iFab customer center

We have been helping people maintain or regain their freedom of movement since 1919. For us, digitalising the treatment process means protecting your freedom of movement in the digital world as well. It is therefore important for us to tell you what personal data we collect, how these data are used and what design options you have.

The success of Ottobock depends not only on the global networking of information flows between the Ottobock companies, employees, customers and patients, but above all on the trustful, secure handling of personal data.

Responsible

Ottobock SE & Co. KGaA
Max-Naeder-Strasse 15
37115 Duderstadt
Germany

Data Protection Officer

You may reach the Global Data Privacy Office confidentially via contact form.

Use of our website

Secure provision of the website

In case you visit our website, the web server temporarily collects the following information to display the website and stores such information in so-called server log files:

Processed categories of data:

Browser type and version
Operating system used
Referrer URL
Browser string
Hostname of the accessing computer
Time of the server request
IP address

Purposes:

Ottobock's interest is the secure and functional operation of the website. The logged data is used in particular for the purposes of data security, to defend against attempts of attack on our web servers. We reserve the right to carry out statistical evaluation of anonymous data records.

Legal basis:

The processing of this data is based on our legitimate interest: We have a legitimate interest in ensuring data security and trouble-free operation.

Storage periods or criteria for determination:

The data will be deleted after 180 days at the latest.

Your User Account (Login to the ifab Customer Center (iCC))

On our website, you may use the "Sign-In" button to log in to the iFab customer center user account using your registered email address and associated password, or create an iFab customer center user account. To create this account, we collect your name, your company name and address including customer number, your role, and a password. After submitting your details, we will send you a confirmation link to verify the email address. For log-in, enter your credentials in a web form provided by iFab customer center. Following successful authorization, an authorization cookie will be stored in your browser. The cookie expires no later than two weeks after the last use or with the use of the logout functionality. Through this authorization technique, we prevent your access data from being stored locally on the smartphone or on your computer.

Processed categories of data:

Company Data (i.e. Company Name and Address, Customer number)
User data (i.e. Username, Experience and role)
Business contact details (i.e. email, phone)

Purposes:

Ottobock's interest is to authorize users placing orders on the system and to ensure that the order may be invoiced correctly to the relevant business.

Legal basis:

Contract or contract initiation with you: The concluded Terms of Use.

Our legitimate interest: Secure provision of the order-platform (website).

Storage periods or criteria for determination:

The user data will be deleted 3 years following last login or after user’s request.

The company’s data will be deleted 3 years following last login of the company’s users.

Ordering of custom-made products

In case you order custom made products, we record the following information to enable us to deliver the requested services.

Processed categories of data:

Data required to process a custom order (i.e. 3 D Scan of body part)
Specification of device to be manufactured

Purposes:

In case you order custom made products, we record the following information to enable us to deliver the requested services. Ottobock's interest is to record the required data to deliver the requested service/ product to the identified business.

Legal basis:

Contract or contract initiation with you: Terms of Use

Our legitimate interest: Secure provision of the order-platform (website)

Storage periods or criteria for determination:

The data will be deleted 3 years following last login within all company users.

When and how we share information with third parties

External libraries:

On our website, we use active Java script content from external providers, so-called web services. When you visit our website, these external providers may receive personal information about your visit to our website. This may involve the processing of data outside the EU.

You can permanently prevent the execution of JavaScript at any time by making appropriate settings in your browser, which would also prevent external libraries from executing the JavaScript.

Information on the use of cookies and other technologies

To ensure that our websites works securely and properly and to offer you relevant products and services, we use cookies and other technologies on our websites. , you find further information and you may change or withdraw your consent settings at any time.

Hyperlinks to third party websites

On our websites we use hyperlinks to third parties sites. Only by clicking on the hyperlink, you will be directed to that external website. The processing of your data on these websites is the responsibility of such website provider.

Your rights

You have the right,

to request confirmation as to whether we are processing personal data concerning you. If this is the case, you have the right to access information about this processing;
to demand the rectification or completion of inaccurate or incomplete data;
to withdraw a given consent at any time with effect for the future;
in certain cases to request the erasure of data;
under certain conditions, to request the restriction of processing;
under certain conditions to data portability, i.e. you may receive your data, which you have provided us with, in a structured, common and machine-readable format or have it transferred to another controller;
to complain to a supervisory authority.

Right to object (Art. 21 GDPR)

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you. This also applies to profiling based on these provisions. We will then no longer process the personal data, unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Where personal data are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing, including profiling, insofar as it is linked to such direct marketing. If you object to processing for the purposes of direct marketing, your personal data will no longer be processed for such purposes.

To whom we share information

To processors – companies that Ottobock commissions with the processing of data within the legally stipulated framework (Art. 28 GDPR - service provider). In this case Ottobock remains responsible for the protection of your data. Our processors are carefully selected, are bound by our instructions and are regularly checked by us. We only commission processors who offer sufficient guarantees that suitable technical and organizational measures are taken in such a way, that processing is carried out in accordance with the requirements of GDPR and guaranteeing the protection of your rights.

To private entities that provide services for you on their own responsibility or in connection with an Ottobock contract. This is the case, if you commission services from private agencies, if you agree to such integrated services or if we integrate private agencies due to legal permission. If, in the course of processing, we nevertheless disclose your data to third parties, transfer it to them or otherwise grant them access to that data, this will also be done exclusively on the basis of one of the legal bases mentioned.

To government agencies to which we transfer certain data due to legal obligations.

Transfer of personal data to countries outside the EU and EEA

We may transfer your data to entities whose registered office is located outside the European Union or the European Economic Area. In doing so, we will ensure prior to the transfer, that apart from exceptional cases permitted by law, either an adequate level of data protection exists at the recipient's end (e.g. through an adequacy decision by the European Commission, through appropriate safeguards such as the agreement of so-called EU standard contractual clauses of the European Commission with the recipient) or your expressed consent has been obtained. Information on suitable safeguards may be obtained from the Global Data Privacy Officer.

Changes to this privacy policy

We will revise this privacy notice whenever changes are made to this website or other reasons that require it. You will always find the current version on this website.

Further privacy notices

The Children's Online Privacy Protection Act

Ottobock cares about protecting the online privacy of children. Absent appropriate consent, we will not intentionally collect any personal information (such as a child's name or e-mail address) from children under the age of 13.

California Consumer Privacy Act

The California Consumer Privacy Act “CCPA” provides California residents with the following rights. To exercise your rights in relation to your personal information as allowed for under the California Consumer Privacy Act, click here.

Right to Access: If you are a California consumer, you have the right to ask us to send you the following information up to two times in a twelve-month period:

The categories of personal data we have collected about you
The categories of sources from which we collected the personal data
Our business or commercial purpose for collecting personal data
The categories of third parties with whom we share personal data
What categories of personal data we disclose about you for business purposes
What categories of personal data we sell or exchange for consideration about you
The specific pieces of personal information we have collected about you

Right to Delete: If you are a California consumer, you have the right to ask us to delete the personal data about you we have collected. We may deny the request if the information is necessary to:

complete a transaction, including providing a requested or reasonably anticipated good or service, or fulfill a contract between the consumer and Ottobock
detect and protect against security incidents, malicious, deceptive, fraudulent, or illegal activity, or take against those responsible for such activity
debug to identify and repair errors impairing intended functionality
exercise free speech or another right provided for by law
comply with the California Electronic Communications Privacy Act
engage in research in the public interest adhering to applicable ethics and privacy laws where the consumer has provided informed consent
enable solely internal uses reasonably aligned with the consumer’s expectations based on the consumer’s relationship with Ottobock
comply with a legal obligation; or
otherwise use the information internally in a lawful manner compatible with the context in which the consumer provided the information

Right to Opt-out of the sale of Personal Information: If a business sells personal information to third parties, California consumers have the right, at any time, to opt out of the sale or disclosure of their personal information to third parties. Ottobock does not sell personal information to third parties, except in conjunction with a corporate sale, merger, dissolution, or acquisition.

Right to designate an authorized agent: You have the right to designate an authorized agent to make a request under the CCPA on your behalf. To designate an authorized agent, please contact us.

Right to non-discrimination: The CCPA grants California consumers the right not to be discriminated against for exercising your privacy rights. If you exercise your privacy rights, we will not discriminate against you, for example, by denying you access to our Ottobock Shop or charging you different rates or prices for the same Ottobock Services, unless that difference is reasonably related to the value provided by your data.

Colorado

Right to opt out. A consumer has the right to opt out of the processing of personal data concerning the consumer.

Right of access. A consumer has the right to confirm whether a controller is processing personal data concerning the consumer and to access the consumer's personal data.

Right to correction. A consumer has the right to correct inaccurate personal data collected from the consumer.

Right to deletion. A consumer has the right to delete personal data concerning the consumer.

Right to data portability. When exercising the right to access personal data, a consumer has the right to obtain the personal data in a portable, and to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hinderance. A consumer may exercise this right no more than two times per calendar year.

Virginia

Right to access. A consumer has the right to confirm whether or not a controller is processing the consumer's personal data and to access such personal data.

Right to correct. A consumer has the right to correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data.

Right to deletion. A consumer has the right to delete personal data provided by or obtained about the consumer.

Right to data portability. A consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried 4 of 8 out by automated means; and

Right to opt out. A consumer has the right to opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

State of declaration: 22/02/2022

iFab. Customer Center