Privacy Statement

Version 3.0, June 2023

This KabiCare website is made available and operated by Fresenius Kabi Limited.

To use the full functionality of this website, we need to collect and use personal information about you. We take the protection of your personal data very seriously. We need to ensure that personal data is appropriately handled and protected. On this page you can find out what data is collected, why we collect it and how we do this.

Fresenius Kabi Limited is the controller and responsible for your personal data. We have appointed a data protection officer as set out below.

For patients

How we collect your data

We collect your personal data in 3 ways:

1. Data you actively provide yourself, by entering data in the system during the registration process or completing questionnaires and data fields on the website
2. Data that is collected during your use of the website by means of cookies
3. Data that is obtained from other sources, by combining your registration code with information we already have from you

What data we collect

We collect the following data about you

• Your email address
• Your password
• Your type of autoimmune condition
• Health information as provided by completing the coaching tools
• Your activity on the site, through a software called Piwik/Matomo e.g.: how long you stayed, what sites you clicked
• Your IP address, and with that your location (country and city)
• The name of your service provider
• The website that directed you to our site
• Your web browser type
• Your marketing preferences

Why do we collect your data and what do we do with it

We collect the above information to:

1. Allow you to login into the page
2. Enable individualising the content, allow you to obtain adequate information related to your disease type and provide you with coaching
3. Send you optional email reminders on my progress in the program
4. Present the website optimised to the device you are using with all its functions
5. Allow us to optimise our website in the future

We will not use the information as a basis for contacting you further, unless you have given us your explicit consent.

For Healthcare Professionals

How we collect your data

We collect your personal data in 2 ways:

1. Data you actively provide yourself, by entering data in the system during the registration process or completing data fields on the website
2. Data that is collected during your use of the website by means of cookies

What data will we collect

We collect the following data about you:

• Your title
• You first name
• Your last name
• County of residence
• Your healthcare organisation
• Your email address
• Your password
• Your professional registration number (medical council, PSI, NMBI)
• Your IP address, and with that your location (country and city)
• The name of your service provider
• The website that directed you to our site
• Your web browser type
• Your activity on the site (e.g. how long you stayed, what pages you visited on the KabiCare website)

Why do we collect your data and what do we do with it

We collect the above information to:

1. Allow you to register and login to the site
2. Present the website optimised to the device you are using with all its functions
3. Allow us to optimise our website in the future
4. Allow you to access and download restricted resources

We will not use the information as a basis for contacting you further, unless you have given us your explicit consent.

For Patients and Healthcare Professionals

Legal basis for collecting and using your data

We do not process personal data unless we have a proper legal basis.

We collect the information on this website as you have consented to us to collect the data as indicated on the login page and the cookie banner. Furthermore, we have a legitimate interest to ensure the proper functioning of the KabiCare Website and to improve our website services, the protection of the integrity of the Website, our system, as well as its users and due to legal obligation to restrict access to information that is provided to healthcare professional only.

With whom we share the data

We share your data with other entities within the Fresenius Group in order to improve and optimise the website and our processes. These entities can be around the world in countries where the Fresenius Kabi group is active (Please refer to the overview of the locations). The data will be shared only on a need-to-know basis.

We make use of other organisations to make the website available to you. In some cases, these organisations have access to parts or all your data to perform the tasks they are contracted to do so. The organisations that support us are:

1. Voodoo Park LTD, located in 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. This organisation provides web design and technical support for the KabiCare website. They make use of
2. Infusionsoft, located in 1260 S Spectrum Blvd, Chandler (HQ), AZ, United States, this organisation provides the IT systems to store your data, and
3. Consider IT, located in Waterview House, 37 Shore Edinburgh, EH6 6QU. This organisation provides the hosting of the website

Some of these organisations are not located in the EU, but in countries that by the EU Commission are not deemed to ensure an adequate level of data protection (third countries). You can find out how we protect personal data sent to third countries in the International data transfers section of this policy below.

We do not share the information with other organisations, unless legally required to do so.

International data transfers

We may send your personal data in parts or as a whole to Fresenius Group recipients, our service providers or other international organizations in countries, which are not member states of the European Union, for the purposes listed above. Please refer to the overview of the locations in which Fresenius Kabi Group companies are active.

We may send data to the following countries for which the European Commission has determined an adequate level of data protection to be in place that matches the level of data protection within the European Union for the following countries / international organizations in which Fresenius entities are located: Argentina, Canada, Japan, New Zealand, Switzerland or Uruguay.

With regards to such international data transfers to third countries, for which the European Commission has not decided that an adequate level of data protection exists, we have provided appropriate safeguards in order to secure your personal data to a degree that equals the level of data protection in the European Union. These safeguards are:

• For the exchange of data within our company: our Binding Corporate Rules for Controllers
• For the exchange of data with our service providers and other international organizations: Standard Contractual Clauses that have been issued by the European Commission

You can obtain a copy of these Standard Contractual Clauses and our Binding Corporate Rules, online, or upon request.

How long we retain your data

We store your data for different periods:

For patients:

• All Cookie data is stored until you close your browser or there are 10mins of inactivity. For more information on what data is stored and to view or change your cookie settings, see our cookie statement
• Your data contained within your user profile is stored for one year after your last login. Following 11 months of inactivity, you will be notified via email that your user profile will be deleted in one month if your account is not accessed. All data related to you will be deleted from the KabiCare CRM
• If your account is deleted after 12 months of inactivity then you will need to obtain a new access code to re-register on KabiCare

For HCPs:

• All Cookie data is stored until you close your browser or there are 10mins of inactivity. For more information on what data is storeed and to view or change your cookie settings, see our cookie statement
• Your data is stored until requested otherwise. To share a request to remove your data, delete, or suspend your account, contact fresenius.kabi@voodoopark.com
• If your account is deleted you will need to re-register on KabiCare to gain access to restricted content

Alternatively, we store the data until requested.

Your rights and how you can contact us

You may request information regarding the processing of your personal data at any time, including but not limited to the origin and recipients of your data and the purposes of the processing.

You also can request access and obtain a copy of the data and request rectification or erasure of your personal data. Furthermore, you also have the right to request the restriction of processing of your personal data, and the right to data portability.

You are also free to revoke your consent at any time with future effect.

You can find further information on your rights by going to https://www.fresenius-kabi.com/ie/privacy-policy or exercise these rights by going to www.fresenius-kabi.com/ie/data-privacy-contact and filling out and submitting the online form.

You also have the right to file a complaint about how we manage your personal data, with a supervisory authority via https://www.dataprotection.ie/ or through our Data Protection Officer or our Data Protection Adviser.

Our Data Protection Officer for Europe can be contacted as follows:

Fresenius Data Protection Officer
Fresenius SE & Co. KGaA
Data Protection Officer,
Else-Kroener-Straße 1,
61352 Bad Homburg vor der Höhe,
Germany
Email: dataprotectionofficer@fresenius-kabi.com

The Irish/UK Local Data Protection Adviser can be contacted as follows:

Data Protection Adviser
Fresenius Kabi Limited
Cestrian Court
Eastgate Way
Runcorn
WA7 1NT
Email: data.protection-uk@fresenius-kabi.com

Future Changes

This Privacy Statement may change from time to time in compliance with the legal requirements, for example to be compliant with new laws or to add new services. We encourage you to review it from time to time.