1

Privacy notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

on the processing of personal data in connection with the BRM Follow-up application

This notice sets out, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), the information on the

processing of personal data connected with the use of the BRM Follow-up mobile application (hereinafter, the

“App”). The App is a digital tool reserved for physicians (“Physician” or “Physicians”), intended to support the

documentation and management of the clinical follow-up of patients who have received implants of medical

controller of the personal data necessary for the Patient’s diagnosis, healthcare, treatment, management of

clinical records and follow-up. The identity and contact details of the controller providing the healthcare service

are communicated to the Patient by the Physician and/or the healthcare facility in the privacy notice relating to

the care relationship. The Physician is responsible for: using the App exclusively for treatment and follow-up

purposes; not entering any direct identifiers of the patient into the App, except for the e-mail address within the

limits set out in this notice; using identification codes that do not allow BRM Extremities S.r.l. to trace the

identity of the patient; entering only data that are relevant, adequate and necessary, and verifying the

correctness of the code used.

BRM Extremities S.r.l.

BRM Extremities S.r.l., VAT No. 08683610961, with registered office in Milan (20145 – MI), Via Lorenzo

assessments relating to product portfolio management; the data necessary for managing the security of the App

and systems.

For the aforementioned statistical purposes, BRM does not process the Patient’s name, tax code, contact

details, e-mail address or other direct identifiers, and does not hold the key that allows the identification code

used in the App to be linked to the Patient’s identity.

The e-mail address collected for sending the privacy notice is stored in an environment logically separate from

the dataset used for statistical processing and is not accessible to the persons carrying out such processing.

2. Data subjects and categories of data

Physicians

BRM processes the personal data of the Physicians who use the App, including:

individual Physician works);

• profile picture, if the Physician chooses to upload one.

Patients

For treatment purposes, the Physician may enter into the App the data necessary and relevant to the clinical

follow-up, such as:

• data concerning health and the care pathway: diagnosis and relevant clinical information, data relating

to the surgery, date of surgery, implanted device and related identifiers, follow-up outcomes, weight

and other relevant clinical parameters;

2

• images of the area affected by the surgery and other diagnostic tests strictly relevant to the follow-up,

where entered by the Physician (the Physician is advised to take images and recordings of the Patient

keeping the area captured to a minimum and absolutely avoiding capturing the face and any other

privacy notice.

The Physician may not enter any identifying data of the Patient into the App, except for the e-mail address for

sending the privacy notice, which, once entered, will no longer be accessible to the Physician, but will be stored

in the backend and accessible only to the authorised system administrator and within the limits strictly

necessary for the technical management of the service and for the fulfilment of the information obligation.

3. Purposes, roles and legal bases

Processing by the Physician or the healthcare facility: treatment and follow-up

The Physician, or the healthcare facility on whose behalf the Physician works, processes the Patient’s data for:

• diagnosis, healthcare, treatment and clinical follow-up;

• documentation and management of the care pathway;

professionals subject to professional secrecy. The legal basis under Article 6(1)(b) or (e) GDPR is identified by

the Physician and/or the healthcare facility in relation to the care context and the applicable rules.

The Patient’s consent is not required for processing strictly necessary for treatment. The Physician and/or the

healthcare facility remain obliged to provide the Patient with their own privacy notice on the processing of data

within their care relationship.

BRM: management of the physician account and operation of the App

BRM processes the Physicians’ data in order to:

• evaluate access requests, create and manage the account, authenticate the user and administer

access authorisations;

• make available, maintain, update and protect the App;

• provide technical assistance, handle support requests and prevent unauthorised use, fraud, security

incidents or breaches of the terms of use;

BRM may send Physicians communications strictly necessary relating to the App, security, service updates,

devices and regulatory requirements. Such communications are sent, where necessary for the contractual

relationship or for security, without requiring consent. For push notifications, if enabled by the Physician in the

App settings, the legal basis for the processing is Article 6(1)(b) GDPR.

BRM: Follow-up, internal device statistics and Patient e-mail address

BRM uses the data available in the App, associated exclusively with identification codes and without direct

identifiers of the Patient, in order to:

• produce internal statistics on implanted devices in aggregate form;

• understand which devices are most widely used;

• analyse the distribution and use of the devices on the market;

3

• analyse the distribution and use of the devices in relation to sex and to age groups derived from the year

of birth;

• understand, on an aggregate basis, the spread of BRM devices across different demographic segments;

BRM does not use the App data for research and development activities.

The patient’s e-mail address is processed exclusively to allow the sending of the privacy notice relating to the

use of the App and the related processing. For this purpose the legal basis is Article 6(1)(c) GDPR, where sending

the notice is necessary to comply with the information obligations laid down by the GDPR, and/or Article 6(1)(f)

GDPR, for the legitimate interest in documenting and giving effect to the information provided to the data

subject.

Provision of the Physicians’ data necessary to create and use the account is required in order to access and use

the App. Failure to provide such data prevents BRM from enabling the account or providing the related service.

Provision of the Patient’s data strictly necessary for treatment and follow-up in the App is left to the Physician’s

clinical judgement and to the rules applicable to the care relationship. If the necessary data are not entered,

some features of the App may not be available.

Activation of push notifications is at the Physician’s discretion. If the setting is not enabled, push notifications

will not be sent.

• consultants, notified bodies, competent authorities, distributors, importers and other parties involved

in the supply chain or in the vigilance of devices, where disclosure is necessary for regulatory

obligations, quality, safety or the protection of rights;

• other parties acting as controllers, where required by law or necessary for the establishment, exercise

or defence of legal claims, whether in court or out of court.

In particular:

• data entered by the Physician, the Physician’s account data and the administrative data connected with

the use of the App are retained for the duration of the relationship, unless further retention is necessary

for legal obligations, handling of disputes and/or protection of rights;

• pseudonymised data used for internal statistical processing, including sex and year of birth, are

retained for the time strictly necessary to achieve the purposes set out above and, in any case, no

4

The retention periods for other healthcare records for treatment purposes are determined by the Physician or

Upon expiry of the applicable periods, the data are deleted or, where technically and legally possible,

transformed into aggregate data that cannot be linked to individual Patients.

Personal data are processed by means of IT and telematic tools, using logic strictly related to the purposes and,

in any case, in such a way as to guarantee the security and confidentiality of the data in accordance with

of-the-art hardware and software. In order to provide high-quality services to data subjects, the Controller may

make use of services provided by specialised companies, which are duly informed of their responsibilities

through the signing of a specific data processing agreement appointing them as processors pursuant to Article

28 GDPR.

For Patient data, BRM adopts pseudonymisation measures and logical separation of direct identifiers from the

data used for statistical analyses. Access to the data is restricted to authorised persons only on a need-to-know

basis, according to differentiated and logged authorisation profiles. The e-mail address used to send the privacy

notice is segregated from the dataset used for statistical processing. Statistical reports are prepared in

aggregate form and with measures suitable to prevent the disclosure or inference of information relating to

individual Patients.

The data are stored on servers located within the European Union. To send push notifications BRM uses

LLC takes place on the basis of the European Commission’s adequacy decision for the EU–U.S. Data Privacy

The data are not subject to decision-making based solely on automated processing, including profiling, which

With respect to the relevant controller, the data subject has the right, within the limits and under the conditions

• to obtain access to the personal data (Article 15 GDPR), to request the rectification (Article 16 GDPR) or