Privacy Notice for Research and Development Activities in Connection with AI Technologies  

Unless otherwise specified in project-specific information, the controller for the processing described in this Privacy Notice is the Siemens Healthineers entity that determines the purposes and means of the relevant processing. In many cases, this is Siemens Healthineers AG, Germany, or one of its affiliated companies that is responsible for the relevant processing (Siemens Healthineers).  

In many cases, the Siemens Healthineers entity receiving the personal data and the third party providing the data act as independent controllers for their processing activities. To the extent Siemens Healthineers and a third party jointly determine the purposes and means of processing; they act as joint controllers within the meaning of applicable data protection law. More detailed information on the respective allocations of roles may be provided in specific information or the relevant data protection notices. 

What personal data does Siemens Healthineers process? 

Siemens Healthineers does not collect personal data directly from individuals. Instead, we receive personal data from third parties in the context of patient care, research, clinical activities, device use, or related healthcare activities. We may process the following categories of personal data: 

• Health data (for example, medical images, health records, and test results), biological samples (such as blood or tissue samples), and data resulting from the analysis of human biological samples 
• Demographic information (for example, age, gender, and other relevant clinical details) 
• Technical metadata (for example, information about how the data files were created, stored, or processed).

Siemens Healthineers does not receive information that would allow individual persons to be directly identified, such as names or contact details. Such information remains with the relevant third party and is not required for the processing carried out by Siemens Healthineers. The personal data made available to Siemens Healthineers is generally pseudonymised before it is shared with us, meaning that Siemens Healthineers does not have access to the information necessary to re-identify the data subject. 

For what purposes do Siemens Healthineers use my Personal Data? 

Siemens Healthineers processes personal data for research and development purposes as well as for the design, development, training, testing, validation, improvement, and fine-tuning of AI technologies, software, algorithms, and medical devices. This may include processing to assess safety, performance, accuracy, cybersecurity, and methodology; to create and maintain documentation and evidence required for quality management and regulatory compliance; and to support market surveillance, vigilance, product monitoring, error analysis, and corrective or preventive actions. Personal data may also be processed to collaborate with third parties and, where necessary, to establish, exercise, or defend legal claims. 

Which legal basis does Siemens Healthineers rely on? 

Siemens Healthineers processes personal data for the purposes described above based on the applicable legal basis under the GDPR and, where required, under supplementary Union or Member State law. Depending on the processing activity and the category of data, the following legal bases may apply:  

• Article 6(1)(a) and Article 9(2)(a) GDPR (consent), where you have explicitly consented to the processing of your personal data, including special categories of personal data. 
• Article 6(1)(c) and Article 9(2)(i) GDPR (public interest in the area of public health), where and to the extent the processing is necessary for compliance with a legal obligation or for reasons of public interest in the area of public health and there is a relevant basis for this in applicable UK or Union or Member State law (as applicable), in particular to comply with post-market surveillance and vigilance obligations under the Medical Devices Regulations 2002, Medical Device Regulation (Regulation (EU) 2017/745) and the In Vitro Diagnostic Regulation (Regulation (EU) 2017/746) (as applicable).
• Article 6(1)(f) and Article 9(2)(j) GDPR (scientific research), where and to the extent the processing is necessary for scientific research purposes or for Siemens Healthineers research and development activities, including the development, validation, and improvement of AI technologies and medical devices, and is permitted under Article 89(1) GDPR and, where applicable, supplementary UK or Union or Member State law, such as Section 27 BDSG19 of the Data Protection Act 2018.
• Article 6(1)(f) GDPR and Article 9(2)(f) GDPR, where and to the extent the processing is necessary for the purposes of the legitimate interests pursued by Siemens Healthineers or a third party and your interests or fundamental rights and freedoms do not override those interests, in particular for the establishment, exercise, or defence of legal claims.

Siemens Healthineers implements technical and organisational measures to protect personal data and ensure a high level of security, confidentiality, and integrity. These measures may include pseudonymisation, aggregation of evaluations, access controls, and other safeguards designed to reduce the risk of re-identification. 

For the purposes described above, Siemens Healthineers may disclose personal data to the recipients listed below, but only where and to the extent this is necessary. 

Internal recipients: Employees of Siemens Healthineers and companies within the Siemens Healthineers that require the data to perform internal tasks or to comply with Siemens Healthineers’ contractual or legal obligations 

External recipients: To the extent necessary for the purposes described above, Siemens Healthineers may disclose personal data to external recipients who, depending on the processing, act as processor, independent controllers, or recipients by reason of a legal obligation. These may in particular include the following categories:  

• Healthcare providers and commissioned service providers supporting Siemens Healthineers’ AI R&D activities, as well as consortium partners and research organisations collaborating with Siemens Healthineers 
• Notified Bodies, for example, where certification is required 
• Supervisory authorities, enforcement authorities, courts, or ethics committees, where disclosure is required by law 
• Business partners or (IT) service providers processing personal data on behalf of Siemens Healthineers, for example in connection hosting, IT maintenance, and support services.

Third parties involved in fulfilling legal obligations, corporate transactions, or the establishment, exercise, or defence of rights and claims, including courts, arbitral tribunals, law enforcement authorities, supervisory authorities, lawyers, and advisors.

Siemens Healthineers stores personal data only for as long as necessary to fulfil the relevant processing purpose. The specific retention period depends in particular on the type of data, the relevant research, development, quality, or regulatory purpose, and applicable statutory retention and documentation obligations. Where personal data is no longer needed, it will be deleted or anonymised accordingly, unless a legal obligation or legitimate need for continued retention exists. In the UK, in accordance with Articles 5(1)(e) and 84B of UK GDPR, personal data being processed for research purposes may be held indefinitely, where it continues to be processed for research-related purposes and provided that appropriate safeguards are in place in relation to your rights and freedoms.

Siemens Healthineers operates globally. For the purposes described in this Privacy Notice, personal data may be transferred within the Siemens Healthineers group and to external recipients in third countries outside the UK, the European Union (EU) and the European Economic Area (EEA). These recipients are located in particular in the United States, Switzerland, the People's Republic of China and India; a complete and up-to-date list of the third countries concerned is available on request at dataprivacy.func@siemens-healthineers.com. As a result, personal data may be processed or stored outside the country in which it was originally collected. 

For certain third countries, both the European Commission and the UK government have issued adequacy decisions under Article 45 GDPR; in those cases the transfer is based on that decision. Where no adequacy decision exists for a third country, which applies in particular to the People's Republic of China and India, Siemens Healthineers bases the transfer on appropriate safeguards under Article 46 GDPR, namely the EU Standard Contractual Clauses (supplemented by the UK International Data Transfer Addendum) together with supplementary intra-group data transfer agreements. Before such a transfer, Siemens Healthineers carries out a transfer impact assessment and, where necessary, supplements the Standard Contractual Clauses with additional technical and organisational measures such as pseudonymisation, encryption and access restrictions. Please note that in certain third countries, in particular the People's Republic of China and India, public authorities may access personal data under applicable local law, and that the level of data protection, oversight and available legal remedies may differ from that within the UK and the EEA. 

For transfers governed by Swiss data protection law, the EU Standard Contractual Clauses apply with the amendments recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) (Swiss Addendum). 

Where possible, Siemens Healthineers transfers anonymised or pseudonymised data. You may request a copy of the appropriate safeguards used, including the Standard Contractual Clauses and the UK and Swiss Addenda, from the Siemens Healthineers Data Privacy Organisation at dataprivacy.func@siemens-healthineers.com. 

Under the GDPR, you have certain rights in relation to your personal data. Subject to the applicable legal requirements (under the GDPR or other applicable laws), you may: 

• request confirmation as to whether Siemens Healthineers processes your personal data and, if so, obtain access to that data and related information 
• request the correction of inaccurate personal data 
• request the deletion of your personal data 
• request the restriction of the processing of your personal data 
• request a copy of the personal data you have provided to Siemens Healthineers or ask that it be transferred to another recipient 
• request not be subject to a decision based solely on automated processing. Making decisions about you based solely on automated decision making where that decision would have a significant impact on you
• object to the processing of your personal data on grounds relating to your particular situation, where the processing is based on legitimate interests.

If you have provided consent for the processing of your personal data, you may withdraw that consent at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. 

Where Siemens Healthineers relies on legitimate interests as the legal basis for processing, those interests have been balanced against your rights and freedoms. You may request further information regarding this balancing of interests from the Siemens Healthineers Data Privacy organisation. 

As Siemens Healthineers generally cannot identify data subjects of the pseudonymised data received, the exercise of certain rights may be limited in individual cases to the extent Siemens Healthineers is unable to identify the data subject. This is subject to the conditions of Article 11 GDPR. If the data subject provides additional information enabling identification, Siemens Healthineers will assess the request in accordance with the applicable data protection requirements. Where necessary, Siemens Healthineers may also refer the data subject to the data-supplying controller.  

In addition, certain rights may be restricted where personal data is processed for scientific research purposes, to the extent permitted under Article 89(1) GDPR and applicable UK or Union or Member State law, in particular where the exercise of those rights would render the achievement of the research purposes impossible or seriously impair it and such restrictions are necessary for those purposes. Depending on the applicable law and the specific circumstances, this may in particular affect the rights of access, rectification, restriction of processing, objection, and erasure. Where required, Siemens Healthineers will coordinate incoming requests with the relevant data-supplying controller. 

The Siemens Healthineers Data Protection Officer and the Siemens Healthineers data privacy organisation provide support with any data privacy related questions, comments, concerns, or complaints or in case you wish to exercise any of your data privacy related rights. They can be contacted at dataprivacy.func@siemens-healthineers.com. 

If you are based in the UK, if you are not happy with the way that Siemens Healthineers processes your personal data, or you believe that there has been an infringement of applicable data privacy laws by Siemens Healthineers, you can complain directly to Siemens Healthineers by registering a complaint using the complaint function available here, or by contacting the Siemens Healthineers data privacy organisation.. Or by contacting the Siemens Healthineers data privacy organisation.

The Siemens Healthineers Data Protection Officer and the Siemens Healthineers data privacy organisation will make every effort to address and resolve any inquiries or complaints brought to their attention. In addition, you have the right to lodge a complaint with a competent supervisory authority, in particular in the country of your habitual residence, place of work, or place of the alleged infringement. 

If you are based in the UK, you may contact the UK’s Information Commission at Information Commission, Wycliffe House, Water Lane, Wilmslow, SK9 5AF; 0303 123 1113 or www.ico.org.uk. 

If you are based in Europe, the competent lead supervisory authority for Siemens Healthineers is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de/en/index/html. 

The list and contact details of the EU national supervisory authorities is available here. 

We review this Privacy Notice regularly to ensure that it remains accurate and up to date. We may update it from time to time. We will inform you of material changes by appropriate means before the change takes effect. The date of the last revision is indicated at the beginning of this Privacy Notice. We recommend that you check this Privacy Notice regularly for any changes.