Welcome to Emperra GmbH E-Health Technologies GmbH, hereinafter referred to as Emperra GmbH. Thank you for your interest in using the ESYSTA product system! The following components are part of this system:

• ESYSTA Pen
• ESYSTA BT Pen
• ESYSTA Lab
• ESYSTA Basic
• ESYSTA Portal
• ESYSTA App
• Compatible devices (medical devices) from other manufacturers

We, Emperra GmbH, attach great importance to protecting your data and safeguarding your privacy. To ensure that you are fully aware of the collection and use of personal data of the ESYSTA product system, please take note of the information below.

1. Personal Data

What is personal data?

This term is defined in Article 4 (1) EU-DSGVO:

"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."

For more information, see:

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

For example, this includes health data. This term is defined in Article 4 (15) of the EU GDPR:

""Health data" Personal data relating to the physical or mental health of a natural person, including the provision of health services, and from which information about his or her health status is obtained."

For more information, see:

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

2. Access data

Emperra GmbH as website operator or page provider collects data about accesses to the page and stores them as server log files. The following data is logged:

• Visit to the ESYSTA portal
• Time at the time of access
• Quantity of data sent in bytes
• Source/reference from which you arrived at the page
• Browser used
• Operating system used
• IP address used

The data collected is used only for statistical analysis and to improve the website. However, the website operator reserves the right to subsequently check the server log files, should concrete indications point to an illegal use. The storage period of this data is a maximum of 14 days.

This is in our legitimate interest. The legal basis for this isArticle 6, paragraph 1f DSGVO.

3. Collection, processing, use and storage of personal data

We collect, process, use and store your personal health data for the purpose of the Diabetes-mellitus management. For this purpose, you create a user account. Your data will be stored for the period in which you ESYSTA use, only collected, processed and stored in accordance with your consent. The legal basis for this is Article 6 paragraph 1 a) as well as Article 9 paragraph 2 a) DSGVO.

Your data will be collected, processed and stored for the period in which you use ESYSTA in accordance with your consent. Even if you delete your ESYSTA account, please note that ourproducts are reimbursable and may therefore be subject to billing by health insurance companies, among others. Billing-relevant data is stored in the customer data management system for 12 months and then in the archive for up to 10 years, which corresponds to thelegal retention periods for companies according to § 147 of the German Fiscal Code (AO) and§ 257 of the German Commercial Code (HGB). Any medical data and values collected in the ESYSTA application are irrevocably deleted when the user account is deleted.

Automated decision making, including profiling according to Article 22 DSGVO does not take place.

When registering, we specifically ask for the following consents:

Required consent:

I agree to the terms and conditions and the privacy policy and consent to the use of my personal data for the intended use of ESYSTA be collected, processed and stored. This is necessary for the use of ESYSTA, billing as well as verification required.

Optional consent:

I agree that Emperra GmbH informs me, for example, to participate in studies or surveys.

Optional consent:

I consent to data processing and data analysis for the purpose of permanently ensuring the technical functionality, user-friendliness and further development of the digital health application.

If you wish to revoke the required consent, you will no longer be able to use ESYSTA. Please use then the "Delete account" option. You can revoke the optional consents at any time and without giving reasons in Revoke the settings of your account.

4. Service agreement

4.1 Use of the ESYSTA product system

By using the ESYSTA product system, you enter into a service agreement with Emperra GmbH on the basis of the the general terms and conditions of Emperra GmbH. The use of the services of this contract is only possible with your declaration of consent. There is no obligation to provide your personal data, neither by contract nor by law. However, information such as name and e-mail mandatory required.

You can at any time use the ESYSTA app and thus the portal even without further medical products/devices of the product system ESYSTA use.

4.2 Use of compatible devices from other manufacturers

4.2.1 Use of the Sanofi^® SoloSmart^®

1. What data is collected?

   When using the Solosmart, the data collected is insulin delivery data, namely:

   • Selected dose,
   • Date of issue,
   • Time of delivery.
2. How is data collected?
   

   data relating to insulin delivery is collected when using the Solosmart.

3. How is data stored and protected?
   

   The data collected is stored in the internal memory of the Solosmart.

   The Solosmart incorporates appropriate technical security measures to preserve the security and confidentiality of the data in order to, amongst others, prevent it from being distorted, damaged, disclosed and accessed by unauthorized third parties.

4. Why is the data collected and what is it used for?
   

   Data is collected to be securely transmitted to the mobile application that will havepreviously been connected to the Solosmart, so that this mobile application can allow medical monitoring.

5. How long is the data kept for?
   

   The Solosmart stores the last 100 insulin deliveries.

   All data collected in the internal memory of the Solosmart is erased by resetting it.

6. What are the rights of users?
   

   In accordance with the applicable regulations and under the conditions defined therein,users may at any time exercise their applicable rights (data erasure) by resetting the Solosmart.

5. Cookies

For the use of the ESYSTA portal, we only use functional cookies to provide you with all functions. These only identify your session and thus enable full use.

Other cookies for analysis or tracking are not set.

6. Use of third-party analytics tools

ESYSTA does not use third-party analytics tools.

7. User rights: information, correction and deletion

You as a user receive upon request to our customer service, for your part,free information about what personal data about you have been stored. Provided that your request does not conflict with a legal obligation to retention of data (e.g., dataretention), you have a right to correct incorrect data and to object to, block or delete your personal data. You can withdraw your consent at any time You revoke at any time, without giving reasons, with effect for the future.

If you wish to delete your customer account with ESYSTA, you can do this in the settings of your ESYSTA account.

Here you will see the following message: "Attention! You are about to delete your account and data completely. Please keep in mind that this may have consequences for your treatment documentation for you and in case of release also for your attending physician. If you wish to do this, we recommend that you export your data beforehand export your data using the export function. [Cancel] / [Continue]. For the final account deletionyour ESYSTA password and confirm [Delete account]. Otherwise please click on [Cancel]."

Technical implementation: After the above confirmation, the deletion of all corresponding data in the database.

Right of appeal:

Without prejudice to these rights and the possibility of asserting a different administrative or judicial remedy, you have the possibility at any time to exercise your right of complaint to a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of the personal personal data concerning you violates data protection law (Art. 77 DSGVO).

Our data protection officer will be happy to assist you with this request.
Contact: see point 9.

8. Data processing and data security

8.1 General

Our website and the systems necessary for the collection, use and processing and storageof data are secured by technical and organizational measures in accordance with a certificate of the international standard ISO/IEC 27001 against loss, destruction, access, alteration or dissemination of your data in accordance with the current state of the art.

8.2 Locations

Our data processing facilities, e.g. web servers, are located exclusively within the territory of the Federal Republic of Germany.

Hosting is provided by the ISO 27001-certified company Pixelpark AG:

Address:

Pixelpark AG Colo II Berlin
Company: Pixelpark AG
Lützowstrasse 105
10785 Berlin

This is a data processing on behalf of Emperra GmbH.

8.3 Encryption

Personal data is transmitted exclusively in encrypted form in accordance with the current state of the art.

8.4 Data processing

All data processing by Emperra GmbH is based on the EU-DSGVO.

Emperra GmbH maintains, in accordance with Article 30 EU-DSGVO, a register of processingactivities.

To the extent that we use service providers for the implementation and handling of data processing processes, the contractual relationships are regulated in accordance with Article 28 EU-DSGVO. These contracts and the technical and organizational measures taken therein are regularly monitored for concrete compliance.

8.5 Data transfer to third parties

The hosting is carried out by the ISO 27001-certified company Pixelpark AG:

Address:

Pixelpark AG Colo II Berlin
Company: Pixelpark AG
Lützowstrasse 105
10785 Berlin

This is a data processing on behalf of Emperra GmbH.

There will be no transfer of your data to a third country.

8.6 Technical data transfer when using ESYSTA

The personal data collected in the course of the use of the ESYSTA product system will be used by Emperra GmbH for the ESYSTA portal for the purpose of documenting the automatic diary and stored and processed there.

9. Further information and contacts

If you have further questions about data protection at Emperra GmbH, please contact us

• Data protection officer:
• Gunther Kohn
• intersoft consulting services AG
• Beim Strohhause 17, 20097 Hamburg
• Email: Datenschutz@Emperra.com


• or
• Responsible:
• Emperra GmbH E-Health Technologies
• Zeppelinstraße 48a
• 14471 Potsdam - Germany
• Email: esysta@emperra.com
• Phone: +49 331/979 34 80-0

For confidential communications, e.g., the sending of prescriptions, please use the postal service.

10. Data Protection Supervisory Authority

• The Brandenburg State Commissioner for Data Protection and for the Right to Inspect Files


• Stahnsdorfer Damm 77
• 14532 Kleinmachnow
• Phone: +49 (0) 33203/356-0
• Telefax: +49 (0) 33203/356-49
• Email: Poststelle@LDA.Brandenburg.de
• https://www.lda.brandenburg.de/lda/de/fusszeile/en/

11. Notice regarding the use of links to other providers

Please note that this privacy policy applies only to the information on this website. Other data protection declarations and data protection and data security provisions may apply to the linked external content. You can find out who is responsible for the respective offer in the imprint of the respective provider.

12. Update of this privacy policy

All information contained on our website is regularly checked with the greatest possible care. If relevant changes arise, we will update this privacy policy.

The current status is of 07/29/2024.