Leica Biosystems Privacy Policy

Leica Biosystems values your privacy and the protection of your personal data. This notice (“Notice”) explains how Leica Biosystems and its affiliates, subsidiaries and related companies under its control (each a "Company Entity”) (together, “Leica Biosystems”, “our”, “us” or “we”), collects, uses, shares, transfers, discloses and processes data collected from or about you. If you are an associate (employee) of Leica Biosystems or another Danaher Entity (as defined below), your privacy rights are outlined in the Danaher Associate Privacy Notice provided by your local HR team and available on Danaher Connect.

The particular Company Entity with which you interact is, where applicable, the data controller (or equivalent under applicable law(s)) responsible for the processing of your Personal Data (as defined below). We are part of the Danaher corporate organization and may process data from, or make data available to, other Danaher subsidiaries, affiliates, or other entities under common ownership (“Danaher Entities”), as appropriate under law and for the purposes described below. Please note that Leica Biosystems is legally separate from and does not control the Danaher Entities other than the Company Entities. You can find a list of relevant Danaher Entities (including the Company Entities) that act as data controllers in Appendix 1 to this Policy.

This Notice is divided into sections to help you find information more easily. If you are after specific information, please click on the relevant section in the list below to navigate directly to it:

1. Scope
2. Your information
3. General categories of Personal Data collected
4. How do we use this information and what is the legal basis for this use?
5. Health information
6. Aggregated, anonymized and de-identified data
7. Combining information
8. Information collected from minors
9. Cross-border data transfers
10. Sale or transfer of business
11. Cookies, web beacons and other tracking tools
12. Third-party links and tools
13. Recipients of Personal Data
14. Data retention
15. Your rights and choices
16. Contact us
17. Updates
18. Appendix 1

This Notice describes the types of Personal Data that we may collect, process or disclose about you and how you may govern this processing by exercising applicable legal rights. This Notice applies to both online and offline information collection, including through your use of websites or subdomains operated by us or any mobile applications, when we provide products and/or services to you, when we notify you about prospective items of interest or regulatory notices, and in other situations where you interact with us in person, by telephone or by mail where this Notice is posted or referenced.

There may be occasions where you have been provided with a circumstance-specific privacy notice that is separate from this Notice, such as privacy notices for specific activities such as recruitment. To the extent you were provided with a different notice, that notice shall apply and govern our interactions with you. If you provide Personal Data about parties other than yourself, you are responsible for ensuring their knowledge of how we will process their Personal Data, and, where applicable, obtaining any necessary consent(s) required in advance.

We are committed to processing Personal Data in accordance with applicable laws. Please note that if you do not wish to provide your Personal Data to us, some products and/or services may become unavailable to you. Personal Data that is mandatory is indicated on relevant forms that you complete or is communicated by us separately. Your use of any or all of our online platforms indicates that you have been notified of our collection, use, sharing, transfer, processing and disclosure of your Personal Data, as described in this Notice and to the extent permitted by applicable law(s).

We connect with individuals for many different reasons. Those interactions may result in us directly or indirectly gaining access to Personal Data about you. The below tables summarize how we may collect, process, and use Personal Data, our legal basis for processing your Personal Data, and the potential recipients of your Personal Data. The described instances may not be applicable in all circumstances.

The table below sets out the categories of Personal Data that may be processed under this Notice. We collect and process Personal Data about you when you interact with us and our websites, and when you purchase goods and services from us.

“Personal Data” is any information that can be used to directly or indirectly identify an individual or that can be reasonably expected to link to an individual. This can include items such as name, address, telephone number, credit card details, email address, ID number, Internet Protocol (“IP”) address of an electronic device used by an individual, or other identifying codes (even absent of other identifying information). Statistical and metric data that are not identifiable to an individual are not considered Personal Data.

This includes:

Sometimes we receive information about you from third parties. In particular:

• other Danaher Entities and Company Entities, including (among other things) information about your relationships with them and interactions with their websites, products or services;
• our customers (which may include healthcare providers), in connection with our services to customers, post-market clinical follow-ups and clinical trials;
• other third parties we work with, including (among others) business partners such as joint marketers, distributors, webinar and event providers, service providers in technical, payment and delivery services, advertising networks, analytics providers, search information providers and credit reference agencies;
• publicly-available sources (where possible) to keep your information up to date (such as professional registration databases, official registers, websites, healthcare provider directories and social media platforms);
• if you are a healthcare provider, we obtain your Identity and Contact Information, and Professional and Educational Information from publicly-available resources (such as official registers, websites, directories of healthcare professionals and similar resources); and
• your employer for administrative purposes, such as the facilitation of events.

There are instances where we have a legitimate interest to use your data. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operation(s) we carry out. You can obtain further information about our legitimate interests by using the contact details at the end of this Notice.

When we process Health Information, we do so in connection with our services for business customers and pursuant to separate privacy notices provided to you by our customer or otherwise provided at the time of data collection. This Notice does not apply to such Health Information, which is governed by the relevant notices provided to you and by our customer agreements. For example, if you are a patient based in the United States of America, this Notice is distinct from your healthcare provider’s HIPAA Notice of Privacy Practices, which describes how your healthcare provider uses and discloses the protected health information that it collects, as well as any other privacy practices it applies to that information.

Leica Biosystems may process anonymized/de-identified data. This is data for which the characteristics that can identify you, directly or indirectly, have been removed such that you are no longer identifiable. This information is no longer considered Personal Data under data protection laws. This includes, in the United States, the removal of identifiers from protected health information required under HIPAA (45 CFR § 164.514(b)(2)) or another permissible method for such data to be considered de-identified. We rely on our legitimate business interests, scientific or historical research and/or statistical purposes, consent or other purposes that may be required or allowed by law as the legal basis to anonymize Personal Data.

We may also obtain and use certain types of combined datasets (such as demographic data) for any purpose (“Aggregated Data”). Aggregated Data may be derived from your Personal Data but does not directly or indirectly reveal your identity. For example, we may aggregate certain information technology-related data of yours with others’ data to calculate the percentage of users accessing a specific feature on our website. We may use Aggregated Data for any purpose without restriction. However, if we re-combine or re-connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we then treat the combined data as Personal Data (which will be used in accordance with this Notice).

We combine information we collect on the website with information we receive from you in person, by email, or by other forms of communication. We also combine information you provide with information we obtain from third parties, service providers, publicly available sources and Danaher Entities.

We do not knowingly collect Personal Data from minors without the permission of such minors’ parents or legal guardians.

We may transfer your Personal Data to recipients (including our affiliates or third-party service providers) in countries other than the country in which your Personal Data was originally collected. When we transfer your Personal Data in such a manner, we take steps to ensure your Personal Data is protected in a way that is consistent with the laws and requirements in your country (including any requirements that apply to cross-border data transfers). Where Personal Data is transferred outside the EEA and/or UK, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, does not fall under the UK government adequacy regulations, or is not considered adequate under applicable data protection laws, we take steps to require that your Personal Data is adequately protected. This includes using the EU Commission approved standard contractual clauses, the UK Information Commissioner approved standard contractual clauses, or a vendor's Processor Binding Corporate Rules. We implement appropriate technical and organizational measures to provide a level of security appropriate to the risk of protecting your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

A copy of the relevant mechanisms can be obtained for your review on request by using the contact details below.

If we are involved in a sale or transfer of all or some of our business assets or operations via (among other mechanisms) a share or asset transaction, your Personal Data may be transferred to the acquiring organization(s), who will be required to take at least the same or higher standards of care in the treatment of your Personal Data. Should such a sale or transfer occur, if required by law, you will be informed about this and may withdraw your consent to the transfer of your Personal Data (if relevant to the processing) or, as applicable, instigate any other legally-available rights, as detailed in the “Your Rights and Choices” section of this Notice with regards to the processing and use of your Personal Data by the transferee.

As outlined in the table above, your interactions with our websites are an additional source for collecting your information. We may use cookies, web beacons and other technologies to help us evaluate and improve the content or functions of the products or services we provide.

Our Cookie Policy provides more detailed information about this topic and how we use cookies to enhance your experience and better serve you.

On our websites, apps and/or platforms, we may link to other websites, apps and/or platforms that we do not control. If you click on a third-party link, you will be taken to a website, app and/or platform we do not control. This Notice does not apply to the privacy practices of those websites, apps and/or platforms. Read the other companies’ privacy policies carefully as we are not responsible for these third parties. Our websites, apps and/or platforms may also serve third party content that contains their own cookies or tracking technologies. We do not control the use of those technologies.

We may share your Personal Data with the following categories of recipients:

We will retain Personal Data for as long as is necessary to carry out the purpose(s) the Personal Data was collected for, or for the period prescribed by applicable laws (whichever is longer). In considering how long to retain your Personal Data, the following are considered:

• the potential risk(s) of harm if the data were subject to unauthorized use or disclosure;
• the volume and sensitivity of the Personal Data;
• the purpose(s) for processing your Personal Data;
• whether we need to keep a record of the relationship we have or had with you;
• if we need to keep a record for possible future legal claims;
• applicable legal or regulatory requirements;
• applicable industry standards or guidelines; and
• if circumstances have changed such that the purposes for which the Personal Data was collected can be achieved by other means.

When the retention of your Personal Data is no longer required, we will delete or anonymize/de-identify the Personal Data as per the details provided above, or, if this is not immediately possible (for example, because your Personal Data has been stored in backup archives), then we will securely store your Personal Data and isolate it from any further processing until deletion is accomplished.

Some jurisdictions have provided individuals with rights in relation to the processing of their Personal Data. These rights are not available to everyone, and they do not necessarily apply in all contexts. Depending on the applicable laws or legal bases, you may have the right to:

• object to the processing of your Personal Data;
• request access to your Personal Data;
• request the correction of your Personal Data if it is inaccurate, incomplete, or obsolete;
• request the erasure/deletion of your Personal Data;
• withdraw your consent to the future processing of your Personal Data where we processed Personal Data on the basis of your consent;
• request restrictions on the processing of your Personal Data, including restricting the sale or sharing of your Personal Data;
• request the transfer (also known as “porting”) of your Personal Data to yourself or a third party; and/or
• opt-out of any or all of our marketing communications, or object to us carrying out profiling for the purposes of direct marketing.

To exercise a right that you believe you may be entitled to under applicable law(s), you can contact us directly by submitting a request through this webform. We may need to verify your identity before we fulfill your request. Otherwise, under applicable laws, we may be unable to action your submission. We will notify you in a timely manner of such decisions or requirements, as necessary.

Whenever we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent (before its withdrawal). We may, however, have other legal grounds for processing your data for other purposes (such as those set out above).

California Residents. Our California Consumer Rights Notice provides certain information required by California law and an overview of how consumers in California can exercise certain privacy rights and protections.

Filing a Complaint. If you are not able to resolve a problem directly with us and wish to make a formal complaint, you can contact your local data protection authority or other enforcement authorities.

If you have any questions about this Notice or our data practices, you can write to us at:

Leica Biosystems
21440 W. Lake Cook Road
Floor 5
Deer Park, IL 60010 United States

Alternatively, you can email us directly at privacy@leicabiosystems.com.

From time to time, we may change our privacy policies. The most updated copy will be found on our website. Please check our site periodically for updates.

Your information is controlled by Company Entities and Danaher Entities. The full list of relevant Danaher Entity controllers and their contact details can be found in the table below.

Japan Appendix

This Appendix applies if you live in Japan or the processing of your Personal Data is otherwise subject to the Act on the Protection of Personal Information of Japan (“APPI”). This Appendix should be read in conjunction with and in addition to the main body of the Privacy Policy to which this Appendix is attached.

Purpose of Processing the Personal Data

The detailed purpose of processing the Personal Data provided in the main body of the Privacy Policy will be as follows:
Marketing 

1. To provide information of our products and services;
2. To provide products and services which are registered or requested;
3. To distribute our newsletter;
4. To deliver products/services requested or ordered;
5. To provide information/invitation relating to trade shows, events where we showcase our products, workshops, or seminars;
6. To provide the results in case a data provider cooperates with us for events and questionnaires;
7. To provide service via communication media such as email, facsimile;
8. To conduct marketing surveys, analysis, and/or measures;
9. To contact customers and respond to inquiries; and/or
10. Other ancillary purpose relating to the above;

Internal Research 

1. To conduct internal audit or receive external audit; and/or
2. To conduct internal research or investigations

Development 

1. To obtain customer and business partner feedback specific to the development of new products; and/or
2. To conduct internal research

Quality Assurance

1. To respond to customer inquiries regarding the quality of our products or services;
2. To implement countermeasures to any (possible) quality failures of our products or services; and/or
3. Other ancillary purposes necessary to maintain and achieve the required quality of our products and services

Notice Regarding Joint Use of Personal Data Under the APPI 
We may jointly use your Personal Data within Danaher Entities (including the Company Entities) here as described in the main body of the Privacy Policy as follows.

• Items of Personal Data to be jointly used: Identity and Contact Information, Commercial and Financial Information, Professional and Educational Information and Technical Information
• Scope of Joint Users: Danaher Entities here (including those entities outside of Japan)
• Purposes of Joint Use: As provided in the Purpose of Processing the Personal Data in the main body of the Privacy Policy and this Appendix
• Name and Address of the Entity Responsible for Personal Data Management and Name of its Representative: Leica Microsystems, Inc. Leica Biosystems Division 1-29-9 Takadanobaba, Shinjuku-ku, Tokyo 169-0075 Japan. Point of contact: Abe, Ikubo, and Katayama (danaher-legal@aiklaw.co.jp)

All Danaher Entities, as included in the link above, have entered into a data protection agreement and will take necessary measures in order to meet the requirements for cross-border data transfer stipulated by the APPI and other applicable laws and ensure that the level of protection of the Personal Data is not undermined.