Informaon pursuant to arcles 13 and 14 of Regulaon (EU) 2016/679 In

This disclosure, pursuant to arcles 13 and 14 of Regulaon (EU) 2016/679 (hereinaer referred to, for the sake of brevity, simply as "GDPR"), the informaon

relang to the processing of personal data connected to the use of the BRM Follow-up mobile applicaon.

The data controller

data controller is BRM Extremies Srl (VAT number 08683610961), based in Civate (LC), in via Papa Giovanni XXIII n. 9 – 23862, tel.: 0341 1693087, ordinary e-mail:

info@brm-extremies.com, PEC: brlextremiesrl@legalmail.it, in the person of its pro tempore legal representave.

The interested pares and the data processed

The interested pares are the natural persons whose personal data the Data Controller processes through the BRM Follow- up applicaon and its funcons, who

are idenﬁed or idenﬁable:

a. the doctors who register on the applicaon (hereinaer referred to, for brevity, simply as the "Doctors" or, in the singular, as the doctor");

b. paents, whose data are entered by the Doctors for the management of the follow-up (hereinaer indicated, for the sake of brevity, simply as the “Paents” or,

in the singular, as the “Paent”).

The Doctors' data processed through the BRM Follow-up applicaon are common personal data (name and surname, any other personal data, e-mail address,

password, type of prosthesis with which the individual doctor works, etc.).

Paent data processed through the BRM Follow-up applicaon are common personal data (name and surname, date of birth, e-mail address and - oponally -

telephone number) and parcular data (sex, age and weight of the paent , date of the operaon, implanted medical device, any images of the operaon, x-rays

and other diagnosc tests, video recordings of the paent limited to the area aﬀected by the operaon or through measures aimed at prevenng the recovery of

the face or other characterisc elements); the e-mail address of the Paent is collected and processed to send the conﬁrmaon of the manifestaon of consent to

the registraon of the same and to allow him to possibly exercise his rights.

The Owner recommends that the Doctor take the images and ﬁlm the Paent, liming the area to be ﬁlmed to a minimum and absolutely avoiding ﬁlming the face

and other characterisc bodily elements (taoos, other idenfying elements).

At the me of saving the Paent's data in the mobile applicaon, the Doctor declares that he is entled to store and in any case process the Paent's data by means

of this tool.

Purpose of the treatment

The personal data of the interested pares are processed for the purposes listed in this paragraph:

1. Registraon of the Doctor's account on the BRM Follow-up mobile applicaon;

2. Paent Registraon;

3. Inseron of any images of the operaon, x-rays and other diagnosc invesgaons, video recordings of the Paent limited to the area aﬀected by the operaon

or by means of a device aimed at prevenng the recovery of the face or other characterisc elements;

4. Making paent follow-up data available for subsequent Doctor visits as well as for sharing with other Doctors who follow the paent;

5. Making follow-up data available to the paent;

6. Sending newsleers to the Doctor regarding the acvity of the Owner.

Processing methods

The processing of personal data takes place using IT and telemac tools with logic strictly related to the purposes and, in any case, in such a way as to guarantee

the security and conﬁdenality of the data in compliance with the regulaons in force. The treatment is carried out with electronic processing methods, through

management and storage systems with cung-edge hardware and soware: in order to provide high quality services to the interested pares, the Data Controller

can use services provided by specialized companies which are promptly made aware of his responsibilies by signing a speciﬁc contract for the appointment of

data controller pursuant to art. 28 GDPR.

The data is stored on servers located at the Data Controller's registered oﬃce, as well as possibly at the headquarters of external managers and their suppliers,

within the European Union. The Data Controller will not transfer User data outside the European Union, unless the condions set out in Arcles exist. 45 et seq.

GDPR.

Legal basis of the processing

For the purpose indicated above in n. 1 the legal basis of the treatment is constuted by the art. 6 par. 1, lit. b) GDPR (i.e. the execuon of

a contract - as well as the provision of related services - or the execuon of pre-contractual measures adopted at the request of the Doctor). For the purposes

indicated above in numbers 2, 3 and 4, the legal basis for the processing of the paent's common personal data is art. 6 par. 1, lit. a) GDPR (i.e. the free, speciﬁc,

informed and unequivocal consent of the Paent who - informed by the Doctor regarding the characteriscs of the processing of his data - expresses his consent

to the same, to then conﬁrm it by contacng the e-mail by the mobile applicaon); for the same purposes, the legal basis for the processing of the paent's

parcular data is art. 9 par. 2, lit. a) GDPR (i.e. the free, speciﬁc, informed and unequivocal consent of the Paent who - informed by the Doctor regarding the

characteriscs of the processing of his data - expresses his consent to the same, to then conﬁrm it by contacng the e-mail by the mobile applicaon).

For the purpose indicated above in n. 5 the legal basis the legal basis of the processing is constuted for common personal data by art. 6 par. 1 lit. a) GDPR and for

parcular data from the art. 9 par. 2, lit. a) GDPR (in both cases it is the free, speciﬁc, informed and unequivocal consent of the Paent, who expresses it by

consulng the data concerning him or by downloading them).

For the purpose indicated above in n. 6 the legal basis of the treatment is constuted by the art. 6 par. 1, lit. a) GDPR (i.e. the free, speciﬁc, informed and unequivocal

consent of the Doctor).

Compulsory or oponal nature of the provision of data and consequences of a possible refusal to answer

The provision of data is oponal for the purposes referred to in numbers 1., 2., 3., 4. and 5.; failing that, the services rendered by the BRM Follow-up applicaon

cannot be provided to the Doctor and the Paent and, for the purposes referred to in art. 6, the newsleer about the acvity of the Owner cannot be sent to the

Doctor.

Communicaon and disseminaon

The personal data of Doctors and Paents are processed by the Data Controller, by any Data Processors and by the Persons authorized to process them. Paent

data may be communicated, subject to the consent expressed by the same, to other Doctors who treat them, by extending access to the pernent ﬁles to them.

Storage mes

In the event of a request for cancellaon of the account by the Doctor, it is removed.

In the event of withdrawal of consent by the paent, or inacvity for more than 24 months aer the conclusion of the follow-up on the relevant ﬁle, his data can

only be stored aer radical and irreversible anonymizaon of the same, for scienﬁc and stascal purposes.

In case of revocaon of the Doctor's consent to the sending of the newsleer, his e-mail address will be removed from the relevant mailing list.

Existence of an automated decision-making process

There is no automated decision-making process.

Rights of the interested

party As an interested party, the subjects connected to the client companies as well as the company representaves of these companies can exercise the following

rights: access to data (art. 15 GDPR); recﬁcaon (art. 16 GDPR), cancellaon (art. 17 GDPR), limitaon of data processing (art. 18 GDPR); data portability (art 20

GDPR) where applicable; opposion to the treatment (art. 21 GDPR). Interested pares can exercise their rights at any me by contacng the Data Controller at

the addresses indicated above and, if they believe that their rights have been violated, they can appeal to the Guarantor for the protecon of personal data.