ DPF Entities collect; (2) the purposes for which the applicable ������Ƶ DPF Entities collect and use personal data; (3) the types or identities of third parties to which the applicable ������Ƶ DPF Entities disclose personal data and the purposes for which the applicable ������Ƶ DPF Entities do so, is available at the following links:

(��)��MEDICAL DEVICE DATA: ������Ƶ Laboratories and its US divisions, ������Ƶ Diabetes Care, Inc., Advanced Neuromodulation Systems, Inc., St. Jude Medical, LLC, St. Jude Medical, Atrial Fibrillation Division, Inc., St. Jude Medical, Cardiology Division, Inc., Pacesetter, Inc. and CardioMEMS, LLC processes the personal data of patients and customers that use our medical devices related to cardiac rhythm, pulmonary arterial pressure, diabetes management, and neurostimulation at the direction of the hospitals and clinics acting as data controllers located in the European Economic Area, Switzerland, and the United Kingdom. ������Ƶ Laboratories also acts as a controller for the data in relation to these devices for research purposes and for complying with medical device regulatory obligations.��

(i) CARDIOMEMS™ HEART FAILURE MONITORING SYSTEM: For information about data processed for patients and customers enrolled in the CardioMEMS™ Heart Failure Monitoring System, please see: /privacy-policy.html, and /privacy-policy/consumer-health-data.html.��

(ii) LIBRE: For information about data processed for patients and customers using the LibreView Data Management System through LibreView.com, the FreeStyle mobile application, the LibreLinkUp mobile application, and/or use of the ������Ƶ FreeStyle customer care line, please see: .

(iii) MERLIN.NET™ PATIENT CARE NETWORK: For more information related to how information is processed for patients and customers enrolled in the Merlin.Net™ Patient Care Network, please see: .

(iv) MYMERLIN™ MOBILE APP: For information about data processed for patients and customers using the MyMerlin™ mobile application, please see: .

(v) For information about all other data processed for patients and customers that use our medical devices, please see: /privacy-policy.html, and /privacy-policy/consumer-health-data.html.

CLINICAL DATA: ������Ƶ Laboratories and its US divisions, its Cardiac Rhythm Management Division, Pacesetter, Inc. d/b/a St. Jude Medical Cardiac Rhythm Management Division; St. Jude Medical Atrial Fibrillation Division, Inc.; Irvine Biomedical Inc.; St. Jude Medical, Cardiology Division, Inc., Advance Neuromodulation Systems, Inc. d/b/a St. Jude Medical Neuromodulation Division; and St. Jude Medical LLC through its��International Division. process personal data of patients (patients enrolled or participating in clinical studies) from its affiliates, subsidiaries and agents and partners located in the European Economic Area, Switzerland, and the United Kingdom to support clinical research. For more information about data processed to support clinic research please see: /privacy-policy.html, and /privacy-policy/consumer-health-data.html.��

(��)��DIAGNOSTIC DATA: ������Ƶ Laboratories and its US divisions, ������Ƶ Molecular Inc., ������Ƶ Point of Care Inc., ������Ƶ Diagnostics Scarborough, Inc., ������Ƶ Rapid Dx North America, LLC, and ������Ƶ Rapid Diagnostics Informatics, Inc. and Standing Stone, LLC process personal data of patients and customers using our diagnostic products and services and located in the European Economic Area, Switzerland, and the United Kingdom. For information about data processed for patients and customers that use our diagnostic products and services, please see: /privacy-policy.html, and /privacy-policy/consumer-health-data.html.

(��)��USER DATA: ������Ƶ Laboratories and its US divisions and Lingo US, Inc. processes the personal data of users/customers that use our Lingo biosensor and app located in the United Kingdom, or where available. For information about data processed for users/customers using Lingo products and services, such as the Lingo mobile application and the Lingo biosensor, please see: .

��

CHOICE

Consent for personal data to be collected, used, or disclosed in certain ways (such as, opt-in consent for sensitive data) may be required for an individual to obtain or use our services. The ������Ƶ DPF Entities’ collect such consent, if necessary, in documents between the applicable ������Ƶ DPF Entity and the individual. The ������Ƶ DPF Entities provide individuals with clear, conspicuous, and readily available mechanisms to exercise the choices (e.g., opt-ins, opt-outs, etc.) set forth under the DPF Program.��

ACCOUNTABILITY FOR ONWARD TRANSFERS TO THIRD PARTIES

The ������Ƶ DPF Entities are responsible for personal data in our possession or custody, including personal data that we may transfer to third parties for processing, including storage. In connection with the purposes described in the “Notice” Section above, the ������Ƶ DPF Entities may transfer your personal data to other companies within the ������Ƶ group of companies or to third parties such as external service providers. In cases of onward transfers to third parties, the ������Ƶ DPF Entities will limit the personal data shared to the minimum amount necessary and will obtain assurances from third party business partners (agents) that they will safeguard personal data consistent with our policies. Examples of appropriate assurances that may be provided by third party business partners may include: standard contractual clauses as approved by the European Commission, certification under the DPF Program or being subject to a European Commission adequacy finding. Where the ������Ƶ DPF Entities have knowledge that a third-party business partner is using or disclosing personal data in a manner contrary to our company policy, the ������Ƶ DPF Entities will take reasonable steps to prevent or stop the use or disclosure. The ������Ƶ DPF Entities remain responsible and liable under the DPF Program if a third-party business partner uses or discloses personal data in a manner inconsistent with the Program, unless the ������Ƶ DPF Entities proves that we are not responsible for the event giving rise to the damage.

SECURITY

The ������Ƶ DPF Entities take reasonable and appropriate measures to protect personal data from loss, misuse and unauthorized access, disclosure, alteration and destructions, taking into account the risks involved in the processing and nature of the personal data.

DATA INTEGRITY

The ������Ƶ DPF Entities will use personal data only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the relevant individual. The ������Ƶ DPF Entities will take reasonable steps to ensure that personal data is accurate, complete, current, and relevant to its intended use.

ACCESS

Upon request and subject to certain exceptions, the ������Ƶ DPF Entities will provide individuals reasonable access to personal data that it holds about them. In addition, the ������Ƶ DPF Entities will take reasonable steps to permit individuals to correct, amend, or delete information that is demonstrated to be inaccurate or incomplete. If an individual wishes to access their personal data subject to DPF Program, they use the ������Ƶ EU DPO site at /eu-dpo.html or use the contact information included in the applicable ������Ƶ DPF Entities’ respective privacy policy. To protect the individual’s privacy, we may take steps to verify the requestors’ identity and/or authority prior to acting on a request regarding personal data.

ENFORCEMENT AND DISPUTE RESOLUTION

The ������Ƶ DPF Entities are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (“FTC”) regarding personal data received or transferred pursuant to the DPF Program.

In compliance with the DPF Program principles, the ������Ƶ DPF Entities commit to resolving complaints about our collection or use of your personal data. We will endeavor to resolve your issue and respond no later than 45 days after receipt. EU, Swiss or UK individuals with inquiries or complaints regarding our Data Protection Framework Statement should first contact the ������Ƶ DPF Entities by sending the inquiry or complaint to:

������Ƶ EU DPO site at /eu-dpo.html or use the contact information included in the applicable ������Ƶ DPF Entities’ respective privacy policies referenced above.

Any privacy or data use concerns that cannot be resolved internally will be referred to JAMS, a third-party alternative dispute provider located in the United States. If you do not receive timely acknowledgement of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit the JAMS complaint link here: . The services of JAMS are provided at no cost to you.

If JAMS or the EU DPAs do not resolve the matter, you may be able to invoke binding arbitration when other dispute resolution procedures have been exhausted. For more information, please visit: . ��

If you have any concerns regarding the use of your data by US intelligence agencies, you have the right to submit a complaint related to data processed after. For more information, please visit: .

Any employee that an ������Ƶ DPF Entity determines is in violation of this policy will be subject to disciplinary action up to and including termination of employment.

LIMITATION ON SCOPE OF PRINCIPLES

Adherence by the ������Ƶ DPF Entities to this policy may be limited to the extent required to meet legal, governmental, or national security obligations, including requirements to cooperate with law enforcement.

CHANGES TO THIS POLICY

This policy may be amended from time to time, consistent with the requirements of applicable laws and regulations. The revisions will take effect on the date of publication of the amended policy, as stated. The ������Ƶ DPF Entities will not amend this statement in a manner inconsistent with the EU-U.S. DPF Program.

You can download a copy of our��Data Privacy Framework Statement.

CONTACT INFORMATION

Complaints, questions, comments, or concerns on this policy, data collection, or data processing practices should be sent to:

Chief Privacy Officer
Address: ������Ƶ
100 ������Ƶ Park Road, Building AP6A
������Ƶ Park,��IL��60064

USA

Website:�� /eu-dpo.html

Email: privacy@abbott.com
Phone:��+1 (224) 668 9400