Welcome, and thank you for your interest in Shockwave Medical, Inc. ( “Shockwave Medical“, “we,” or “us“), and our website at www.shockwavemedical.com, as well as all related websites on which a link to this Privacy Policy (this “Policy“) is displayed (collectively, our “Sites“). This Policy describes the Personal Information that we gather from you on the Sites, how we use and disclose such information, your rights and choices with respect to your information, and how you can contact us if you have any questions or concerns. This Policy applies to persons anywhere in the world who visit or use the Sites, except as specified, and certain provisions apply only to persons in specified locations. If you are a resident of California, Nebraska, Texas, Japan, the European Economic Area, or the United Kingdom, please see the additional disclosures below and information about additional rights with respect to Personal Information that we collect or otherwise obtain about you.
Please read this Policy carefully to understand what Personal Information we collect and how we treat it. We recommend that you review this Policy periodically because we revise from time to time without notice to you. The “Effective Date” at the top of this page indicates when this Policy was last revised.
We collect Personal Information about you directly from you and from third parties, as well as automatically through your use of the Sites. In this Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular resident or household.
Information Provided by You
Information Collected via Automated Means
Information Collected from Third Parties
We use Personal Information we collect on the Sites as necessary for the following purposes:
We also use the information in other ways for which we provide specific notice at the time of collection and obtain your consent to the extent required by applicable law. We may aggregate or de-identify any information collected about you and we may use that aggregated or de-identified information for any purpose in accordance with applicable law.
How We Use Cookies and Similar Technologies
Below is an overview of the types of cookies we and third parties use to collect Personal Information.
For more details on the types of cookies we use, including their purpose and storage duration, please see the information in our Cookie Settings tool. Where required by applicable law, we obtain your consent to use cookies that are not strictly necessary. You can find more information about your rights and choices, and how to manage your cookie preferences, including how to make individual choices or to opt out of the use of certain cookies in the section Your Rights and Choices below.
Except as described in this Policy, we will not disclose your information that we collect on the Sites to third parties without your consent. We disclose information to third parties if you consent to us doing so, as well as in the following circumstances:
You can, of course, decline to share certain Personal Information with us, in which case we may not be able to provide to you some of the features and functionality of the Sites.
If you receive commercial emails from us , you can unsubscribe at any time by following the instructions contained within the email. You can also opt-out from receiving commercial email from us, and any other promotional communications that we send to you from time to time, by contacting us using the contact details at the end of this Policy. We allow you to view and modify settings relating to the nature and frequency of promotional communications that you receive from us in user account functionality on the Sites.
Please be aware that if you opt-out of receiving commercial emails from us or otherwise modify the nature or frequency of promotional communications you receive from us, it may take up to ten business days for us to process your request , and you may receive promotional communications from us that you have opted-out from during that period. Additionally, even after you opt-out from receiving commercial messages from us, you will continue to receive administrative messages from us regarding the Sites.
Your Cookie Choices
You have the following choices regarding the use of cookies and similar technologies.
For the 12-month period prior to the date of this Policy, the table below shows the categories of Personal Information subject to the California Consumer Privacy Act’s (“CCPA”) notice provisions we have collected, which categories of categories of third parties the Personal Information was shared with, and, if applicable, which categories of third parties the Personal Information was “sold” to or “shared” with, as defined by the CCPA.
Data Category | Categories of Third Parties to Whom Personal Information Has Been Disclosed for Business Purposes | Categories of Third Parties to Whom Personal Information Has Been Sold or Shared for Targeted Advertising |
Identifiers, e.g., name, email address, online identifiers (such as username) | Our affiliates | N/A |
Internet and other online activity, and device information, such as IP address, device ID, browser information and history, cookie information, operating systems, time stamps, the pages you request, the path you take on the Sites, user settings, your use of our Service and apps, etc. | Our affiliates; service providers that host our Sites and place advertisements for us. | Advertising networks |
Geolocation data | N/A | |
Professional or employment related information | N/A | |
Educational information | N/A | |
Inferences drawn from other information | Advertising networks |
We do not have actual knowledge that we sell or share for cross-context behavioral advertising purposes Personal Information of individuals under 16 years of age. We do not use or disclose sensitive Personal Information (as defined by the CCPA) for purposes other than those expressly permitted under the CCPA. Additionally, we do not to attempt to re-identify de-identified information that we derive from Personal Information.
Sources. We obtain the data identified in the chart above directly from you when you provide it to us, when you sign up for our services or marketing, and when you interact with our Sites. We also obtain this data indirectly from cookies, tags, and other digital tools. We make inferences drawn from other information based on our own observation, analysis, or algorithms.
Purposes for Processing. We process your Personal Information as described in Section 2, above.
Non-Discrimination. You have the right to be free from discrimination for exercising your rights to know or delete. We will not deny you products or services, charge you different rates, or give you different discounts because you used any of these rights.
Right to Know. You may request that we provide you a list of the categories of Personal Information we have collected about you over the last 12 months, the categories of sources from which it was collected, the business or commercial purpose for collecting, selling, or sharing the information, the categories of third parties to whom we disclosed, sold, or shared that information, and the specific pieces of Personal Information we have collected about you.
Right to Rectify. You may request that we rectify any of your Personal Information that we possess if you believe it is not accurate. We will ensure that all references to such Personal Information within our systems is updated according to your request.
Right to Portability. You may also request that we provide you a copy of the specific pieces of Personal Information we have collected about you in the past 12 months in an electronic format. You may make a request to know up to two times in a 12-month period, subject to limitations described in the law. For a list of general categories of information that we have collected and shared in the past 12 months, see the table above. The foregoing does not apply to personal information exempted under the CCPA.
Right to Delete. You may request that we delete any Personal Information that we have collected from you, apart from information that the law allows us to keep. When we respond to your request to delete, we will explain what (if any) information we have kept and why. The foregoing does not apply to personal information exempted under the CCPA.
Right to Opt-Out of Sale or Sharing. You may opt-out of the “sale” or “sharing” of your Personal Information by using the “Do Not Sell My Personal Information” link located on www.shockwavemedical.com. How to Make a Request to Know, Rectify, or Delete. You may make a request to know, rectify, or delete by completing a Privacy Web Form request online or emailing privacy@shockwavemedical.com. When you make a request, we will take steps to verify your identity before responding. This is to protect your information. We will ask you to provide us your email address.
Authorized Agent. You may designate an authorized agent to make requests on your behalf. We will require verification that you did, in fact, authorize the agent. Unless the law requires otherwise, your authorized agent must provide contact details for you. We will contact you to confirm that you authorized the agent. Once you confirm, we will promptly respond to the rights request.
No Automated Decision-Making. We do not perform any automated decision-making with the Personal Information that we collect about you.
Depending on where you live, and subject to certain exceptions, you may have the following rights with respect to certain of your Personal Information:
You may submit requests to exercise your other rights by completing a Privacy Web Form request online or emailing privacy@shockwavemedical.com.
You may also have the right to appeal a refusal to take action on your request by emailing us at privacy@shockwavemedical.com with the subject line “Appeal of Rights Request Decision.”
If you are located in the European Economic Area (“EEA“) or the United Kingdom (“UK“), your Personal Information may be protected by data protection laws in the EEA or UK, such as the EU General Data Protection Regulation (“GDPR“) or UK data protection laws. Below we provide additional information on the “processing” (as such term is defined under EEA/UK data protection laws) of your Personal Information, which supplements the other information provided in this Privacy Policy. For purposes of EEA/UK data protection laws, the term “Personal Information” as used in this Privacy Policy includes “personal data”, as such term is defined and understood under EEA/UK data protection laws.
Responsible Entity for Processing of EEA / UK Personal Information
Shockwave Medical, Inc. is responsible as controller (as defined under EEA and UK data protection laws) for the processing of your Personal Information. You can contact us, and our data protection officer , at any time at the contact details set out at the end of this Privacy Policy.
Legal Basis for Our Use of European/UK Personal Information
When we process your Personal Information as described in this Privacy Policy, we rely on the following “legal bases”:
We only rely on our or a third party’s legitimate interests to process your Personal Information when these interests are not overridden by your rights and interests
Transfer and Processing outside of the EEA and the UK
Shockwave Medical, Inc. is headquartered in the U.S., and as a result your Personal Information will be collected and processed by us in the U.S.
If you are located in the EEA or UK, we will comply with applicable EEA/UK data protection law when transferring your Personal Information to recipients located outside of the EEA/UK. We transfer your Personal Information to countries which have been found to provide adequate protection by the EU Commission (e.g., Switzerland, Canada) or to recipients certified under a mechanism recognized under an adequacy decision by the EU Commission (such as the EU-U.S. Data Protection Framework for recipients in the USA). In case of a transfer to recipients in countries which may not provide for the same level of data protection as considered adequate in the EEA/UK and for which an adequacy decision by the European Commission does not exist, we use contractual protections for the transfer of Personal Information (such as the EU Standard Contractual Clauses ), or transfer to recipients who have adopted Binding Corporate Rules. For more information about how we transfer Personal Information outside of the EEA/UK, or to obtain a copy of the safeguards we use for such transfers, you may contact us as specified below.
Your Rights in Relation to the Processing of Your Personal Information
If you are located in the EEA or the UK, to the extent you are affected by the processing of Personal Information by us, you have the following rights in accordance with applicable legal provisions:
You also have the right to object, in accordance with the legal provisions, to the processing of Personal Information, which is necessary for the purpose of our legitimate interests, on grounds relating to your particular situation (right to object). If your Personal Information is processed by us for direct marketing purposes, you have the right to object to this processing at any time, without any special reason.
You may further withdraw any consent you previously provided to us regarding the processing of your Personal Information, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.
You may exercise your rights, and withdraw your consent, by contacting us using the contact details at the end of this Policy. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain information for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.
Without prejudice to any other remedies, you also have the right to lodge a complaint with a supervisory authority at any time.
If you are located in Japan, you have additional rights described below.
You may request access to and receive information about the Personal Information we maintain about you, update, and correct inaccuracies in your Personal Information, restrict or object to the processing/providing of your Personal Information, and have the information deleted pursuant to the Act on the Protection of Personal Information of Japan (the “APPI“). In addition, you may lodge a complaint with the competent authority.
You may exercise these rights by contacting us using the contact details at the end of this Policy. Please note that there are exceptions and limitations to each of these rights under the APPI.
We transfer your Personal Information to countries whose laws may not provide the same level of data protection as Japan. For these cases, we have established contractual arrangements and security safeguards within Shockwave Medical and with third parties to ensure an adequate level of data protection at least as required for personal information processing operators under the APPI. We may use your “Personal Data” as defined under the APPI, with our affiliates and subsidiaries jointly as below, Shockwave Medical is responsible for such sharing and our General Counsel is our representative.
Personal data items to be used jointly | Purposes of joint-use | Scope of joint users | Person responsible for managing personal data for joint use |
Items as stated in Section 1 “Personal Information We Collect” above | Purposes as stated in Section 2 above “How We Use Personal Information (Purposes of Use)” above | our affiliates and subsidiaries |
|
The Sites are hosted in the United States. If you choose to use the Sites from regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your Personal Information outside of those regions to the United States for storage and processing, which does not have the same data protection laws as your jurisdiction. Also, we transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Sites. By providing any information, including Personal Information, on or to the Sites, you consent to such transfer, storage, and processing.
Our Sites are for general audiences and are not directed to children under the age of 13, and we do not knowingly collect Personal Information from children under the age of 13 without obtaining parental consent. If you are under 13 years of age, then please do not use or access the Sites at any time or in any manner. If we learn that Personal Information has been collected on the Sites from persons under 13 years of age and without verifiable parental consent, then we will take the appropriate steps to delete this information. If you are a parent or guardian and discover that your child under 13 years of age has provided Personal Information on the Sites, then you may alert us using the contact details at the end of this Policy, and request that we delete that child’s Personal Information from our systems.
We retain your Personal Information only for as long as is reasonably necessary to fulfill the purpose for which it was collected, and to meet legal requirements, including record retention, resolving disputes, and enforcing our agreements. We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it unless we are required by law to keep this information for a longer period or the information is necessary to exercise, establish or defend our legal claims. When determining the specific retention period, we consider various criteria, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by law and the statute of limitations.
The Sites contain features or links to websites and services provided by third parties. Any information you provide on third-party sites or services is provided directly to the operators of such services and is subject to those operators’ policies, if any, governing privacy and security, even if accessed through the Sites. We are not responsible for the content or privacy and security practices and policies of third-party sites or services to which links or access are provided through the Sites. We encourage you to learn about third parties’ privacy and security policies before providing them with information.
We use certain physical, managerial, and technical safeguards that are designed to provide an appropriate level of integrity, confidentiality, and security of Personal Data that we collect and maintain. We cannot, however, ensure or warrant the security of any information you transmit to us, and you do so at your own risk.
Please revisit this page periodically to stay aware of any changes to this Policy, which we update from time to time. If we modify this Policy, we will make it available through the Sites, and indicate the date of the latest revision. If the modifications materially alter your rights or obligations hereunder, we will make reasonable efforts to notify you of the change. For example, we may send a message to your email address, if we have one on file, or generate a pop-up or similar notification when you access the Sites for the first time after such material changes are made. Your continued use of the Sites after any revisions to this Policy have become effective indicates that you have read, understood, and agreed to the current version of this Policy.
Unless otherwise indicated, Shockwave Medical is the entity responsible for the processing of your Personal Information as described in this Policy. Please contact us with any questions or comments about this Policy, your Personal Information, our use and disclosure practices, or your consent choices by email at privacy@shockwavemedical.com.
Shockwave Medical, Inc.
Attn: Legal
5403 Betsy Ross Drive
Santa Clara, CA 95054
United States