Night Shift Privacy Notice | Night Shift Positional Therapy

NIGHT SHIFT PRIVACY NOTICE

ABOUT ADVANCED BRAIN MONITORING

Advanced Brain Monitoring, Inc. (ABM) is a neuro-diagnostics device company internationally recognized for its innovative technologies. Our products are used by individuals, clinicians, researchers, and in clinical trials to interpret brain and physiological function as they relate to chronic diseases and early-stage neurodegeneration, as well as to improve sleep quality and enhance performance. ABM is an ISO 13485 certified and FDA registered device manufacturer subject to FDA Quality Management System Regulations (21 C.F.R. Part 820) and Medical Device Reporting requirements (21 C.F.R. Part 803), which require ABM to retain certain records as described in this Notice. ABM maintains a global distribution network established in Australia, Asia, Canada, and Europe. ABM is based in Carlsbad, CA, USA with a European office in Belgrade, Serbia.

PRIVACY COMMITMENT STATEMENT

ABM is committed to protecting your privacy and developing Night Shift™ (NS) technologies. Consistent with this commitment, ABM’s direct consumer privacy practices are governed by applicable law. Specifically, ABM applies the following frameworks to the extent they are applicable to ABM’s products, services, and the data subjects whose personal data ABM processes:

Health Insurance Portability and Accountability Act of 1996 (HIPAA) — applies only in the limited context of electronic prescriptions (eRx) generated by healthcare providers, in which ABM acts as a business associate to the prescribing provider. ABM is not itself a HIPAA covered entity, and HIPAA does not otherwise govern ABM’s direct relationship with consumers. ABM implements HIPAA-compatible security standards across its systems and performs periodic technical and non-technical security evaluations.
Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) — applies in the same eRx business-associate context as HIPAA.
EU-U.S. (with UK Extension) and Swiss-U.S. Data Privacy Framework (DPF) — applies to transfers of personal data from the EU/EEA, UK, and Switzerland to ABM in the United States. ABM’s current DPF certification can be verified at https://www.dataprivacyframework.gov.
European Union (EU) General Data Protection Regulation (GDPR) — applies to ABM’s processing of personal data of individuals located in the EU/EEA to the extent required by Article 3 of the GDPR.
United Kingdom (UK) Data Protection Act 2018 (DPA) and General Data Protection Regulation (UK GDPR) — applies to ABM’s processing of personal data of individuals located in the United Kingdom to the extent required by applicable UK law.
Swiss Federal Act on Data Protection (FADP) — applies to ABM’s processing of personal data of individuals located in Switzerland to the extent required by applicable Swiss law.

INDIVIDUAL RIGHTS

ABM is committed to honoring the following core privacy rights for all users of the Night Shift services, subject to the limitations and reservations described below:

Be informed if personal data is being used;
Request a copy of the personal data ABM holds about you;
Request correction of inaccurate or incomplete personal data;
Request deletion of personal data, subject to the legal retention obligations described below and ABM’s reservations described in this Notice;
Raise a concern about ABM’s privacy practices.

ABM will honor these commitments except where retention or processing is required by applicable law, necessary to protect the security or integrity of ABM’s systems and services, necessary to prevent or investigate fraud or other unauthorized or illegal activity, or otherwise permitted or required by ABM’s legitimate interests in operating its business, in each case to the extent permitted by applicable law.

Additional rights under applicable law. Depending on your jurisdiction and the applicable data protection or consumer privacy law, you may have additional rights, including the right to portability of personal data, the right to restrict or limit how organizations use personal data, the right to object to certain uses of personal data, and, where applicable, the right to opt out of the sale or sharing of personal data or targeted advertising. These rights apply only to the extent required by, and subject to the conditions and exceptions contained in, the law of your jurisdiction. Additional information for residents of the EU/EEA, UK, Switzerland, and specific US states is set out in the sections below.

Verification and response to requests. To protect your personal data, ABM will verify your identity before responding to a rights request. ABM may request additional information reasonably necessary to authenticate you and, where a request is made through an authorized agent, to verify the agent’s authority. ABM will respond to verified requests within the timeframes required by applicable law. Consistent with applicable law, including GDPR Art. 12(5), ABM may decline or charge a reasonable fee for requests that are manifestly unfounded, excessive, or repetitive.

For US consumers in states that have not enacted a comprehensive consumer privacy law, the core commitments above are provided as part of ABM’s voluntary privacy practices. For consumers in states that have enacted applicable privacy laws, additional statutory rights and disclosures are described in the Additional US State Privacy Disclosures section below.

Note on Legal Retention Obligations: As an FDA-registered medical device manufacturer, ABM is required by applicable federal regulations to retain certain records regardless of a deletion request. Under 21 C.F.R. § 820.35, ABM must maintain complaint file records, including device identification (serial number) and complainant contact information. Under 21 C.F.R. § 803.18(c), ABM must retain MDR event files documenting adverse events for a period of 2 years from the date of the event or the expected life of the device, whichever is greater. The device serial number itself cannot be deleted from ABM’s database. Shipping records, electronic prescriptions, and complaint or customer support communications associated with a device serial number are subject to these requirements. Where possible, ABM will limit the association of your personal information with records retained solely for regulatory compliance purposes.

NIGHT SHIFT SERVICES — PRIVACY INFORMATION

ABM offers the Night Shift sleep positioner device and associated software services, currently comprising the Night Shift Portal (NS Portal) and the Night Shift Mobile App (NS App). This Notice applies to both services. The following sections describe what data is collected through each service, how it is used, and with whom it is shared.

1. Night Shift Portal (NS Portal)

The Night Shift software, accessible through the NS Portal, produces graphical reports of previously recorded physiological signals obtained during sleep with ABM’s proprietary Night Shift medical device.

Collecting Information

When an individual utilizes the NS Portal, information is collected by ABM. There are two categories of information ABM collects: (1) information the user provides to utilize services; and (2) information ABM obtains to perform services.

a) Device Registration

Registration of a Night Shift device is not required to use the NS Portal. However, if a user chooses to register a device, ABM will have the ability to notify the user of important improvements that could benefit the use of the device (e.g., firmware upgrades or NS Portal enhancements).

To register a device on the NS Portal, the user must disclose: (i) device serial number; and (ii) email address. Registering a “Customer Name” is optional. Device data associated only with a serial number and email address is pseudonymous (not directly identifiable to you by name), which reduces the sensitivity of the data ABM holds; for that reason, ABM recommends that you do not enter a Customer Name. Even where a user requests deletion of registration data, ABM may retain the association between a device serial number and the registrant for as long as necessary to support the device (including warranty administration, technical assistance, and post-market safety monitoring), and deletion of registration data does not delete complaint file records retained under 21 C.F.R. § 820.35 or MDR event files retained under 21 C.F.R. § 803.18(c), as further described in the Note on Legal Retention Obligations and the Retention and Storage section of this Notice.

Personal data that an individual chooses to provide ABM when registering a device is used only to provide technical assistance or to communicate product improvements.

b) Report Generation

The generation of reports is not required to use a device; however, it is the primary purpose for using the NS Portal. No personal data is required to generate a report. When a report is generated, the Customer Name, if provided, will appear on the report. As an alternative, if no Customer Name is registered but you wish to personalize a report, a “User Name” may be entered at the time of report generation and will appear on the report.

The report is saved to the NS Portal database as an unreadable byte array field. The NS Portal database is used to provide technical assistance should any problems with a device or with generating a report be encountered. Reports in PDF format are retained for a period of 6 months from the date of generation, after which they are automatically deleted from ABM’s database, as further described in the Retention and Storage section of this Notice. You may request deletion of your stored reports at any time, subject to the legal retention obligations described above.

c) Device Data (.acq Files)

When the NS Portal is used, ABM obtains raw data from the Night Shift device via an “.acq” file. The information is used primarily to generate a report at your request, and for the additional purposes described in this Notice, including technical assistance, product improvement, compliance with ABM’s legal and regulatory obligations (including FDA complaint file and MDR record requirements described in the Note on Legal Retention Obligations), and, in de-identified form, scientific research and publication as described in the Using Your Information section and subject to the opt-out described there. The information is identified by the device serial number, which can only be linked to personal data if a device has been registered.

The following types of information are recorded by the device:

Use (e.g., how many nights the device was used)
Sleep (e.g., how many hours a user was asleep)
Awake (e.g., how many hours a user was awake)
Position (e.g., how much time a user slept on his/her back and how quickly he/she responded to the position avoidance feedback)
Snoring (e.g., did the user snore, and if so, how loudly)

Each time the NS Portal is used, a copy of the .acq file is saved to the NS Portal database as an unreadable byte array field, identified by device serial number. This copy is retained for the expected service life of the device (currently 3 years from the date of purchase) and is used to provide technical assistance, as further described in the Retention and Storage section of this Notice. Because .acq files are identified by device serial number, the data is pseudonymous rather than fully anonymous; if your name and email address are removed from the NS Portal, .acq files retained after that point will no longer be directly identifiable to you, although ABM may retain the serial number to comply with legal retention obligations. You may request deletion of your stored .acq files at any time, subject to the legal retention obligations described above.

d) Connection Information

ABM may automatically collect and store certain information when the NS Portal is used, including internet protocol (IP) addresses, referring/exit pages, operating system, browser type, date/time stamp, and clickstream data. When a device is registered on the NS Portal, this connection information is associated with the device serial number for purposes of service administration, technical assistance, security, and fraud prevention. ABM uses this information solely to administer services, analyze trends for service enhancements, prevent fraud or unauthorized use, protect the security and integrity of ABM’s systems, and comply with applicable legal obligations, including record retention requirements. ABM does not use this information for marketing or advertising purposes, or combine it with device physiological data for such purposes, without your consent where consent is required by applicable law.

2. Night Shift Mobile App (NS App)

The NS App provides mobile access to Night Shift device data and report generation. The NS App collects and processes the same categories of information as the NS Portal, as described in Section 1 above, including device registration data, report data, raw device data (.acq files), and connection information. The same retention periods and data practices described in this Notice, and the same individual rights and reservations described in the Individual Rights section, apply to data collected through the NS App.

a) Registration Information

Registration of a Night Shift device is not required to use the NS App. However, if a user chooses to register a device, ABM will have the ability to notify the user of important improvements. To register a device on the NS App, the user must disclose: (i) device serial number; and (ii) email address. Registering a Customer Name is optional. The pseudonymity considerations, ABM’s recommendation regarding entry of a Customer Name, and ABM’s regulatory retention reservations described in Section 1(a) apply equally to registration data collected through the NS App.

b) Report Information

The primary purpose for using the NS App is to generate reports. Each time a report is generated through the NS App, a copy of the .acq file and the report are saved to ABM’s database as unreadable byte array fields, identified by device serial number, and used to provide technical assistance. The Mobile NS Report does not contain your name. Standard NS Reports, which can be optionally generated from the NS App and emailed to yourself or a third party, will contain the Customer Name if one was entered at registration. Reports and .acq files generated through the NS App are retained under the same schedule described in the Retention and Storage section of this Notice.

c) Connection Information

When the NS App is used, ABM may automatically collect and store mobile device information, IP addresses, referring/exit pages, and date/time stamps. When a device is registered, this connection information is associated with the device serial number for service administration, technical assistance, security, and fraud prevention. ABM uses this information solely for those purposes and for compliance with applicable legal obligations, including record retention requirements. ABM does not use this information for marketing or advertising purposes, or combine it with device physiological data for such purposes, without your consent where consent is required by applicable law.

3. Electronic Prescription (eRx)

Night Shift devices are only available by prescription in the U.S. For the convenience of U.S. customers, healthcare providers may register a provider account to generate an eRx, which allows patients to purchase a Night Shift device directly via the ABM web store. To generate an eRx, providers are required to enter into a Business Associate Agreement (BAA) in recognition of obligations required under HIPAA and HITECH. In this context, ABM acts as a business associate to the prescribing healthcare provider (not to the patient), and the HIPAA framework identified in the Privacy Commitment Statement governs ABM’s handling of protected health information received under the BAA. Patients seeking to exercise HIPAA rights (including access, amendment, or an accounting of disclosures) with respect to protected health information ABM holds as a business associate should direct those requests to the prescribing healthcare provider, who is the covered entity responsible for responding under the HIPAA Privacy Rule. All information obtained from the provider, including patient prescription information, is stored in ABM’s secure database and used to verify that a customer has a prescription for purchasing a device and to facilitate re-order and other prescribed purchases by the same patient. eRx records are retained as described in the Retention and Storage section of this Notice. eRx services are only available to U.S. customers.

Payment card processing for eRx-driven purchases is handled through the same third-party payment gateway and non-storage arrangement described in Section 4 (Web Store).

4. Web Store

ABM utilizes a third-party payment gateway (Authorize.Net) to facilitate secure transactions on its web store, whether initiated directly by a consumer or through the eRx flow described in Section 3. Payment card information (including card number, cardholder name, and billing address) is submitted directly to Authorize.Net and is not received or stored by ABM. All other purchase data, including shipping information (name, shipping address, and phone number) and order details, is stored on ABM’s secure database and used to fulfill the order, ship the device, provide order and shipping confirmations, verify warranty information, track prescriptions uploaded at the time of purchase, respond to customer support inquiries, and comply with applicable legal obligations, including record retention requirements under 21 C.F.R. Parts 820 and 803. Web store records are retained as described in the Retention and Storage section of this Notice. Web store services are only available to U.S. customers.

5. Contact and Support

Users may submit requests and inquiries through ABM’s support channels. All technical support and privacy requests may be submitted through NightShift@advanced-sleep.com or, for privacy requests, directly to privacy@b-alert.com. Privacy requests are logged in a privacy request record. Technical support requests are logged in ABM’s customer support system and associated with the device serial number. Sales and product inquiries are maintained by Zoho, ABM’s third-party CRM provider, and are retained for the period necessary to respond to the inquiry and for a reasonable follow-up period thereafter, and in any event not longer than 24 months from the date of last contact, unless a longer retention period is required by applicable law, is necessary to respond to an ongoing warranty claim, or is required by ABM’s regulatory obligations under 21 C.F.R. Parts 820 and 803.

To submit a request, the user provides: type of request; name; email address; and, where applicable, country and message details.

6. Access Logs

ABM may automatically collect and store information in log files when services are utilized, including IP addresses and date/time stamps. Where a device is registered, log data may be associated with the device serial number for service administration, security, and troubleshooting purposes. ABM uses this information solely to administer services, analyze trends for service enhancements, prevent fraud or unauthorized use, protect the security and integrity of ABM’s systems, and comply with applicable legal obligations, including record retention requirements. Access logs are retained as described in the Retention and Storage section of this Notice. ABM does not combine access log data with device physiological data for marketing or advertising purposes without your consent where consent is required by applicable law.

USING YOUR INFORMATION

ABM uses your information for the purposes described below. Where ABM shares information with distributors as described in the Sharing Your Information section, distributors may use that information only as necessary for the specific purposes for which it was shared and subject to written contracts with ABM.

Provide technical assistance should any problems be encountered with a device, registering or managing a device, or generating a report.
Validate warranty coverage.
Communicate with you, via email, regarding important improvements and enhancements to ABM’s devices and services. You may opt out of these communications at any time by using the unsubscribe link in any such email or by contacting ABM at privacy@b-alert.com; where consent is required under applicable law (including for EU/EEA, UK, and Swiss users), ABM will obtain your prior consent before sending marketing communications.
Monitor types and trends of issues experienced when using the NS Portal or NS App, on an aggregate or de-identified basis, for use in developing product and service enhancements.
Verify your identity and prevent fraud or other unauthorized or illegal activity.
Analyze usage and trends to publish de-identified findings for product improvement, scientific research, and publication purposes. Where ABM uses device data for these purposes, ABM applies de-identification methods designed to satisfy applicable legal standards, including Cal. Civ. Code § 1798.140(m) for data subject to the CCPA/CPRA, 45 C.F.R. § 164.514(b) for data received or processed by ABM as a HIPAA business associate, and, for EU/EEA, UK, and Swiss data subjects, methods designed to render the data anonymous within the meaning of GDPR Recital 26 or, where full anonymization is not achievable, appropriate pseudonymization safeguards. You may opt out of this use at any time by submitting a request to privacy@b-alert.com. Upon receipt of a verified opt-out request, ABM will not use data associated with your device or email address for de-identified research, publication, or product marketing analysis.

SHARING YOUR INFORMATION

ABM does not sell personal information as defined by the CCPA/CPRA and the Washington My Health My Data Act, and ABM does not share personal information for cross-context behavioral advertising or targeted advertising. ABM discloses personal information to third parties only in the limited circumstances described below, as otherwise expressly permitted by applicable law, and as described in this Notice. ABM may transfer a report or raw data (.acq file) to a third party in the following limited circumstances:

Healthcare provider: With your permission, ABM may share your .acq file or report with a healthcare provider to qualify your device for insurance reimbursement or to enable your healthcare provider to monitor therapy compliance.

Distributor: When devices are sold through a distributor, ABM may share an .acq file with the distributor in order to provide technical assistance.

Service providers: ABM uses third-party service providers to support its operations, including a payment processor (Authorize.Net), a customer relationship management system (Zoho), an IT security consultant, and an off-site data backup provider. All service providers are engaged under written contracts and are permitted to use personal information only as necessary to perform services for ABM.

Shipping providers: ABM shares shipping information (name, shipping address, and phone number) with third-party shipping and logistics providers (including national parcel carriers) as necessary to fulfill and deliver web store orders. Shipping providers are engaged under written contracts and use the information only to deliver the applicable shipment and for their own compliance and operational purposes as required by law.

ABM will disclose personal information without notice if required to do so by law or in the good faith belief that such action is necessary to: (a) comply with legal process served on ABM; (b) protect and define the rights or property of ABM; or (c) act under exigent circumstances to protect the personal safety of users or the public.

RETENTION AND STORAGE

ABM retains personal information for no longer than necessary for the purpose for which it is processed. Specific retention periods are as follows:

PDF reports (NS Portal and NS App): Retained for 6 months from the date of generation, after which they are automatically deleted from ABM’s database. You may request earlier deletion at any time, subject to the legal retention obligations below.

acq files (NS Portal and NS App): Retained for the expected service life of the device (currently 3 years from the date of purchase), after which .acq files are automatically deleted from ABM’s database. You may request earlier deletion at any time, subject to the legal retention obligations below. ABM retains .acq files during the device service life to support technical assistance, warranty administration, and post-market safety monitoring.

Registration data (email address, Customer Name, device serial number): Retained for as long as a device is registered. Registration data may be removed upon request, subject to ABM’s reservation described in Sections 1(a) and 2(a) to retain the association between a device serial number and the registrant as necessary to support the device (including warranty administration, technical assistance, and post-market safety monitoring), and subject to the legal retention obligations below.

eRx and web store records: Retained for the expected service life of the device (currently 3 years from the date of purchase) plus 2 additional years, to support warranty claims, prescription verification, and re-order and other prescribed purchases by the same patient, after which records are deleted unless subject to the legal retention obligations described above.

Complaint, support, and MDR records: Retained as required by applicable federal regulations: (i) 21 C.F.R. § 820.35 (complaint files) — records of complaints involving possible device failure, including device serial number and complainant contact information, retained as part of ABM’s quality management system; and (ii) 21 C.F.R. § 803.18(c) (MDR event files, applicable to ABM as a manufacturer, not a user facility) — records documenting adverse events (device-related death, serious injury, or malfunction evaluated for FDA reporting), retained for a period of 2 years from the date of the event or the expected life of the device, whichever is greater. Note: MDR event files under § 803.18(c) are distinct from routine customer support records retained under § 820.35. These records, which include device serial numbers and complainant contact information, cannot be deleted in response to a privacy request.

Access log data: Retained for service administration and security purposes for a period not to exceed 12 months from the date of collection, unless a longer period is required for an active, documented security investigation, a pending or reasonably anticipated legal proceeding, or a documented preservation obligation, after which access logs are deleted or anonymized.

All information is stored on secured servers owned and operated by ABM or its contracted service providers. ABM uses third-party vendors to support its services, including an IT Security Consultant. Backups are stored offsite with a third-party storage provider. All IT services are governed by written contracts.

COOKIES

ABM’s website (advancedbrainmonitoring.com) and nightshifttherapy.com use cookies. Cookies are small text files used by websites to personalize a user’s online experience. Cookies are uniquely assigned to you and can only be read by a web server in the domain that issued the cookie. ABM employs the Cookiebot service to obtain consent for the use of cookies where required on advancedbrainmonitoring.com and nightshifttherapy.com. ABM is redesigning its front-end website and will maintain cookie consent management on the redesigned site. The Night Shift Portal itself uses only cookies strictly necessary for user authentication and session management, which do not require consent under applicable law. If ABM implements analytics or advertising cookies on any of its properties in the future (including, for example, Google Analytics on the redesigned website), ABM will update this Notice, disclose the categories of cookies used, and provide appropriate consent and opt-out mechanisms consistent with applicable law. The first-party “CookieConsent” cookie stores the user’s consent and expires automatically after 12 months. A user may withdraw consent at any time by deleting the “CookieConsent” cookie.

SECURITY

ABM maintains physical, electronic, and procedural safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. These safeguards include industry-standard encryption in transit and at rest, access controls that limit access to personal information to employees who reasonably need it to provide products or services, and network monitoring tools designed to identify unauthorized attempts to access or modify information. ABM regularly reviews its security practices in light of applicable regulations and evolving threats.

No system of security is impenetrable. Despite the safeguards ABM maintains, no method of electronic transmission or storage can be guaranteed to be 100% secure, and ABM cannot warrant the security of information you transmit to us or that ABM stores. In the event of a security incident, ABM will respond consistent with the Security Incident Notification section of this Notice and applicable law.

SECURITY INCIDENT NOTIFICATION

In the event of a security incident involving personal health information stored in ABM’s systems, ABM will notify affected individuals and applicable regulatory authorities in accordance with applicable law.

THIRD PARTY LINKS AND FEATURES

The ABM website may contain links to third-party websites and may include third-party plug-ins and functionalities. ABM is not responsible for the content or practices of those websites or services. The collection, use, and disclosure of your information on third-party sites will be subject to the privacy policies of those third parties. We urge you to read the privacy and security policies of any third-party sites you visit.

ASSIGNMENT

If ABM is acquired by, merges with, or transfers a business line or asset to another entity (including in connection with a bankruptcy or reorganization), personal information stored in ABM’s databases may be transferred to the acquiring, surviving, or receiving entity. ABM will provide notice of any such transfer to affected users where required by applicable law, and users will have a reasonable opportunity, before the transfer takes effect, to exercise their rights described in this Notice (including access, deletion, and, where applicable, objection or opt-out). Any such transfer will be conducted in compliance with applicable data protection law, including any requirements for consumer authorization under the Washington My Health My Data Act, any requirements for cross-border transfers of personal data under GDPR, UK GDPR, and FADP, and any applicable state-law notification obligations.

ADDITIONAL US STATE PRIVACY DISCLOSURES

California Residents

Based on ABM’s current data practices, ABM does not currently meet the applicability thresholds under the California Consumer Privacy Act and California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 et seq.), and the threshold-dependent disclosures and rights under those laws therefore do not currently apply to ABM. Nonetheless, ABM is committed to honoring requests from California residents to access, correct, or delete their personal information to the extent described in the Individual Rights section of this Notice, subject to the legal retention obligations described above. ABM reassesses its threshold status annually and will update this Notice if ABM becomes subject to the CCPA/CPRA.

ABM is a California-based entity that may be subject to the California Confidentiality of Medical Information Act (CMIA), Cal. Civ. Code § 56 et seq., independent of CCPA applicability. ABM uses any medical information it maintains only for the purposes described in this Notice and as permitted by applicable law.

Washington Residents

Device physiological data collected through the Night Shift device (sleep, position, and snoring data) constitutes consumer health data within the meaning of the Washington My Health My Data Act, except to the extent exempted under the Act. This Notice serves as ABM’s consumer health data privacy policy under RCW 19.373.020; the categories of data collected, sources, third-party recipients, and how to exercise your rights are described in the Night Shift Services, Sharing Your Information, Individual Rights, and Contact Us sections. Consistent with RCW 19.373.040, Washington consumers may confirm and access their consumer health data (including third-party recipients), withdraw consent, request deletion, and appeal a denial by contacting privacy@b-alert.com; if an appeal is denied, the consumer may submit a complaint to the Washington Attorney General at www.atg.wa.gov. ABM does not sell consumer health data, except as expressly permitted under the Act and with any authorization the Act requires, and ABM will not share consumer health data except as permitted by the Act (including its exceptions for service providers, legal process, and defense of legal claims) or as otherwise permitted by applicable law.

Other US States

If you reside in a state with an enacted comprehensive consumer privacy law, ABM will honor the rights available to you under that law to the extent applicable. To exercise any rights available to you under your state’s privacy law, please contact privacy@b-alert.com.

CHANGES TO THIS NOTICE

ABM may update this Notice from time to time to reflect changes in ABM’s data practices, changes in applicable law, or changes in ABM’s products and services. When ABM makes changes to this Notice, ABM will update the “Revision” date at the top of this Notice and post the updated Notice on the ABM website. Where a change to this Notice is material, ABM will provide notice through the NS Portal, the NS App, an email to registered users, or another means reasonably calculated to reach affected users. Where required by applicable law, including the Washington My Health My Data Act, ABM will obtain any additional consent necessary before applying material changes to previously collected consumer health data. ABM encourages users to review this Notice periodically.

CONTACT US

Should you desire to exercise any of the individual rights described in this Notice, or if you have any questions regarding ABM’s privacy practices, please contact ABM through the following channels:

To protect your personal data, ABM will verify your identity before responding to a rights request. Verification is typically completed by cross-checking the information you provide (such as your name, device serial number, and email address) against the information ABM holds about you. For device purchases made through a distributor or reseller, ABM may request additional identifiers, such as the shipping address associated with your device. If ABM cannot verify your identity using commercially reasonable efforts, ABM may decline the request and will explain the reason. ABM typically confirms receipt of privacy requests within 72 hours and responds within the timeframes required by applicable law.

General and technical support: NightShift@advanced-sleep.com
Privacy requests: privacy@b-alert.com
Mailing address for privacy requests: Advanced Brain Monitoring, Inc., Attn: Privacy, 2237 Faraday Avenue, Suite 100, Carlsbad, CA 92008

Please note: ABM does not have the right to copy, correct, delete, limit, or transmit any personal data without first obtaining identity verification. An ABM representative will contact you to begin the identity verification process before any action can be taken.

EU/EEA, UK, and Switzerland individuals also have the right to contact ABM through its GDPR/DPA/FADP representative, DataRep, as described in the section below.

LEGAL BASIS FOR PROCESSING (EU/EEA, UK, and Switzerland)

For individuals in the European Union, European Economic Area, United Kingdom, and Switzerland, ABM processes personal data on the following legal bases:

Performance of a contract (GDPR Art. 6(1)(b)): Processing necessary to deliver the NS Portal and NS App services you have requested, including report generation and technical assistance.
Legitimate interests (GDPR Art. 6(1)(f)): Processing for service security, fraud prevention, and service administration of non-special-category personal data, where these interests are not overridden by your rights and freedoms. Where service improvement or other analytical purposes involve special category health data, ABM processes that data only on the basis of your explicit consent as described below, and not on the basis of legitimate interests.
Legal obligation (GDPR Art. 6(1)(c)) and public health (Art. 9(2)(i)): Processing required to comply with legal obligations to which ABM is subject as a medical device manufacturer, including US FDA quality-system and adverse-event reporting obligations under 21 C.F.R. Parts 820 and 803, and any parallel obligations under the EU Medical Device Regulation (Regulation (EU) 2017/745), the UK Medical Devices Regulations 2002 (as amended), and the Swiss Medical Devices Ordinance (MedDO) applicable to ABM’s post-market surveillance and vigilance activities. Where such processing involves special category health data, ABM relies on Art. 9(2)(i) (processing necessary for reasons of public interest in the area of public health, including ensuring high standards of quality and safety of medical devices) in addition to the applicable Art. 9(2) basis identified below.
Explicit consent (GDPR Art. 9(2)(a)): Device physiological data collected through the Night Shift device (sleep, position, and snoring data) constitutes special category health data under GDPR Art. 9(1). Where ABM processes such data of EU/EEA, UK, or Swiss users for the purposes of report generation, product improvement, or scientific research, ABM processes it only on the basis of your explicit, freely given, specific, informed, and unambiguous consent, obtained through a mandatory consent mechanism prior to processing. You may withdraw your consent at any time by contacting ABM at privacy@b-alert.com or, where technically available, through the same interface used to obtain your consent. Withdrawal of consent does not affect the lawfulness of processing that took place before your withdrawal. Where ABM processes de-identified device data for scientific research and publication purposes, ABM applies appropriate safeguards consistent with GDPR Art. 89, including data minimization and, where feasible, anonymization or pseudonymization, as further described in the Using Your Information section.

DATA REPRESENTATIVE (EU/EEA, UK, and Switzerland)

Advanced Brain Monitoring, Inc. is the data controller for personal data processed in connection with direct-consumer use of the NS Portal and NS App. Where personal data is received or processed under a Business Associate Agreement with a prescribing healthcare provider (as described in Section 3 of this Notice), ABM acts as a data processor on behalf of that provider. In both cases, ABM has appointed DataRep as its Data Protection Representative for the purposes of GDPR in the EU/EEA, the Data Protection Act 2018 and UK GDPR (as amended) in the UK, and the FADP in Switzerland. DataRep acts as the local point of contact for EU/EEA, UK, and Swiss supervisory authorities and data subjects; ABM (not DataRep) remains responsible for the underlying processing decisions.

If ABM has processed or is processing your personal data, you may be entitled to exercise your rights under GDPR, UK GDPR, or FADP in respect of that personal data. A description of these rights is set out in the Individual Rights section (including the Additional rights under applicable law paragraph) of this Notice. You may submit requests directly to ABM through the channels described in the Contact Us section or through DataRep as described below. International transfers of your personal data from the EU/EEA, UK, or Switzerland to ABM in the United States are governed by the EU-U.S. (with UK Extension) and Swiss-U.S. Data Privacy Framework identified in the Privacy Commitment Statement, and, where the Data Privacy Framework does not apply to a particular transfer, by appropriate safeguards under Chapter V of the GDPR (including standard contractual clauses where required). For more details on the rights available to you, you may also refer to the national Data Protection Authority in your country, the European Commission (https://commission.europa.eu), the Information Commissioner’s Office in the UK (https://ico.org.uk) , or the Federal Data Protection and Information Commissioner in Switzerland (https://www.edoeb.admin.ch/en).

To submit a personal data request to ABM, or to exercise your rights, you may do so by:

Sending an email to DataRep at datarequest@datarep.com, quoting “Advanced Brain Monitoring, Inc.” in the subject line;
Contacting DataRep via online webform at www.datarep.com/data-request; or
Mailing your inquiry to DataRep at the address for your country listed below. Note: When mailing, address your letter to ‘DataRep’, not ‘Advanced Brain Monitoring, Inc.’, and reference Advanced Brain Monitoring, Inc. clearly within the letter itself.

DataRep Contact Addresses