LIBREVIEW
PROFESSIONAL TERMS OF USE

Effective Date: January 2021

These Terms of Use govern your use of the LibreView website located at www.Libreview.com (the 'Site'). Please read these Terms of Use carefully before you start to use our Site, create any patient profile, practices, and/or invite Professional Users to create a LibreView Data Management System account, as these Terms of Use are a legal agreement between you and Abbott Diabetes Care Inc.

Abbott Diabetes Care Inc. of 1420 Harbor Bay Parkway, Alameda, CA 94502, USA ('Abbott' or 'us' or 'our' or 'we') is the developer of Sensors ("Sensors"), Readers ("Readers") and glucose test meters ("Meters") for the FreeStyle Libre family of products and the FreeStyle LibreLink mobile app ("FreeStyle App") which may be compatible with the Site and with the LibreView data management system ("LibreView Data Management System").

Newyu, Inc., an affiliate of Abbott, maintains the medical authorizations for the LibreView Data Management System as a medical device, provides other application and software support, and manages the marketing authorizations/registrations for the LibreView Data Management System.

The LibreView Data Management System is a secure, cloud-based diabetes management system that is intended for use by Abbott, Professional Users and patients to aid in the review, analysis and evaluation of patients' historical glucose data, glucose test results and ketone test results in support of an effective diabetes health management program. The LibreView Data Management System allows Abbott to provide improved treatment guidance for patients utilizing Abbott's Meters, Readers and FreeStyle App. The LibreView Data Management System also allows Professional Users to create patient profiles, to remotely manage patients who have LibreView Data Management System accounts and to share patients' LibreView Data Management System account information with other professional users within the same LibreView practice.

THE LIBREVIEW DATA MANAGEMENT SYSTEM IS NOT INTENDED FOR THE DIAGNOSIS OF OR SCREENING FOR DIABETES MELLITUS. USERS SHOULD BE AWARE THAT THE LIBREVIEW DATA MANAGEMENT SYSTEM IS AN INFORMATION MANAGEMENT SERVICE TO ENABLE THE ANALYSIS OF GLUCOSE DATA AND IS NOT INTENDED AS A SUBSTITUTE FOR THE ADVICE THAT YOU PROVIDE TO YOUR PATIENTS AS A HEALTHCARE PROFESSIONAL. THE LIBREVIEW DATA MANAGEMENT SYSTEM IS NOT AN ELECTRONIC HEALTH RECORDS SYSTEM AND YOU MUST PRINT AND/OR DOWNLOAD PATIENT INFORMATION THAT YOU DEEM RELEVANT TO YOUR PROVISION OF MEDICAL CARE, TREATMENT OR ADVICE.

YOUR ACCESS AND USE OF THE SITE AND THE LIBREVIEW DATA MANAGEMENT SYSTEM CONSTITUTES, AND IS CONDITIONED UPON, YOUR AGREEMENT TO BE BOUND BY THESE TERMS OF USE. IF YOU DO NOT AGREE TO THESE TERMS OF USE, DO NOT ACCESS OR OTHERWISE USE THIS SITE, ANY SERVICES AVAILABLE THROUGH THIS SITE OR ANY INFORMATION CONTAINED ON THIS SITE.

YOUR USE OF THE SITE IS ALSO SUBJECT TO THE LIBREVIEW PROFESSIONAL PRIVACY NOTICE AVAILABLE AT WWW.LIBREVIEW.COM ('PRIVACY NOTICE'), WHICH EXPLAINS HOW WE COLLECT, PROTECT, RETAIN, STORE, AND DISCLOSE YOUR PERSONAL INFORMATION THAT YOU PROVIDE THROUGH YOUR USE OF THE SITE. IT ALSO SETS OUT THE INFORMATION THAT YOU, AS A PROFESSIONAL USER, SHOULD PROVIDE TO YOUR PATIENTS.

You do not need to register as a Professional User and create a LibreView Data Management System account to simply visit and view the Site.

  1. General: The Site is your gateway to create a LibreView Data Management System account in which your patients' Meters, Readers and the FreeStyle App readings may be stored, reviewed and analyzed by you. The LibreView Data Management System is designed to assist you in viewing and managing aspects of your patients' condition, and to allow Abbott to provide improved treatment guidance for patients utilizing Abbott's Meters, Readers and the FreeStyle App. The LibreView Data Management System allows patients with LibreView Data Management System accounts to share their glucose readings with you, and it also allows you to connect your patients' Meters, Readers and the FreeStyle App to your computer and upload their glucose readings into a patient profile that you have created.

    'Professional User' includes only those medical providers (and their duly authorized representatives and agents) who have either registered a clinical practice or have registered as a professional user of the LibreView Data Management System.

    Abbott only permits one LibreView Data Management System user account per email address. As a Professional User, you may create a clinical practice account and invite other professionals and/or link with other Professional Users with LibreView Data Management System accounts within your practice.

    These Terms of Use apply to your use of the Site and to your right to use the LibreView Data Management System. They are effective from when you set up a LibreView Data Management System account as a Professional User until terminated as set forth below.

    By using this Site, you represent, acknowledge and agree that you are duly authorized to use this Site and to create a Professional User account in the LibreView Data Management System and that you also have the appropriate authority to create a practice and link other HCPs or professionals within your practice, and also create patient profiles that will be shared with and utilized by Abbott.

  2. LibreView Data Management System account: Do not reveal your LibreView Data Management System account information to anyone else or disclose to anyone your password details. You are responsible for maintaining the confidentiality and security of your LibreView Data Management System account and for all activities that occur on or through it. You agree to notify Abbott if you become aware of a security incident or breach affecting your LibreView Data Management System account, including where you believe your password may have been compromised, and fully cooperate with us, law enforcement or other applicable regulatory body in addressing the breach. Abbott is not responsible for any lost, stolen or compromised passwords or for any activity on your LibreView Data Management System account from unauthorized users or for any losses arising out of or in connection with the unauthorized use of your LibreView Data Management System account where caused by you. If there is a violation of any of the security requirements by you or other professional users in a practice that you create, that violation may be considered a breach of these Terms of Use and may result in the immediate loss of your LibreView Data Management System account.

    You will be responsible for obtaining and maintaining any Internet connections, computing equipment and supplies necessary for you to receive, access and use the LibreView Data Management System. You agree to only use the LibreView Data Management System as expressly permitted herein. Abbott, its affiliates and its suppliers own all rights, titles and interests in and to the LibreView Data Management System and to content through the Site, including logos, graphics, videos, images, software and other materials ('Materials').

    Subject to your compliance with these Terms of Use, Abbott hereby grants you a limited, personal, non-exclusive and non-transferable license to use and to display the Materials and to use this Site solely for your professional use. Except for the foregoing license, you have no other rights in the Site or any Materials and you may not modify, edit, copy, reproduce, create derivative works of, reverse engineer, alter, modify, enhance, or in any way exploit any of the Site or Materials in any manner. If you, or any other person under your responsibility, breach any of the provisions in these Terms of Use, the above license will terminate automatically and you must immediately destroy any downloaded or printed Materials.

    Where you create a practice, you will supervise, monitor and train your employees, representatives, contractors, agents, and other professional users who you add to a practice that you create, to ensure proper use and security. You will limit access to the services available through the Site at your locations to those duly authorized users. You will be responsible for their use of the services, compliance with these Terms of Use and for the consequences of any breach of security that is caused by such users or that occurs at your locations.

  3. Permitted uses of your LibreView Data Management System account: To use the LibreView Data Management System you must enter some of your personal information, including your username and password, to create your LibreView Data Management System account. You agree to provide accurate and complete information when you register with, and as you use, the LibreView Data Management System, and you agree to keep your LibreView Data Management System account information accurate, current and complete. These Terms of Use allow you to set up a LibreView Data Management System account as a Professional User over your organization's network, and to set up a practice for use by any professional, employee or other individual authorized by you within your practice. If you have patients who do not have a LibreView Data Management System account which would enable you to view their glucose readings, it also allows you to create a patient profile whereby you may connect your patients' Meters to your computer, upload their glucose readings into the patient profile that you created for them, and share that information with Abbott.

    You acknowledge and agree that the Site and the LibreView Data Management System are provided to enhance your care of your patients and to allow Abbott to provide improved treatment guidance for patients utilizing Abbott's Meters, and you understand that these are not a substitute for your professional judgement or for your responsibilities to your patients.

    AS YOU ARE SETTING UP A LIBREVIEW DATA MANAGEMENT SYSTEM PRACTICE IN YOUR PROFESSIONAL CAPACITY, YOU ACKNOWLEDGE AND AGREE THAT YOU ARE DULY AUTHORIZED TO AGREE AND BIND YOUR PRACTICE TO THESE TERMS OF USE AND HAVE THE NECESSARY CAPACITY AND AUTHORITY TO DO SO.

  4. Prohibited uses of your LibreView Professional system account: We restrict access to the professional parts of our Site to Professional Users. We reserve the right to disable any Professional User ID at any time if, in our opinion, you have failed to comply with any of the provisions of these Terms of Use. When using our Site you may not engage in the prohibited uses set out below. Where required by law, Professional Users must not create any patient profiles without having first obtained their informed, voluntary and explicit consent as may be required by applicable law. You agree that you will NOT use the LibreView Data Management System to:

    1. upload, download, email, transmit, store or otherwise make available any data that is unlawful, harmful, tortious, invasive of another's privacy or otherwise objectionable;
    2. pretend to be anyone that you are not or misrepresent who you are or otherwise misrepresent your affiliation with any person (including a child). Abbott reserves the right to reject or block any LibreView Data Management System account or email address which could be deemed to be an impersonation or misrepresentation of your identity, or a misappropriation of another person's name or identity, or that has been used to hijack another user's data;
    3. upload, download, email, transmit, store or otherwise make available any data or other information from children (any person under the age of 18 or such other age as local law defines as a child), including but not limited to any of the following: full name or surname, date of birth, email address and their Meter data unless you have obtained the consent of the child's parent/guardian;
    4. infringe any person's intellectual property rights (including uploading any content to which you do not have the right to upload);
    5. upload, post, email, transmit, store or otherwise make available any material that contains viruses or any other computer code, files or programs designed to harm, interfere or limit the normal operation of the LibreView Data Management System (or any part thereof), or any other computer software or hardware;
    6. interfere with or disrupt the Site or LibreView Data Management System (including accessing the LibreView Data Management System through any automated means, such as scripts or web crawlers), or any servers or networks connected to the LibreView Data Management System, or any policies, requirements or regulations of networks connected to the LibreView Data Management System (including any unauthorized access to, use or monitoring of data or traffic thereon);
    7. gather, store or upload personal information, including health information, on any persons using an Abbott FreeStyle Libre flash glucose monitoring system without first having received their prior consent or without otherwise being authorized to do so, for example if you are a caregiver, HCP or parent/guardian;
    8. reverse engineer, decompile, disassemble, decode, create derivative works of, gain access to the source code of or modify the LibreView Data Management System except and then solely to the extent permitted under applicable law;
    9. gather, store or upload personal information, including health information, on any other users of the LibreView Data Management System or any individual using a FreeStyle Libre sensor in connection with any of the foregoing prohibited activities; and/or
    10. disclose information about the Site or LibreView Data Management System features or performance to any third party without our prior consent, except as required for legal or regulatory purposes or to assist in the provision of your medical treatment of a patient.
  5. Patient profiles: After you have created a LibreView Data Management System account, you will be permitted to create patient profiles. When creating a patient profile, you will be required to manually enter some personal information for example their name and date of birth. Within their patient profile, you will be able to manually upload their Meter readings to the LibreView Data Management System.

    You will only use the Site and the LibreView Data Management System for those patients from whom you have previously obtained their informed, voluntary or, as necessary, explicit consent, or when you deem it necessary to protect their vital interests and will comply with any additional requirements arising under your local data protection, privacy, health or related laws. It is a misuse of the Site and the LibreView Data Management System to enter personal patient information, including health-related information, without either first securing their informed, voluntary or, as necessary, explicit consent, or having determined that which is necessary to protect their vital interests. Abbott will accept no liability in relation to your use of the Site, including where you use the Site to enter personal information relating to your patients, where these conditions have not been satisfied. We will provide reasonable assistance with any request that you make to remove the personal information of any of your patients from the LibreView Data Management System within a reasonable period from receipt of such request; this does not apply to personal information that Abbott has accessed to improve its treatment guidance for patients utilizing Abbott's Meters.

    AS A PROFESSIONAL USER YOU ARE RESPONSIBLE FOR (I) ANY PATIENT DATA THAT YOU ENTER INTO THE LIBREVIEW DATA MANAGEMENT SYSTEM, (II) THE PERSONAL INFORMATION OF OTHER PROFESSIONALS THAT YOU INVITE TO JOIN A PRACTICE ACCOUNT, AND (III) YOUR USE OF PERSONAL INFORMATION OF ANY INDIVIDUAL WITH A LIBREVIEW DATA MANAGEMENT SYSTEM ACCOUNT. YOU ARE THEREFORE RESPONSIBLE FOR COMPLYING WITH APPLICABLE DATA PROTECTION AND PRIVACY LAWS AND FOR OBTAINING, WHERE REQUIRED, ANY CONSENTS (INCLUDING EXPLICIT CONSENT) NEEDED UNDER APPLICABLE LAW.
    For users in European Economic Area ('EEA') and Switzerland: Patient data will be processed in accordance with the Privacy Notice for the following different purposes:

    1. Where you enter patient data into the LibreView Data Management System or use the personal information of any individual with a LibreView Data Management System account for the purpose of providing medical treatment, except as otherwise provided in these Terms of Use, you are the data controller and are responsible are for complying with applicable data protection and privacy laws;
    2. Where Abbott uses identifiable patient data that you enter into the LibreView Data Management System for the purposes of improving treatment guidance for patients utilizing Abbott's Meters, system troubleshooting, system and/or customer support, research or reporting, or to comply with Abbott's legal obligations, including in relation to quality and safety of medical devices, Abbott will be the data controller and will comply with applicable local data protection and privacy laws; and
    3. Where your patient has independently created a LibreView Data Management System account, either for their own use or for the use of a child or other person for whom they provide care, Abbott will be the data controller and will comply with applicable local data protection and privacy laws.

    Abbott will treat all personal patient information for which it is a data controller, including health information, in accordance with the Privacy Notice. When your patient has created a LibreView Data Management System account and grants you access to that account, or where you set up a LibreView Data Management System account for your patient, Abbott (through the LibreView Data Management System) will be processing both your and your patient's personal data as a 'processor' on your behalf as a healthcare provider where you process your patient information to protect their vital interests as determined in your sole discretion as their healthcare provider.

    Before you start to use our Site, create any patient profile, practices, and/or invite other Professional Users to create a LibreView Data Management System Account, please review the Data Processing Agreement located at the end of these Terms of Use.

    For users in Brazil: Patient data will be processed in accordance with the Privacy Notice for the following different purposes:

    1. Where you enter patient data into the LibreView Data Management System or use the personal information of any individual with a LibreView Data Management System account for the purpose of providing medical treatment, except as otherwise provided in these Terms of Use, you are the data controller and are responsible for complying with applicable data protection and privacy laws;
    2. Where Abbott uses identifiable patient data that you enter into the LibreView Data Management System for the purposes of improving treatment guidance for patients utilizing Abbott's Meters, system troubleshooting, system and/or customer support, research or reporting, or to comply with Abbott's legal obligations, including in relation to quality and safety of medical devices, Abbott will be the data controller and will comply with applicable local data protection and privacy laws; and
    3. Where your patient has independently created a LibreView Data Management System account, either for their own use or for the use of a child or other person for whom they provide care, Abbott will be the data controller and will comply with applicable local data protection and privacy laws.

    Abbott will treat all personal patient information for which it is a data controller, including health information, in accordance with the Privacy Notice. When your patient has created a LibreView Data Management System account and grants you access to that account, or where you set up a LibreView Data Management System account for your patient, Abbott (through the LibreView Data Management System) will be processing both your and your patient's personal data as a 'processor' on your behalf as a healthcare provider where you process your patient information to protect their vital interests as determined in your sole discretion as their healthcare provider.

    For users in the US: Additionally, if you are a healthcare provider in the United States and a covered entity as defined by the Health Insurance Portability and Accountability Act, as amended, and its implementing regulations ('HIPAA'), you are creating the patient profile and using the Site and the LibreView Data Management System in compliance with HIPAA either by: i) obtaining a patient authorization to do so; or ii) relying on the exception to the requirement for an authorization under HIPAA for disclosure of Protected Health Information for treatment or healthcare operations purposes. Additionally, that part of Abbott that oversees operation of the Site has implemented safeguards for PHI that HIPAA requires of Covered Entities.

  6. Availability and accuracy of information: The Site and the LibreView Data Management System, or any feature or part thereof, may not be available in all languages or in all countries and Abbott makes no representation that the LibreView Data Management System, or any feature or part thereof, is appropriate or available for use in any particular location. To the extent that you choose to access and use the Site and the LibreView Data Management System, you do so at your own initiative and are responsible for compliance with any applicable laws. Any data uploaded by you or available to view by you are based exclusively on your patients' glucose, ketone and insulin data and other information provided by them. Abbott makes no representations or warranties regarding the accuracy, completeness, reliability or timeliness of any data accessible or viewed by you or of any content generated by the data stored in the LibreView Data Management System. In particular, Abbott makes no representations or warranties that any information based on such data will be in compliance with government regulations requiring disclosure of information.
  7. Deletion of your LibreView Data Management System account: You may delete your LibreView Data Management System account at any time. Your LibreView Data Management System account will be deleted upon receipt and processing of your delete request, unless there is any contractual or legal obligation to keep your information in our databases. Please be aware that it may take up to 72 hours to process your request. You acknowledge that deletion of your LibreView Data Management System account may have no effect on the personal information relating to your patients that Abbott has accessed to improve its treatment guidance for patients utilizing Abbott's Meters. Abbott has no responsibility for retaining/storing or backing up your LibreView Data Management System account on your behalf. You are solely responsible for retaining/maintaining/storing and backing up (electronically and/or with hard copies) any data that you wish to preserve. Abbott is not responsible for unauthorized access to, use of or alteration of your information. If you email, back up or otherwise share any of your personal information or reports with third parties, that information may not be encrypted and Abbott will have no ability to manage the privacy or security of that information. You should take the steps that you determine appropriate to protect the security of such information. In the event that you have registered a practice, you will be required to delete your LibreView Data Management System account upon retirement or upon you leaving that practice and will be responsible for transferring administration rights to another duly authorized Professional User within that practice. Unless otherwise required by law, you agree that your LibreView Data Management System account is non-transferable and that any rights to have a LibreView Data Management System account or any data stored in the LibreView Data Management System will terminate upon your death. Upon receipt of a copy of a death certificate your LibreView Data Management System account may be terminated and all data within deleted. Email DiabetesCarePrivacy@Abbott.com for further information.
  8. Links to third-party websites: This Site may be linked to other websites that are not sites controlled or operated by Abbott (collectively, 'Third-Party Sites'). Certain areas of the Site may allow you to interact and/or conduct transactions with such Third-Party Sites and, if applicable, allow you to configure your privacy settings in your Third-Party Site account to permit your activities on this Site to be shared with your contacts in your Third-Party Site account and, in certain situations, you may be transferred to a Third-Party Site through a link but it may appear that you are still on this Site. In any case, you acknowledge and agree that the Third-Party Sites may have different privacy policies, terms and conditions and/or user guides and business practices than Abbott, and you further acknowledge and agree that your use of such Third-Party Sites is governed by the respective Third-Party Site privacy notice and terms and conditions and/or user guides. You hereby agree to comply with any and all terms and conditions, user guides and privacy policies of any Third-Party Sites. Abbott is providing links to the Third-Party Sites to you as a convenience, and Abbott does not verify, make any representations or take responsibility for such Third-Party Sites, including, without limitation, the truthfulness, accuracy, quality or completeness of the content, services, links displayed and/or any other activities conducted on or through such Third-Party Sites. YOU AGREE THAT ABBOTT WILL NOT, UNDER ANY CIRCUMSTANCES, BE RESPONSIBLE OR LIABLE, DIRECTLY OR INDIRECTLY, FOR ANY GOODS, SERVICES, INFORMATION, RESOURCES AND/OR CONTENT AVAILABLE ON OR THROUGH ANY THIRD-PARTY SITES AND/OR THIRD-PARTY DEALINGS OR COMMUNICATIONS, OR FOR ANY HARM RELATED THERETO, OR FOR ANY DAMAGES OR LOSS CAUSED OR ALLEGED TO BE CAUSED BY OR IN CONNECTION WITH YOUR USE OR RELIANCE ON THE CONTENT OR BUSINESS PRACTICES OF ANY THIRD PARTY. Any reference on the Site to any product, service, publication, institution, or organization of any third-party entity or individual does not constitute or imply Abbott's endorsement or recommendation.
  9. No medical advice: THE LIBREVIEW DATA MANAGEMENT SYSTEM IS NOT INTENDED FOR THE DIAGNOSIS OF OR SCREENING FOR DIABETES MELLITUS. YOU ACKNOWLEDGE THAT, WHILE ABBOTT USES INFORMATION THAT IT RECEIVES VIA THE LIBREVIEW DATA MANAGEMENT SYSTEM TO IMPROVE TREATMENT GUIDANCE, ABBOTT IS NOT A PROVIDER OF MEDICAL CARE AND ABBOTT IS NOT RESPONSIBLE FOR NOTIFYING YOU OF ANY CHANGES TO ANY OF YOUR PATIENTS' METER READINGS OR FOR PROVIDING MEDICAL ADVICE TO PATIENTS. The LibreView Data Management System is for informational purposes and is designed to help Abbott, patients and you better manage and support diabetes through information, analysis and communication, and is not meant to replace the relationship between patients and their medical providers. Health information content available to you through the LibreView Data Management System is based on information provided via medical device-related data transmissions from patients scanning their FreeStyle Libre sensor. Abbott does not recommend or endorse any specific tests, products, procedures or opinions. YOUR DECISION TO TAKE ACTION BASED ON ANY INFORMATION TRANSMITTED TO OR STORED ON THE LIBREVIEW DATA MANAGEMENT SYSTEM OR ON ANY INFORMATION RECEIVED FROM ABBOTT EMPLOYEES, AGENTS OR SUPPLIERS IS SOLELY AT YOUR OWN RISK. ABBOTT, OUR OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AFFILIATES, THIRD-PARTY PROVIDERS AND RELATED COMPANIES ASSUME NO RESPONSIBILITY FOR ERRORS OR OMISSIONS IN THE CONTENT, INCLUDING HEALTH INFORMATION CONTENT, POSTED ON OUR SITE OR FOR THE ACCURACY, TRUTHFULNESS OR CONTENT, INCLUDING HEALTH INFORMATION CONTENT, OF OUR SITE, AND NO RELIANCE BY REGISTERED USERS SHOULD BE PLACED ON THE INFORMATION AVAILABLE IN THE LIBREVIEW DATA MANAGEMENT SYSTEM.
  10. No electronic health records: THE INFORMATION AVAILABLE TO YOU THROUGH THE LIBREVIEW DATA MANAGEMENT SYSTEM IS NOT AN ELECTRONIC MEDICAL RECORD. YOU MUST DOWNLOAD AND/OR PRINT OFF ANY INFORMATION THAT YOU, IN YOUR SOLE DISCRETION, DEEM NECESSARY TO INCLUDE IN YOUR PATIENTS' MEDICAL RECORDS.
  11. Disclaimer of Warranties: YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT YOUR USE OF THE LIBREVIEW DATA MANAGEMENT SYSTEM IS AT YOUR SOLE RISK AND THAT TO THE EXTENT PERMITTED BY LAW, THE ENTIRE RISK AS TO SATISFACTORY QUALITY, PERFORMANCE, ACCURACY AND EFFORT IS WITH YOU. Any content included in the LibreView Data Management System is for the purpose of providing information only. Although Abbott believes the data displayed in the LibreView Data Management System to be accurate as at the time it is transmitted to the LibreView Data Management System, Abbott makes no representation, express or implied, as to the accuracy, completeness or timeliness of the information. In no event will Abbott be liable to you for any losses from mistakes, omissions or delays in transmission of information, or from interruptions in telecommunications connections to the LibreView Data Management System.

    TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ABBOTT, ITS AFFILIATES AND ITS THIRD-PARTY PROVIDERS PROVIDE THE LIBREVIEW DATA MANAGEMENT SYSTEM 'AS IS' AND 'AS AVAILABLE' WITH ALL FAULTS AND DEFECTS AND WITHOUT ANY OTHER WARRANTY OF ANY KIND, AND HEREBY DISCLAIM ALL OTHER WARRANTIES AND CONDITIONS, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF TITLE AND NON-INFRINGEMENT, ANY IMPLIED WARRANTIES, DUTIES OR CONDITIONS OF MERCHANTABILITY, OF FITNESS FOR A PARTICULAR PURPOSE AND QUALITY, AND OF LACK OF VIRUSES. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY ABBOTT OR AN ABBOTT-AUTHORIZED REPRESENTATIVE SHALL CREATE A WARRANTY.

    Abbott, its affiliates and its third-party providers do not warrant that the functions contained in the LibreView Data Management System will meet your requirements or that the operation of the LibreView Data Management System will be uninterrupted or error free. To the extent that applicable law requires Abbott to provide warranties, you agree that the scope and duration of such warranty shall be to the minimum extent required to be provided under such applicable law.

    In no event does Abbott provide any warranty or representation with respect to any third-party hardware or software, and Abbott disclaims all liability with respect to any failures thereof. Abbott disclaims any and all liability that may derive from actions or claims against Abbott or any of its affiliates, agents or assigns, or other third parties as may become applicable over the course of these Terms of Use.

    For users in Russia: This Section 11 shall apply to the extent permissible by the Russian healthcare legislation, regulations, and standards.

  12. Limitation of liability: NOTWITHSTANDING ANY LOSSES THAT YOU MAY INCUR AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE ENTIRE LIABILITY OF ABBOTT, ITS AFFILIATES AND ANY OF ITS THIRD PARTY PROVIDERS UNDER ANY PROVISION OF OR OTHERWISE IN CONNECTION WITH THESE TERMS OF USE AND YOUR EXCLUSIVE REMEDIES FOR ALL OF THE FOREGOING SHALL BE LIMITED TO EITHER THE FIXING, REPAIRING OR OTHERWISE RECTIFYING ANY FAULTS WITHIN THE LIBREVIEW DATA MANAGEMENT SYSTEM, EVEN IF ANY SUCH LOSS WAS FORESEEABLE OR CONTEMPLATED BY THE PARTIES OR, WHERE APPLICABLE, THE GREATER OF THE AMOUNT ACTUALLY PAID BY YOU FOR THE LIBREVIEW DATA MANAGEMENT SYSTEM ACCESS OR USD$10.00. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL ABBOTT, ITS AFFILIATES OR ITS THIRD-PARTY PROVIDERS BE LIABLE TO YOU (OR YOUR PATIENTS, EMPLOYEES, CONTRACTORS, AGENTS OR USERS) FOR MONETARY DAMAGES, INCLUDING ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS, FOR LOSS OF DATA OR OTHER INFORMATION, FOR BUSINESS INTERRUPTION, FOR PERSONAL INJURY, FOR LOSS OF PRIVACY ARISING OUT OF OR IN ANY WAY RELATED TO THE USE OF OR INABILITY TO USE THE LIBREVIEW DATA MANAGEMENT SYSTEM, THIRD-PARTY SOFTWARE AND/OR THIRD-PARTY HARDWARE USED OR THAT MAY BE USED WITH THE LIBREVIEW DATA MANAGEMENT SYSTEM, FOR LOSS FROM ANY VIRUSES OR OTHER TECHNOLOGICALLY HARMFUL MATERIAL THAT MAY INFECT YOUR INFORMATION SYSTEM AND HARDWARE DUE TO YOUR DOWNLOADING ANY MOBILE APP/MATERIAL/WEBSITE LINKED TO THE LIBREVIEW DATA MANAGEMENT SYSTEM, OR OTHERWISE IN CONNECTION WITH ANY PROVISION OF THESE TERMS OF USE) WHETHER IN WARRANTY, CONTRACT OR TORT, INCLUDING NEGLIGENCE OR PRODUCT LIABILITY EVEN IF INFORMED ABOUT THE POSSIBILITY THEREOF, INCLUDING WITHOUT LIMITATION MEDICAL EXPENSES, LEGAL FEES, LOSS OF REVENUE OR PROFITS (WHETHER DIRECT OR INDIRECT), EVEN IF ABBOTT, ITS AFFILIATES OR ANY THIRD-PARTY PROVIDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF THE REMEDY FAILS OF ITS ESSENTIAL PURPOSE. ONLY YOU CAN IMPLEMENT BACK-UP PLANS AND SAFEGUARDS NECESSARY TO APPROPRIATELY ADDRESS YOUR NEEDS IN THE EVENT THAT AN ERROR IN THE LIBREVIEW DATA MANAGEMENT SYSTEM CAUSES COMPUTER PROBLEMS AND RELATED DATA LOSSES. FOR THESE BUSINESS REASONS, YOU UNDERSTAND AND AGREE TO THE LIMITATIONS OF LIABILITY IN THIS SECTION AND ACKNOWLEDGE THAT WITHOUT YOUR AGREEMENT TO THIS PROVISION, ANY APPLICABLE FEE CHARGED, WOULD BE HIGHER.

    FOR USERS IN INDONESIA: NOTHING IN THIS AGREEMENT SHALL EXCLUDE ANY MANDATORY STATUTORY REMEDY AVAILABLE TO A USER IN THE EVENT OF A FAILURE TO COMPLY WITH A DATA PROTECTION REQUIREMENT BY ABBOTT THAT MAY GIVE RIGHT TO THE ABILITY OF AN AFFECTED PERSONAL DATA SUBJECT'S RIGHT TO CLAIM MONETARY COMPENSATION UNDER THE ELECTRONIC AND INFORMATION TECHNOLOGY LAW AND/OR ANY OTHER REGULATIONS RELATING TO PROTECTION OF PERSONAL DATA.

    In no event will we be liable to you (your patients, employees, contractors, agents or users) for any losses, costs, damages, charges or expenses resulting from loss, misappropriation, unauthorized access to or modification of data, including personal data, by any third party, or from mistakes, omissions or delays in transmission of information, or from interruptions in telecommunications connections to the service, viruses or failures of performance, interception or from the impact of the LibreView Data Management System on your information or communications systems, including without limitation any record or other communication provided by you, any patient or by us under these Terms of Use.

    For users in Singapore, the UK or Switzerland: Nothing in these Terms of Use shall exclude our liability for death or personal injury arising out of our negligence or fraudulent misrepresentation in connection with the LibreView Data Management System.

    For users in Vietnam: Nothing in this Agreement shall exclude any mandatory statutory liability, including our liability in connection with monetary damages, personal injury or death arising out of our fault or negligence or product defect in connection with Vietnam's Consumer Protection Law and other applicable law and regulations in Vietnam.

    For users in Russia: Nothing in this Agreement shall exclude Abbott's liability for willful misconduct.

  13. Indemnity: You agree to indemnify, defend and hold harmless Abbott, its affiliates and their respective officers, directors, employees, agents, successors, assigns and licensors from and against any and all claims, demands, liabilities, losses, costs and expenses (including solicitors' and experts' fees) made by a third party due to or arising out of, or related to a violation of these Terms of Use or laws, regulations or third party rights including any breach of data protection or privacy obligations, any infringement of their copyright or intellectual property rights of any third party by you or others in your practice or organization or otherwise in connection with your or their use of the LibreView Data Management System whether by negligent act, omission, or willful misconduct.
  14. License: Abbott does not claim ownership of your personal data that you transmit or submit to the LibreView Data Management System. By disclosing your personal information to Abbott, you grant it a worldwide, royalty-free, non-exclusive license to use, distribute, reproduce, modify, adapt, publish and translate such data for the purpose of providing you with the LibreView Data Management System. Abbott may create, access, retain, use or disclose to third-party researchers, aggregated, anonymized, de-identified (or pseudonymized to the extent permitted by your law) data derived from the LibreView Data Management System for the purposes of research, to evaluate how the LibreView Data Management System is provided, to evaluate its use and its various components and equipment, to evaluate performance or impact on clinical staff or across clinics, to enhance the functioning of the LibreView Data Management System and the FreeStyle Libre sensors, to validate LibreView Data Management System upgrades, or for product development and quality and safety of medical devices. You agree that the license herein permits Abbott to take any such actions. Where personal information is provided to third-party suppliers to assist us with the provision of the LibreView Data Management System, they are required to keep personal information confidential and secure and may only use personal information to the minimum extent necessary.
  15. Feedback: Any data, comments or materials that you supply via the LibreView Data Management System or provide to Abbott in order to receive support, including feedback data, such as questions, comments, suggestions or the like ('Feedback'), shall be deemed to be non-confidential and non-proprietary. Abbott shall have no obligation of any kind with respect to such Feedback and shall be free to reproduce, use, disclose, exhibit, display, transfer, create derivative works and distribute the Feedback to others without limitation, except for health information and personal information which might be included in the Feedback but is subject to 'Section 14. License' above. Furthermore, Abbott shall be free to use any idea, concepts, know-how or techniques contained in such Feedback for any purpose whatsoever, including developing, manufacturing and marketing products incorporating such Feedback.
  16. Trademarks: LibreView, FreeStyle LibreLink, FreeStyle Libre, FreeStyle and related brand marks are trademarks of Abbott Diabetes Care Inc. in various jurisdictions. Other trademarks are the property of their respective owners. No license or right, express or implied, is granted to you in any of the aforesaid trademarks, and you further agree that you shall not remove, obscure, or alter any proprietary notices (including trademark and copyright notices) that may be affixed to or contained within the LibreView Data Management System. No use of any Abbott trademark, trade name, or trade dress may be made without the prior written authorization of Abbott, except to identify the product or services of the company.
  17. Proprietary rights: You acknowledge and agree that Abbott and/or its licensors own all legal rights, titles and interest in and to the LibreView Data Management System, including but not limited to graphics, user interface, the scripts and software used to implement the LibreView Data Management System, and any software or documents provided to you as a part of and/or in connection with the LibreView Data Management System, including all Intellectual Property Rights that exist therein, whether registered or not, and wherever in the world they may exist. You further agree that the LibreView Data Management System contains proprietary and confidential information that is protected by applicable intellectual property rights and other laws, including but not limited to copyright. You agree that you will not use such proprietary information or materials in any way whatsoever except for use of the LibreView Data Management System in compliance with these Terms of Use. No portion of the LibreView Data Management System may be reproduced in any form or by any means, except as expressly permitted in these Terms of Use or where permitted by applicable law. You shall not remove any product identification, copyright notices or proprietary restrictions from the LibreView Data Management System. You expressly acknowledge and agree that LibreView Data Management System access is licensed and not sold to you, and that Abbott, its licensors, affiliates and suppliers, grant you a non-exclusive license to use the LibreView Data Management System on the basis of these Terms of Use, and that your use of the LibreView Data Management System is also subject to any rules or policies applied by Abbott's third-party providers. You therefore agree that Abbott and/or its licensors do not transfer to any user any ownership or proprietary rights in the LibreView Data Management System, any Intellectual Property Rights, or any other technology, information or materials, and as between the parties, Abbott, its affiliates, its suppliers, and its licensors, retain exclusive ownership of all rights, titles and interest in and to all aspects of the LibreView Data Management System, any Intellectual Property Rights, and all other technology, information and materials, as well as any and all copies or modifications thereof (by whomever and whenever made). RIGHTS NOT EXPRESSLY GRANTED HEREIN ARE RESERVED BY ABBOTT AND/OR ITS LICENSORS. The use of this material and the associated rights of Abbott, its affiliates and its suppliers, are hereby acknowledged except solely to the extent that the foregoing is ineffective in certain countries/states/provinces/jurisdictions.
  18. Remedies: Violations of these Terms of Use may be investigated and appropriate legal action may be taken, including civil, criminal or equitable relief. You understand and agree that Abbott, in its sole discretion, and without prior notice, may terminate your access to our Site, remove any unauthorized user content or exercise any other remedy available if we believe, in our sole discretion, that your conduct or the conduct of any person with whom we believe you act in concert with, or the user content that you provide, violates or is inconsistent with these Terms of Use or applicable law or violates our rights or the rights of our affiliates, licensor or another user of our Site. You agree that monetary damages may not provide us with a sufficient remedy for violations of these Terms of Use and you consent to injunctive or other equitable relief for such violations. A printed version of these Terms of Use and of any related notice given in electronic form shall be admissible in judicial or administrative proceedings based upon or relating to these Terms of Use to the same extent and subject to the same conditions as other business documents and records originally generated and maintained in printed form.
  19. Termination of your LibreView Data Management System account: These Terms of Use are effective upon your creation of a LibreView Data Management System account and shall continue in effect until terminated. You may ask Abbott to delete your LibreView Data Management System account at any time. Abbott may suspend or terminate your LibreView Data Management System account for any of the following reasons without advance notice to you:

  20. Language: The parties agree that the English language will be the official language of these Terms of Use. If there is any conflict, apparent conflict or ambiguity between any of the clauses of these Terms of Use in the English language and the translated language, the wording of the English-language version shall prevail.
  21. Applicable law:

    These Terms of Use shall be governed and construed in accordance with the laws of the State of Illinois without regard to any choice of law provisions. In the event of any conflict between foreign laws, rules and regulations and those of the United States, the laws, rules and regulations of the United States shall govern to the fullest extent possible. You agree that these Terms of Use shall be fully performable in the State of Illinois, and you agree that jurisdiction and venue are proper in of the state and federal courts located in the State of Illinois, United States of America, with respect to any proceedings arising from these Terms of Use or the relationship between the parties hereto. The parties hereby agree that the United Nations Convention on Contracts does not govern these Terms of Use for the International Sale of Goods.

    For users in EEA, the UK, Switzerland, India and Indonesia: These Terms of Use will be governed by and construed in accordance with English law. The parties hereby agree that the United Nations Convention on Contracts does not govern these Terms of Use for the International Sale of Goods. Any dispute arising out of or in connection with these Terms of Use, including any question regarding their existence, validity or termination, shall be referred to and finally resolved by arbitration under the LCIA Rules, which Rules are deemed to be incorporated by reference into this clause. The number of arbitrators shall be one. The seat, or legal place, of arbitration shall be London. The language to be used in the arbitral proceedings shall be English.

  22. Severability. If, for any reason, a court with proper jurisdiction holds that any part of these Terms of Use is invalid or cannot be enforced, all other parts will remain in effect. The invalid or unenforceable part will be reformed only to the extent necessary to make it valid and enforceable. For example, some jurisdictions may not permit certain disclaimers of warranties in relation to individual Professional Users despite the fact that this is a business to business rather than a consumer agreement, and in such an event, only those disclaimers deemed invalid should be severed from these Terms of Use.
  23. No third party rights. These Terms of Use are between you and us. No other person shall have any rights to enforce any of the terms, whether under the UK Contracts (Rights of Third Parties) Act 1999, or otherwise.
  24. Support: Free technical support is available by going to the LibreView.com support site and clicking on the "Customer Support" link. Inquiries will be directed to the appropriate support teams.
  25. Changing LibreView Data Management System Terms of Use: Abbott reserves the right to change these Terms of Use at any time at our discretion and without prior notice. Users of our Site are expected to regularly check the Terms of Use for changes as they are binding on you. We encourage you to review these Terms of Use every time that you use our Site. Updates will be indicated by a change in the Effective Date and your continued use of our Site and continued access to your LibreView Data Management System account as a Professional User following any such change constitutes your agreement to follow and be bound by the most recent version of these Terms of Use. You will be able to store or print out changes to these Terms of Use in legible form.

BY CLICKING AGREE WHEN YOU CREATE A LIBREVIEW DATA MANAGEMENT SYSTEM ACCOUNT AS A PROFESSIONAL USER, YOU REPRESENT AND WARRANT THAT YOU ARE DULY AUTHORIZED TO ACCEPT AND ENTER INTO THESE TERMS OF USE AND THAT YOU INTEND YOUR ACT TO SERVE AS AN ELECTRONIC SIGNATURE TO THESE TERMS OF USE WITH THE SAME FORCE AND EFFECT AS A MANUAL SIGNATURE.

Please print a copy of this Agreement for Your records.

[FOR USERS IN THE EEA, PLEASE SEE DATA PROCESSING AGREEMENT BELOW]

LIBREVIEW
PROFESSIONAL USER EU/UK DATA PROCESSING AGREEMENT

Effective Date: June 2021

This EU/UK Data Processing Agreement ("DPA") form part of and is incorporated into the Terms of Use that govern your use as a Professional User of the LibreView website located at www.LibreView.com (the "Site"). Please read this DPA carefully before you start to use our Site, create any patient profile, practices, and/or invite other Professional Users to create a LibreView Data Management System account, as this DPA is a legal agreement between you and Abbott Diabetes Care Inc.

YOUR ACCESS AND USE OF THE SITE AND THE LIBREVIEW DATA MANAGEMENT SYSTEM CONSTITUTES, AND IS CONDITIONED UPON, YOUR AGREEMENT TO BE BOUND BY THIS DPA. IF YOU DO NOT AGREE TO THIS DPA, DO NOT ACCESS OR OTHERWISE USE THIS SITE, ANY SERVICES AVAILABLE THROUGH THIS SITE OR ANY INFORMATION CONTAINED ON THIS SITE.

  1. Introduction: This DPA governs how Abbott will process Personal Data on behalf of Professional User. This DPA forms part of and is incorporated into the Site Terms of Use between a Professional User and Abbott for the provision of the LibreView Data Management System available at https://www.LibreView.com ("Terms of Use") and, where applicable, the contract between Professional User and its local Abbott company to provide the LibreView Data Management System ("Main Agreement"). When providing the LibreView Data Management System, Abbott processes certain Personal Data on behalf of Professional User as set out at Annex A (Description of Personal Data processing).

  2. Scope: This DPA applies where Abbott is a Processor of Personal Data on behalf of Professional User, which is a Controller of Personal Data. Abbott processes Personal Data on behalf of Professional User when Abbott provides the LibreView Data Management System to Professional User. This DPA does not apply where Abbott processes Personal Data as a Controller as explained in the Terms of Use and Privacy Policy.

  3. Definitions and Interpretation: Capitalized terms in this DPA have the same meaning as in the Terms of Use, and the following terms in this DPA have the same meaning as contained in Article 4 of the General Data Protection Regulation (2016/679) ("GDPR") and EU member state laws implementing GDPR: "Controller", "Data Subject", "Personal Data", "Personal Data Breach", "processing" (used lowercase throughout this DPA and includes "process", "processes" and "processed"); "Processor"; and "Supervisory Authority".

    "Standard Contractual Clauses" means the standard contractual clauses adopted by the European Commission pursuant to Council Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries, as well as any amendments, replacements or other supplementing provisions, as set out at Annex D (Standard Contractual Clauses).

    "UK GDPR" means the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 as supplemented by the UK's Data Protection Act 2018, as amended or superseded from time to time.

    References in this DPA to "GDPR" shall be construed as references to "GDPR and/or the UK GDPR as applicable".

  4. Professional User's obligations: Professional User will: (a) comply with all obligations placed on it as a Controller under GDPR; (b) treat as confidential any knowledge of trade secrets and data security measures of Abbott which it acquires from using the services of the LibreView Data Management System provided by Abbott; and (c) reimburse or pay Abbott for any costs arising from any instructions received from Professional User related to Personal Data processing beyond the contractually agreed provision of the LibreView Data Management System under the Terms of Use or Main Agreement.

  5. Abbott's obligations: Abbott will:

    1. comply with all obligations placed on it as a Processor under GDPR;
    2. only process Personal Data in accordance with Professional User's documented instructions as contained in the Terms of Use unless otherwise required by applicable law;
    3. implement appropriate technical and organizational measures to safeguard Personal Data, taking into account the state of the art, costs of implementation, and the nature, scope, context and purposes of processing appropriate to the risk as set out at Annex C (Security measures);
    4. notify Professional User of a Personal Data Breach without undue delay after becoming aware of it, and, where appropriate, take measures to mitigate the possible adverse effects of any security incident or Personal Data Breach;
    5. provide reasonable assistance to Professional User in relation to Professional User's third party notification and communication obligations, including to Data Subjects (as set out at Section 6 (Data Subject requests) below) and Supervisory Authorities, arising out of its use of the LibreView Data Management System and taking into account the nature of the processing and the information available to Abbott;
    6. ensure that its employees, agents, and/or Subprocessors authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
    7. maintain a record of any processing of Personal Data it carries out for Professional User and limit the disclosure of such record to those third parties where Professional User has provided prior written consent unless Abbott is otherwise required by applicable law;
    8. ensure that Professional User can verify Abbott's compliance with its obligations under GDPR Article 28, as set out at Section 7 (Verification of compliance and audit rights);
    9. immediately inform Professional User if, in Abbott's opinion, an instruction from Professional User infringes GDPR;
    10. provide Professional User with reasonable assistance in connection with Professional User's obligation under GDPR to carry out data protection impact assessments and to liaise with Supervisory Authorities, where necessary;
    11. to the extent not prohibited by GDPR or any other applicable laws, notify Professional User as soon as reasonably practicable in writing of any subpoena or other judicial or administrative order, process or proceeding seeking access to, or disclosure of, Personal Data uploaded by Professional User in the LibreView Data Management System, and Abbott acknowledges that Professional User may, at its sole expense, seek to defend against or contest such action in lieu and on behalf of Abbott;
    12. at the expiry or termination of Abbott's provision of the LibreView Data Management System at Professional User's choice, delete or return to Professional User without undue delay all Personal Data and refrain from any further processing of such Personal Data, to the extent that this does not contradict Abbott's own obligations under applicable law; where Abbott, retains Personal Data after the termination or expiry of this DPA or the Main Agreement, Abbott will retain such Personal Data in accordance with its relevant retention policies, copies of which can be made available to Professional User on request.

    If Abbott is required to process Personal Data under GDPR or other applicable laws in a manner that does not align with Professional User's instructions, Abbott will, insofar as possible, inform Professional User of the processing activities it is required to undertake before commencing such processing.

  6. Data Subject requests: Taking into account the nature of the processing of Personal Data, Abbott will provide Professional User with reasonable assistance, using appropriate technical and organizational measures where possible, to enable Professional User to respond to a request from a Data Subject to exercise his/her rights under GDPR Chapter 3. Abbott reserves the right to verify that any request for portability has arisen from a Data Subject rather than Professional User. Abbott will notify Professional User of any request it receives from a Data Subject under GDPR Chapter 3, where the Data Subject specifically references Professional User in his/her request.

    Where a Data Subject does not reference Professional User in his/her request, Abbott will respond to the Data Subject using its automated tools by primarily directing Data Subjects to the self-service portals within the LibreView Data Management System or, alternatively, by directing a Data Subject to Abbott's EU DPO site available at https://www.abbott.com/eu-dpo.html or via contact with its dedicated email address at DiabetesCarePrivacy@Abbott.com.

  7. Verification of compliance and audit rights: Abbott will ensure that Professional User can verify Abbott's compliance with its obligations in accordance with GDPR Article 28. Abbott undertakes to give Professional User the necessary information on request and, in particular, to demonstrate the execution of the technical and organizational measures. Evidence of such compliance measures may be provided by: (a) Abbott's compliance with approved codes of conduct pursuant to GDPR Article 40; (b) Abbott's certification to an approved certification procedure in accordance with GDPR Article 42; or (c) current auditors' certificates, reports or excerpts from reports provided by independent bodies (for example, auditor, data protection officer, IT security department, data privacy auditor, quality auditor).

    If Professional User cannot verify Abbott's compliance with its obligations using the methods set out herein, Professional User may, after consultation with Abbott and upon advance notice, carry out inspections or have them carried out by an auditor to be designated in each individual case.

  8. Subprocessors: Professional User acknowledges that Abbott has entered into written agreements with subprocessors as in listed at Annex B (Subprocessors), each a "Subprocessor", that impose materially similar obligations on such Subprocessors as are placed on Abbott under this DPA. Professional User expressly authorizes Abbott to appoint additional or replacement Subprocessors to assist Abbott to process Personal Data provided that Abbott (a) has executed written agreements with such Subprocessors that impose materially similar obligations on the Subprocessor as are placed on Abbott under this DPA; and (b) informs Professional User about the engagement of any new key Subprocessor through publishing of an updated Privacy Policy. If a Subprocessor fails to comply with its processing obligations, Abbott will be liable to Professional User for such processing obligations.

    Professional User can request Abbott to provide it with further information about a Subprocessor's technical and organizational security measures to protect Personal Data where this is required by local law of Professional User's jurisdiction.

  9. International transfers: LibreView Data Management System servers for the European Economic Area ("EEA") and the UK users are located in the EEA. Abbott is located in the United States of America, a third country for the purposes of GDPR. Professional User understands that for Abbott to provide customer support, maintenance and updates to the LibreView Data Management System ("Maintenance Services"), it will sometimes be necessary to transfer Personal Data, including via remote access into the LibreView servers, from the EEA to Abbott or its Subprocessors pursuant to GDPR Article 49(1)(c).

    To legitimize the export of EEA and UK originating Personal Data under GDPR, the Standard Contractual Clauses set out at Annex D (Standard Contractual Clauses) shall apply. Any references to Directive 95/46/EC in the Standard Contractual Clauses will be read as references to appropriate provisions of GDPR, where possible. Without prejudice to the foregoing, Abbott may transfer Personal Data from the EEA and/or UK to a member of the Abbott group of companies and Subprocessors to the extent necessary for the performance of its contractual obligations under the Terms of Use provided that Abbott has provided appropriate safeguards and on condition that enforceable Data Subject rights and effective legal remedies for Data Subjects are available in accordance with GDPR.

  10. Data Protection Officers and local representatives: Abbott's Data Protection Officers can be contacted at https://www.abbott.com/eu-dpo.html. In situations where we process information on your behalf and where we act as processor, we will refer the request you as Controller. Professional User's local Abbott company is a designated representative of Abbott pursuant to GDPR Article 27.

  11. Liability: The parties shall each be responsible and liable for their own actions and will take all reasonable steps to mitigate against any damages. The liability regulated in this Article 11 shall relate exclusively to the liability between the parties arising from a breach of the GDPR and this DPA and are without prejudice to and supplement the liability provisions contained in the Terms of Use.

    Where Abbott as a processor and has not complied with obligations of the GDPR specifically directed to data processors or when it has acted outside or contrary to lawful instructions of Professional User then it will: (a) be liable to Professional User for the damage directly caused by its processing of the Personal Data; and (b) reimburse Professional User for all claims, actions or demands by third parties for damage arising directly from its processing of Personal Data. Professional User will take all reasonable steps to mitigate any such damages or losses.

    Where Abbott has paid full compensation for the damage suffered by a Data Subject in accordance with GDPR Article 82.4, Professional User shall reimburse Abbott that part of the compensation corresponding to Professional User's part of the responsibility for the damage.

  12. Governing law and jurisdiction: The governing law relating to the processing or transfer of personal data from the EEA or the UK, this DPA and the Standard Contractual Clauses (as set out at Annex D (Standard Contractual Clauses)) will be the law of the EEA member state in which Professional User is located or, where Professional User is located in the U.K., the governing law will be the laws of England and Wales. In all other respects, the governing law is as set out in the Terms of Use.

  13. Order of Precedence: This DPA supplements and amends the TOU and in the event of a conflict, the following order of precedence will apply:

    1. Standard Contractual Clauses (as set out at Annex D (Standard Contractual Clauses));
    2. this DPA;
    3. Terms of Use; and
    4. where applicable, Main Agreement, except where Abbott and Professional User have entered into a data processing or data sharing agreement as part of the Main Agreement, and in such event, the data processing or data sharing agreement shall supersede this DPA.
  14. Changes: Abbott reserves the right to change this DPA at any time and without prior notice. Professional Users are expected to regularly check the DPA for changes. Abbott encourages Professional Users to review this DPA every time LibreView.com is used. Updates will be indicated by a change in the Effective Date and continued use of LibreView and continued access to your Professional User LibreView Data Management System account following any such change constitutes agreement to be bound by the most recent version of this DPA. You will be able to store or print out the DPA in legible form.

  15. Term and termination: This DPA will remain in force for as long as Professional User has a LibreView Data Management System account. Where required by GDPR or other applicable laws, Abbott may process Personal Data after it has ceased to provide Professional User with the LibreView Data Management System.

***********************************

Annex A
Description of Personal Data processing

Subject matter: When it provides the LibreView Data Management System, Abbott processes the Personal Data of the following categories of Data Subjects as a Processor on behalf of Professional User:

  1. Professional User's employees; and
  2. Patients enrolled to the LibreView Data Management System by Professional User except where patients have separately registered for a LibreView account through the LibreView website.

Processing explanation: Information about the following matters are included in the relevant LibreView Professional User Privacy Policy available at https://pro.libreview.com:

  1. The duration of processing of Personal Data;
  2. The nature and purpose of the processing of Personal Data;
  3. The types of Personal Data Abbott processes;
  4. The categories of Data Subjects whose Personal Data is processed; and
  5. Professional User's rights and obligations.

***********************************

Annex B
Subprocessors

Subprocessor name Subprocessor address Description of services Location from which services are provided
FRANCE ONLY: OVH SAS 2 rue Kellermann, BP 80157, 59100 Roubaix, France Hosting LibreView Data Management System accounts for users located in France. France
Amazon Web Services 410 Terry Avenue North, Seattle, WA 98109, U.S.A. Hosting LibreView Data Management System accounts for users located in the European Economic Area, except France. Ireland
Newyu, Inc., a wholly owned subsidiary of Abbott Laboratories 801 Second Avenue, Suite 800, Seattle, WA 98104, U.S.A. Providing Maintenance Services, in particular troubleshooting and other application and software support. United States of America

***********************************

Annex C
Security measures

Abbott has implemented the technical and organizational security measures set out in this Annex C to ensure the ongoing confidentiality, integrity, availability and resilience of its processing systems and services. Abbott processes Personal Data on EEA server sites operated by an industry-leading cloud service provider that offers sophisticated measures to protect against unauthorized access.

  1. Access control of processing areas (confidentiality): Steps taken by Abbott's industry-leading cloud service provider to prevent unauthorized access to data processing equipment (for example, telephones, database and application servers, and associated hardware) in which Personal Data is processed include the following appropriate measures:

  2. Access control to data processing systems (confidentiality): Abbott takes appropriate measures to prevent its data processing systems from being used by unauthorized persons. This is achieved by:

  3. Access control for the use of certain areas of data processing systems (confidentiality): Abbott personnel authorized to use data processing systems may only access Personal Data where they have sufficient access authorization. Personal Data which is encrypted cannot be read, copied, changed or removed without authorization. This is achieved by:

  4. Transfer control (integrity): Abbott takes steps to prevent Personal Data from being read, copied, altered or deleted by unauthorized persons during its transfer or transport. This is achieved by:

  5. Input control (integrity): Abbott does not access Professional User content unless it is necessary to provide Professional User with the products and professional services it selects. Abbott does not access Professional User content for any purposes other than those set out in the Terms of Use and this DPA. Accordingly, Abbott does not know what content Professional User stores on its systems and cannot distinguish between Personal Data and other content. As a result, Abbott treats all Professional User content in the same manner. In this way, all Professional User content receives the same high level of security, regardless of whether this content contains Personal Data or not.

    Abbott takes appropriate measures to ensure that it is possible to verify and establish that no Personal Data has been entered into or removed from data processing systems. This is achieved by:

  6. Order control: Abbott takes steps to ensure that, where Personal Data is processed, it is processed strictly in accordance with Professional User's instructions. This is achieved by:

  7. Availability control (availability): Abbott takes steps to ensure that Personal Data is protected from accidental destruction or loss. This is achieved by:

  8. Separation of processing for different purposes: Abbott takes steps to ensure that Personal Data collected for different purposes can be processed separately. This is achieved by:

  9. Resilience: Abbott has implemented the following technical and organizational security measures, in particular to ensure the reliability of its processing systems and services:

***********************************

Annex D
Standard Contractual Clauses for Data Processors

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection

Professional User (hereinafter referred to as "data exporter")
and
Abbott (hereinafter referred to as "the data importer")
each for itself a "party"; together "the parties"

HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

Clause 1
Definitions

The following definitions shall apply in the context of contractual clauses:

For the purposes of the Clauses:

  1. 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
  2. 'the data exporter' means the controller who transfers the personal data;
  3. 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his Instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
  4. 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his Instructions, the terms of the Clauses and the terms of the written subcontract;
  5. 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
  6. 'technical and organizational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2
Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3
Third-party beneficiary clause

  1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.

  2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.

  3. The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

  4. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4
Obligations of the data exporter

The data exporter agrees and warrants:

  1. that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
  2. that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;
  3. that the data importer will provide sufficient guarantees in respect of the technical and organizational security measures specified in Appendix 2 to this contract;
  4. that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
  5. that it will ensure compliance with the security measures;
  6. that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
  7. to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
  8. to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
  9. that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
  10. that it will ensure compliance with Clause 4(a) to (i).

Clause 5
Obligations of the data importer

The data importer agrees and warrants:

  1. to process the personal data only on behalf of the data exporter and in compliance with its Instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
  2. that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the Instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
  3. that it has implemented the technical and organizational security measures specified in Appendix 2 before processing the personal data transferred;
  4. that it will promptly notify the data exporter about:

    1. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
    2. any accidental or unauthorized access, and
    3. any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized to do so;
  5. to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
  6. at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
  7. to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
  8. that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
  9. that the processing services by the subprocessor will be carried out in accordance with Clause 11;
  10. to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

Clause 6
Liability

  1. The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.

  2. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.

    The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.

  3. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7
Mediation and jurisdiction

  1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:

    1. to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
    2. to refer the dispute to the courts in the Member State in which the data exporter is established.
  2. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8
Cooperation with supervisory authorities

  1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.

  2. The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.

  3. The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9
Governing law

These Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10
Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11
Subprocessing

  1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement.

  2. The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

  3. The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.

  4. The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.

Clause 12
Obligations after termination of data processing services

  1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

  2. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

Appendix 1 to Standard Contractual Clauses

Capitalized terms in this Annex 1 have the meanings given to them in the DPA.

Data exporter
The data exporter is a provider of healthcare services to patients.

Data importer
The data importer is the provider of the LibreView Data Management System.

Data Subjects
The Personal Data transferred concern the following category of Data Subjects:

Categories of Personal Data
The Personal Data transferred concern the following categories of data:

Registration data

IT usage data

Special Categories of Personal Data

Processing Operations
The Personal Data transferred shall be subject to the following processing operations:

Appendix 2 to Standard Contractual Clauses

A description of the technical and organizational measures that Abbott implements in accordance with Clauses 4(d) and 5(c) of the Standard Contractual Clauses is set out at Annex C (Security measures).

As set out in Annex C of this DPA.

DOC42186-001_rev-D_en-US