Patient Notice

Effective December 2024

iRhythm Technologies Ltd. and iRhythm Technologies, Inc. ("iRhythm™"), care about your confidentiality and privacy rights and comply with data protection laws to keep your information safe. Please read this patient notice carefully before returning it with your Zio® Monitor cardiac monitor to iRhythm.
By returning the Zio patch to us, you acknowledge that you have read and understood this patient notice (as contained in the Zio booklet).

1. CONFIDENTIALITY AND CONSENT 

Your doctor has prescribed the Zio service for you. iRhythm provides the Zio service, which includes long-term heart monitoring and evaluation. Your doctor will, with your consent, start the Zio service by attaching an adhesive monitoring device to your chest. This device will collect your heart rhythm data. Your doctor will collect identification information such as your name, address and date of birth to safely identify your resulting heart rhythm report, and register it on iRhythm’s physician portal. Your heart rhythm data will be sent to iRhythm when you return the Zio patch by post.

iRhythm receives and processes your personal data in confidence to help create a report of the findings. Only iRhythm, your doctor and hospital will have access to this report for the purpose of supporting your direct care. iRhythm may also replace your direct identifying information with a reference number and study your heart rhythm data for two reasons: (i) reporting to your doctor and (ii) improvement of iRhythm services.

How to contact iRhythm

You have the right to object to the disclosure of your personal data. If you wish to do so, or have any question about the processing of your data, please contact the iRhythm Privacy Official through our UK office at 0808 189 3411 or via email at privacy@irhythmtech.com. Please also consult your doctor regarding his or her privacy practices.

Calls may be recorded or monitored for training and quality purposes with callers notified prior to being connected with a call handler.

2. DATA PROTECTION 

Here we explain how iRhythm collects and uses your personal data and heart rhythm data during and after your use of the Zio service.

How will iRhythm use personal data it receives about you? 

iRhythm processes your personal data as a data contoller for the following purposes and on corresponding lawful basis in connection with providing the Zio service.

Your personal data will be used for the purposes set out in this patient notice. If iRhythm needs to use your personal data for an unrelated purpose not set out in this patient notice, we will notify you and where relevant, obtain your consent.

iRhythm may also be engaged by a health care provider to process your personal data on its behalf as a data processor. In these instances, iRhythm will process your personal data only as instructed by the data controller, as set out in a contract between iRhythm and the data controller, and as required by applicable data protection law.

Our use of AI 

Our use of AI, which follows highly regulated industry standards, helps eliminate the risks of error associated with a purely human review of heart rhythm data. Our diagnostic systems do not use solely automated decision making but support rather than replace, clinician review by drawing upon derived understanding from analysing and comparing thousands of different heart rhythm patterns. This learning helps our software to recognise and flag anomalies for closer inspection by our clinicians, thereby enabling more efficient heart rhythm analysis for faster, more reliable diagnostic outcomes.

We apply rigorous measures to ensure data we use for this purpose is safeguarded under data protection law.  Heart rhythm data and associated clinical markers are extracted and processed in a separate environment from your identifying data. The purpose of this processing is to better inform at a system level, the understanding of different diagnostic models rather decisions relating to you.

Data sharing 

We may share your information in the following circumstances:

1. Within the iRhythm Group when needed to support our processing of your personal data.
2. iRhythm may provide personal data to third parties including our vendors, partners and service providers (e.g. cloud service providers) who perform services on our behalf. These providers have limited access to your personal data only to the extent necessary to perform these support tasks on our behalf and subject to the same confidentiality and security safeguards as those applied by iRhythm.

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements

We are responsible and remain liable for the processing of personal data we receive, including where  this involves an International Transfer of personal data or if we subsequently transfer to a third party acting as an agent on our behalf as described further below.

International Transfers

In accordance with data protection law(s), iRhythm will transfer only necessary personal data to its independent diagnostic testing facility in the United States and may share details of specific enquiries, reports or complaints received with the iRhythm US support team, in each case subject to applicable legal and supplemental safeguards.

Approved Standard Contractual Clauses and Supplemental Safeguards

iRhythm, Ltd has executed approved Standard Contractual Clauses (SCCs) with iRhythm Technologies, Inc. in order to provide adequate data protection for this data transfer. iRhythm also seeks to apply supplemental safeguards in support of the use of legal data transfer mechanisms, including pseudonymization of transmitted Zio patch data (using a patch serial number rather than a direct patient identifier) and encryption of transmitted data. iRhythm, Ltd. will keep under review the continued adequacy of any data transfer arrangement.

Data Privacy Framework

iRhythm Technologies, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. iRhythm Technologies, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, iRhythm Technologies, Inc. commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, should first contact iRhythm at privacy@irhythmtech.com or at the following phone numbers:

United Kingdom: 08081893411

Austria: 0800018108

Spain: 900751451

Netherlands: 08000221642

Switzerland: 0800562826

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, iRhythm Technologies, Inc. commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to TrustArc, an alternative dispute resolution provider based in the United States. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

How long will your information be used for? 

We retain personal data for the length of your use of the Zio service and as necessary to meet our contractual obligations, to identify issues or to resolve legal proceedings. We may also retain aggregate information beyond this time for research purposes and to help us develop and improve our services. You cannot be identified from aggregate information retained or used for these purposes.

Your rights in connection with personal data

You have the right under certain circumstances:

1. To be provided with a copy of your personal data held by us
2. To request the rectification or erasure of your personal data held by us
3. To request that we restrict the processing of your personal data (while we verify or investigate your concerns with this information, for example)
4. To object to the further processing of your personal data
5. To request that your provided personal data be moved to a third party

Where the processing of your personal data by us is based on consent, you have the right to withdraw that consent by contacting us, your doctor or hospital. The possible consequences of this will be explained to you and could include delays in diagnosis, care or treatment that the Zio service supports.

Contacting iRhythm and resolving disputes about your information 

You can contact iRhythm about your rights or with any questions about this privacy policy as further described above, by contacting the iRhythm privacy official through our UK office at 0808 189 3411 or via email at privacy@irhythmtech.com. 

Complaint to Data Protection Authority 

If your request or enquiry is resolved to your satisfaction, you may approach your supervisory authority for data protection concerns in the following countries:

United Kingdom: Information Commissioner’s Office, https://ico.org.uk/

Austria: Österreichische Datenschutzbehörde, https://www.dsb.gv.at/

Spain: Agencia Española de Protección de Datos, https://www.aepd.es/es

Netherlands: Autoriteit Persoonsgegevens, https://www.autoriteitpersoonsgegevens.nl/

Switzerland: Federal Data Protection and Information Commissioner, https://www.edoeb.admin.ch/

FTC enforcement 

iRhythm Technologies, Inc. is subject to the investigation and enforcement actions of the Federal Trade Commission (FTC). iRhythm may be required to share your personal data, including the disclosure of EU personal data, to public authorities and law enforcement agencies in response to lawful requests, including requests to meet national security and law enforcement requirements.

Binding Arbitration

Under certain conditions, you may be able to invoke binding arbitration for complaints regarding iRhythm Technologies, Inc.’s compliance with the Data Privacy Framework not resolved by any of the other mechanisms provided. For more information on binding arbitration for Data Privacy Framework complaints, please visit DPF ANNEX I-Introduction.