Privacy Notice

This Privacy Notice applies to personal data collected, submitted, uploaded, accessed, used, generated, stored, disclosed, transferred, retained or otherwise processed through or in connection with the Site, including personal data of qualified healthcare professionals (“HCP”) and patients or individuals whose information is entered, submitted, uploaded or otherwise processed through the Site (“Patients”).

This Privacy Notice forms part of the Site’s Terms of Use (“Terms”). Capitalized terms not defined in this Privacy Notice have the meanings given to them in the Terms. If there is any inconsistency between this Privacy Notice and the Terms in relation to the use of the Site, the Terms shall prevail to the extent necessary to protect Merz Aesthetics’ rights, comply with applicable laws and maintain the intended allocation of responsibilities between HCP, Patients and Merz Aesthetics.

The Site is intended as a general educational and reference tool for HCP use only and is not intended to create, maintain or store medical records, treatment records, clinical notes, prescriptions, diagnoses or other patient healthcare records. HCP remains solely responsible for maintaining all required medical and patient records outside the Site in accordance with applicable laws, professional obligations and institutional requirements.

By accessing, browsing, entering and submitting information to, creating an account, logging into or using the Site, you confirm that you have read and expressly agree to the collection, use, disclosure, transfer and other processing of your personal data in accordance with this Privacy Notice. Further, you acknowledge that we may change the terms and conditions of this Privacy Notice at any time without notice. You should review this Privacy Notice each time you visit and/or use the Site.

This Privacy Notice applies to:

• HCP. Duly qualified healthcare professionals who register for, access, use, review, refer to, submit information through, or otherwise interact with the Site. The definition of HCP also includes HCP’s clinic, hospital, institution, employer, authorized personnel or representative (who must also be a qualified healthcare professional).
• Patients. Patients or individuals in the Location whose personal data is entered, uploaded, submitted, reviewed, used or otherwise processed through the Site for their designated HCP.
• Authorized personnel and representatives. Where applicable, personnel (who must also a qualified healthcare professional) acting for HCP, HCP’s clinic, hospital, institution, employer or other authorized organization in connection with the Site.

References to “User”, “Users”, “you” or “your” mean HCP and Patients collectively, unless the context requires otherwise.

Depending on your role, how the Site is configured and what information is entered into the Site, we may process the following categories of personal data:

• HCP account and professional information: name, business contact details, clinic, hospital, institution or employer details, professional role, user credentials, access rights, account status, registration information, confirmations, consents, acceptance records and other information needed to administer HCP access to the Site.
• Patient Data: personal data, images, records, notes, patient responses, consultation or assessment-related information, treatment history, treatment planning information, health, medical or aesthetic-related information, and any other information entered, uploaded, submitted or otherwise processed through the Site by Patients or HCP.
• Site usage, technical and security data: login records, audit trails, consent records, device, browser, network, IP address, system, security, diagnostic, error, troubleshooting, support and usage logs, and information generated through the operation, maintenance, security, administration or improvement of the Site.
• Site Output and derived information: outputs, suggestions, prompts, risk indicators, treatment pathways, reference guidance, analytics, quality assurance results, de-identified, anonymized, aggregated or non-identifiable data or datasets generated through or in connection with the Site.

HCP and Patients must not submit personal data that is unnecessary, excessive, inaccurate, unlawful or inappropriate for the intended use of the Site.

Personal data may be collected:

• directly from HCP when HCP registers for, accesses, uses or submits information through the Site;
• directly from Patients when Patients provide, enter, upload or submit information through the Site;
• from HCP, HCP’s clinic, hospital, institution, employer, authorized personnel or representative (who must also be a qualified healthcare professional) when they enter, upload, submit, review, access or otherwise process Patient Data through the Site;
• automatically through the operation of the Site, including through access logs, audit trails, technical logs, usage data, security tools, analytics tools and support or troubleshooting processes; and
• from Merz Aesthetics’ related entities, affiliates, contractors, service providers, technology vendors, support providers, security providers, analytics providers, hosting providers, cloud service providers and other persons who assist with the Site or related services.

Merz Aesthetics, its related entities, affiliates, contractors, service providers and other authorized persons may collect, host, store, access, use, process, analyze, transmit, disclose, retain, transfer and otherwise handle personal data for the following purposes:

• operating, hosting, maintaining, securing, supporting, troubleshooting, administering, monitoring, updating, modifying and improving the Site;
• creating, managing and administering HCP accounts, registrations, credentials, access controls, user roles, account status, acceptance records, consent records and audit trails;
• enabling Patients to submit information for HCP review and enabling HCP to access, review, assess, manage and use Patient Data for reference and treatment planning according to HCP’s independent professional judgment;
• generating Site Output for HCP review, including outputs, suggestions, options, prompts, risk indicators, treatment pathways, treatment guidance or other reference information;
• supporting HCP’s lawful use of the Site, including technical support, service support, maintenance, troubleshooting, security monitoring and administrative assistance;
• conducting analytics, quality assurance, review, testing, verification, validation, monitoring, improvement and development of the Site and related services;
• de-identifying, anonymizing, aggregating and/or creating non-identifiable data or datasets, including for analytics, quality assurance, service improvement, research or reporting purposes, where permitted by applicable law;
• detecting, preventing, investigating and responding to suspected or actual misuse, unauthorized access, security incidents, vulnerabilities, cyber threats, fraud, technical issues, operational issues, data loss or other risks affecting the Site;
• complying with legal, regulatory, pharmacovigilance, product complaint, adverse event, audit, security, compliance, investigation, reporting and recordkeeping requirements;
• establishing, exercising, enforcing or defending legal rights, contractual rights, claims, complaints, investigations or proceedings; and
• exercising Merz Aesthetics’ rights and performing Merz Aesthetics’ functions under the Terms and this Privacy Notice.

Patient Data may be entered, uploaded, submitted or otherwise processed through the Site by Patients, HCP or persons acting on their behalf. HCP is solely responsible for determining what Patient Data is necessary, appropriate, accurate, complete, lawful and proportionate for HCP’s intended use of the Site.

Before entering, uploading, submitting, accessing, using, disclosing, transferring or otherwise processing Patient Data through the Site, HCP must ensure that all required patient notices, consents and/or authorizations have been provided or obtained under applicable data protection, privacy, medical confidentiality, healthcare, professional and institutional requirements.

• HCP must not enter Patient Data unless HCP is legally permitted to do so and has obtained all necessary patient consents, authorizations or other lawful basis.
• HCP must not enter more Patient Data than is necessary for the intended purpose of using the Site.
• HCP must promptly correct or delete inaccurate, excessive, unnecessary or inappropriate Patient Data where required or appropriate.
• HCP is responsible for handling and responding to Patient questions, access requests, correction requests, deletion requests, withdrawal requests, objections, complaints, consents and other data protection requests relating to Patient Data.
• HCP remains solely responsible for maintaining all required medical, treatment, clinical and patient records outside the Site.

By using the Site, HCP represents and warrants that HCP has provided all required notices, obtained all required consents, authorizations and lawful bases, and complied with all applicable data protection, privacy, healthcare, medical confidentiality, professional and institutional requirements relating to Patient Data.

As between HCP and Merz Aesthetics, HCP is the data controller of Patient Data and remains solely responsible and accountable for HCP’s collection, submission, upload, access, use, disclosure, transfer, retention and other processing of Patient Data through or in connection with the Site.

Merz Aesthetics provides, operates, hosts, supports and administers the Site and may process Patient Data on behalf of, at the request of, or for the benefit of HCP or HCP’s clinic, hospital or institution. Such processing shall not make Merz Aesthetics a controller, joint controller, healthcare provider, medical record custodian or medical decision-maker in respect of Patient Data, nor shall it impose on Merz Aesthetics any controller obligations, fiduciary duties, professional duties, patient-care responsibilities, consent-management obligations, data subject request obligations, recordkeeping obligations, notification obligations, liability or accountability that properly rests with HCP, HCP’s institution or another applicable controller, except to the extent such obligations cannot be excluded under mandatory applicable law.

Nothing in this Privacy Notice prevents Merz Aesthetics from processing personal data in its own capacity where necessary to comply with legal, regulatory, pharmacovigilance, product complaint, audit, security, compliance, investigation, risk-management, corporate governance or legal claims requirements, or to establish, exercise, enforce or defend its rights.

Merz Aesthetics may disclose, transfer or make personal data available to the following categories of recipients, whether located within or outside the Location, where necessary or useful for the purposes described in this Privacy Notice:

• Merz Aesthetics related entities and affiliates. Related entities, affiliates and group companies involved in operating, administering, supporting, securing, monitoring, improving or otherwise providing the Site and related services.
• Service providers and contractors. Hosting providers, cloud service providers, technology vendors, application developers, maintenance providers, support providers, security providers, analytics providers, testing providers, quality assurance providers, professional advisers, consultants, auditors and other contractors or providers who process personal data for or on behalf of Merz Aesthetics or in connection with the Site.
• HCP and HCP-related parties. HCP, HCP’s clinic, hospital, institution, employer, personnel, representatives and authorized users, where such disclosure is necessary or useful for HCP’s lawful use of the Site and review of Patient Data.
• Regulators and authorities. Regulatory authorities, healthcare authorities, data protection authorities, law enforcement bodies, courts, tribunals, government agencies and other competent authorities where required or permitted by applicable law.
• Transaction, restructuring and legal recipients. Professional advisers, insurers, auditors, potential or actual purchasers, assignees, transferees, successors or other persons involved in a corporate transaction, restructuring, audit, claim, investigation, proceeding or legal matter, where permitted by applicable law.

Merz Aesthetics may also disclose or transfer personal data where necessary to comply with applicable laws, respond to lawful requests, protect the rights, property, safety, security or integrity of Merz Aesthetics, the Site, Users, Patients, HCP, service providers or third parties, or enforce the Terms and this Privacy Notice.

Merz Aesthetics may engage contractors, hosting providers, cloud service providers, technology vendors, support providers, security providers, analytics providers and other sub-processors or service providers to process HCP personal data, Patient Data and any other data where necessary or useful to operate, host, maintain, support, troubleshoot, secure, administer, monitor, update, improve or otherwise provide the Site and related services.

The Site may also rely on, interoperate with, link to or incorporate third-party software, hosting, cloud services, analytics, connectivity, operating systems, browsers, devices, content, databases, clinical references, artificial intelligence systems or other third-party components (“Third-Party Services”). Merz Aesthetics does not control or operate Third-Party Services and shall not be liable for any act, omission, failure, vulnerability, unavailability, error, data breach, inaccuracy, security incident or content of any Third-Party Service, except to the extent such liability cannot be excluded under applicable law.

Merz Aesthetics shall not be responsible or liable for any act, omission, default, failure, vulnerability, breach, delay, interruption, loss, damage or misconduct of any third party, contractor, service provider, sub-processor or Third-Party Service, except to the extent such liability cannot be excluded under applicable law.

Personal data, including HCP personal data and Patient Data, may be stored, accessed, transferred, disclosed or processed in Singapore and/or other countries or territories where Merz Aesthetics, its related entities, affiliates, contractors, service providers, sub-processors or Third-Party Services operate or maintain systems, subject to applicable laws.

By using the Site, HCP and Patient consent to such storage, access, transfer, disclosure and processing. Merz Aesthetics’ decision to permit, facilitate or perform a transfer shall not be treated as a representation, warranty or confirmation that HCP’s collection, use, disclosure, transfer or other processing of Patient Data complies with applicable laws.

HCP remains solely responsible for ensuring that any collection, use, disclosure, transfer or other processing of Patient Data by or on behalf of HCP complies with all applicable data protection, privacy, healthcare, medical confidentiality, professional, institutional and cross-border transfer requirements.

HCP is responsible for maintaining the confidentiality and security of HCP’s account credentials, devices, networks, systems, personnel access, local records, exports, downloads, screenshots, printouts and any onward disclosure or use of Patient Data by HCP, HCP’s institution or personnel. HCP must not share login credentials or permit any unauthorized person to access the Site through HCP’s account.

HCP shall ensure that only authorized personnel with a legitimate need may access Patient Data through HCP’s account or HCP’s clinic environment. HCP remains responsible for all activity conducted through HCP’s account.

You agree that no system, platform, transmission, storage environment or technology service can be guaranteed to be completely secure, uninterrupted, error-free or immune from cyber threats.

To the maximum extent permitted by applicable law, Merz Aesthetics shall not be liable for any loss, damage, claim, complaint, penalty, regulatory action, data loss, data corruption, interruption, unavailability, malfunction, system error, technical failure, security incident, personal data breach, inaccurate output or other issue arising from or relating to the Site, any Third-Party Services, any system or technology failure, HCP’s account or use of Patient Data, or any act or omission of HCP, HCP’s institution, personnel, authorized users or third parties.

As between HCP and Merz Aesthetics, HCP remains solely responsible and accountable for any suspected or actual personal data breach, unauthorized access, loss, misuse, disclosure, alteration, corruption or compromise of Patient Data arising from or relating to HCP’s collection, submission, access, use, disclosure, transfer, retention or other processing of Patient Data, HCP’s account or HCP’s use of the Site.

HCP shall promptly notify Merz Aesthetics of any such incident and shall be responsible for assessing, investigating, mitigating, remediating, documenting and making any required notifications to Patients, regulators or other persons under applicable law. If Merz Aesthetics becomes aware of a personal data breach affecting Patient Data processed through the Site, Merz Aesthetics will respond in accordance with applicable law and may provide reasonable cooperation to HCP where legally required and technically feasible.

Nothing in this Privacy Notice creates any notification, remediation, compensation, indemnity or liability obligation for Merz Aesthetics beyond what is expressly required by applicable law.

Merz Aesthetics may retain personal data for as long as necessary or useful for the purposes described in this Privacy Notice, the Terms, applicable legal, regulatory, pharmacovigilance, product complaint, audit, security, compliance, investigation, risk-management, operational, accounting, reporting or legal claims requirements, or to exercise Merz Aesthetics’ rights.

The Site is not intended to be a medical record system, treatment record system, clinical record repository or patient charting tool. HCP remains solely responsible for maintaining all required medical records, treatment records, clinical notes and patient records outside the Site.

Upon expiry, suspension, termination, account closure or discontinuation of access, Merz Aesthetics is not required to return, export, restore, preserve, archive, back up or provide access to Patient Data, backup information, archived data, restored data, historical records or other information submitted through or generated by the Site, except to the extent expressly required under mandatory applicable law.

Merz Aesthetics may de-identify, anonymize, aggregate or otherwise transform personal data into non-identifiable data or datasets, and may use, retain, disclose, transfer, analyze, develop, improve or otherwise process such non-identifiable data or datasets for analytics, quality assurance, monitoring, improvement, research, reporting, benchmarking, service development, product development, business, legal, regulatory, compliance, security or other purposes, where permitted by applicable law.

To the extent such data is no longer personal data under applicable law, it will not be subject to this Privacy Notice and the applicable personal data laws.

Patients should contact their HCP, clinic, hospital, institution or other applicable controller for questions, requests, complaints, consents, withdrawals or objections relating to Patient Data. HCP is primarily responsible for handling and responding to Patient access, correction, deletion, withdrawal, objection, portability, restriction, complaint, enquiry or other data protection requests relating to Patient Data.

HCP may contact Merz Aesthetics for questions relating to HCP account information or the processing of personal data in connection with the Site. Merz Aesthetics may require verification of identity, authority and request scope before responding to any request, and may decline, limit or defer any request where permitted by applicable law, where the request relates to Patient Data controlled by HCP or another controller, or where the request would adversely affect legal, regulatory, security, audit, investigation, pharmacovigilance, product complaint, compliance or risk-management requirements.

The Site is intended for Users who are 18 years old or over. The Site is not intended for use by children or persons below the applicable age of majority. HCP must not submit personal data relating to a Patient who is below the applicable age of consent unless HCP has provided all required notices and obtained all required consents, authorizations or other lawful basis from the Patient, parent, guardian or other legally authorized person under applicable law.

Merz Aesthetics may amend this Privacy Notice from time to time without notice. Your continued access to or use of the Site after the updated Privacy Notice becomes effective constitutes your acknowledgement of the updated Privacy Notice. If you do not agree with the updated Privacy Notice, you must stop using the Site.

This Privacy Notice shall be governed by the laws of Singapore, without regard to conflict of law principles, unless mandatory law requires otherwise. The courts of Singapore shall have exclusive jurisdiction over any dispute arising out of or relating to these Terms, the Site or Site Output, unless mandatory law requires otherwise.

For questions regarding this Privacy Notice, the Site or personal data processed in connection with the Site, please contact us via the contact feature available on the Site.