Data Act Notice

Type of data

Device operational data (power on/off events, self-test results, battery status), usage data (shock delivery events, CPR guidance provided, electrode pad status), and incident data (date/time stamps, event logs).

Format

Structured data files in standard formats.

Estimated volume

The Equipment generates only small quantities of data per use. Likely to be no more than 1MB per incident/use.

Continuous/Real-Time

The Equipment generates data during active use and operational events. Continuous monitoring data is generated when the device is powered on and performing self-checks. Real-time event data is generated during deployment and use on a patient.

Storage and retention

Data stored locally on the device's internal memory is retained until storage capacity is reached, after which older data may be overwritten.

Access

Users can access the product data by emailing a request to digitalinquiries@stryker.com with "Data Act - Data Access Request" in the subject line. Data is erased automatically in accordance with our retention policies.

Nature of data

In addition to the product data listed above, we collect software update logs, remote diagnostic results, technical support interactions, warranty and service records, and customer communication history.

Volume and frequency

No more than 1MB per incident.

User access

Users can access their data or request their data is shared with a nominated third-party by emailing a request to digitalinquiries@stryker.com with "Data Act - Data Access Request" in the subject line.

Storage and retention

Data stored on the Stryker-Hosted Software is retained for at least 60 days.

Data usage

Stryker will use the data in accordance with Stryker’s Software and Hosting Terms & Conditions and may share the data with third parties for these purposes.

Data holder

Stryker is the data holder under the Data Act, and our details are set out in Stryker’s Software and Hosting Terms & Conditions. You can contact us at digitalinquiries@stryker.com.

User rights

Stryker endeavors to support our customers and users to get the best out of our products. We have provided information here to help our EU users access information under the EU Data Act. If you believe that your rights under the EU Data Act have been infringed, you have the right to lodge a complaint with the relevant competent authority in the EU Member State of your habitual residence, place of work, or establishment. This right is without prejudice to any other administrative or judicial remedies available to you. Upon request, we will provide information to help you contact the appropriate authority.

Trade secrets

We endeavor to provide you with transparent information regarding the trade secrets contained in the relevant data.

These may relate to device algorithms, proprietary diagnostic methods, and manufacturing processes. At the time of your request, we will provide further details on whether the content of your request will reveal trade secrets.

Contract information

The term and termination arrangements of our agreement are set out in Stryker’s Software and Hosting Terms & Conditions.

Exportable Data and Digital Assets

The Exportable Data and Digital Assets primarily include the data generated by the use of the Equipment and stored on the cloud-based software for access by the Customer. Stryker will work with the Customer to port these data and assets.

Trade Secrets

Certain data may be exempt from the Exportable Data because its disclosure would risk the release of our trade secrets. Stryker will confirm the existence of any trade secrets data upon request from the Customer.

Switching methods

Customers can export data from our service in standard formats and manually import to an alternative provider.

Porting process

Customers should submit a request to digitalinquiries@stryker.com with "Data Act - Switching Request" in the subject line at least 60 days before the intended start of the switching period. This request initiates the porting process, and Stryker will help Customers port their data and assets upon receiving such requests.

Available data formats

Standard structured machine-readable formats are supported. For inquiries regarding the availability of a specific format, please contact us at digitalinquiries@stryker.com.

All formats comply with relevant industry standards for medical devices/ISO standards.

Restrictions and technical limitations

There are certain restrictions in exporting data:

• Trade secret data: Certain proprietary algorithms and analytical outputs may be subject to confidentiality restriction.
• Regulatory limitations: Some data may be subject to retention requirements under medical device regulations and cannot be deleted upon termination.

In addition to the restrictions, there are a number of complexities in the switching process which may affect the risks of switching form the Stryker services.

• Historical data: Protected Health Information (PHI) older than 60 days is routinely deleted and cannot be exported.
• Business continuity with the Equipment: Stryker cannot guarantee the service levels for ongoing use of the Equipment if you choose to switch to another provider.
• Format capability: Not all receiving systems support all available formats; users should verify compatibility with their chosen alternative provider.
• Real-time data: Active/real-time monitoring data can only be switched once the device is reconfigured to connect to the new service provider.
• Processing time: Complex data transformations may require a substantial time period to complete.

ICT Infrastructure

Stryker continues to seek transparency of data residency from its infrastructure providers and can make further enquiries upon your request.

To provide a higher level of availability of service, Stryker uses solutions which store data in regional data centers that meet regulatory requirements.

Technical, organizational and contractual measures to prevent governmental access

Stryker protects non-personal data in accordance with its security policies. For example:

Technical Measures

• Encryption: End-to-end encryption of data at rest and in transit using industry-standard protocols (AES-256 or equivalent).
• Access controls: Multi-factor authentication and role-based access controls limiting.
• Data segregation: Logical separation of data.
• Audit logging: Comprehensive logging of all data access requests.
• Network restrictions: Geo-blocking and network segmentation.
• Secure deletion capabilities: Technical ability to rapidly delete or render data inaccessible if required.

Organisational Measures

• Staff training: Regular training for personnel on data legal obligations.
• Incident response procedures: Documented procedures for responding to governmental access requests, including immediate legal review.
• Limited personnel access: Restriction of data access to employees with a 'need to know'.
• Escalation procedures: Clear escalation paths to legal and senior management for any governmental access demands.

Contractual Measures

• Contractual prohibitions: Contracts with subcontractors and service providers limiting disclosure of data.

Stryker complies with lawful requests for data as required by applicable laws.

Standard service fees

If you elect to switch and in doing so terminate Stryker’s Software and Hosting Terms & Conditions early:

• No fees paid prior to termination will be refunded.
• Instalments of fees which fall due between the switching notice and the termination of the agreement remain payable.

Early termination penalties

If you elect to switch and in doing so terminate Stryker’s Software and Hosting Terms & Conditions early, we will notify you of any applicable early termination fees. This may include fees with respect to the unexpired portion of the term and any discounts offered to you in return for your commitment to the term.