Privacy

Farapulse, Inc. Privacy Notice

Effective Date: July 23, 2021

OVERVIEW

Farapulse, Inc. (“Farapulse”) is a medical device company based in Menlo Park, California. We collect and process personal data by respecting your privacy as part of our commitment to ethical, compliant and responsible practices. We process personal data collected for conducting our day-to-day business, including in clinical studies.

This Privacy Notice provides you information on what we gather and do with the data you provide when you interact with us in a business or clinical context.

EU’s General Data Protection Regulation, EU 201/679 (GDPR), (EU 2016/679) was enacted in 2018 to protect the privacy and security of personal data transferred out of the EU. This Privacy Notice has been written in compliance with that regulation and applies to personal data collected by Farapulse in the course of our business activities. This includes information from our business partners, suppliers, their personnel and other health care professionals, or researchers and data subjects that participate in studies or clinical trials that we sponsor.

PERSONAL DATA WE COLLECT

Personal data in this Privacy Notice means all information that can directly or indirectly identify you or other individuals. We collect different types of personal data depending on your interactions with Farapulse.

Farapulse collects the following types of personal data:

Personal data from clinical trial or study subjects: when you consent to participate in a clinical trial or study with Farapulse, information collected includes but may not be limited to your gender or biological sex, age/age range, height, weight, medical condition, mental health condition, and other health data.
Personal data from health care professionals, researchers and personnel from Clinical Research Organizations and our vendors: we collect personal data from the different entities and professionals that participate on the studies or clinical trials that we sponsor, including their contact details, signatures, and qualifications or resumes.
Personal data from job applicants: when you apply for a job posting with Farapulse, information collected includes your contact details, resume, employment history and other information that you submit for our consideration.
Personal data from public sources: including from internet sites such as clinicaltrials.gov to ensure we conduct the proper due diligence on professionals, physicians, etc. for purposes of clinical trials.
Other personal data provided directly by you: we collect your contact details if you request information or submit questions to us via email at info@farapulse.com, as well as other personal data that you decide to share with us.

HOW WE USE YOUR PERSONAL DATA

The purposes for which we collect and use your personal data varies depending on your relationship or how you interact with us, such as if you are a clinical trial or study participant or applying for an open job position.

For our everyday business purposes, including recruitment practices;
To provide you with requested information or answer your inquiry;
To provide company informational materials and content, as well as other communications that may include invitations to events or webinars hosted or sponsored by Farapulse;
To identify clinical trial and study subjects, study sites and investigators and conducting clinical trial and research activities;
To train and support hospitals and health care professionals who have contracted with Farapulse to use our medical devices or services;
To ensure quality assurance of devices and adjudicate customer inquiries or complaints;
To comply with laws and regulations, including court orders, or in the course of litigation or defense from legal claims;
To protect the rights, property or safety of Farapulse, or any of our respective business partners, or other third parties in accordance with Data Privacy Laws;
To cooperate with law enforcement authorities in investigating and prosecuting users who violate our rules or engage in behavior that is illegal or harmful to other users, including suspected fraud, or situations involving potential threats to the physical safety of any person; and
To share your personal data with other uses that you specifically authorize us based on your consent.

DISCLOSURE OF PERSONAL DATA

At times, Farapulse engages third party contractors or service providers to help us accomplish our business objectives. There are other circumstances where we are required by law to disclose personal data to third parties such as public bodies or judicial authorities.

Disclosures to Third Parties Assisting in Our Operations. We engage with contractors and service providers for email solutions or cloud hosting services, as well as agents, legal contacts, regulatory bodies, auditing organizations, and other professional and business advisors. Such recipients may be located in the United States (US) or in other jurisdictions such as the European Economic Area (EEA). If the engagement involves the transmission of personal data, we require the service provider to sign a data processing agreement consistent with this notice before any data is disclosed. These companies do not have any independent right to share or use this information.

Disclosures required by law. We may provide information about you, to respond to subpoenas, court orders, search warrants, legal processes or governmental regulations or inquiries, or to establish or exercise our legal rights or defend against legal claims.

Other Parties with Your Consent or at Your Direction. In addition to the disclosures described in this Privacy Notice, we may share information about you with third parties when you consent to or request such sharing.

Business Transfers. We may share your personal data with another business entity in connection with the sale, assignment, merger, or other transfer of all or a portion of Farapulse’s business to such business entity.

PRIVACY SETTINGS/OPT-OUT/CHANGES/ACCESS

You may review and request changes to your personal data that Farapulse has collected, including the removal of your personal data from Farapulse’s databases where it can be verified or validated in order to prevent receipt of future communications, by contacting us at privacy@farapulse.com.

Farapulse does not currently send promotional or marketing emails, and as such we do not have a method to “unsubscribe” individuals from emails sent by Farapulse.

TRANSFERS OF PERSONAL DATA OUTSIDE OF YOUR LOCAL JURISDICTION

If you are located outside the United States and you provide us personal data, then your personal data may be transferred to the United States or to other jurisdictions. However, we provide appropriate safeguards to ensure the same level of protection of your personal data.

We may transfer your personal data to the United States (US) when you interact with us. If you are located in the European Economic Area (EEA) or Switzerland, please note that the US has not obtained adequacy status from the European Union, and therefore, the level of protection of your personal data is not deemed equivalent to the protection provided data in Europe. In the context of our studies or clinical trials, your personal data can be transferred to other jurisdictions with less stringent data privacy laws. However, we provide appropriate safeguards to ensure the same level of protection of your personal data including the use of standard contractual clauses (data transfer agreements), that can be provided to you on request.

DATA PROTECTION RIGHTS

If you reside or otherwise find yourself in the territory of the European Economic Area (EEA) or Switzerland, we are committed to facilitate the exercise of your rights granted by the data protection laws of these territories.

For the purposes of the European Data protection law, any personal data you provide to Farapulse directly or Farapulse is the sponsor of a clinical study, Farapulse is considered the controller of your personal data. You can contact our Data Protection Officer at privacy@farapulse.com or our EU Data Representative at datarequest@datarep.com with any inquiries you may have regarding the processing of your personal data.
‍
Farapulse assigns a legal basis for each data collection and use:

For our everyday business purposes, including our studies and clinical trials, legal communications, and responses to your requests: legitimate interest to conduct our day-to-day business, communicate with you or to respond to your inquiries.
Recruitment practices: legitimate interest of Farapulse to process and review your resume submission or consent when you directly submit your job application and resume to Farapulse.
Corporate or informational communications: legitimate interest of Farapulse to send specific company material, or consent when you directly request this information.
Compliance with laws and regulations: compliance with legal obligation.
Protect the rights, property, and safety of Farapulse or third parties: legitimate interest of Farapulse or other third parties to protect their rights, property, or safety.
Uses that you specifically authorize us: consent.

Farapulse recognizes your Data Privacy Rights:

Right to access, rectification, restriction of processing, erasure, and data portability: we provide you with access to your own personal data. In addition, we will rectify your personal data when it is incorrect or inaccurate, and we will ensure the right to erasure, portability, and to restriction of processing when these rights are not incompatible with other legal obligations or conflict with our legitimate interest to process.
Right to object: though not conducted as of posting of this Privacy Notice, in the event that Farapulse distributes any promotional or marketing emails, we will provide the option for individuals to opt-out anytime and free of charge. The right to object for other processing activities will be balanced to ensure that it is not incompatible with local regulations or our legitimate interests.
Right to withdraw consent at any time. When we use your information based on your consent, you have the right to withdraw such consent at any time.
Farapulse does not engage in automated decision making, including profiling.
Right to lodge a complaint with your supervisory authority. If you are not satisfied with our response or how we process your personal data, you can make a complaint to the data protection authority of your habitual residence.

Data Privacy Rights requests should be submitted as follows:

To exercise your rights, or for any further privacy-related question or concerns you may have, you can contact us by email at privacy@farapulse.com or our EU Data Representative at datarequest@datarep.com. We will attend to your request in a timely manner within 30 days after receiving your request. If for any reason we need to extend this period of time, we will contact you.
You also have the right to lodge a complaint with a supervisory authority: A list of the European authorities is available here and the contact of the Federal Data Protection and Information Commissioner of Switzerland is available here.

DATA PROTECTION OFFICER AND EU DATA REPRESENTATIVE

Farapulse has appointed a Data Protection Officer and an EU Data Representative in the European territory.

For any inquiries with regard to this notice or about our handling of your information, you can contact our Data Protection Officer at privacy@farapulse.com or our EU Data Representative at datarequest@datarep.com.

CHILDREN'S PRIVACY PROTECTION

You should be at least 18 years old to contact Farapulse or provide us with any information.

Farapulse does not knowingly collect personal data directly from minors. Any information we collect from minors is always with the consent of a parent or guardian. If you are under 18 years old, do not provide any information by contacting Farapulse directly.

RETENTION PERIODS

Farapulse retains personal data for the length of time required to fulfill the purpose for which the data was collected.

According to our retention policy, we only keep personal data in our records as long as they are necessary for the purposes they have been processed. After the retention period expires, the personal data is deleted. The retention periods are established considering the purposes defined in this Privacy Notice, all relevant legal requirements, and the context in which we process your personal data.

SECURITY

Farapulse understands that storing our data in a secure manner is essential. We take reasonable precautions to keep all information secure against unauthorized access and use.

Farapulse stores personal data by using reasonable physical, technical, and administrative safeguards to secure data against foreseeable risks, such as unauthorized use, access, disclosure, destruction, or modification.

In addition, our information security team has developed policies, standards, and procedures to support and enforce preventive and detective operational controls to ensure the confidentiality, integrity, and availability of all data collected and managed by Farapulse.

CHANGES TO THIS PRIVACY NOTICE

This Privacy Notice may be revised from time to time as we add new features, as laws change, and as industry privacy and security best practices evolve.

If we update the Privacy Notice, we will let you know about any changes that we consider material by placing a note on the Farapulse website
(http://www.farapulse.com). The most current version of the Privacy Notice will always be available on the website. You can check the "effective date" posted to see when the Privacy Notice was last updated.

CONTACT INFORMATION

If you have any questions about this Privacy Notice or about our handling of your information, please contact Farapulse at privacy@farapulse.com.

Farapulse, Inc. (att: Legal Department)
3715 Haven Ave., Suite 110
Menlo Park, CA 94025
USA