Global Privacy Notice

The information we collect and how we handle it depends on the data type and what you do when you use our services and products, or otherwise interact with Intuitive. You should not provide Intuitive Surgical with any personal information that is not specifically requested.

Most information provided to us via our websites is not subject to the US Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule. However, we may receive protected health information from a health care provider that is subject to HIPAA and our service agreement with the provider. We will comply with HIPAA and the service agreement when using such information.

2.1. Website users

When you interact with our Sites or engage with our services or products, we may collect the following types of data from you:

Type of data	Examples of data
Identification information	First name, last name
Contact information	Email address, postal address, phone number
Relationship management information	Requests for information / complaints (date, subject, action taken), other interactions with our products and services
Professional information	Title, role, employer, professional specialty, professional interests, education/training, and professional identification number

Any other information you choose to provide to us.

Where applicable, the Sites automatically collect the following data via cookies and other automatic means:

Type of data	Examples of data	Purposes
Internet or other electronic network activity information	Date and time of the visit, IP address, device type, browser type, viewed pages, location based on IP address	This data is necessary for the proper functioning of the Site, or internal business analytics purposes such as audience measurement. For more information on cookies and other trackers, please see the Cookie Settings of the Sites.

2.2. System users

If you are a healthcare professional, medical student, proctor, or you otherwise use, have used, or may use our products or services, we may collect the following types of personal information from you:

Type of data	Examples of data
Identification information	First name, last name, birthdate, geolocation
Contact information	Email address, postal address, phone number
Personal characteristics	Travel and meal preferences
Data related to your exchanges with Intuitive	Exchanges with our services and/or products (date, time, subject, content)
Data related to our products, including training systems	Data related to the use of and interactions with our products (date, time, training pathway and records, procedure related information, kinematics), ergonomic and other user-defined system settings associated with a user-defined identifier
Financial data	Payment and bank account details
Recordings	Photos, still images, audio, video
Relationship management information	Requests for information / complaints (date, subject, action taken), other interactions with our products and services
Professional information	Title, role, employer, professional specialty, professional interests, resume, professional memberships, education, training

Any other information you choose to provide to us.

You are not required to provide your personal information to us, although some information may be provided by you, your employer or a hospital or healthcare facility at which you have privileges and we with which have a contract. However, not providing your information may impact our ability to support your or your employer/hospital’s use of certain product features or functionality, including the use of relevant training materials or metrics.

2.3. Others

If you are an employee, director, officer, agent, consultant, advisor of our customers, suppliers, service providers, consultants, distributors, regulatory agencies and others (“Third Party”), with a professional relationship with Intuitive, or an interest related to Intuitive’s or related products or services, we may collect the following types of personal information from you:

Type of data	Examples of data
Identification information	First name, last name, birthdate
Contact information	Email address, postal address, phone number
Personal characteristics	Travel and meal preferences
Data related to your exchanges with Intuitive	Exchanges with our services and/or products (date, hour, subject, content)
Financial data	Payment and bank account details
Recordings	Photos, still images, audio, video
Relationship management information	Requests for information / complaints (date, subject, action taken), other interactions with our products and services
Professional information	Title, role, employer, professional specialty, professional interests, resume, professional memberships, education, training, professional identification number

Any other information you choose to provide to us.

We only use the information required to provide the products and services requested and for the purposes to which you agreed, unless otherwise required by law. Where we are required by law to request and receive your consent prior to collection, use, transfer or other processing of your information, Intuitive is committed to seeking such consent.

We may use the information we collected for the following purposes:

Purpose	Legal basis
Managing commercial relationships with existing and prospective customers (e.g., providing services, providing product and service support and insights, communicating with you, coordinating events).	Contract or legitimate interest
Learning and professional education, course enrollments, training recommendations and management	Legitimate interest
Proctoring, speaking engagements and consultancy related interactions	Contract
Complying with statutes, regulations or other legal obligations to which Intuitive is subject	Legal obligation
Providing information or materials about our products and services; Proposing information and content based on professional interest or professional activity	If you are an existing client: Legitimate interest, or consent where required by law. If you are not an existing client: consent
Conducting market research	Legitimate interest, or consent where required by law
Evaluating and coordinating clinical trials, other studies, research and other related projects	Contract or legitimate interest
Conducting our business, including improving our products and services, the Sites; business development; budgeting, planning, surveys, sponsored agreements and complaints handling	Legitimate interest
Investigating, preventing or taking pre-litigation or litigation actions regarding potential violations of our policies, suspected fraud, situations, involving potential threats to the safety of any person and illegal activities, network and information security	Legitimate interest
In the event of a sale, merger, transfer of substantial assets, other business change, reorganization, or liquidation, to transfer, or assign information concerning your relationship with us, including, without limitation, your personal information	Legitimate interest
Creating aggregated statistics on website usage	Legitimate interest

Unless we have your consent or to the extent permitted by applicable law, we do not use your personal information for automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.

To the extent permitted by applicable law, we may create pseudonymized, deidentified or anonymous data for the purpose of helping us develop or improve our products and services.

For questions or additional information regarding the purpose and legal basis for processing personal information, please contact our Data Privacy Office at data.privacy@intusurg.com.

Your personal information may be transferred to countries where the local legislation provides a different level of protection for your personal information and rights compared with your country. If that is the case, we will ensure that appropriate legal and/or contractual safeguards (e.g., adequacy decisions, standard contractual clauses, transfer impact assessments) are in place for such transfers as required by your local legislation (where applicable). In particular, the information that we collect about you may be stored in the EU/EMEA, Switzerland, UK, Israel, the United States and/or Mexico. For more information about the countries where your personal information is transferred and the safeguards implemented by Intuitive (where applicable), please contact us at data.privacy@intusurg.com.

We keep your Personal Data as long as necessary to guarantee our commitments related to our products and services, and to maintain the professional relationship over time. We may keep your Personal Data longer if required by applicable law or where we have a legitimate and lawful purpose to do so.

We will securely dispose of personal information once the retention period ends.

The security and confidentiality of your information is important to us. We process personal information with commercially reasonable information technology and we may use cloud services. We have also implemented technical and organizational security measures to protect your personal information from loss, misuse or unauthorized access, disclosure, deletion or modification. It includes, among other mechanisms, secured back-up and archiving servers, access control, firewalls or encryption.

We or third parties on our behalf may use different types of “cookies” as part of data collection.

Essential cookies are required for the proper functioning of the site and may be used to, for example:

• Remember previous actions when navigating back to a page in the same session
• Manage and pass security tokens to different services within the website to identify a visitor’s status
• Maintain tokens for the implementation of secure areas of the website.
• Route customers to specific versions/applications of a service, such as what might be used during a technical migration

Non-essential cookies are not required for the proper functioning of the site, and may be used to, for example:

• Track and store data about visits
• Track and store visitor information
• Record session details and page traffic
• Customize and retarget contacts based on behavioral and demographic data

Under the applicable data protection legislation/regulations, you have various rights in connection with the processing of your personal information. These rights may differ based on your region.

Intuitive Surgical shall strictly uphold your rights and is responsible for implementing adequate procedures and policies to effectively protect your rights and monitoring compliance with applicable data protection laws and regulations. We will respond and provide information upon request without undue delay and in any event within the legally required timeline for your jurisdiction. That period may be extended where possible by local law.

Please note that we will have to identify you in order to fulfill your request. We will retain archival copies of the information you have requested. Until our backups are overwritten, we will retain the information, but make no further use of your personal information. You can submit your requests to our Data Privacy Office via email at data.privacy@intusurg.com or via phone at (800) 876-1310 (in the US).

As a data subject, your rights may include the following, depending on your jurisdiction and applicable laws:

11.1 EU/EEA, Japan, South Korea, Switzerland and UK privacy rights

If you are a resident of the European Union, European Economic Area, Japan, South Korea, Switzerland or the United Kingdom, the disclosures set out below apply to you in addition to the disclosures set out in the general sections of this Privacy Notice.

To exercise your rights, to obtain details of our data transfer safeguards, or for any other questions related to personal information, you may contact our Data Privacy Office by emailing data.privacy@intusurg.com.

When necessary, we may request identifying information from you to confirm your identity. We will respond to requests in accordance with applicable data protection law.

Intuitive Surgical, Inc.; Intuitive Surgical Operations, Inc.; Intuitive Surgical Holdings, LLC; Intuitive Surgical International Finance, LLC; Intuitive Venture Fund I, LLC; KindHeart, LLC; Orpheus Medical USA, Inc. and Intuitive Surgical Service Optic, Inc. (hereinafter: “Intuitive Surgical Entities Certified under the Data Privacy Framework”) comply with and are certified under the EU-US Data Privacy Framework Principles (“EU-US DPF”) and the UK Extension to the EU-US DPF (“UK-US Data Bridge”) as set forth by the US Department of Commerce, with regard to the processing of personal data originating from the European Union and the United Kingdom. Intuitive has certified to the US Department of Commerce that it adheres to the Swiss-US Data Privacy Framework principles (“Swiss-US DPF”) with regard to the processing of personal data originating from Switzerland in reliance on the Swiss-US DPF. If there is any conflict between the terms in this Privacy Notice and the Principles of the EU-US DPF and/or the UK-US Data Bridge and/or the Swiss-US DPF, the Principles of the EU-US DPF, the UK-US Data Bridge and the Swiss-US DPF shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

The Intuitive Surgical Entities Certified under the Data Privacy Framework may be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) or any other U.S. authorized statutory body. Under the DPF Principles, we are liable (unless we prove that we are not responsible for the event giving rise to the harm) if one of our agents processes personal information in a manner inconsistent with the DPF Principles.

Where data transfers are not covered by the EU-US DPF, the UK-US Data Bridge or the Swiss-US DPF and where applicable, we have implemented international data transfer agreements based on standard contractual clauses covering onward transfers where applicable; a copy of these clauses can be obtained by contacting us at data.privacy@intusurg.com.

If you believe that any Intuitive Surgical Entity Certified under the Data Privacy Framework has failed to comply with its Data Privacy Framework certification, you may exercise your right by contacting JAMS at https://www.jamsadr.com/DPF-Dispute-Resolution. If you have an unresolved privacy concern that we have not addressed satisfactorily, you may contact your local data protection authority. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Intuitive Surgical commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship. If neither Intuitive nor your local data protection authority resolves your inquiry or complaint, you may have the possibility to engage in binding arbitration through the Data Privacy Framework Panel. For more information on this option, please see Annex I of the EU-U.S. Data Privacy Framework Principles.

Right to access. You are entitled to obtain confirmation from Intuitive as to whether or not any personal information concerning you is processed by Intuitive.

You have the right to access such personal information, to obtain a copy of it free of charge (except for repetitive or excessive requests) and to be provided with the following information: (i) purposes of such processing, (ii) categories of personal information concerned, (iii) recipients or categories of recipients of personal information, in particular recipients in third countries where there is not an adequacy decision, (iv) the envisaged retention period or, if not possible, the criteria used to determine it, (v) existence of the right to request rectification or erasure of personal information, as well as the right to object to or request restriction of processing, (vi) the right to lodge a complaint with a supervisory authority, (vii) information relating to any third party source of personal information if the data were not collected from you and (viii) the existence, the logic involved, the significance and the consequences of any automated decisions, including profiling. Where personal information is transferred outside of your home jurisdiction, we will accomplish the transfer as described in this Privacy Notice.

Right to rectification. You have the right to obtain without undue delay the rectification of inaccurate, incomplete or outdated personal information concerning you.

Right to erasure. You have the right to obtain without undue delay the erasure of your personal information in one of the following cases:

• The personal information is no longer necessary in relation to the purpose(s) for which it was collected or otherwise processed;
• You withdraw the consent on which the processing was based and there are no other legal grounds for the processing;
• You object to the processing, as provided in the “Right to object” section below;
• Your personal information has been unlawfully processed; or
• Your personal information has to be erased for compliance with a legal obligation.

However, Intuitive may refuse the erasure of personal information if the processing of such data is necessary for (i) exercising the right of freedom of expression and information, (ii) compliance with a legal obligation or for the performance of a task carried out in the public interest, (iii) reasons of public interest in the area of public health, scientific or historical research purposes or statistical purposes, or (iv) establishment, exercise or defense of legal claims.

Right to restriction. You have the right to obtain restriction of processing in the following cases:

• Where you claim inaccuracy of your personal information processed by us (the restriction being provided for a period enabling Intuitive to verify the accuracy);
• Where the processing appears unlawful and you oppose the erasure and request the restriction of use of your personal information instead;
• Where Intuitive does not need your personal information for the purposes of processing, but the personal information is required by you for the establishment, exercise or defense of legal claims; and
• Where an objection is raised by you in relation to the processing, pending the verification whether the legitimate grounds of Intuitive override those of you.

When you have obtained a restriction of processing of your personal information, you will be informed prior to lifting of such restriction.

Right to object. As a general rule, you have the right to object, at any time and on legitimate grounds relating to your particular situation, to the processing of your personal information. Provided that such objection is justified, Intuitive will no longer process the personal information concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests.

Right to data portability (not applicable in South Korea). In cases where the data processing is based on your consent or on your contract and where such processing is carried out by automated means, you can request us (i) to communicate to you the personal information concerning you, in a structured, commonly used and machine-readable format, in order to be able to further transmit such personal information to another data controller, or (ii) to directly transmit such personal information to such other data controller, if technically feasible. However, Intuitive can refuse such request if the processing concerned is necessary for the performance of a task carried out in the public interest or if responding to such request risks to adversely affect the rights and freedoms of others.

Right to withdraw consent. Where the processing of your personal information is based on consent, you have the right to withdraw such consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint. You also have the right to lodge a complaint with the competent supervisory authority.

You will never be discriminated against if you exercise your rights.

11.2 Israel and Taiwan privacy rights

If you are in Israel or Taiwan, the disclosures set out below apply to you in addition to the disclosures set out in the general sections of this Privacy Policy.

Right to access. You are entitled to obtain confirmation from Intuitive as to whether any personal information concerning you is processed by Intuitive. You have the right to access such personal information, to obtain a copy.

Right to rectification. You have the right to obtain without undue delay the rectification of inaccurate, incomplete or outdated personal information concerning you.

Right to erasure. You have the right to obtain without undue delay the erasure of your personal information in certain cases and subject to certain limitations.

Right to restriction. You have the right to request that we restrict the use, collection or processing of data under certain circumstances.

Right to withdraw consent. Where the processing of your personal information is based on consent, you have the right to withdraw such consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint. You also have the right to lodge a complaint with the competent supervisory authority.

To exercise your rights, you may contact our data protection office by emailing data.privacy@intusurg.com.

When necessary, we may request identifying information from you to confirm your identity. We will respond to requests in accordance with applicable data protection law.

You will never be discriminated against if you exercise your rights.

11.3 Canada privacy rights

If you are in Canada, the disclosures set out below apply to you in addition to the disclosures set out in the general sections of this Privacy Notice.

Right to access. You are entitled to obtain confirmation from Intuitive as to whether any personal information concerning you is processed by Intuitive. You have the right to access such personal information, to obtain a copy.

Right to rectification. You have the right to obtain without undue delay the rectification of inaccurate, incomplete or outdated personal information concerning you.

To exercise your rights, you may contact our Data Privacy Office by emailing data.privacy@intusurg.com.

When necessary, we may request identifying information from you to confirm your identity. We will respond to requests in accordance with applicable data protection law.

You will never be discriminated against if you exercise your rights.

11.4 California privacy rights

California Civil Code Section 1798.83 permits individual California residents to request certain information regarding our disclosure of certain categories of personal information to third parties for those third parties’ direct marketing purposes. To make such a request, please contact us using the information in the “Contact Us” section below. This request may be made no more than twice in a 12-month period and we reserve our right not to respond to requests submitted other than to the email or mailing addresses specified below. Note that we do not currently share personal information with third parties for those third parties’ direct marketing purposes.

In addition, California residents have the following privacy rights:

The right to know. You have the right to request to know (i) the categories of personal information we have collected about you in the last 12 months, (ii) the specific pieces of personal information we have about you, (iii) the categories of sources from which that personal information was collected, (iv) the categories of your personal information that we sold or disclosed in the last 12 months, (v) the categories of third parties to whom your personal information was sold or disclosed in the last 12 months, and (vi) the purpose for collecting and selling your personal information.

Right to correct. You have the right to obtain without undue delay the correction of inaccurate, incomplete or outdated personal information concerning you.

The right to deletion. You have the right to request that we delete the personal information that we have collected or maintain about you. We may deny your request under certain circumstances, such as if we need to comply with our legal obligations or complete a transaction for which your personal information was collected. If we deny your request for deletion, we will let you know the reason why.

The right to equal service. If you choose to exercise any of these rights, Intuitive will not discriminate against you in anyway. If you exercise certain rights, understand that you may be unable to use or access certain features of our websites or services.

Right to opt-out the “sale” or “share” of your personal information (as defined in the CCPA and CPRA respectively). Intuitive does not “sell” or “share” your personal information for monetary value. However, some third-party cookies and other trackers placed on our Sites may be considered a “sale” or a “share” when used for our “targeted” or “cross-contextual” advertising campaigns. If you opt-in to targeting cookies, we allow trusted parties to collect via cookies certain information about you when you interact with our Sites to provide you with targeted advertising. You can opt-out of these cookies as detailed in “Cookie and trackers” section above by changing your cookie preferences here. Alternatively, you can rely on an opt-out preference signal to tell us you wish to opt out of us “selling” or “sharing” your personal information. We will recognize the opt-out preference signal in a “frictionless” manner. We will not (i) charge you for using it, (ii) change your experience with our products and services, or (iii) display pop-ups or other notifications in response to your opt-out signal other than a status indicator.

You may exercise your right to know twice a year free of charge. To exercise your rights, contact us using the information provided in the “Contact Us” section below.

We will take steps to verify your identity before processing your request. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the individual about whom we collected personal information. We will only use the personal information provided in the verification process to verify your identity or authority to make a request and to track and document request responses, unless you initially provided the information for another purpose.

You may use an authorized agent to submit a request. When we verify your agent’s request, we may verify your identity and request a signed document from your agent that authorizes your agent to make the request on your behalf. To protect your personal information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on their behalf.

11.5 Notice to residents of Nevada

If you are a Nevada resident, you have the right to opt out of the sale of certain personal information, including your name and mailing address, to third parties. As of the date of this Privacy Notice, Intuitive does not sell any personal information to any third party. If that changes in the future, we will update this Privacy Notice.

This Privacy Notice is subject to change at any time, so please check back periodically. If significant changes are made in how your personal information is collected, shared, or otherwise processed, we will update this Privacy Notice and post an alert on our website.

Any inquiry regarding our Privacy Notice can be addressed to the Data Privacy Office at data.privacy@intusurg.com.

The Privacy Notice effective date is at the top of this page.