Privacy Policy

About Nevro

Nevro is a global medical device company that offers products and services for the Senza^® and Senza Omnia^™ HF10^™ Systems (“Services”).

Who is your Nevro controller

“Nevro”, “we”, “us” or “our” refers to the relevant Nevro entity with which you deal as set out in the table below. This entity is the primary controller of your personal data and is responsible for providing you with this Notice.

Information we collect

We collect information about you when you provide it to us, when you use our Services, and when other sources provide it to us, as described below. We collect the following types of information:

• Information you provide through our Sites: When you complete and submit an online form on any of our Sites, such as through the “Contact Us” page, we may collect your name, phone number, and email address. When you complete and submit a patient assessment form on our HF10.com website in the U.S. and Germany, we collect your age, gender, phone number, email address, and other health-related information. We do not directly collect this contact information outside of the U.S and Germany. When you submit a form to see if you qualify for or express interest in one of our studies or clinical trials, we may collect your name, age, date of birth, gender, phone number, email address, zip code, and other health-related information, such as medical conditions you may be experiencing or any medications you might be taking. Where we provide the option for you to refer a friend or family member for one of our studies or clinical trials, we may collect that person’s name, email address, and other contact information.
• Information you provide for Nevro HF10 Therapy: We may collect information about you when you receive HF10 Therapy to facilitate treatment and post-treatment care. This will vary depending on where you are located but may include your name, gender, date of birth, mailing address, email, phone number, information relating to your pain (pain scores, procedure type, pain location), your Nevro medical device settings, and your experience with our Services. We may also collect your name and appointment information from healthcare providers, such as hospitals and clinics, where your procedure is performed. If you are located in Europe you will be provided with a separate notice which details the information collected when you receive HF10 Therapy.
• Information you provide at events: When you attend Nevro-hosted professional or patient education events, or submit requests for more information about our Services, we collect your name, email address, and phone number during the registration process. We also collect contact information to coordinate travel for attendees of Nevro-hosted professional education events and trainings. When you engage with us at trade shows and conferences, we collect contact information you provide to us, such as your name, email address, and phone number.
• Information you provide when you visit our offices: When you visit one of our offices we collect your name, organizational affiliation and contact information. In some offices we may also collect video images from CCTV when you enter and exit our offices.
• Information you provide to publish your testimonial: With your consent, we collect information such as your name, city, state, email address, health information (pain location), implant date, photographs and videos of you to publish your testimonial. Your testimonial may be featured on a variety of platforms, including on our Sites, social media, television, print, audio, marketing emails, and promotional materials.
• Service providers: If you are a service provider or professional advisor engaged by us, or if you are employed or otherwise engaged by a service provider or professional advisor to us, we may collect (either from you or from the organization with which you are affiliated) your name, organizational affiliation, national provider identifier, contact information and bank account details.
• Device information: When you visit our Sites, we automatically collect your operating system, IP address, device type, and device version.
• Browsing information: When you visit our Sites, we automatically collect your browser type and usage details, such as time, frequency, and use pattern. We may collect the domain name from which you access our Sites, the pages of our Sites that you visit, the amount of time spent on our Sites, and the number of times you return to our Sites.
• Cookies information: We collect cookies from your web browser when you navigate through our Sites. Cookies help make interactions with our Sites easier and faster for you. We also use cookies to analyze trends, administer our Services, and track activity and interactions with our Sites. For more information about how we use cookies and to learn how to manage cookies, please see our Cookie Notice.
• “Do Not Track” technologies: We currently do not respond to web browser “Do Not Track” signals.

How we use information

We use the information we collect about you to:

• Communicate with you: We may contact you to respond to your inquiries, requests, and/or send important notices. For example, we may contact to provide customer support, schedule appointments, update you about new Services, or to send invitations to Nevro-hosted events. See “Your choices and rights” section below to learn how to manage your communication preferences.
• Provide and improve our Services: We use information we collect to provide and analyze how you use our Services, develop new products and services, and improve functionality, efficiency, and quality of our Services.
• Perform data analytics for patient outcomes: The information we collect is anonymized and aggregated to perform data analytics. That helps us improve the quality of our Services, optimize our algorithms for HF10 Therapy, and present patient outcomes to current and prospective customers.
• Conduct scientific research and clinical studies: We conduct clinical studies and trials to test and improve our Services. We may use your information to contact you about studies or clinical trials for which you may be eligible or that might interest you. If you are a participant in a study or clinical trial, we will use your information to conduct the study or trial and any related follow-up activities. Participation in our studies and trials is voluntary. We use anonymized data for scientific research purposes in connection with our Services.
• Billing: Depending on your location, we may collect your name, date of birth, insurance number, and other health information, as necessary, to use for billing purposes.
• Marketing and advertising: We only publish testimonials, send marketing emails and newsletters, or call you about our Services with your consent. We advertise our Services on social media platforms, such as Facebook, but we will not directly contact you or collect your information through these platforms. In the U.S., we engage in behavioral advertising and partner with third parties, such as Google, to provide you targeted advertisements on our Sites.
• Coordinate travel for events: We use your contact information to coordinate travel arrangements if you attend a Nevro-hosted professional education event that requires you to travel outside of your city.
• Sale of information (CCPA): We do not sell patient or physician information as defined by the CCPA. See more information here.

Legal basis for processing (for EU and EEA customers)

If you are an individual in the European Union (EU) or European Economic Area (EEA), we collect and process your personal data only where we have a legal basis for doing so under applicable EU laws. The legal basis we determine depends on how you use our Services. This means we collect and use your personal information only:

• To perform direct marketing activities and publishing testimonials with your consent;
• For the provision of patient treatment and support in connection with our Services;
• To operate our business, develop and improve our Services, and for fraud prevention purposes;
• For scientific or research purposes in connection with our Services; and/or
• For compliance with legal obligations, such as regulatory safety reporting obligations.

If you have any questions about these lawful bases and how we use your personal information, please contact [email protected].

Legal basis for processing (for EU and EEA customers)

• To perform direct marketing activities and publishing testimonials with your consent;
• For the provision of patient treatment and support in connection with our Services;
• To operate our business, develop and improve our Services, and for fraud prevention purposes;
• For scientific or research purposes in connection with our Services; and/or
• For compliance with legal obligations, such as regulatory safety reporting obligations.

How we share information

We share information about you with third party service providers only in the manner described below:

• Service providers: We provide your information to other third party service providers to help us perform our Services. These service providers are authorized to use your information only as necessary to provide services on our behalf and under our direction. We use service providers for business activities such as relationship management, content management, data center hosting services, customer support, document management, marketing, and email administration.
• Nevro Corp. and Nevro affiliated companies: We share information we have about you with our affiliated companies to operate and improve our Services. Nevro affiliated companies are owned or operated by us. This Notice applies to the information we share with our affiliates.
• Behavioral advertising: In the U.S., we partner with advertising technology service providers, such as Google, to manage our marketing and advertising activities. These partners use cookies and other tracking technologies to collect information about your internet-browsing activities and habits. They use this information to provide you with targeted advertisements. To learn how to opt-out of ad network interest-based advertising in the U.S., please visit www.aboutads.info/choices and http://www.networkadvertising.org/choices/. If you are in the European Union, please visit www.youronlinechoices.eu. Even if you choose to opt-out, you will continue to receive generic advertisements.
• Legal purposes: We disclose your information when we believe that disclosure is (1) reasonably necessary to comply with any applicable law, regulation, subpoena, legal process or enforceable governmental request; (2) necessary to enforce the provisions of this Notice; or (3) necessary to protect against harm to the rights, property, or safety of Nevro, our customers, or the public as required or permitted by law.

International data transfers

We collect information globally, including from customers in the U.S., EEA, United Kingdom, Switzerland and Australia. We may transfer your information outside of the country in which you originally provided it to where our affiliated companies and service providers operate, including the United States.  These countries may not have the same data protection laws as the country in which you provided your personal data. In particular, the European Commission has determined that the United States does not provide an adequate level of data protection.

To ensure that your data is secure, we use European Commission approved standard contractual clauses when we transfer information from the EEA and Switzerland. We also make use of intra-group data export agreements to protect your information when we transfer it to our affiliated companies.

Your choices and rights

Your choices

Where appropriate or legally required, we will describe how we use personal information we collect so you can make choices about how your data is used. You can notify us during the information collection process and change your preferences at any time.

• Marketing communications: With your consent, we may contact you by email or phone to provide additional information about our Services. If you would like to opt-out of further marketing communications, you can click the link in the bottom of any marketing email, or email us at [email protected]
• Patient care communications: Subject to applicable law, we may call, email, or send SMS texts after your procedure to schedule appointments and facilitate follow up treatment.
• Transactional communications: We send transactional emails if you submit a message through the “Contact Us” form on our websites, to notify you about changes to our Services, and to send other disclosures as required by law.

Your rights

For California consumers, please see our California Consumer Privacy Act Notice for information about your rights and how to exercise them.

For other individuals, depending on your country or state and as required by law, you have the right to:

• Access and receive a copy of your personal data;
• Update, amend, delete or correct incomplete or inaccurate data;
• For CA consumers, additionally:
  • Request to delete information;
• For EEA/AUS individuals, additionally:
  • Request that we stop processing your personal data;
  • Withdraw your consent to the processing of your personal data;
  • Object to the processing of your data;
  • The portability of personal data – i.e., ask for a copy of your personal data to be provided to you, or a third party, in a digital format; and
  • Lodge a complaint with a Data Protection Authority/EU Supervisory Authority.

We can correct or delete incorrect data, or provide a copy of your personal data upon request, but we reserve the right to request where necessary, additional information to verify your identity before we process your request and to maintain a copy of all requests for our legal records. If you wish to exercise these rights, please submit your request here and we will respond to verifiable requests within 30-45 days, depending on the applicable state or country regulations (if any). Applicable privacy laws may give you the right to file a complaint with a government regulator if you are not satisfied with our response.

How we store and secure information

Data security

We maintain appropriate administrative, technical, and physical safeguards designed to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. We maintain a Corporate IT Security Policy and use-tested access and security controls to ensure that your data is secure. We also require third party service providers acting on our behalf or with whom we share your information also provide such security measures in accordance with industry standards.

We use data hosting service providers in the U.S. and EEA to host the information we collect in connection with our HF10 Therapy. The servers which store the information we collect are kept in a controlled environment. Where data is transferred over the Internet as part of our website, the data is encrypted using industry standard SSL (HTTPS) and multi-factor authentication is required for remote access to most systems containing sensitive information.

Although we implement safeguards designed to protect your information, it is impossible to guarantee absolute security in all situations. If you have any questions about security of our Services, please contact us at [email protected].

Data retention

We retain your information for as long as needed to comply with our legal obligations (such as maintaining medical records and reporting to regulatory authorities), resolve disputes, and enforce our rights. We also may retain your information to support our business operations and develop our Services.

Other important privacy information

Children’s privacy

Our Services are intended for a general audience and are not directed to children. We do not knowingly collect personal information online from minors under the age of 16. If you believe that a minor under the age of 16 may have provided us with personal information, please contact us at [email protected] and we will promptly delete that information from our records.

Third party services, applications, and websites

Certain third party services or websites you use, or navigate to or from our Services (such as social media sites) may have separate user terms and privacy policies that are independent of this Notice. We are not responsible for the privacy practices of these third party services or applications. We recommend carefully reviewing the user terms and privacy statement of each third party service, website, and/or application prior to use.

Changes to Privacy Notice

We may update this Notice to reflect changes in our personal data practices or relevant laws. We will notify you if we make any material changes by revising the “effective date” at the top of this Notice. We encourage you to review this Notice for updates each time you use our Services.

Contact us

If you have any questions about our privacy practices, or if you would like to exercise your rights, please contact our Chief Privacy Officer at [email protected] or write to us at:

Nevro Corp.
Attn: Chief Privacy Officer
1800 Bridge Pkwy
Redwood City, CA 94065
USA

EU Data Protection Representative: Nevro Germany GmbH ([email protected])

UK Data Protection Representative: Nevro Medical Ltd. ([email protected])

California Consumer Privacy Act Privacy Notice (“CCPA Notice”)

Introduction

This California Consumer Privacy Act Notice (“CCPA Notice”) supplements the information provided in the Nevro Privacy Notice. This CCPA Notice describes the rights and choices that California consumers have with respect to their personal information and Nevro’s responsibilities in relation to California consumers’ personal information. Capitalized terms used but not defined herein are defined in the Privacy Notice.

If you have questions or concerns about any of the information provided in this CCPA Notice, please contact us using the information provided in the “Contact Us” section of the Privacy Notice.

Definition of Personal Information

For purpose of this CCPA Notice, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household.

Personal information does not include:

• Publicly available information that is lawfully made available from federal, state, or local government records;
• De-identified or aggregated Consumer information; and
• Information excluded from the scope of the CCPA such as:
  • Health or medical information covered under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the California Confidentiality of Medical Information Act (“CMIA”) or clinical trial data;
  • Financial information covered under the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach Bliley Act (“GLBA”) or the California Financial Information Privacy Act (“FIPA”).

Scope

For purposes of the CCPA, Nevro acts as a business in relation to personal information collected through our Services, our NevroCare reimbursement support provided pursuant to patient authorization, providing customer support, and our marketing activities.  This CCPA Notice does not cover personal information processed for clinical trial purposes or those other activies excluded from the scope of the CCPA. (See the “How we use information” section above.)

Collection and Use of Personal Information

We collect personal information in order to provide our Services and operate our business. This section describes our collection, use, and disclosure of personal information.

Sources, Purposes, and Disclosures of Personal Information

The table below describes the sources for each category of personal information we have collected in the last twelve (12) months, the business and/or commercial purposes for which we use each category of personal information, and the categories of third parties with whom we share each category of personal information we collect.

Nevro does not sell personal information for business or commercial purposes.

Your California Privacy Rights

If you are a resident of California, you have specific rights regarding your personal information. This section describes your rights under the CCPA and how to exercise them. However, these California privacy rights are not absolute, and we may be able to decline your request in accordance with the CCPA. You may exercise your California privacy rights following the methods described under the subsection titled “Exercising Your California Privacy Rights” below.

• Right to Know About Personal Information Collected, Disclosed, or Sold. You have the right to request that Nevro disclose certain information to you about our collection and use of your personal information over the past twelve (12) months.
• Right to Delete Personal Information. You have the right to request that Nevro delete personal information we may hold about you. Please be aware there are occasions when we are not able to delete your personal information. If we deny your request to delete personal information, we will inform you of the reasons for denial in our response to you. We will keep a copy of your deletion request in order to document that the action was taken, and any new information you submit to Nevro will not be subject to the pre-dated deletion request.
• Right to Opt-Out of Sale of Personal Information. You have the right to opt out of the sale of your personal information. Because we do not sell personal information, this right does not apply to Nevro.
• Right to Non-Discrimination. You have the right to not receive discriminatory treatment from Nevro for exercising any of your rights described under this “Your California Privacy Rights” section. This means we will not treat you differently for exercising any of the rights described above.