MyClinic Privacy Notice

This Privacy Notice explains how we collect and use your personal data, when you – as a hearing care professional (HCP) or professional customer use the following services (‘the Services’):

• MyClinic
• Oticon RemoteCare Administration Portal

WHO WE ARE

Oticon A/S acts as data controller and is responsible for the collection and use of your personal data through the Services as described in this privacy notice. If you have any requests or questions related to our use of your personal data, please contact us by using the contact points below:

Oticon A/S
Re.: Data Privacy
Kongebakken 9
DK-2765 Smørum
E-mail: privacy@demant.com

In this privacy notice, "we", "us" and "our" refer to Oticon A/S.

PERSONAL DATA WE COLLECT

When you use the Services, we collect and use your personal data to provide you with the Services and to manage our relationship with you. The legal basis for our processing of your personal data is our legitimate interest in operating and delivering the Services, cf. GDPR article 6(1)(f).

Below, we describe how we collect and use your personal data in each of the specific Services.

MyClinic

MyClinic is a telehealth care tool providing hearing care professionals with an overview of the hearing aid user’s progress in the adaptation to the hearing aid. The progress is tracked through a questionnaire that the hearing aid user is asked to fill out through the Oticon ON mobile app. MyClinic analyzes the input from the hearing aid user automatically in the cloud and generates notifications for significant events on the hearing aid user’s experience.

When you use MyClinic, we collect and register:

• Your name and clinic name
• Your Oticon RemoteCare account number
• Data about how you use the MyClinic tool and the actions you take on the website

We use the above data to:

• Create and manage your access to MyClinic
• Establish a link between your clinic and the hearing aid user, including sending an SMS to the hearing aid user
• Show you notifications, so you will be able to support the user during the hearing aid adaptation period
• Analyze usage behavior and risk of the user returning the hearing instruments
• Feature troubleshooting
• Develop improvements of the solution and the user experience

Oticon RemoteCare Administration Portal

The Oticon RemoteCare Administration Portal is a secure website, where hearing care professionals can manage their employees’ access to Oticon RemoteCare or to MyClinic. It is a standard user administration tool, which allows administrators to add, delete, and modify existing users.

The Oticon RemoteCare Administration Portal is used by HCP Administrators to:

• Invite their HCP colleagues who need to do remote fitting sessions with hearing aid users through Oticon RemoteCare, or to follow up on the satisfaction of new hearing aid users through MyClinic
• Delete HCP user access
• Reset HCP admin password

We collect your name and email address to create your Oticon RemoteCare Administration Portal account and to send invitations for the Oticon RemoteCare Administration Portal.

HOW WE SHARE YOUR PERSONAL DATA

As part of our hearing health care services and operations, it may be necessary for us to share your personal data with other entities in the Demant Group. To see which companies are part of the Demant Group, please refer to the organizational chart in our latest annual report on www.demant.com.

We may also share your personal data with our suppliers and service providers for tasks such as:

• Assisting us with the supply or design of our products or with our business administration
• Operating our call centers
• Providing us with electronic or physical storage services or systems
• Data analysis
• Delivery of products (e.g. logistics operators)

We will only share your personal data if it is necessary in order for our suppliers and service providers to deliver their services to us. Our suppliers are not authorized to keep or use your personal data for any other purposes, and they will always be under a strict obligation to keep your personal data safe and confidential.

We may also disclose your personal data, if the disclosure is warranted by law, court order or judicial act.

TRANSFER OF DATA TO THIRD COUNTRIES

We may share personal data with affiliated companies in the Demant Group located outside the EU/EEA and non-affiliated companies, such as service providers or business partners, located outside the EU/EEA, if this is considered necessary in relation to a particular data processing activity.

If your personal data are transferred outside the EU/EEA, we will implement appropriate technical and organizational measures to ensure that processing will meet the requirements of the relevant data protection laws, including ensuring the protection of the rights of the data subject. Where necessary, we have entered into the EU Commission’s Standard Contractual Clauses with the recipient of the personal data. The EU Commission finds these clauses to provide adequate guarantees for the protection of privacy, basic rights and liberties, as well as for exercising the associated rights.

HOW LONG DO WE KEEP YOUR DATA

We will only process and keep your personal data as long as it is legitimate and necessary for purposes related to our supply of the Services or to comply with any regulatory or legal requirements. After that, we will either delete your data or de-identify it so it is no longer associated with you.

YOUR PRIVACY RIGHTS

As a result of our processing of your personal data, you have certain rights under the GDPR. They are:

• The right to access your personal data
• The right to have us rectify (correct) your personal data
• The right to have us delete your personal data
• The right to restrict our processing of your personal data
• The right to data portability
• The right to object to our processing

These rights may be subject to conditions and/or exemptions, e.g. to ensure other people’s privacy, trade secrets, intellectual property rights or to comply with a legal obligation.

If you would like to exercise one or more of your rights, please contact us by using the contact points outlined at the top of the privacy notice.

RIGHT TO LODGE A COMPLAINT

If you have a concern related to how we use your personal data, please contact us by using the contact points outlined at the top of this notice. We will reply to your queries as soon as possible and if necessary, we will take steps to ensure that our practices are consistent with our obligations.

If you are still not satisfied with the way we use your data, you have the right to file a complaint with the relevant national data protection authority. In Denmark, the relevant data protection authority is Datatilsynet. You can contact Datatilsynet at tel: +45 3319 3200 or e-mail: dt@datatilsynet.dk. Alternatively, you may contact the relevant data protection authority in your country of residence or work.