Personal Data Privacy Policy

Our Sites may contain links or references to other websites outside of our control. Please be aware that this Privacy Notice does not apply to those other websites. Intuitive encourages you to read the privacy statements and terms and conditions of linked or referenced websites you enter. These third-party websites may send their own cookies and other tracking devices to you, log your IP address, and otherwise collect data or solicit personal information.

Under the applicable data protection legislation/regulations, you have various rights in connection with the processing of your personal information. These rights may differ based on your region.

Intuitive Surgical shall strictly uphold your rights and is responsible for implementing adequate procedures and policies to effectively protect your rights and monitoring compliance with applicable data protection laws and regulations. We will respond and provide information upon request without undue delay and in any event within the legally required timeline for your jurisdiction. That period may be extended where possible by local law.

Please note that we will have to identify you in order to fulfill your request. We will retain archival copies of the information you have requested. Until our backups are overwritten, we will retain the information, but make no further use of your personal information. You can submit your requests to our Data Privacy Office via email at data.privacy@intusurg.com, or via phone at (800) 876-1310 (in the US).

As a data subject, your rights may include the following, depending on your jurisdiction and applicable laws:

11.1. EU/EEA, Japan, South Korea, Switzerland and UK privacy rights

If you are a resident of the European Union, European Economic Area, Japan, South Korea, Switzerland or the United Kingdom, the disclosures set out below apply to you in addition to the disclosures set out in the general sections of this Privacy Notice.

To exercise your rights, to obtain details of our data transfer safeguards, or for any other questions related to personal information, you may contact our Data Privacy Office by emailing data.privacy@intusurg.com.

When necessary, we may request identifying information from you to confirm your identity. We will respond to requests in accordance with applicable data protection law.

Intuitive Surgical, Inc.; Intuitive Surgical Operations, Inc.; Intuitive Surgical Holdings, LLC; Intuitive Surgical International Finance, LLC; Intuitive Venture Fund I, LLC; KindHeart, LLC; Orpheus Medical USA, Inc. and Intuitive Surgical Service Optic, Inc. (hereinafter: “Intuitive Surgical Entities Certified under the Data Privacy Framework”) comply with and are certified under the EU-US Data Privacy Framework Principles (“EU-US DPF”) and the UK Extension to the EU-US DPF (“UK-US Data Bridge”) as set forth by the US Department of Commerce, with regard to the processing of personal data originating from the European Union and the United Kingdom. Intuitive has certified to the US Department of Commerce that it adheres to the Swiss-US Data Privacy Framework principles (“Swiss-US DPF”) with regard to the processing of personal data originating from Switzerland in reliance on the Swiss-US DPF. If there is any conflict between the terms in this Privacy Notice and the Principles of the EU-US DPF and/or the UK-US Data Bridge and/or the Swiss-US DPF, the Principles of the EU-US DPF, the UK-US Data Bridge and the Swiss-US DPF shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

The Intuitive Surgical Entities Certified under the Data Privacy Framework may be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) or any other U.S. authorized statutory body. Under the DPF Principles, we are liable (unless we prove that we are not responsible for the event giving rise to the harm) if one of our agents processes personal information in a manner inconsistent with the DPF Principles.

Where data transfers are not covered by the EU-US DPF, the UK-US Data Bridge or the Swiss-US DPF and where applicable, we have implemented international data transfer agreements based on standard contractual clauses covering onward transfers where applicable; a copy of these clauses can be obtained by contacting us at data.privacy@intusurg.com.

If you believe that any Intuitive Surgical Entity Certified under the Data Privacy Framework has failed to comply with its Data Privacy Framework certification, you may exercise your right by contacting JAMS at https://www.jamsadr.com/DPF-Dispute-Resolution. If you have an unresolved privacy concern that we have not addressed satisfactorily, you may contact your local data protection authority. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Intuitive Surgical commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship. If neither Intuitive nor your local data protection authority resolves your inquiry or complaint, you may have the possibility to engage in binding arbitration through the Data Privacy Framework Panel. For more information on this option, please see Annex I of the EU-U.S. Data Privacy Framework Principles.

Right to access. You are entitled to obtain confirmation from Intuitive as to whether or not any personal information concerning you is processed by Intuitive.

You have the right to access such personal information, to obtain a copy of it free of charge (except for repetitive or excessive requests) and to be provided with the following information: (i) purposes of such processing, (ii) categories of personal information concerned, (iii) recipients or categories of recipients of personal information, in particular recipients in third countries where there is not an adequacy decision, (iv) the envisaged retention period or, if not possible, the criteria used to determine it, (v) existence of the right to request rectification or erasure of personal information, as well as the right to object to or request restriction of processing, (vi) the right to lodge a complaint with a supervisory authority, (vii) information relating to any third party source of personal information if the data were not collected from you and (viii) the existence, the logic involved, the significance and the consequences of any automated decisions, including profiling. Where personal information is transferred outside of your home jurisdiction, we will accomplish the transfer as described in this Privacy Notice.

Right to rectification. You have the right to obtain without undue delay the rectification of inaccurate, incomplete or outdated personal information concerning you.

Right to erasure. You have the right to obtain without undue delay the erasure of your personal information in one of the following cases:

• The personal information is no longer necessary in relation to the purpose(s) for which it was collected or otherwise processed;
• You withdraw the consent on which the processing was based and there are no other legal grounds for the processing;
• You object to the processing, as provided in the “Right to object” section below;
• Your personal information has been unlawfully processed; or
• Your personal information has to be erased for compliance with a legal obligation.

However, Intuitive may refuse the erasure of personal information if the processing of such data is necessary for (i) exercising the right of freedom of expression and information, (ii) compliance with a legal obligation or for the performance of a task carried out in the public interest, (iii) reasons of public interest in the area of public health, scientific or historical research purposes or statistical purposes, or (iv) establishment, exercise or defense of legal claims.

Right to restriction. You have the right to obtain restriction of processing in the following cases:

• Where you claim inaccuracy of your personal information processed by us (the restriction being provided for a period enabling Intuitive to verify the accuracy);
• Where the processing appears unlawful and you oppose the erasure and request the restriction of use of your personal information instead;
• Where Intuitive does not need your personal information for the purposes of processing, but the personal information is required by you for the establishment, exercise or defense of legal claims; and
• Where an objection is raised by you in relation to the processing, pending the verification whether the legitimate grounds of Intuitive override those of you.

When you have obtained a restriction of processing of your personal information, you will be informed prior to lifting of such restriction.

Right to object. As a general rule, you have the right to object, at any time and on legitimate grounds relating to your particular situation, to the processing of your personal information. Provided that such objection is justified, Intuitive will no longer process the personal information concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests.

Right to data portability (not applicable in South Korea). In cases where the data processing is based on your consent or on your contract and where such processing is carried out by automated means, you can request us (i) to communicate to you the personal information concerning you, in a structured, commonly used and machine-readable format, in order to be able to further transmit such personal information to another data controller, or (ii) to directly transmit such personal information to such other data controller, if technically feasible. However, Intuitive can refuse such request if the processing concerned is necessary for the performance of a task carried out in the public interest or if responding to such request risks to adversely affect the rights and freedoms of others.

Right to withdraw consent. Where the processing of your personal information is based on consent, you have the right to withdraw such consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint. You also have the right to lodge a complaint with the competent supervisory authority.

You will never be discriminated against if you exercise your rights.

11.2. Israel and Taiwan privacy rights

If you are in Israel or Taiwan, the disclosures set out below apply to you in addition to the disclosures set out in the general sections of this Privacy Notice.

Right to access. You are entitled to obtain confirmation from Intuitive as to whether any personal information concerning you is processed by Intuitive. You have the right to access such personal information, to obtain a copy.

Right to rectification. You have the right to obtain without undue delay the rectification of inaccurate, incomplete or outdated personal information concerning you.

Right to erasure. You have the right to obtain without undue delay the erasure of your personal information in certain cases and subject to certain limitations.

Right to restriction. You have the right to request that we restrict the use, collection or processing of data under certain circumstances.

Right to withdraw consent. Where the processing of your personal information is based on consent, you have the right to withdraw such consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint. You also have the right to lodge a complaint with the competent supervisory authority.

To exercise your rights, you may contact our Data Privacy Office by emailing data.privacy@intusurg.com.

When necessary, we may request identifying information from you to confirm your identity. We will respond to requests in accordance with applicable data protection law.

You will never be discriminated against if you exercise your rights.

11.3. Canada privacy rights

If you are in Canada, the disclosures set out below apply to you in addition to the disclosures set out in the general sections of this Privacy Notice.

Right to access. You are entitled to obtain confirmation from Intuitive as to whether any personal information concerning you is processed by Intuitive. You have the right to access such personal information, to obtain a copy.

Right to rectification. You have the right to obtain without undue delay the rectification of inaccurate, incomplete or outdated personal information concerning you.

To exercise your rights, you may contact our Data Privacy Office by emailing data.privacy@intusurg.com.

When necessary, we may request identifying information from you to confirm your identity. We will respond to requests in accordance with applicable data protection law.

You will never be discriminated against if you exercise your rights.

11.4. California privacy rights

California Civil Code Section 1798.83 permits individual California residents to request certain information regarding our disclosure of certain categories of personal information to third parties for those third parties’ direct marketing purposes. To make such a request, please contact us using the information in the “Contact Us” section below. This request may be made no more than twice in a 12-month period and we reserve our right not to respond to requests submitted other than to the email or mailing addresses specified below. Note that we do not currently share personal information with third parties for those third parties’ direct marketing purposes.

In addition, California residents have the following privacy rights:

The right to know. You have the right to request to know (i) the categories of personal information we have collected about you in the last 12 months, (ii) the specific pieces of personal information we have about you, (iii) the categories of sources from which that personal information was collected, (iv) the categories of your personal information that we sold or disclosed in the last 12 months, (v) the categories of third parties to whom your personal information was sold or disclosed in the last 12 months, and (vi) the purpose for collecting and selling your personal information.

Right to correct. You have the right to obtain without undue delay the correction of inaccurate, incomplete or outdated personal information concerning you.

The right to deletion. You have the right to request that we delete the personal information that we have collected or maintain about you. We may deny your request under certain circumstances, such as if we need to comply with our legal obligations or complete a transaction for which your personal information was collected. If we deny your request for deletion, we will let you know the reason why.

The right to equal service. If you choose to exercise any of these rights, Intuitive will not discriminate against you in anyway. If you exercise certain rights, understand that you may be unable to use or access certain features of our websites or services.

Right to opt-out the “sale” or “share” of your personal information (as defined in the CCPA and CPRA respectively). Intuitive does not “sell” or “share” your personal information for monetary value. However, some third-party cookies and other trackers placed on our Sites may be considered a “sale” or a “share” when used for our “targeted” or “cross-contextual” advertising campaigns. If you opt-in to targeting cookies, we allow trusted parties to collect via cookies certain information about you when you interact with our Sites to provide you with targeted advertising. You can opt-out of these cookies as detailed in “Cookie and trackers” section above by changing your cookie preferences here. Alternatively, you can rely on an opt-out preference signal to tell us you wish to opt out of us “selling” or “sharing” your personal information. We will recognize the opt-out preference signal in a “frictionless” manner. We will not (i) charge you for using it, (ii) change your experience with our products and services, or (iii) display pop-ups or other notifications in response to your opt-out signal other than a status indicator.

You may exercise your right to know twice a year free of charge. To exercise your rights, contact us using the information provided in the “Contact Us” section below.

We will take steps to verify your identity before processing your request. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the individual about whom we collected personal information. We will only use the personal information provided in the verification process to verify your identity or authority to make a request and to track and document request responses, unless you initially provided the information for another purpose.

You may use an authorized agent to submit a request. When we verify your agent’s request, we may verify your identity and request a signed document from your agent that authorizes your agent to make the request on your behalf. To protect your personal information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on their behalf.

11.5. Notice to residents of Nevada

If you are a Nevada resident, you have the right to opt out of the sale of certain personal information, including your name and mailing address, to third parties. As of the date of this Privacy Notice, Intuitive does not sell any personal information to any third party. If that changes in the future, we will update this Privacy Notice.