LIBREVIEW
PROFESSIONAL TERMS OF USE

Effective Date: December 2023

These Terms of Use govern your use of the LibreView website located at www.Libreview.com (the 'Site'). Please read these Terms of Use carefully before you start to use our Site, create any patient profile, practices, and/or invite Professional Users to create a LibreView Data Management System account, as these Terms of Use are a legal agreement between you and Abbott Diabetes Care Inc.

Abbott Diabetes Care Inc. of 1420 Harbor Bay Parkway, Alameda, CA 94502, USA ('Abbott' or us or 'our' or 'we') is the developer of Sensors ("Sensors") and Readers ("Readers") for the FreeStyle Libre family of products and the FreeStyle LibreLink mobile app ("FreeStyle App") which may be compatible with the Site and with the LibreView data management system ("LibreView Data Management System").

Abbott maintains the medical authorizations for the LibreView Data Management System as a medical device, provides other application and software support, and manages the marketing authorizations/registrations for the LibreView Data Management System.

The LibreView Data Management System allows Abbott to provide improved treatment guidance for patients utilizing Abbott’s Readers and FreeStyle App. The LibreView Data Management System also allows Professional Users to create patient profiles, to remotely manage patients who have LibreView Data Management System accounts and to share patients’ LibreView Data Management System account information with other professional users within the same LibreView practice.

THE LIBREVIEW DATA MANAGEMENT SYSTEM IS A SECURE, CLOUD-BASED DIABETES MANAGEMENT SYSTEM THAT IS INTENDED FOR USE BY INDIVIDUALS, HEALTHCARE PROFESSIONALS, AND ABBOTT TO AID IN THE REVIEW, ANALYSIS, AND EVALUATION OF HISTORICAL GLUCOSE DATA, GLUCOSE TEST RESULTS, KETONE TEST RESULTS, DATA FROM CONNECTED DEVICES, AND USER-ENTERED INFORMATION INCLUDING INSULIN, FOOD, EXERCISE, AND NOTES TO SUPPORT AN EFFECTIVE DIABETES HEALTH MANAGEMENT PROGRAM.

THE LIBREVIEW DATA MANAGEMENT SYSTEM IS NOT INTENDED FOR THE DIAGNOSIS OF OR SCREENING FOR DIABETES MELLITUS.

USERS SHOULD BE AWARE THAT THE LIBREVIEW DATA MANAGEMENT SYSTEM IS AN INFORMATION MANAGEMENT SERVICE TO ENABLE THE ANALYSIS OF GLUCOSE DATA AND IS NOT INTENDED AS A SUBSTITUTE FOR THE ADVICE THAT YOU PROVIDE TO YOUR PATIENTS AS A HEALTHCARE PROFESSIONAL. INDIVIDUALS SHOULD ALWAYS CONSULT THEIR DOCTOR OR OTHER QUALIFIED HEALTHCARE PROFESSIONAL WITH ANY QUESTIONS THAT THEY MAY HAVE REGARDING A MEDICAL CONDITION, INCLUDING DIABETES MANAGEMENT. NEITHER ABBOTT NOR ANY OF ITS AFFILIATED COMPANIES ARE RESPONSIBLE OR LIABLE FOR ANY DIAGNOSIS, DECISION, OR ASSESSMENT MADE BY A USER OR ANY INJURIES A USER MAY INCUR AS A RESULT OF ANY DECISIONS MADE BASED ON THE CONTENT OF THE PRODUCT.

THE LIBREVIEW DATA MANAGEMENT SYSTEM IS NOT AN ELECTRONIC HEALTH RECORDS SYSTEM AND YOU MUST PRINT AND/OR DOWNLOAD PATIENT INFORMATION THAT YOU DEEM RELEVANT TO YOUR PROVISION OF MEDICAL CARE, TREATMENT OR ADVICE.

YOUR USE OF THE SITE AND THE LIBREVIEW DATA MANAGEMENT SYSTEM CONSTITUTES, AND IS CONDITIONED UPON, YOUR AGREEMENT TO BE BOUND BY THESE TERMS OF USE. IF YOU DO NOT AGREE TO THESE TERMS OF USE, DO NOT ACCESS OR OTHERWISE USE THIS SITE, ANY SERVICES AVAILABLE THROUGH THIS SITE OR ANY INFORMATION CONTAINED ON THIS SITE.

YOUR USE OF THE SITE IS ALSO SUBJECT TO THE LIBREVIEW PROFESSIONAL PRIVACY NOTICE AVAILABLE AT WWW.LIBREVIEW.COM ('PRIVACY NOTICE'), WHICH EXPLAINS HOW WE COLLECT, PROTECT, RETAIN, STORE, AND DISCLOSE YOUR PERSONAL INFORMATION THAT YOU PROVIDE THROUGH YOUR USE OF THE SITE. IT ALSO SETS OUT THE INFORMATION THAT YOU, AS A PROFESSIONAL USER, SHOULD PROVIDE TO YOUR PATIENTS.

You do not need to register as a Professional User and create a LibreView Data Management System account to simply visit and view the Site.

General: The Site is your gateway to create a LibreView Data Management System account in which your patients’ Readers and the FreeStyle App readings may be stored, reviewed and analyzed by you. The LibreView Data Management System is designed to assist you in viewing and managing aspects of your patients’ condition, and to allow Abbott to provide improved treatment guidance for patients utilizing Abbott’s Readers and the FreeStyle App. The LibreView Data Management System allows patients with LibreView Data Management System accounts to share their glucose readings with you, and it also allows you to connect your patients’ Readers and the FreeStyle App to your computer and upload their glucose readings into a patient profile that you have created.

'Professional User' includes only those licensed healthcare providers (‘HCPs’) (and their duly authorized representatives and agents working on behalf of their clinical practice) who have either registered a clinical practice or have registered as a professional user of the LibreView Data Management System..

Abbott only permits one LibreView Data Management System user account per email address. As a Professional User, you may create a clinical practice account and invite other professionals and/or link with other Professional Users with LibreView Data Management System accounts within your practice.

These Terms of Use apply to your use of the Site and to your right to use the LibreView Data Management System. They are effective from when you set up a LibreView Data Management System account as a Professional User until terminated as set forth below.

By using this Site, you represent, acknowledge and agree that you are a Professional User and are duly authorized to use this Site and to create a Professional User account in the LibreView Data Management System and that you also have the appropriate authority to create a practice and link other HCPs or professionals within your practice, and also create patient profiles that will be shared with and utilized by Abbott.
LibreView Data Management System account: Do not reveal your LibreView Data Management System account information to anyone else or disclose to anyone your password details. You are responsible for maintaining the confidentiality and security of your LibreView Data Management System account and for all activities that occur on or through it. You agree to notify Abbott if you become aware of a security incident or breach affecting your LibreView Data Management System account, including where you believe your password may have been compromised, and fully cooperate with us, law enforcement or other applicable regulatory body in addressing the breach. Abbott is not responsible for any lost, stolen or compromised passwords or for any activity on your LibreView Data Management System account from unauthorized users or for any losses arising out of or in connection with the unauthorized use of your LibreView Data Management System account where caused by you. If there is a violation of any of the security requirements by you or other professional users in a practice that you create, that violation may be considered a breach of these Terms of Use and may result in the immediate loss of your LibreView Data Management System account.

You will be responsible for obtaining and maintaining any Internet connections, computing equipment and supplies necessary for you to receive, access and use the LibreView Data Management System. You agree to only use the LibreView Data Management System as expressly permitted herein. Abbott, its affiliates and its suppliers own all rights, titles and interests in and to the LibreView Data Management System and to content through the Site, including logos, graphics, videos, images, software and other materials ('Materials').

Subject to your compliance with these Terms of Use, Abbott hereby grants you a limited, personal, non-exclusive and non-transferable license to use and to display the Materials and to use this Site solely for your professional use. Except for the foregoing license, you have no other rights in the Site or any Materials and you may not modify, edit, copy, reproduce, create derivative works of, reverse engineer, alter, modify, enhance, or in any way exploit any of the Site or Materials in any manner. If you, or any other person under your responsibility, breach any of the provisions in these Terms of Use, the above license will terminate automatically and you must immediately destroy any downloaded or printed Materials.

Where you create a practice, you will supervise, monitor and train your employees, representatives, contractors, agents, and other professional users who you add to a practice that you create, to ensure proper use and security. You will limit access to the services available through the Site at your locations to those duly authorized users. You will be responsible for their use of the services, compliance with these Terms of Use and for the consequences of any breach of security that is caused by such users or that occurs at your locations.
Permitted uses of your LibreView Data Management System account: To use the LibreView Data Management System you must enter some of your personal information, including your username and password, to create your LibreView Data Management System account. You agree to provide accurate and complete information when you register with, and as you use, the LibreView Data Management System, and you agree to keep your LibreView Data Management System account information accurate, current and complete. These Terms of Use allow you to set up a LibreView Data Management System account as a Professional User over your organization’s network, and to set up a practice for use by any professional, employee or other individual authorized by you within your practice. If you have patients who do not have a LibreView Data Management System account which would enable you to view their glucose readings, it also allows you to create a patient profile whereby you may connect your patients’ Readers to your computer, upload their glucose readings into the patient profile that you created for them.

For Professionals in Turkey: You must provide us with your prior explicit consent with respect to transfer of your personal data outside of Turkey before entering into the LibreView Data Management System.

You acknowledge and agree that the Site and the LibreView Data Management System are provided to enhance your care of your patients and to allow Abbott to provide improved treatment guidance for patients utilizing Abbott's Readers and the Freestyle App, and you understand that these are not a substitute for your professional judgement or for your responsibilities to your patients.

AS YOU ARE SETTING UP A LIBREVIEW DATA MANAGEMENT SYSTEM PRACTICE IN YOUR PROFESSIONAL CAPACITY, YOU ACKNOWLEDGE AND AGREE THAT YOU ARE DULY AUTHORIZED TO AGREE AND BIND YOUR PRACTICE TO THESE TERMS OF USE AND HAVE THE NECESSARY CAPACITY AND AUTHORITY TO DO SO.
Prohibited uses of your LibreView Professional system account: We restrict access to the professional parts of our Site to Professional Users. We reserve the right to disable any Professional User ID at any time at our discretion, if, in our opinion, you are not a Profesional User or you have failed to comply with any of the provisions of these Terms of Use. When using our Site, you may not engage in the prohibited uses set out below. Where required by law, Professional Users must not create any patient profiles without having first obtained their patient’s informed, voluntary and explicit consent as may be required by applicable law. You agree that you will NOT use the LibreView Data Management System to:
1. upload, download, email, transmit, store or otherwise make available any data that is unlawful, harmful, tortious, invasive of another's privacy or otherwise objectionable;
2. pretend to be anyone that you are not or misrepresent who you are or otherwise misrepresent your affiliation with any person (including a child or HCP). Abbott reserves the right to reject or block any LibreView Data Management System account or email address that could be deemed to be an impersonation or misrepresentation of your identity, or a misappropriation of another person's name or identity, or that has been used to hijack another user's data;
3. upload, download, email, transmit, store or otherwise make available any data or other information from children (any person under the age of 18 or such other age as local law defines as a child), including but not limited to any of the following: full name or surname, date of birth, email address and their Reader data unless you have obtained the consent of the child's parent/guardian;
4. infringe any person's intellectual property rights (including uploading any content to which you do not have the right to upload);
5. upload, post, email, transmit, store or otherwise make available any material that contains viruses or any other computer code, files or programs designed to harm, interfere or limit the normal operation of the LibreView Data Management System (or any part thereof), or any other computer software or hardware;
6. interfere with or disrupt the Site or LibreView Data Management System (including accessing the LibreView Data Management System through any automated means, such as scripts or web crawlers), or any servers or networks connected to the LibreView Data Management System, or any policies, requirements or regulations of networks connected to the LibreView Data Management System (including any unauthorized access to, use or monitoring of data or traffic thereon);
7. gather, store or upload personal information, including health information, on any persons using an Abbott FreeStyle Libre glucose monitoring system without first having received their prior consent or without otherwise being authorized to do so, for example if you are a caregiver, HCP or parent/guardian;
8. reverse engineer, decompile, disassemble, decode, create derivative works of, gain access to the source code of or modify the LibreView Data Management System except and then solely to the extent permitted under applicable law;
9. engineer or engage in automated downloading of personal information, including health information, from multiple patient LibreView Data Management System accounts;
10. request, receive, or use log-in credentials for a patient’s LibreView Data Management System account;
11. access a patient’s LibreView Data Management System account (using the patient’s log-in credentials) and link the patient’s account to a LibreView Professional User account;
12. gather, download, store or upload personal information, including health information, using an Abbott FreeStyle Libre glucose monitoring system, in order to display the personal information on a third-party mobile app or website not controlled or operated by Abbott and not associated with or created by an HCP or clinical practice;
13. gather, download, store, or upload personal information, including health information, using an Abbott FreeStyle Libre glucose monitoring system, in order to charge the patient to display the information on a third-party mobile app or website not controlled or operated by Abbott;
14. gather, download, store or upload personal information, including health information, on any other users of the LibreView Data Management System or any individual using a FreeStyle Libre sensor in connection with any of the foregoing prohibited activities; and/or
15. disclose information about the Site or LibreView Data Management System features or performance to any third party without our prior consent, except as required for legal or regulatory purposes or to assist in the provision of your medical treatment of a patient.
Patient profiles: After you have created a LibreView Data Management System account, you will be permitted to create patient profiles. When creating a patient profile, you will be required to manually enter some personal information about the patient for example their name and date of birth. Within their patient profile, you will be able to manually upload the patient’s Reader readings to the LibreView Data Management System.

You will only use the Site and the LibreView Data Management System for those patients from whom you have previously obtained their informed, voluntary or, as necessary, explicit consent, or when you deem it necessary to protect their vital interests and will comply with any additional requirements arising under your local data protection, privacy, health or related laws. It is a misuse of the Site and the LibreView Data Management System to enter personal patient information, including health-related information, without either first securing their informed, voluntary or, as necessary, explicit consent, or having determined that which is necessary to protect their vital interests. Abbott will accept no liability in relation to your use of the Site, including where you use the Site to enter personal information relating to your patients, where these conditions have not been satisfied. We will provide reasonable assistance with any request that you make to remove the personal information of any of your patients from the LibreView Data Management System within a reasonable period from receipt of such request; unless prohibited by applicable law, this does not apply to personal information that Abbott has accessed to improve its treatment guidance for patients utilizing Abbott’s Readers and Freestyle App.

AS A PROFESSIONAL USER YOU ARE RESPONSIBLE FOR (I) ANY PATIENT DATA THAT YOU ENTER INTO THE LIBREVIEW DATA MANAGEMENT SYSTEM, (II) THE PERSONAL INFORMATION OF OTHER PROFESSIONALS THAT YOU INVITE TO JOIN A PRACTICE ACCOUNT, AND (III) YOUR USE OF PERSONAL INFORMATION OF ANY INDIVIDUAL WITH A LIBREVIEW DATA MANAGEMENT SYSTEM ACCOUNT. YOU ARE THEREFORE RESPONSIBLE FOR COMPLYING WITH APPLICABLE DATA PROTECTION, HEALTH AND PRIVACY LAWS AND FOR OBTAINING, WHERE REQUIRED, ANY CONSENTS (INCLUDING EXPLICIT CONSENT) NEEDED UNDER APPLICABLE LAW.

Patient data will be processed in accordance with the Privacy Notice

Abbott will treat all personal patient information for which it is a controller, including health information, in accordance with the Privacy Notice. When your patient has created a LibreView Data Management System account and grants you access to that account, or where you set up a LibreView Data Management System account for your patient, Abbott (through the LibreView Data Management System) will be processing your patient’s personal data as a ‘processor’ on your behalf as a healthcare provider where you process your patient information to protect their vital interests as determined in your sole discretion as their healthcare provider.

For Professional Users in the European Economic Area, United Arab Emirates, Switzerland and UK: Before you start to use our Site, create any patient profile, practices and/or invite other Professional Users to create a LibreView Data Management System Account, please review the EU/Swiss/UK Data Processing Agreement located at the end of these Terms of Use.

For Professional Users in Japan: Before you start to use our Site, create any patient profile, practices, and/or invite other Professional Users to create a LibreView Data Management System account to share the data with the J-DREAMS (as defined below) project, please review the Japan Data Processing Agreement for J-DREAMS located at the end of these Terms of Use.

For Professional Users in the US: Additionally, if you are a healthcare provider in the United States and a covered entity as defined by the Health Insurance Portability and Accountability Act, as amended, and its implementing regulations ('HIPAA'), you are creating the patient profile and using the Site and the LibreView Data Management System in compliance with HIPAA either by: i) obtaining a patient authorization to do so; or ii) relying on the exception to the requirement for an authorization under HIPAA for disclosure of Protected Health Information for treatment or healthcare operations purposes. Additionally, that part of Abbott that oversees operation of the Site has implemented safeguards for PHI that HIPAA requires of Covered Entities.
Availability and accuracy of information: The Site and the LibreView Data Management System, or any feature or part thereof, may not be available in all languages or in all countries and Abbott makes no representation that the LibreView Data Management System, or any feature or part thereof, is appropriate or available for use in any particular location. To the extent that you choose to access and use the Site and the LibreView Data Management System, you do so at your own initiative and are responsible for compliance with any applicable laws. Any data uploaded by you or available to view by you are based exclusively on your patients' glucose, ketone and insulin data and other information provided by them. Abbott makes no representations or warranties regarding the accuracy, completeness, reliability or timeliness of any data accessible or viewed by you or of any content generated by the data stored in the LibreView Data Management System. In particular, Abbott makes no representations or warranties that any information based on such data will be in compliance with government regulations requiring disclosure of information.
Deletion of your LibreView Data Management System account: You may delete your LibreView Data Management System account at any time. Your LibreView Data Management System account will be irreversibly deleted upon receipt and processing of your delete request, unless there is any contractual or legal obligation to keep your information in our databases. Please be aware that it may take up to 72 hours to process your request. You acknowledge that deletion of your LibreView Data Management System account may have no effect on the personal information relating to your patients that Abbott has accessed to improve its treatment guidance for patients utilizing Abbott’s Readers. Abbott has no responsibility for retaining/storing or backing up your LibreView Data Management System account on your behalf. You are solely responsible for retaining/maintaining/storing and backing up (electronically and/or with hard copies) any data that you wish to preserve. Abbott is not responsible for unauthorized access to, use of or alteration of the information you retain/maintain/store or backup. If you email, back up or otherwise share any of your personal information or reports with third parties, that information may not be encrypted and Abbott will have no ability to manage the privacy or security of that information. You should take the steps that you determine appropriate to protect the security of such information. In the event that you have registered a practice, you will be required to delete your LibreView Data Management System account upon retirement or upon you leaving that practice and will be responsible for transferring administration rights to another duly authorized Professional User within that practice. Unless otherwise required by law, you agree that your LibreView Data Management System account is non-transferable and that any rights to have a LibreView Data Management System account or any data stored in the LibreView Data Management System will terminate upon your death. Upon receipt of a copy of a death certificate your LibreView Data Management System account may be terminated and all data within deleted. Email DiabetesCarePrivacy@Abbott.com for further information. Abbott reserves the right to delete inactive LibreView Data Management System accounts after six (6) months. We will notify you in advance by sending an email to the email address associated with your LibreView Data Management System account so that you have an opportunity to ensure your account stays current and available for your use.
Links to third-party websites: This Site may be linked to other websites that are not sites controlled or operated by Abbott (collectively, 'Third-Party Sites'). Certain areas of the Site may allow you to interact and/or conduct transactions with such Third-Party Sites and, if applicable, allow you to configure your privacy settings in your Third-Party Site account to permit your activities on this Site to be shared with your contacts in your Third-Party Site account and, in certain situations, you may be transferred to a Third-Party Site through a link but it may appear that you are still on this Site. In any case, you acknowledge and agree that the Third-Party Sites may have different privacy policies, terms and conditions and/or user guides and business practices than Abbott, and you further acknowledge and agree that your use of such Third-Party Sites is governed by the respective Third-Party Site privacy notice and terms and conditions and/or user guides. You hereby agree to comply with any and all terms and conditions, user guides and privacy policies of any Third-Party Sites. Abbott is providing links to the Third-Party Sites to you as a convenience, and Abbott does not verify, make any representations or take responsibility for such Third-Party Sites, including, without limitation, the truthfulness, accuracy, quality or completeness of the content, services, links displayed and/or any other activities conducted on or through such Third-Party Sites. YOU AGREE THAT ABBOTT WILL NOT, UNDER ANY CIRCUMSTANCES, BE RESPONSIBLE OR LIABLE, DIRECTLY OR INDIRECTLY, FOR ANY GOODS, SERVICES, INFORMATION, RESOURCES AND/OR CONTENT AVAILABLE ON OR THROUGH ANY THIRD-PARTY SITES AND/OR THIRD-PARTY DEALINGS OR COMMUNICATIONS, OR FOR ANY HARM RELATED THERETO, OR FOR ANY DAMAGES OR LOSS CAUSED OR ALLEGED TO BE CAUSED BY OR IN CONNECTION WITH YOUR USE OR RELIANCE ON THE CONTENT OR BUSINESS PRACTICES OF ANY THIRD PARTY. Any reference on the Site to any product, service, publication, institution, or organization of any third-party entity or individual does not constitute or imply Abbott's endorsement or recommendation.
No medical advice: THE LIBREVIEW DATA MANAGEMENT SYSTEM IS NOT INTENDED FOR THE DIAGNOSIS OF OR SCREENING FOR DIABETES MELLITUS. YOU ACKNOWLEDGE THAT, WHILE ABBOTT USES INFORMATION THAT IT RECEIVES VIA THE LIBREVIEW DATA MANAGEMENT SYSTEM TO IMPROVE TREATMENT GUIDANCE, ABBOTT IS NOT A PROVIDER OF MEDICAL CARE AND ABBOTT IS NOT RESPONSIBLE FOR NOTIFYING YOU OF ANY CHANGES TO ANY OF YOUR PATIENTS' READINGS OR FOR PROVIDING MEDICAL ADVICE TO PATIENTS. The LibreView Data Management System is for informational purposes and is designed to help Abbott, patients and you better manage and support diabetes through information, analysis and communication, and is not meant to replace the relationship between patients and their medical providers. Health information content available to you through the LibreView Data Management System is based on information provided via medical device-related data transmissions from patients scanning their FreeStyle Libre sensor. Abbott does not recommend or endorse any specific tests, products, procedures or opinions. YOUR DECISION TO TAKE ACTION BASED ON ANY INFORMATION TRANSMITTED TO OR STORED ON THE LIBREVIEW DATA MANAGEMENT SYSTEM OR ON ANY INFORMATION RECEIVED FROM ABBOTT EMPLOYEES, AGENTS OR SUPPLIERS IS SOLELY AT YOUR OWN RISK. ABBOTT, OUR OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AFFILIATES, THIRD-PARTY PROVIDERS AND RELATED COMPANIES ASSUME NO RESPONSIBILITY FOR ERRORS OR OMISSIONS IN THE CONTENT, INCLUDING HEALTH INFORMATION CONTENT, POSTED ON OUR SITE OR FOR THE ACCURACY, TRUTHFULNESS OR CONTENT, INCLUDING HEALTH INFORMATION CONTENT, OF OUR SITE, AND NO RELIANCE BY REGISTERED USERS SHOULD BE PLACED ON THE INFORMATION AVAILABLE IN THE LIBREVIEW DATA MANAGEMENT SYSTEM.
No electronic health records: THE INFORMATION AVAILABLE TO YOU THROUGH THE LIBREVIEW DATA MANAGEMENT SYSTEM IS NOT AN ELECTRONIC MEDICAL RECORD. YOU MUST DOWNLOAD AND/OR PRINT OFF ANY INFORMATION THAT YOU, IN YOUR SOLE DISCRETION, DEEM NECESSARY TO INCLUDE IN YOUR PATIENTS' MEDICAL RECORDS.
Disclaimer of Warranties: YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT YOUR USE OF THE LIBREVIEW DATA MANAGEMENT SYSTEM IS AT YOUR SOLE RISK AND THAT TO THE EXTENT PERMITTED BY LAW, THE ENTIRE RISK AS TO SATISFACTORY QUALITY, PERFORMANCE, ACCURACY AND EFFORT IS WITH YOU. Any content included in the LibreView Data Management System is for the purpose of providing information only. Although Abbott believes the data displayed in the LibreView Data Management System to be accurate as at the time it is transmitted to the LibreView Data Management System, Abbott makes no representation, express or implied, as to the accuracy, completeness or timeliness of the information. In no event will Abbott be liable to you for any losses from mistakes, omissions or delays in transmission of information, or from interruptions in telecommunications connections to the LibreView Data Management System.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ABBOTT, ITS AFFILIATES AND ITS THIRD-PARTY PROVIDERS PROVIDE THE LIBREVIEW DATA MANAGEMENT SYSTEM 'AS IS' AND 'AS AVAILABLE' WITH ALL FAULTS AND DEFECTS AND WITHOUT ANY OTHER WARRANTY OF ANY KIND, AND HEREBY DISCLAIM ALL OTHER WARRANTIES AND CONDITIONS, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF TITLE AND NON-INFRINGEMENT, ANY IMPLIED WARRANTIES, DUTIES OR CONDITIONS OF MERCHANTABILITY, OF FITNESS FOR A PARTICULAR PURPOSE AND QUALITY, AND OF LACK OF VIRUSES. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY ABBOTT OR AN ABBOTT-AUTHORIZED REPRESENTATIVE SHALL CREATE A WARRANTY.

Abbott, its affiliates and its third-party providers do not warrant that the functions contained in the LibreView Data Management System will meet your requirements or that the operation of the LibreView Data Management System will be uninterrupted or error free. To the extent that applicable law requires Abbott to provide warranties, you agree that the scope and duration of such warranties shall be to the minimum extent required to be provided under such applicable law.

In no event does Abbott provide any warranty or representation with respect to any third-party hardware or software, and Abbott disclaims all liability with respect to any failures thereof. Other than as expressly set out in these Terms of Use, Abbott disclaims any and all liability that may derive from actions or claims against Abbott or any of its affiliates, agents or assigns, or other third parties as may become applicable over the course of these Terms of Use.

For users in Russia: This Section 11 shall apply to the extent permissible by the Russian healthcare legislation, regulations, and standards.

For users in Australia: Nothing in Section 11 affects your rights in respect of the consumer guarantees in the Competition and Consumer Act 2010 (Cth). If our services come with guarantees that cannot be excluded under the Australian Consumer Law. For major failures with the service, you are entitled:
1. to cancel your service contract with us; and
2. to a refund for the unused portion, or to compensation for its reduced value (if you made a payment to access the Site).
If a failure with the service does not amount to a major failure, you are entitled to have the failure rectified in a reasonable time. If this is not done you are entitled to cancel the contract for the service and obtain a refund of any unused portion (if you made a payment to access the Site). You are also entitled to be compensated for any other reasonably foreseeable loss or damage from a failure in the service.
Limitation of liability: NOTWITHSTANDING ANY LOSSES THAT YOU MAY INCUR AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE ENTIRE LIABILITY OF ABBOTT, ITS AFFILIATES AND ANY OF ITS THIRD PARTY PROVIDERS UNDER ANY PROVISION OF OR OTHERWISE IN CONNECTION WITH THESE TERMS OF USE AND YOUR EXCLUSIVE REMEDIES FOR ALL OF THE FOREGOING SHALL BE LIMITED TO EITHER THE FIXING, REPAIRING OR OTHERWISE RECTIFYING ANY FAULTS WITHIN THE LIBREVIEW DATA MANAGEMENT SYSTEM, EVEN IF ANY SUCH LOSS WAS FORESEEABLE OR CONTEMPLATED BY THE PARTIES OR, WHERE APPLICABLE, THE GREATER OF THE AMOUNT ACTUALLY PAID BY YOU FOR THE LIBREVIEW DATA MANAGEMENT SYSTEM ACCESS OR USD$10.00. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL ABBOTT, ITS AFFILIATES OR ITS THIRD-PARTY PROVIDERS BE LIABLE TO YOU (OR YOUR PATIENTS, EMPLOYEES, CONTRACTORS, AGENTS OR USERS) FOR MONETARY DAMAGES, INCLUDING ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS, FOR LOSS OF DATA OR OTHER INFORMATION, FOR BUSINESS INTERRUPTION, FOR PERSONAL INJURY, FOR LOSS OF PRIVACY ARISING OUT OF OR IN ANY WAY RELATED TO THE USE OF OR INABILITY TO USE THE LIBREVIEW DATA MANAGEMENT SYSTEM, THIRD-PARTY SOFTWARE AND/OR THIRD-PARTY HARDWARE USED OR THAT MAY BE USED WITH THE LIBREVIEW DATA MANAGEMENT SYSTEM, FOR LOSS FROM ANY VIRUSES OR OTHER TECHNOLOGICALLY HARMFUL MATERIAL THAT MAY INFECT YOUR INFORMATION SYSTEM AND HARDWARE DUE TO YOUR DOWNLOADING ANY MOBILE APP/MATERIAL/WEBSITE LINKED TO THE LIBREVIEW DATA MANAGEMENT SYSTEM, OR OTHERWISE IN CONNECTION WITH ANY PROVISION OF THESE TERMS OF USE) WHETHER IN WARRANTY, CONTRACT OR TORT, INCLUDING NEGLIGENCE OR PRODUCT LIABILITY EVEN IF INFORMED ABOUT THE POSSIBILITY THEREOF, INCLUDING WITHOUT LIMITATION MEDICAL EXPENSES, LEGAL FEES, LOSS OF REVENUE OR PROFITS (WHETHER DIRECT OR INDIRECT), EVEN IF ABBOTT, ITS AFFILIATES OR ANY THIRD-PARTY PROVIDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF THE REMEDY FAILS OF ITS ESSENTIAL PURPOSE. ONLY YOU CAN IMPLEMENT BACK-UP PLANS AND SAFEGUARDS NECESSARY TO APPROPRIATELY ADDRESS YOUR NEEDS IN THE EVENT THAT AN ERROR IN THE LIBREVIEW DATA MANAGEMENT SYSTEM CAUSES COMPUTER PROBLEMS AND RELATED DATA LOSSES. FOR THESE BUSINESS REASONS, YOU UNDERSTAND AND AGREE TO THE LIMITATIONS OF LIABILITY IN THIS SECTION AND ACKNOWLEDGE THAT WITHOUT YOUR AGREEMENT TO THIS PROVISION, ANY APPLICABLE FEE CHARGED, WOULD BE HIGHER.

FOR USERS IN INDONESIA: NOTHING IN THESE TERMS OF USE SHALL EXCLUDE ANY MANDATORY STATUTORY REMEDY AVAILABLE TO A PROFESSIONAL USER IN THE EVENT OF A FAILURE TO COMPLY WITH A DATA PROTECTION REQUIREMENT BY ABBOTT THAT MAY GIVE RISE TO THE ABILITY OF AN AFFECTED PERSONAL DATA SUBJECT TO CLAIM MONETARY COMPENSATION UNDER THE ELECTRONIC AND INFORMATION TECHNOLOGY LAW AND/OR ANY OTHER REGULATIONS RELATING TO PROTECTION OF PERSONAL DATA.

In no event will we be liable to you (your patients, employees, contractors, agents or users) for any losses, costs, damages, charges or expenses resulting from loss, misappropriation, unauthorized access to or modification of data, including personal data, by any third party, or from mistakes, omissions or delays in transmission of information, or from interruptions in telecommunications connections to the service, viruses or failures of performance, interception or from the impact of the LibreView Data Management System on your information or communications systems, including without limitation any record or other communication provided by you, any patient or by us under these Terms of Use.

For Users in Australia: Nothing in this Section 12 affects your rights in respect of the consumer guarantees in the Competition and Consumer Act 2010 (Cth). Regardless of any other provision of these Terms of Use, if the Competition and Consumer Act 2010 (Cth) or any other legislation states that there is a guarantee in respect of the services we supply, and our liability for breach of that guarantee may not be excluded but may be limited, our liability for such breach is limited to, supplying the services again or paying the cost of having the services supplied again.

For users in Belgium: Nothing in these Terms of Use shall exclude our liability for damages caused by our wilful misconduct, fraud, fraudulent misrepresentation or gross negligence in connection with the LibreView Data Management System. Abbott’s liability for personal injury or death caused by our fault is not excluded either.

For users in Singapore, United Arab Emirates and the UK: Nothing in these Terms of Use shall exclude our liability for death or personal injury arising out of our negligence or fraudulent misrepresentation in connection with the LibreView Data Management System.

For users in Switzerland: Nothing in these Terms of Use shall exclude our liability for death or personal injury arising out of our negligence or fraudulent misrepresentation or our liability for damages arising out of our gross negligence or willful misconduct in connection with the LibreView Data Management System.

For users in Vietnam: Nothing in these Terms of Use shall exclude any mandatory statutory liability, including our liability in connection with monetary damages, personal injury or death arising out of our fault or negligence or product defect in connection with Vietnam’s Consumer Protection Law and other applicable law and regulations in Vietnam.

For users in Russia: Nothing in these Terms of Use shall exclude Abbott’s liability for willful misconduct.

For users in Turkey: Nothing in these Terms of Use shall exclude Abbott’s liability for gross negligence or willful misconduct.
Indemnity: You agree to indemnify, defend and hold harmless Abbott, its affiliates and their respective officers, directors, employees, agents, successors, assigns and licensors from and against any and all claims, demands, liabilities, losses, costs and expenses (including solicitors' and experts' fees) made by a third party due to or arising out of, or related to a violation of these Terms of Use or laws, regulations or third party rights including any breach of data protection or privacy obligations, any infringement of their copyright or intellectual property rights of any third party by you or others in your practice or organization or otherwise in connection with your or their use of the LibreView Data Management System whether by negligent act, omission, or willful misconduct.
License: Abbott does not claim ownership of your personal data that you transmit or submit to the LibreView Data Management System. By disclosing your personal information to Abbott, you grant it a worldwide, royalty-free, non-exclusive license to use, distribute, reproduce, modify, adapt, publish and translate such data for the purpose of providing you with the LibreView Data Management System. Abbott may create, access, retain, use or disclose to third-party researchers, aggregated, anonymized, de-identified (or pseudonymized to the extent permitted by your law) data derived from the LibreView Data Management System for the purposes of research, to evaluate how the LibreView Data Management System is provided, to evaluate its use and its various components and equipment, to evaluate performance or impact on clinical staff or across clinics, to enhance the functioning of the LibreView Data Management System, the Readers and the FreeStyle Libre sensors, to validate LibreView Data Management System upgrades, or for product development and quality and safety of medical devices. You agree that the license herein permits Abbott to take any such actions subject to our compliance with any applicable data protection laws. Where personal information is provided to third-party suppliers to assist us with the provision of the LibreView Data Management System, they are required to keep personal information confidential and secure and may only use personal information to the minimum extent necessary.
Feedback: Any data, comments or materials that you supply via the LibreView Data Management System or provide to Abbott in order to receive support, including feedback data, such as questions, comments, suggestions or the like ('Feedback'), shall be deemed to be non-confidential and non-proprietary. Abbott shall have no obligation of any kind with respect to such Feedback and shall be free to reproduce, use, disclose, exhibit, display, transfer, create derivative works of and distribute the Feedback to others without limitation, except for health information and personal information which might be included in the Feedback but is subject to 'Section 14. License' above. Furthermore, Abbott shall be free to use any idea, concepts, know-how or techniques contained in such Feedback for any purpose whatsoever, including developing, manufacturing and marketing products incorporating such Feedback.
Trademarks: LibreView, FreeStyle LibreLink, LibreLinkUp, FreeStyle Libre, FreeStyle and related brand marks are trademarks of Abbott in various jurisdictions. Other trademarks are the property of their respective owners. No license or right, express or implied, is granted to you in any of the aforesaid trademarks, and you further agree that you shall not remove, obscure, or alter any proprietary notices (including trademark and copyright notices) that may be affixed to or contained within the LibreView Data Management System. No use of any Abbott trademark, trade name, or trade dress may be made without the prior written authorization of Abbott, except to identify the product or services of the company.
Patents: One or more patents owned by Abbott or its affiliates apply to this Site and to the features and services accessible via the Site either alone or in combination with other product(s), including without limitation the patents listed at https://www.abbott.com/patents/diabetes-patents.html (‘Abbott Patents Website’). The Abbott Patents Website may not be comprehensive and other Abbott products, services, platforms, and/or features not listed there may also be protected by one or more patents. Additional patents may be issued and/or pending in the U.S. or elsewhere. This notice is provided to satisfy the patent marking provisions of various jurisdictions, including the patent marking provisions of the America Invents Act (AIA), as codified by 35 U.S.C. § 287(a).
Proprietary rights: You acknowledge and agree that Abbott and/or its licensors own all legal rights, titles, and interest in and to the LibreView Data Management System, including but not limited to graphics, user interface, the scripts and software used to implement the LibreView Data Management System, and any software, including open-source software or documents provided to you as a part of and/or in connection with the LibreView Data Management System, including all Intellectual Property Rights that exist therein, whether registered or not, and wherever in the world they may exist. You further agree that the LibreView Data Management System contains proprietary and confidential information that is protected by applicable intellectual property rights and other laws, including but not limited to copyright. You agree that you will not use such proprietary information or materials in any way whatsoever except for use of the LibreView Data Management System in compliance with these Terms of Use. No portion of the LibreView Data Management System (including patient data) may be reproduced, retransmitted, or displayed in any form or by any means, except as expressly permitted in these Terms of Use or where permitted by applicable law. You shall not remove any product identification, copyright notices or proprietary restrictions from the LibreView Data Management System. You expressly acknowledge and agree that LibreView Data Management System access is licensed and not sold to you, and that Abbott, its licensors, affiliates and suppliers, grant you a non-exclusive license to use the LibreView Data Management System on the basis of these Terms of Use, and that your use of the LibreView Data Management System is also subject to any rules or policies applied by Abbott’s third-party providers (and provided to you in advance of agreeing to thse Terms of Use). You therefore agree that Abbott and/or its licensors do not transfer to you any ownership or proprietary rights in the LibreView Data Management System, any Intellectual Property Rights, or any other technology, information or materials, and as between the parties, Abbott, its affiliates, its suppliers, and its licensors, retain exclusive ownership of all rights, titles and interest in and to all aspects of the LibreView Data Management System, any Intellectual Property Rights, and all other technology, information and materials, as well as any and all copies or modifications thereof (by whomever and whenever made). RIGHTS NOT EXPRESSLY GRANTED HEREIN ARE RESERVED BY ABBOTT AND/OR ITS LICENSORS. The use of this material and the associated rights of Abbott, its affiliates and its suppliers, are hereby acknowledged except solely to the extent that the foregoing is ineffective in certain countries/states/provinces/jurisdictions.
Remedies: Violations of these Terms of Use may be investigated and appropriate legal action may be taken, including civil, criminal or equitable relief. You understand and agree that Abbott, in its sole discretion, and without prior notice, may terminate your access to our Site, remove any unauthorized user content or exercise any other remedy available if we believe, in our sole discretion, that your conduct or the conduct of any person with whom we believe you act in concert with, or the user content that you provide, violates or is inconsistent with these Terms of Use or applicable law or violates our rights or the rights of our affiliates, licensor or another user of our Site. You agree that monetary damages may not provide us with a sufficient remedy for violations of these Terms of Use and you consent to injunctive or other equitable relief for such violations. A printed version of these Terms of Use and of any related notice given in electronic form shall be admissible in judicial or administrative proceedings based upon or relating to these Terms of Use to the same extent and subject to the same conditions as other business documents and records originally generated and maintained in printed form.
Termination of your LibreView Data Management System account: These Terms of Use are effective upon your creation of a LibreView Data Management System account and shall continue in effect until terminated. You may ask Abbott to delete your LibreView Data Management System account at any time. Abbott may suspend or terminate your LibreView Data Management System account for any of the following reasons without advance notice to you:
- Any violation by you of these Terms of Use.
- Failure to provide accurate, current and complete LibreView Data Management System account information.
- Failure to report any security incident or any actual or suspected compromise of your password or LibreView Data Management System account.
Language: The parties agree that the English language will be the official language of these Terms of Use. If there is any conflict, apparent conflict or ambiguity between any of the clauses of these Terms of Use in the English language and the translated language, the wording of the English-language version shall prevail.
Applicable law:

These Terms of Use shall be governed and construed in accordance with the laws of the State of Illinois without regard to any choice of law provisions. In the event of any conflict between foreign laws, rules and regulations and those of the United States, the laws, rules and regulations of the United States shall govern to the fullest extent possible. You agree that these Terms of Use shall be fully performable in the State of Illinois, and you agree that jurisdiction and venue are proper in any of the state and federal courts located in the State of Illinois, United States of America, with respect to any proceedings arising from these Terms of Use or the relationship between the parties hereto. The parties hereby agree that the United Nations Convention on Contracts for the International Sale of Goods does not govern these Terms of Use.

For users in EEA, the UK, Switzerland, India and Indonesia: These Terms of Use will be governed by and construed in accordance with English law. The parties hereby agree that the United Nations Convention on Contracts for the International Sale of Goods does not govern these Terms of Use. Any dispute arising out of or in connection with these Terms of Use, including any question regarding their existence, validity or termination, shall be referred to and finally resolved by arbitration under the LCIA Rules, which Rules are deemed to be incorporated by reference into this clause. The number of arbitrators shall be one. The seat, or legal place, of arbitration shall be London. The language to be used in the arbitral proceedings shall be English.

For Users in Australia: Nothing in this Section 22 excludes or purports to exclude the application of the Competition and Consumer Act 2010 (Cth) where relevant.
Severability. If, for any reason, a court with proper jurisdiction holds that any part of these Terms of Use is invalid or cannot be enforced, all other parts will remain in effect. The invalid or unenforceable part will be reformed only to the extent necessary to make it valid and enforceable. For example, some jurisdictions may not permit certain disclaimers of warranties in relation to individual Professional Users despite the fact that this is a business to business rather than a consumer agreement, and in such an event, only those disclaimers deemed invalid should be severed from these Terms of Use.
No third party rights. These Terms of Use are between you and us. No other person shall have any rights to enforce any of the terms, whether under the UK Contracts (Rights of Third Parties) Act 1999, or otherwise.
Support: Free technical support is available by going to the LibreView.com support site and clicking on the "Customer Support" link. Inquiries will be directed to the appropriate support teams.
Changing LibreView Data Management System Terms of Use: Abbott reserves the right to change these Terms of Use at any time at our discretion and without prior notice. Professional Users of our Site are expected to regularly check the Terms of Use for changes as they are binding on you. We encourage you to review these Terms of Use every time that you use our Site. Updates will be indicated by a change in the Effective Date and your continued use of our Site and continued access to your LibreView Data Management System account as a Professional User following any such change constitutes your agreement to follow and be bound by the most recent version of these Terms of Use. You will be able to store or print out changes to these Terms of Use in legible form.

For Users in Australia: You will be notified of any changes to these Terms of Use when You start the LibreView Data Management System. Changes will be considered to have been accepted by You unless You inform Abbott in writing or by using electronic means agreed upon by Abbott. Abbott will draw Your attention to this fact when changes are announced. If You should decide to object to any change, You must do so within six weeks after receipt of announcement of the change. In the event of an objection, Abbott may terminate Your LibreView Data Management System account upon four weeks’ notice. Otherwise, Section 26 does not apply to users located in Australia.

BY CLICKING AGREE WHEN YOU CREATE A LIBREVIEW DATA MANAGEMENT SYSTEM ACCOUNT AS A PROFESSIONAL USER, YOU REPRESENT AND WARRANT THAT YOU ARE DULY AUTHORIZED TO ACCEPT AND ENTER INTO THESE TERMS OF USE AND THAT YOU INTEND YOUR ACT TO SERVE AS AN ELECTRONIC SIGNATURE TO THESE TERMS OF USE WITH THE SAME FORCE AND EFFECT AS A MANUAL SIGNATURE.

Please print a copy of these Terms of Use for Your records.

[FOR USERS IN THE EEA, JAPAN, SWITZERLAND AND UK, PLEASE SEE DATA PROCESSING AGREEMENT BELOW]

LIBREVIEW PROFESSIONAL USER EU/JAPAN/SWISS/UK DATA PROCESSING AGREEMENT

AGREEMENT based on the Standard Contractual Clauses 2021/914 - Module 2 (Transfer Controller to Processor) and including Module 3 (Transfer Processor to Processor)

Effective Date: May 2023

This EU/Japan/Swiss/UK Data Processing Agreement (“DPA”) forms part of and is incorporated into the Terms of Use that govern your use as a Professional User of the LibreView website located at www.LibreView.com (the “Site”). Please read this DPA carefully before you start to use our Site, create any patient profile, practices, and/or invite other Professional Users to create a LibreView Data Management System account, as this DPA is a legal agreement between you as controller and data exporter and Abbott Diabetes Care Inc., 1420 Harbor Bay Parkway, Alameda, CA 94502 (USA), through its GDPR Article 27 representative or other local affiliates ("Abbott") as processor and data importer and Abbott Laboratories as sub-processor and receipt of personal data via an onward transfer from Abbott as processor and data importer.

Your access and use of the Site and the Libreview Data Management System (“Libreview”) constitutes and is conditioned upon your agreement to be bound by this DPA. If you do not agree to this DPA, do not use or access any services or information available through this Site. All pre-existing data protection agreement(s) relating to Libreview or a Professional User Libreview account between the parties are replaced and shall no longer apply except when the parties specifically agree.

Standard Contractual Clauses

SECTION I

Clause 1

Purpose and scope

(a)

The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ¹ for the transfer of personal data to a third country.

(b)

The Parties:

(i)	the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and

(ii)	the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’) have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).

(c)	These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

(d)

The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

¹ Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915.

Clause 2

Effect and invariability of the Clauses

(a)

These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b)	These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3

Third-party beneficiaries

(a)

Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

(i)	Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;

(ii)	Clause 8 –Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g);

(iii)

Clause 9 – Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and (e);

(iv)	Clause 12 – Clause 12(a), (d) and (f);

(v)	Clause 13;

(vi)	Clause 15.1(c), (d) and (e);

(vii)

Clause 16(e);

(viii)

Clause 18 – Modules One, Two and Three: Clause 18(a) and (b).

(b)	Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4

Interpretation

(a)	Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b)	These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c)	These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6

Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7

Intentionally left blank

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organizational measures, to satisfy its obligations under these Clauses.

MODULE TWO: Transfer controller to processor

8.1 Instructions

(a)	The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.

(b)	The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B, unless on further instructions from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.4 Accuracy

If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6 Security of processing

(a)

The data importer and, during transmission, also the data exporter shall implement appropriate technical and organizational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymization, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymization, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organizational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(b)

The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(c)

In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(d)

The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.

8.7 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offenses (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ² (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

(i)	the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(ii)	the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;

(iii)

the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(iv)	the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

² The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.

8.9 Documentation and compliance

(a)	The data importer shall promptly and adequately deal with inquiries from the data exporter that relate to the processing under these Clauses.

(b)	The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.

(c)

The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.

(d)	The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.

(e)	The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

MODULE THREE: Transfer processor to processor

8.1 Instructions

(a)	The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
(b)	The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
(c)	The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.
(d)	The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter..

8.2 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I. B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.

8.3 Transparency

On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.

8.4 Accuracy

8.5 Duration of processing and erasure or return of data

Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6 Security of processing

(a)

The data importer and, during transmission, also the data exporter shall implement appropriate technical and organizational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymization, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymization, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organizational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(b)

The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(c)

In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(d)

The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.

8.7 Sensitive data

8.8 Onward transfers

The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union ³ (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:

(i)	the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(ii)	the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679;

(iii)

the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(iv)	the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.9 Documentation and compliance

(a)	The data importer shall promptly and adequately deal with inquiries from the data exporter or the controller that relate to the processing under these Clauses.

(b)	The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.

(c)	The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.

(d)

The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.

(e)	Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.

(f)

The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.

Clause 9

Use of sub-processors

MODULE TWO: Transfer controller to processor

(a)

The data importer has the data exporter’s general authorization for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 90 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.

(b)

Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. ⁴ The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.

(c)

The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

(d)	The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.

(e)

The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

⁴ This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.

MODULE THREE: Transfer processor to processor

(a)

The data importer has the controller’s general authorization for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 90 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).

(b)

Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects ⁵. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.

(c)

The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

(d)	The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.

(e)

⁵ This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.

Clause 10

Data subject rights

MODULE TWO: Transfer controller to processor

(a)	The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorized to do so by the data exporter.

(b)

The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organizational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.

(c)	In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.

MODULE THREE: Transfer processor to processor

(a)	The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorized to do so by the controller.

(b)

The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organizational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.

(c)	In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.

Clause 11

Redress

(a)	The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorized to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

(b)

In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

(c)

Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:

(i)	lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(ii)	refer the dispute to the competent courts within the meaning of Clause 18.

(d)	The Parties accept that the data subject may be represented by a not-for-profit body, organization or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.

(e)	The data importer shall abide by a decision that is binding under the applicable EU or Member State law.

(f)	The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

Clause 12

Liability

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

(a)	Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b)	The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.

(c)

Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.

(d)	The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.

(e)	Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(f)	The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.

(g)	The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

Clause 13

Supervision

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

(a)

Where the data exporter is established in an EU Member State: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679: The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.

Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679: The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.

(b)

The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to inquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14

Local laws and practices affecting compliance with the Clauses

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

(a)

The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorizing access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

(b)

The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(i)

the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(ii)	the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorizing access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards ⁶

(iii)

any relevant contractual, technical or organizational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

(c)	The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

(d)	The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

(e)

The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). [For Module Three: The data exporter shall forward the notification to the controller.]

(f)

Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organizational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation [for Module Three:, if appropriate in consultation with the controller]. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by [for Module Three: the controller or] the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

⁶ As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.

Clause 15

Obligations of the data importer in case of access by public authorities

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

15.1 Notification

(a)

The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:

(i)

receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(ii)	becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

[For Module Three: The data exporter shall forward the notification to the controller.]

(b)

If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c)

Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). [For Module Three: The data exporter shall forward the information to the controller.]

(d)	The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.

(e)	Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2 Review of legality and data minimization

(a)

The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b)

The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.[For Module Three: The data exporter shall make the assessment available to the controller.]

(c)	The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION IV – FINAL PROVISIONS

Clause 16

Non-compliance with the Clauses and termination

(a)	The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b)	In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c)

The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i)	the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii)	the data importer is in substantial or persistent breach of these Clauses; or

(iii)

the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority [for Module Three: and the controller] of such non- compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d)

[For Modules One, Two and Three: Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data.] The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

(e)

Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17

Governing law

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

These Clauses shall be governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does allow for third-party beneficiary rights.

Clause 18

Choice of forum and jurisdiction

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

(a)	Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(b)	The Parties agree that those shall be the courts of the Member State whose law shall apply pursuant to Clause 17.

(c)	A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.

(d)	The Parties agree to submit themselves to the jurisdiction of such courts.

ANNEX I

A. LIST OF PARTIES

MODULE TWO: Transfer controller to processor

Data exporter:

Professional User, a provider of healthcare services to patients.

Role: Controller

Data importer:

Abbott, the provider of the LibreView Data Management System.

Role: Processor

MODULE THREE: Transfer processor to processor

Data exporter:

Abbott, the provider of the LibreView Data Management System.

Role: Processor

Data Importer:

Abbott Laboratories

Role: Sub-processor

B. DESCRIPTION OF TRANSFER

MODULE TWO: Transfer controller to processor

Categories of data subjects whose personal data is transferred:

The Personal Data transferred concern the following categories of Data Subjects:

Professional User's employees who have their name and email address in a Professional User account; and
Patients enrolled to the LibreView Data Management System by Professional User except where patients have separately registered for a LibreView account through the LibreView website.

Categories of personal data transferred

The Personal Data transferred concern the following categories of data:

Registration data

Name;
Email address;
Age; and
Other Personal Data provided by Data Subjects when registering for the LibreView Data Management System (for example, name of parent or legal guardian if the patient is a minor without the ability to consent).

IT usage data

Information about the use of the LibreView Data Management System mobile app in relation to the Data Subject (for example, number of uploads from the measuring device, login times); and
Other IT usage data created and processed in connection with the LibreView Data Management System with respect to the Data Subject, including, but not limited to, information about the operating system or software version used.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Type of diabetes measuring device;
Serial number of the diabetes measuring device;
Diabetes type;
Average number of blood glucose measurements in a given period of time;
Information on insulin therapy;
Data from the patients' measuring devices;
Related health information uploaded by the data subjects, such as meal plans; and
Historical glucose data, glucose test results and ketone test results.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous as long as the data exporter uses the service of the data importer.

Nature of the processing

The Personal Data transferred shall be subject to the following processing operations:

Providing access to Personal Data from the LibreView Data Management System for authorized employees of Professional User via the ‘Practice’ function in LibreView, including, but not limited to, colleagues, doctors, nurses and / or caregivers working in the same medical practice; and.
Maintenance, support and updating of the LibreView Data Management System for which access to Personal Data (via remote access) cannot be excluded.

Purpose(s) of the data transfer and further processing

To provide, operate and maintain the LibreView Data Management System.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:

Data Importer will continue to store data exporter's patients' personal information for the period that the data exporter has an active Professional User LibreView Data Management System account, unless data exporter chooses to delete their patient information sooner. Data Exporter's Professional User LibreView Data Management System account will be considered to be inactive once there has been no activity on it for six (6) months. Further, Data Importer may retain personal data in accordance with applicable legal requirements.

MODULE THREE: Transfer processor to processor

Categories of data subjects whose personal data is transferred:

The Personal Data transferred concern the following categories of Data Subjects:

Professional User's employees who have their name and email address in a Professional User account; and
Patients enrolled to the LibreView Data Management System by Professional User except where patients have separately registered for a LibreView account through the LibreView website.

Categories of personal data transferred:

The Personal Data transferred concern the following categories of data:

Registration data

Name
Email address;
Age; and
Other Personal Data provided by Data Subjects when registering for the LibreView Data Management System (for example, name of parent or legal guardian if the patient is a minor without the ability to consent).

IT usage data

Information about the use of the LibreView Data Management System mobile app in relation to the Data Subject (for example, number of uploads from the measuring device, login times); and
Other IT usage data created and processed in connection with the LibreView Data Management System with respect to the Data Subject, including, but not limited to, information about the operating system or software version used.

Type of diabetes measuring device;
Serial number of the diabetes measuring device;
Diabetes type;
Average number of blood glucose measurements in a given period of time;
Information on insulin therapy;
Data from the patients' measuring devices;
Related health information uploaded by the data subjects, such as meal plans; and
Historical glucose data, glucose test results and ketone test results.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):

As and when Maintenance Services are provided.

Nature of the processing:

The Personal Data transferred shall be subject to the following processing operations:

Maintenance, support and updating of the LibreView Data Management System for which access to Personal Data (via remote access) cannot be excluded.

Purpose(s) of the data transfer and further processing:

To provide, operate and maintain the LibreView Data Management System.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:

Once the issue for which Maintenance Services are provided has been resolved, the personal data is deleted by the Data Importer.

C. COMPETENT SUPERVISORY AUTHORITY

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

The supervisory authority competent for the controller.

ANNEX II

TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

MODULE TWO: Transfer controller to processor

MODULE THREE: Transfer processor to processor

A description of the technical and organizational measures that Abbott implements in accordance with Clause 8.6 of the Standard Contractual Clauses is set out in Annex C (Security measures).

Abbott has implemented the technical and organizational security measures set out in this Annex II to ensure the ongoing confidentiality, integrity, availability and resilience of its processing systems and services. Abbott processes Personal Data on EEA server sites operated by an industry-leading cloud service provider that offers sophisticated measures to protect against unauthorized access.

Access control of processing areas (confidentiality): Steps taken by Abbott’s industry-leading cloud service provider to prevent unauthorized access to data processing equipment (for example, telephones, database and application servers, and associated hardware) in which Personal Data is processed include the following appropriate measures:
- a multi-layered security model that includes security features such as customized electronic access cards, alarms, vehicle access barriers, fences, metal detectors and biometrics;
- Data centres which are monitored around the clock by high-resolution indoor and outdoor cameras that can detect and track unauthorized persons;
- Access logs, activity records and camera recordings that are available in the event of a break-in; and
- Physical access controls to prevent unauthorized access to data processing systems such as security restricted areas and device security. Physical access rights and authentication controls (for example, keys, identification cards, chip cards) for security areas are implemented, documented and regularly checked.
Access control to data processing systems (confidentiality): Abbott takes appropriate measures to prevent its data processing systems from being used by unauthorized persons. This is achieved by:
- Multi-factor authentication, including native identity and access management integration with hardware;
- Restricting access to services through encryption, signature algorithms and secure certificates;
- Data communicated between a user's browser, mobile application, partner application, or other service interaction with the platform is encrypted using the HTTPS protocol and FIPS-certified TLS 1.2 and 1.3 ciphers using secure SSL certificates;
- Data is encrypted in transit, end to end, and at rest;
- Storing data on a secure database that uses file-level encryption; key storage mechanisms prevent the cloud hosting provider from viewing the data;
- Backing databases up with different keys from primary databases;
- Logging failed authentication attempts and regularly evaluating such logs;
- Using industry standard encryption and password requirements (for example, minimum length, use of special characters, and so on); and
- Locking access following unsuccessful attempts or inactivity and having a method to reset locked access identifiers.
Access control for the use of certain areas of data processing systems (confidentiality): Abbott personnel authorized to use data processing systems may only access Personal Data where they have sufficient access authorization. Personal Data which is encrypted cannot be read, copied, changed or removed without authorization. This is achieved by:
- Access is restricted on the basis of roles and responsibilities and is maintained by organizational authorizations;
- Privileges are allocated on a need-to-use and event-by-event basis;
- Access requests and changes of access are monitored and retained;
- Access controls are always defaulted to "no access" unless specifically required;
- Password protected; unique username and password requirement; multifactor authentication enabled; Traffic is controlled through AWS security groups;
- Access rights are reviewed periodically to ensure that correct access rights are granted; when roles and responsibilities change, access rights are removed, even in the event of termination; and
- Effective disciplinary action against individuals who access Personal Data without authorization.
Transfer control (integrity): Abbott takes steps to prevent Personal Data from being read, copied, altered or deleted by unauthorized persons during its transfer or transport. This is achieved by:
- The transfer of data is encrypted using server-side encryption;
- Servers are located in a virtual private cloud and use a secure network that can only be accessed through certificate-based authentication that restricts traffic to HTTPS only;
- Data communicated between a user's browser, mobile application, partner application, or other service interaction with the platform is encrypted using the HTTPS protocol and FIPS-certified TLS 1.2 and 1.3 ciphers using secure SSL certificates;
- Data at rest is encrypted using AES-256;
- Avoid storing Personal Data on portable storage media for transportation purposes and on corporate laptops or other mobile devices unless Personal Data is encrypted;
- Risk minimization through grid disconnection; and
- Critical security patches will be implemented within 30 days of release.
Input control (integrity): Abbott does not access Professional User content unless it is necessary to provide Professional User with the products and professional services it selects. Abbott does not access Professional User content for any purposes other than those set out in the Terms of Use and this DPA. Accordingly, Abbott does not know what content Professional User stores on its systems and cannot distinguish between Personal Data and other content. As a result, Abbott treats all Professional User content in the same manner. In this way, all Professional User content receives the same high level of security, regardless of whether this content contains Personal Data or not.

Abbott takes appropriate measures to ensure that it is possible to verify and establish that no Personal Data has been entered into or removed from data processing systems. This is achieved by:
- Protective measures for reading, changing and deleting stored data;
- Documentation to control which persons are authorized and responsible for making entries into data processing systems on the basis of their tasks; and
- Protocols that require the logging of possible entries and / or deletions of Personal Data.
Order control: Abbott takes steps to ensure that, where Personal Data is processed, it is processed strictly in accordance with Professional User’s instructions. This is achieved by:
- Clear instructions to Abbott on the scope of required Personal Data processing as set out in the Terms of Use and this DPA. This is limited to specific requirements for development of Professional User’s system and database management (for example, creating new report templates for which data processing is necessary to test report templates).
Availability control (availability): Abbott takes steps to ensure that Personal Data is protected from accidental destruction or loss. This is achieved by:
- Regular data backups;
- Guidelines prohibiting permanent local (workplace) storage of Personal Data; and
- Implementation of a contingency plan listing necessary steps to be taken and identifying the persons to be informed about an incident.
Separation of processing for different purposes: Abbott takes steps to ensure that Personal Data collected for different purposes can be processed separately. This is achieved by:

Ensuring database-driven security by separating patient information from glucose information with separate file-level encryption keys; and
Designing interfaces, batch processes, and reports for specific purposes and functions only, so data collected for specific purposes is processed separately.

Resilience: Abbott has implemented the following technical and organizational security measures, in particular to ensure the reliability of its processing systems and services:
- Data protection management policies and procedures;
- Data protection-friendly pre-settings (as required by GDPR Article 25(1)); and
- Order control.
Abbott has also implemented organizational and technical measures in consideration of the European Data Protection Board's Recommendations 01/2020 as well as the European Court of Justice's "Schrems II" decision.

ANNEX III

LIST OF SUB-PROCESSORS

MODULE TWO: Transfer controller to processor

Subprocessor name	Subprocessor address	Description of services	Location from which services are provided
Amazon Web Services	410 Terry Avenue North Seattle WA 98109 U.S.A.	Hosting LibreView Data Management System accounts for users located in the European Economic Area, Switzerland and the UK.	France for users located in France Germany for users located in Germany Ireland for all other EEA, Swiss and UK users Japan for Japanese users

MODULE THREE: Transfer processor to processor

Subprocessor name	Subprocessor address	Description of services	Location from which services are provided
Abbott Laboratories	100 Abbott Park Road, Abbott Park, Ill. 60064U.S.A.	Providing Maintenance Services, in particular troubleshooting and other application and software support.	United States of America

ANNEX IV

LOCAL LAW AMENDMENTS FOR DATA EXPORTERS NOT SUBJECT TO THE GDPR

1

Local Law Amendments for Data Exporters located in Switzerland:

(a)

Insofar data transfers are subject to the Swiss Federal Act on Data Protection of June 19, 1992 or as from 1 September 2023 the Federal Act on Data Protection of 25 September 2020 (“FADP”), references to the GDPR shall be interpreted as references to the FADP or any subsequent act, including the relevant amendments and implementing ordinances (whereby “the authority” shall mean the competent data protection authority in the territory in which the data exporter is established; for Switzerland i.e. the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern); insofar data transfers are subject to cantonal data protection laws, references to the GDPR shall be interpreted as references to the relevant cantonal data protection laws applicable to the data exporter (whereby the “Authority" shall mean the competent cantonal data protection authority in the canton in which the data exporter is established).

(b)

The Data Importer acknowledges and agrees that the personal data transferred to the Data Importer by the Data Exporter may include personal data of legal persons and personality profiles of natural persons. The Data Importer shall process personal data of legal persons in the same manner as other personal data and personality profiles in the same manner as special categories of data (the special protection of data from legal persons and from personality profiles will be abolished upon entering into force of the revised Swiss Federal Data Protection Act of 25 September 2020 on 1 September 2023, whereupon the obligations of the Data Importer according to this paragraph (b) shall cease);

(c)

The term "Member State" shall be interpreted as including Switzerland;

(d)

The term “Member State” must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their habitual place of residence (Switzerland) in accordance with Clause 18c.

2

Local Law Amendments for Data Exporters located in United Kingdom::

UK International Data Transfer Addendum for the EU Commission Standard Contractual Clauses
This Addendum has been issued by the Information Commissioner (“ICO”) for Parties making Restricted Transfers. The ICO considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.
PART 1: TABLES
Table 1: Parties

Start date As per the commencement or effective date set out in this Data Processing Agreement to which this Addendum is attached (“DPA”)

The Parties Exporter (who sends the Restricted Transfer) Importer (who receives the Restricted Transfer)

Parties’ details As set out in the Addendum EU SCCs As set out in the Addendum EU SCCs

Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs

The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information.
The Standard Contractual Clauses as defined in the DPA.

Table 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A:	List of Parties: As set out in Annex 1A of the the Addendum EU SCCs
Annex 1B:	Description of Transfer: As set out in Annex 1B of the Addendum EU SCCs
Annex II:	Technical and organizational measures including technical and organizational measures to ensure the security of the data: As set out in Annex II of the Addendum EU SCCs
Annex III:	List of Sub processors (Modules 2 and 3 only): As set out in Annex III of the Addendum EU SCCs

Table 4: Ending this Addendum when the Approved Addendum Changes

Ending this Addendum when the Approved Addendum changes

Which Parties may end this Addendum as set out in Section 19:
Importer
Exporter
neither Party

PART 2: MANDATORY CLAUSES

Entering into this Addendum

(1)	Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.

(2)

Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

(3)	Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

Addendum	This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs.
Addendum EU SCCs	The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information.
Appendix Information	As set out in Table 3.
Appropriate Safeguards	The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR.
Approved Addendum	The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 28 January 2022, as it is revised under Section 18.
Approved EU SCCs	The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
ICO	The Information Commissioner.
Restricted Transfer	A transfer which is covered by Chapter V of the UK GDPR.
UK	The United Kingdom of Great Britain and Northern Ireland.
UK Data Protection Laws	All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
UK GDPR	As defined in section 3 of the Data Protection Act 2018.

Alternative Part 2 Mandatory Clauses:

Mandatory Clauses

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

(3)

Local Law Amendments for Data Exporters located in Japan:

This Japan Data Processing Agreement for J-DREAMS (“Japan DPA”) forms part of and is incorporated into the Terms of Use that govern your use as a Professional User of the LibreView website located at www.LibreView.com (the “Site”) for the purpose of sharing data with the Japan Diabetes compREhensive database project based on Advanced electronic Medical record System (“J-DREAMS”). When you use the Site for the purpose of other than data sharing with J-DREAMS, this Japan DPA does not apply. Please read this Japan DPA carefully before you start to use our Site, create any patient profile, practices, and/or invite other Professional Users to create a LibreView Data Management System account to share the data with J-DREAMS, as this Japan DPA is a legal agreement between you and Abbott Diabetes Care Inc
YOUR ACCESS AND USE OF THE SITE AND THE LIBREVIEW DATA MANAGEMENT SYSTEM FOR DATA SHARING WITH J-DREAMS CONSTITUTES, AND IS CONDITIONED UPON, YOUR AGREEMENT TO BE BOUND BY THIS JAPAN DPA. IF YOU DO NOT AGREE TO THIS JAPAN DPA, DO NOT ACCESS OR OTHERWISE USE THIS SITE, ANY SERVICES AVAILABLE THROUGH THIS SITE OR ANY INFORMATION CONTAINED ON THIS SITE FOR DATA SHARING WITH J-DREAMS.
This Japan DPA governs how Abbott will process Personal Data on behalf of Professional User for the purpose of sharing it with J-DREAMS. This Japan DPA forms part of, and is incorporated into the Site Terms of Use between a Professional User and Abbott for the provision of the LibreView Data Management System available at https://www.LibreView.com (“Terms of Use”), and, where applicable, the contract between Professional User and its local Abbott company to provide the LibreView Data Management System (“Main Agreement”).
This Japan DPA only applies where Abbott processes Personal Data retained by Professional User in its LibreView Data Management System account specifically created for the purpose of data sharing with J-DREAMS on behalf of Professional User, which is responsible for handling of Personal Data.
References to "APPI" shall mean the Act on the Protection of Personal Information (Act No. 57 of May 30, 2003, as amended)
All references to:

The term "Community", "European Economic Area (EEA)" and "EU" shall be replaced with the term "Japan".
"controller", "data subject", and "supervisory authority / authority" shall have the same meaning as in APPI and all related regulations
“authority” shall mean the Personal Information Protection Commission, Japan.
The term "European Commission" shall be replaced with the term "authority".
References to "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) " including any abbreviations contained in the Agreement, as well as references to any and all "Articles" of Regulation (EU) 2016/679 shall be replaced with the term "APPI and all related regulations".

Second sentence of Clause 8.6 (c) shall be replaced with:

The data importer shall also notify the data exporter without undue delay within five days after having become aware that a serious breach involving one or more of the following has occurred, or is likely to have occurred:

breach of personal data containing sensitive data including race, creed, social status, medical history, criminal record, any crimes a person has been a victim of, and any other information prescribed by cabinet order as those might cause the person to be discriminated against;
breach of personal data that is likely to cause property damage if wrongfully used;
breach of personal data that is likely to be committed with a wrongful purpose; or
breach of personal data Involves more than 1,000 individuals.

Third sentence of Clause 8.6 (c) shall be replaced with:

Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, categories and approximate number of data subjects and personal data records concerned), its likely consequences, the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects, and other information reasonably required by the data exporter in accordance with the APPI.

A new sentence shall be added to Clause 8.6(c):

This initial serious breach notification period can be extended if there are any reasonable grounds and the subsequent period for providing further information can be extended if it is difficult for the data importer to provide all information set forth in this clause by the initial deadline in which case, the data importer shall provide all available information by the initial deadline and provide the remaining information as soon as the data importer obtains such information.

Clause 8.7 shall be replaced with

Where the transfer involves special categories of data/sensitive data as defined under the APPI (hereinafter ‘sensitive data’), the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include restricting the personnel permitted to access the personal data, additional security measures (such as pseudonymization) and/or additional restrictions with respect to further disclosure (please see Annex I.B for more details).

The data importer shall take all reasonable measures to ensure its employees comply with all necessary and appropriate security measures under the APPI and all related regulations, and implement necessary and appropriate monitoring of employees activities. “all reasonable measures” include providing quality and frequent training for employees on company rules and practices relating to the security measures and conducting audits of employees’ compliance with the company rules and practices on a regular basis.
Where the data importer transfers personal data to a third party regardless of whether the third party is located in Japan or outside Japan, the data importer shall do this using a means compliant with the APPI (e.g., pursuant to Clause 9) and all related regulations, but where uncertain, shall default to obtaining consent for the data transfers from data subjects.
The following data protection safeguards shall be addition to Clause 8 (Data protection safeguards) of this DPA:

In order to enable data subjects to effectively exercise their rights pursuant to Clause 10 and the APPI, the data importer shall inform them through the data exporter:

(i)	of its identity and contact details;

(ii)	of the categories of personal data processed;

(iii)

of the purpose of use personal data processed;

(iv)	of the right to obtain a copy of these Clauses; and

(v)	where it intends to onward transfer the personal data to any third party/ies, of the recipient or categories of recipients (as appropriate with a view to providing meaningful information), the purpose of such onward transfer and the ground therefor pursuant to Clause 8.8.

The data importer shall not use personal data in a manner that may encourage or induce unlawful or unfair acts.

Clause 8.8 of this DPA should be replaced with the following:

The data importer shall not disclose the personal data to any third party (in the same country as the data importer or in another third country) unless the data subject's consent to such transfer has been obtained or it falls under the exception to the third party transfer restrictions under the APPI (e.g., pursuant to Clause 9).
Furthermore, the data importer shall not disclose the personal data to a third party located outside Japan unless such transfer falls under any of the following circumstances:

(i)	When the data subject has provided a specific consent to such transfer after being informed information required under the APPI;

(ii)	When the third party is located in one of the countries that are designated by the Japanese data protection authority as countries that offer a level of data protection equivalent to that of Japan; or

(iii)

When the third party is or agrees to be bound by the obligations substantially equivalent to those provided under the APPI that conform with the requirements for cross-border transfer of personal information from Japan to a third party outside Japan.

Clause 17 of this DPA should be replaced with the following:

These Clauses shall be governed by the law of Japan.

Clause 18 of this DPA should be replaced with the following:

(i)	Any dispute arising from these Clauses shall be resolved by the courts of Japan.

(ii)	The Parties agree to submit themselves to the jurisdiction of such courts.

DOC42186-001_rev-P_en-US

LIBREVIEWPROFESSIONAL TERMS OF USE

Effective Date: December 2023

LIBREVIEW PROFESSIONAL USER EU/JAPAN/SWISS/UK DATA PROCESSING AGREEMENT

Effective Date: May 2023

Standard Contractual Clauses

LIBREVIEW
PROFESSIONAL TERMS OF USE