Privacy Statement on Bittium Medical Device Product Development Operations

2. Contact person

Karoliina Malmi

[email protected]

+358 40 344 2000

3. Name of the register

Bittium Medical Device Product Development Operations Register

4. The purpose of processing personal data

Bittium processes personal data only for the purposes mentioned in this Privacy Statement. Personal data is processed on the basis of a consent of the data subject. Bittium processes the personal data to improve and develop its medical products and services for its customers.

Bittium aggregates volumes of measuring data to generate statistical models, reports, incident investigations and analyses about service performance. In addition, Bittium may use measuring data, such as EKG, to test the functioning of our services and products.

Bittium de-identifies the measuring data to the extent possible, for example, by pseudonymizing any personal data identifiers.

5. Content of the register

The register may contain the types of personal data mentioned below:

Technicians, business users and specialists

• System identifiers: name, email address

Service provider

• Administrations information

• Log files

Patients

• Year of birth

• Gender

• Height

•  Weight

•  Medication

•  Diseases

•  Habits

•  Symptoms

•  Place of remittance

• Recorded measurement data

• Additional optional information given to the cardiologist related to the analysis

• Additional information in the diagnosis given by the specialist

6. Regular sources of the personal data

Personal data is collected from MedicalSuite Platform Service, recording device, such as Faros and/or the customer or service provider of Bittium.

7. Storage time of the personal data

Bittium processes the personal data as long as the legal basis of the collection of personal data exists and the purpose of the collection of personal data is valid or the data subject itself prohibits the processing of personal data related to the data subject.

8. Sharing of the personal data

Bittium may share personal data within the limits of the applicable law within the Bittium group of companies. Personal data may also be transferred under the applicable law when Bittium uses subcontractors in the data processing.

The personal data may also be shared with authorities in statutory cases.

9. Transferring of the personal data outside the EU or EEA

Bittium shall not transfer personal data outside the EU or EEA.

10. The rights of the data subject

The data subject has, to the extent permitted by the law, following rights under the General Data Protection Regulation regarding Bittium’s privacy statement:

Right to access

The data subject shall have the right to obtain from Bittium confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data.

Right to rectification

The data subject shall have the right to obtain from Bittium without undue delay the rectification of inaccurate personal data concerning him or her. Considering the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure

The data subject shall have the right to obtain from Bittium the erasure of personal data concerning him or her without undue delay provided that the legal grounds apply.

Right to object

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on, for example legitimate interests of Bittium or direct marketing.

Right to restriction of processing

The data subject shall have the right to obtain from Bittium restriction of processing provided that the legal grounds apply.

Right to data portability

The data subject shall have the right to receive his/her personal data provided to Bittium, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from Bittium when the processing is based on consent and the processing is carried out by automated means.

Right to lodge a complaint with a supervisory authority

The data subject shall have the right to lodge a complaint with a supervisory authority.

11. Changes to this Privacy Statement

Bittium reserves the right to make changes to this privacy statement.