Notice of Privacy Practices

THIS NOTICE OF PRIVACY PRACTICES APPLIES TO U.S. CUSTOMERS OF MEDTRONIC DIABETES. THIS NOTICE DESCRIBES HOW YOUR PROTECTED HEALTH INFORMATION MAY BE USED AND DISCLOSED BY MEDTRONIC, AND YOUR RIGHTS REGARDING SUCH INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices ("Notice") explains how Medtronic handles Protected Health Information, as further defined below, created or received by Medtronic MiniMed, Inc. doing business as Medtronic Diabetes ("Medtronic"). This Notice does not apply to personal information collected from Medtronic websites that do not link to this Notice, to Customers of non-U.S. countries or to third-party websites to which Medtronic websites may link.

Medtronic is committed to maintaining the privacy of your Protected Health Information. Medtronic will only use or disclose (share) your Protected Health Information as described in this Notice. You will be asked to sign an acknowledgement that you received this Notice.

> TOP

Definition of Protected Health Information

Protected health information ("PHI") means information that identifies you or could reasonably be used to identify you and which is submitted to and/or collected by Medtronic and maintained by Medtronic in an accessible form, whether oral, electronic or paper.

Examples of PHI include, but are not limited to:

• Information about your diagnosis/disease
• Information about Medtronic products or services provided to you
• Demographic information

> TOP

Medtronic Uses and Disclosures of PHI

Treatment, Payment, or Health Care Operations

Medtronic typically uses or shares your PHI in the following ways:

Treatment. Medtronic may share PHI with third parties for all treatment related purposes. For example, Medtronic may fax or securely email documents with your treating physicians or other health care providers involved in your care about product orders or health care services.

Payment. Medtronic may share your PHI to bill and obtain payment from health plans or other entities, including for example, federal health care programs (Medicare and Medicaid).

Health Care Operations. Medtronic may utilize and share your PHI to run its business, improve your treatment and contact you when necessary. For example, Medtronic may use your PHI to conduct quality or compliance audits, or to review the quality of Medtronic products and services.

> TOP

Other Uses and Disclosures for Which Your Authorization is Not Required

Medtronic may use and disclose your PHI without your written authorization under the following circumstances:

Disclosures to Individuals Involved in Your Care or Payment for Your Care

Medtronic will only disclose your PHI to family members, other relatives, friends or other persons you identify as involved in your care or in your payment for care.

> TOP

Disclosures to Business Associates

Some services are provided by Medtronic through contracts with other companies (“Business Associates”). Medtronic may share your PHI with Business Associates, such as a billing company, who help Medtronic with its business operations. All Medtronic Business Associates must protect the privacy and security of your PHI just as Medtronic does.

> TOP

Disclosures Allowed or Required by Law

• Coroners, Medical Examiners or Funeral Directors: Medtronic may disclose your PHI as needed to such persons for them to do their jobs.
• Corporate Change: In the event of a corporate change resulting from a sale to or merger with another entity, or in the event of a sale of assets or bankruptcy, Medtronic may transfer your PHI to the new party in control or the entity acquiring assets.
• Disaster Relief: Medtronic may need to share your location/general location for the purpose of notifying your family, friends or agencies chartered by law to assist in disaster relief efforts.
• Judicial and Administrative Proceedings: Medtronic may disclose your PHI if required to do so by federal, state, or local law; if ordered by a court or by another properly authorized body; or if you put your PHI at issue in litigation.
• Law Enforcement: Medtronic may disclose your PHI to law enforcement officials to comply with court orders, subpoenas, or warrants or certain wound reporting obligations. If you are an inmate or are detained by a law enforcement officer, Medtronic will disclose your PHI to prison or law enforcement officials only as permitted by law.
• Private or Public Safety: Medtronic may disclose your PHI if Medtronic has a good faith belief that such action is appropriate and necessary to protect and defend the rights of Medtronic, or to protect the safety of Medtronic Customers and the general public.
• Public Health and Safety: Medtronic may disclose your PHI to authorized government health officials to carry out public health activities, including, for example: reporting diseases/population health; reporting suspected abuse, neglect or domestic violence; to avoid a serious threat to public health or safety; monitoring product recalls; or reporting information for safety and quality purposes.
• Research: In most cases, Medtronic will ask for your written authorization before using or disclosing your PHI with others to conduct research. However, in some cases, Medtronic may use or disclose your PHI without prior authorization when the research has been approved by an Institutional Review Board or Privacy Board.
• Worker’s Compensation and Other Government Requests: Medtronic may disclose your PHI in relation to workers’ compensation claims payment or hearings; health oversight agencies for activities authorized by law; or special government functions (e.g., military, national security).

> TOP

Education and Information

Medtronic may use your PHI to provide you with non-promotional and educational information on Medtronic products and therapies, related trainings, programs and events. Medtronic will obtain an authorization for any communications with you for marketing purposes, or any disclosures that constitute a sale of PHI. You may revoke any such written authorization at any time after you provide it.

> TOP

De-Identified Information

Medtronic may de-identify your PHI for the purpose of analytics and business operations. Medtronic complies with the requirements for de-identification under HIPAA to ensure that you cannot be identified as a single unique individual. Once Medtronic has de-identified such information, it is non-personal information, i.e., is no longer considered PHI, and Medtronic may treat it like other non-personal information.

> TOP

Authorization

Medtronic will obtain your authorization or consent before using your PHI or disclosing it to persons or organizations outside of Medtronic in the following situations:

• For marketing or promotional purposes
• Sale of your PHI
• Any other reason not described in this Notice

You may revoke any authorization or consent you have provided to Medtronic in writing, on the application or website where you originally gave authorization/consent, or via email at rs.diabeteslegalprivacy@medtronic.com.

> TOP

How to Access and Control Your Protected Health Information

Access Your Account Record

You may request access to or get an electronic or paper copy of your Medtronic account record, including your medical and billing records. Under certain circumstances, Medtronic may deny your request for a copy of your account record. You may be charged a reasonable cost based fee for your request.

You may also direct Medtronic to transmit your PHI (whether in hard copy or electronic form) directly to an entity or person clearly and specifically designated by you in writing.

> TOP

Amend Your Account Record

If you believe that your PHI is incorrect or incomplete, you may submit a written request for Medtronic to amend your account record, for as long as Medtronic retains your information. Medtronic may deny your request for an amendment, but Medtronic will provide an explanation for the denial in writing within sixty (60) days.

> TOP

Request an Accounting of Disclosures

You may request an "accounting of disclosures," i.e., a list of the times Medtronic shared your PHI and reason for sharing your PHI with other persons or organizations within the past six (6) years. This accounting, however, does not include disclosures that are made directly to you, such as those made for treatment, payment or health care operations. You may receive one free accounting in any twelve (12)-month period. Medtronic will charge you for additional requests.

> TOP

Request Restrictions on Use of Your PHI

You may request a restriction or limitation on the PHI Medtronic uses or discloses for your treatment, payment and health care operations. If you directly pay for a product or service in full (without obtaining insurance coverage), then you may request that Medtronic not disclose any information to your health plan for purposes of payment or health care operations, unless a law requires Medtronic to share such information. Medtronic is not required to agree to any other requests but will review your request.

> TOP

Request Confidential Communications

You may request that Medtronic contact or send PHI to you in a certain way or at a certain location, such as only at work or home, or only by mail. Medtronic will not ask you the reason for your request, and Medtronic will accommodate all reasonable requests.

> TOP

Request a Copy of this Notice

You have the right to receive a copy of this Notice in the format you prefer (paper or electronic) at any time. This Notice is also available on Medtronic’s website at www.medtronicdiabetes.com/notices.

> TOP

Medtronic Responsibilities

Medtronic is required by law to maintain the privacy of your PHI. Medtronic will notify you if a breach occurs that may have compromised the privacy or security of your PHI. Medtronic must follow the practices described in this Notice and will provide a copy of this Notice to you.

> TOP

How to File a Complaint

If you believe your PHI has not been safeguarded, protected, or handled as required by law or pursuant to the terms of this Notice, you may file a complaint with Medtronic by submitting your complaint in writing to our Privacy Official. Medtronic will not retaliate or take action against you for filing any such complaint. If you wish, you may also file a complaint or seek resolution with the Secretary of Health and Human Services (200 Independence Avenue, S.W. Washington, D.C. 20201; (202) 619-0257; https://www.hhs.gov/ocr/index.html)

> TOP

How to contact the Privacy Official for Medtronic Diabetes

If you have any questions, comments or complaints, you may contact the Privacy Official in the Legal Department by phone at (800) 646-4633, by email at rs.diabeteslegalprivacy@medtronic.com, or by mail at the following address:

Medtronic MiniMed, Inc.
ATTN: Privacy Official, Legal Department
18000 Devonshire Street
Northridge, CA 91325-1219

> TOP

Effective Date of this Notice

The effective date of this Notice is April 14, 2003, and it has been updated on October 25, 2018. Medtronic reserves the right to change the terms of this Notice and the changes will apply to all information Medtronic has about you. The new Notice will be available upon request and is also available on Medtronic’s website at www.medtronicdiabetes.com/notices.

> TOP