Legal Global Privacy Policy

Updated: May 2024

ZimVie values your privacy and the protection of your personal data. This ZimVie Privacy Notice (“Notice”) explains how we collect, use, share, transfer, and process information collected from or about you (“Personal Data”) by any subsidiary or affiliate of ZimVie Inc. (collectively “ZimVie,” “we,” “our,” or “us”).

This Notice describes the types of Personal Data that ZimVie may collect or process, how we may use and disclose that Personal Data, and how you may exercise any rights you may have regarding our processing of your Personal Data. This Notice applies to Personal Data collected or processed by us online (through websites, applications, and otherwise), when we provide products or services to you, your doctor, hospital, medical treatment or scanning facility, or other healthcare provider (collectively, “Healthcare Provider,” which refers both to the Healthcare Provider institution, organization, or company, and individuals employed by or working for or with such organization), or your patients, and in other situations where you interact with us, including anywhere this Notice is posted or referenced (products, services, websites, and other systems will be referred to in this Notice as “Products and Services”). This Notice also applies to Personal Data that is collected or processed when you interact with us in-person, by telephone, or by mail.

ZimVie may have other unique privacy notices that apply to certain specific situations, such as privacy notices for specific Products and Services in various specific circumstances. To the extent you were provided with a different privacy notice or policy and those policies or notices apply, those policies or notices will govern our interactions with you, not this one.

If you provide Personal Data of anyone other than yourself, please note that you are responsible for complying with all applicable privacy and data protection laws prior to providing that information to ZimVie (including obtaining consent, if necessary and required).

The ZimVie subsidiary or affiliate with whom you, your Healthcare Provider, or your patient is interacting or who owns and operates the Product or Service is, where applicable, the entity responsible for the collection and use of your Personal Data (known in some jurisdictions as the data controller). A list of the data controllers can be found in Appendix 1 to this Notice, and contact details can be found in the Contact Us section at the end of this Notice.

Personal Data

“Personal Data” is any information that can be used to identify an individual or that we can link directly to an individual, such as name, address, email address, telephone number, credit card number, or health or treatment information, as applicable. Personal Data in some jurisdictions can include information that indirectly identifies a person – such as a unique number assigned to a patient by a Healthcare Provider, even absent other identifying information. Please note that, for patients, as described below, we often receive information about you from your Healthcare Provider.

Some examples of instances where we collect Personal Data include if you:

• Register for an account for one of our Products or Services;
• Sign up for newsletters or other informational or marketing materials;
• Participate in our events, conferences, or trainings, including surgery trainings and Product and Service demonstrations;
• Ask us a question by contacting us;
• Apply for employment with us;
• Interact with us as a customer, vendor, supplier, or business partner or an employee or representative of same, including if you provide information about your customers or patients;
• Respond to our surveys or questionnaires;
• Make a complaint to us or to our customers about us; or
• Purchase, use, or receive our Products or Services.

We will process any Personal Data we collect in accordance with applicable law and as explained in this Notice (unless, as explained above, one of our other policies or notices governs). In some circumstances, if you do not want to provide us with your information, certain Products and Services may be unavailable to you.

Below is a summary of how we collect, process, and use Personal Data and the potential recipients of your Personal Data. Some jurisdictions require us to state the legal bases for processing your Personal Data, which is included below, but please note that not all jurisdictions may recognize all legal bases.

To the extent we offer any public or group forums on our Products or Services, such as newsfeeds, blogs, message boards, or similar tools (“Interactive Features”), the posts or comments you make may be public and viewed by others. You should use care before posting information about yourself, including Personal Data. You acknowledge and understand that you have no expectation of privacy or confidentiality in the content you submit to Interactive Features over the Products and Services. Except when required to do so by applicable law, we assume no obligation to remove Personal Data you post on our Products and Services, and you disclose any Personal Data at your own risk.

Our Products or Services may contain links to other websites, applications, products, or services that are not owned or operated by ZimVie, such as social media websites and applications like Facebook and Twitter. You should carefully review the privacy policies and practices of other websites, products, and services as we cannot control and are not responsible for privacy policies, notices, or practices of third party websites, applications, products, and services.

Consistent with applicable laws and requirements, ZimVie has put in place physical, technical, and administrative safeguards designed to protect Personal Data from loss, misuse, alteration, theft, unauthorized access, and unauthorized disclosure.  However, as is the case with all websites, applications, products, and services, we unfortunately are not able to guarantee security for data collected through our websites, applications, Products and Services.

Your Rights Regarding Your Personal Information

Subject to applicable data protection law, you may have a right to some or all of the following with respect to your personal data:

●          To request access to your Personal Data (including under GDPR Article 15);

●          To request that we rectify or erase your Personal Data (including under GDPR Articles 16 and 17);

●         To object to the processing of your Personal Data (including under GDPR Article 21);

●         To request that we restrict or block the processing of your Personal Data (including under GDPR Articles 21 and 22);

●          To provide your Personal Data directly to another, i.e., a right to data portability (including under GDPR Article 20); and

●          When we previously obtained your consent, to withdraw consent to processing (including under GDPR Article 21).

To exercise these rights, please write to us at privacy.emea@zimvie.com or ZimVie, Attn: ZimVie Privacy Officer, 4555 Riverside Drive, Palm Beach Gardens FL 33410 USA.

You may also contact our Data Protection Officer for the European Union and the United Kingdom at privacy.emea@zimvie.com. For Germany, you may also contact our German Data Protection Officer at dpo.germany@zimvie.com.

California law grants its residents certain rights regarding the collection and use of their personal information. If you are a California resident and would like to exercise your rights, please submit a request using the CA Privacy Request Form linked below or call us at 844-922-2721 so that our support team can communicate with you and provide assistance regarding your request. Please note that we may require additional information from you or your authorized agent to honor your request and may deny your request if we cannot verify your identity or status as a California resident.

CA Privacy Request Form (zimvie.com)

If you are concerned about how your Personal Data is used, please email us or contact us. You may also have the right to lodge a complaint against us. To do so, contact your local data protection authority (if one exists in your country).

Please be aware that Personal Data we collect and process may be transferred and maintained outside your state, province, country, or other jurisdiction, where the privacy laws may not be as protective as those in your location, including the United States. ZimVie has put in place safeguards, in accordance with applicable legal requirements, to protect your Personal Data irrespective of the standards in the country where your Personal Data may be transferred. This includes entering into agreements with third parties, such as service providers, to require them to adopt standards that ensure an equivalent level of protection for data as those we adopt.

You may unsubscribe from any marketing or promotional emails. To do so, please email us at websupport@zimvie.com or use the unsubscribe mechanism offered in our marketing emails or other communications, as applicable. Please note that if you already have requested our Products or Services when you decide to withdraw consent, a short period of time may elapse before we can update your preferences and ensure that we honor your request.

We will retain your Personal Data for as long as we maintain a relationship with you, your Healthcare Provider, or your patient and/or for as long as we provide a Product or Service to you or to customers that serve you, plus a reasonable period thereafter to fulfil the purposes described above. Retention periods may be extended if we are required to preserve your Personal Data in connection with litigation, investigations and court or administrative proceedings or if a longer retention period is required or permitted by applicable law. 

• If you are a U.S. patient, please note that this Notice is distinct from your Healthcare Provider’s HIPAA Notice of Privacy Practices, which describes how your Healthcare Provider uses and discloses individually identifiable information about your health that it collects, as well as any other privacy practices it applies. ZimVie collects, uses, and discloses Personal Data it receives on behalf of your Healthcare Provider in accordance with your Healthcare Provider’s HIPAA Notice of Privacy Practices.
•  If you are a patient in the E.U., please note that this Notice is distinct from your clinician, hospital, health insurance or institution (“Healthcare Provider”) privacy notice, which describes how they use and disclose your Personal Data that they collect, as well as any other privacy practices they apply.

In accordance with their privacy notices, ZimVie receives data from your Healthcare Provider to allow for the proper development of the insurance relation between you and your insurer as permitted by law including minimum data in invoices and delivery notes.

Additionally, ZimVie receives data from your Healthcare Provider when they report¹ product events that may disclose potential product’s defects / adverse effects including patient identifier, gender, age at the time of the event and weight, and information on ZimVie’s devices and products (i.e., number, type, date of use, characteristic, and adverse effects as the case may be). This information is codified by your Healthcare Provider.

The ZimVie subsidiary or affiliate with whom your Healthcare Provider is interacting with or who manages the processing of products events reporting or acts as a legal manufacturer of the product (see Appendix 1 for further details) will process the data to manage the reports and evaluate the event that disclosed the product’s defect / adverse effects. This processing is based on its legal obligations and, when shared with group entities, on our legitimate interest to adequately manage such reports (for instance, when transmitting such information for administrative purposes) for which the due balancing test has been done. We are entitled to process health data based on reasons of public interest related to the need to ensure high standards of quality and safety of medicinal products or medical devices. We may also disclose this data to the recipients described above (especially to ZimVie group companies as specified in the section related to “health information” in Information Collection of ZimVie Global Privacy Notice ).

Personal Data may be transferred outside the European Economic Area under the safeguards described in the section “Transfer of Personal Data Across National Borders”. The information will be retained following the criteria of the section “How Long Your Personal Information Will Be Retained” and particularly to comply with the purposes of the processing as described above.

You can exercise your data protection rights (including addressing the due data protection authority) as described in the section “Your Rights Regarding Your Personal Information” and you can contact the data protection officer at the addresses included in the section “Contact us”.

[1] “*Health Care Providers shall notify product incidents events using ZimVie Product Experience Report available in ZimVie portal https://eservices.zimviedental.com/ or contacting the local ZimVie representative or by email to emeacomplaints@zimvie.com”

The present Privacy Policy is applicable to ZimVie´s Speak Up channel (whistleblowing scheme) that allows us to receive and, if applicable, manage, investigate and take actions regarding any information or complaint received about any alleged irregularity or act contrary to the law, ZimVie´s internal regulations and policies or industry practice as detailed in our website – Speak Up section (hereinafter, the “Speak Up Channel”). 

The ZimVie Group entities listed in the following link: Privacy Notice (zimvie.com) (hereinafter, jointly “ZimVie”) are the joint-controllers for the processing of your personal data through the Speak-Up Channel. Notwithstanding this, the data received through the Speak Up Channel will be accessed by the ZimVie Group entities and joint-controllers on a strictly "need to know" basis and limited only to what is necessary to carry out the relevant investigations.

The contact address of the joint controllers for the purposes of this Privacy Policy (and in case of any questions about joint-controllership regime and its operation) and the appointed data protection officer is the following:  you are based in the EU or EEA privacy.emea@zimvie.com or dpo.germany@zimvie.com if you are based in Germany; in North America privacy.nam@zimvie.com; or APAC privacy.apac@zimvie.com.

  A. If you are the person filing the complaint / providing the information (hereinafter, the “Whistleblower”):

You can use the Speak Up Channel without identifying yourself directly and remaining anonymous, either completely (neither ZimVie nor the platform provider will know your identity) or exclusively towards ZimVie (only the platform provider will know your identity). In case you decide to remain anonymous towards ZimVie, you may be contacted by our provider managing the Speak-Up Channel Convercent, Inc., to confidentially gather some additional information about the complaint, yet it will not reveal your identity to ZimVie.

In any event, personal data may be collected directly from you, or from witnesses or any third party involved in the investigation. These data may include identification data (i.e. name, surname and contact details), economic data, commercial data, professional data (i.e. professional role, department, tasks, employment data), as well as any information that is the subject of the investigation or that is included in the description of the facts of the complaint. While special categories of data (such as health data, data concerning person’s sex life or sexual orientation, sanctions & infringements, etc.) would not generally be processed, depending on the information and investigation exceptionally it may be required.

B. If you are a person under investigation, witness or any third party involved in the investigation:

Your personal data may be collected directly from you, from the Whistleblower or from individuals involved in the investigation. These data may include identification data (i.e. name, surname and contact details), economic data, commercial data, professional data (i.e. professional role, department, tasks, employment data), as well as any information that is the subject of the investigation or that is included in the description of the facts of the complaint. While special categories of data (such as health data, data concerning person’s sex life or sexual orientation, sanctions & infringements, etc.) would not generally be processed, depending on the information and investigation exceptionally it may be required.

Your personal data will be processed for the sole purpose of managing the Speak Up Channel and complaint / information received, investigating and taking action in relation to complaints received through ZimVie´s Speak-Up Channel. This includes ensuring the protection against any reprisals towards the Whistleblower or towards other persons such as facilitators, colleagues or relative of the Whistleblower who are also in a work-related connection with the reporting person’s employer or customer or recipient of services; taking corrective action or any other action relevant to the specific misconduct/illegal conduct (e.g. informing the competent authorities, disciplinary actions, etc.); and complying with applicable regulations and, in particular, those governing the protection of Whistleblowers, as well as providing our management board with reporting on the complaints received within the Speak Up Channel on an anonymous basis.

If you are an EU resident, we process your personal data in compliance with our legal obligations to the extent that we are legally obliged to establish such a channel (under local laws implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law); or, for joint controllers voluntarily adhering to this Channel, on the basis of the public interest to prevent and detect misconducts and unlawful behaviors based on the same laws.

Please avoid providing us special categories of data unless strictly required for the handling of the relevant complaint. As the case may be, we will process it in accordance with the essential public interest recognized by currently applicable laws. Otherwise, we will erase them immediately.

Your personal data may be communicated to the competent judicial and administrative authorities, following the legal obligations of ZimVie. Such communication is always provided to the extent legally required.

Additionally, on certain occasions, ZimVie may communicate personal data received through the Speak Up Channel to other companies of the ZimVie Group and joint controllers on a "need to know" basis and limited only to what is necessary to carry out the relevant investigations, and third parties, such as external consultants, auditors or persons in charge of managing the processing of the data or investigation according to the instructions received by ZimVie (e.g. Convercent, Inc.).

Please access our policy on transfer of personal data across national borders by clicking on this link.

If you are an EU resident, we generally process your personal data within the European Economic Area (EEA) and we procure to contract with service providers located within the EEA or in countries that have been declared as having an adequate level of protection. However, as explained below, certain processing of personal data necessary for the operation of the Speak Up Channel may be also carried out in the United States.

In those cases where we need to share your personal data with entities located outside the EEA in countries that haven´t been declared as having an adequate level of protection, we will adopt the appropriate safeguards in order to ensure the level of protection comparable to that of the European Union.

In particular, your personal data is shared with the entity Biomet 3i, LLC, based in United States, in order to ensure the aligned and coordinated operation of the Speak Up Channel in the ZimVie Group. Those joint-controllers subject to the General Data Protection Regulation 2016/679 have entered into the appropriate standard contractual clauses approved by the European Commission with Biomet 3i, LLC. Additionally, our Speak Up Channel platform provider Convercent, Inc., is also based in United States, processing the personal data on Biomet 3i LLC´s behalf in accordance with Biomet 3i, LLC and Convercent Data privacy agreement whereby Convercent agrees to adopt the required standards to ensure an equivalent level of protection for processed data. For further information, please contact ZimVie by means provided within the section “1. Who is the data controller of the personal data related to Speak Up Channel? Is there a data protection officer?”. 

Your personal data will be processed only for as long as necessary to carry out the investigation (including legal proceedings, if applicable) and comply with our legal obligations including the obligation to keep the Speak Up Channel’s registry for no more than 10 years.

In any case, after 3 months from the reception of the complaint in the Speak Up Channel, the personal data will be erased if it is understood that, after examining the complaint, the investigation was not appropriate or when the investigation has not been initiated.

You may exercise your rights of access, rectification, erasure, portability, restriction of processing and, as the case may be, objection and/or withdrawal of consent in the terms and conditions provided under applicable data protection laws by addressing to the following email address: privacy.emea@zimvie.com for the EU or EEA; in North America privacy.nam@zimvie.com; or APAC privacy.apac@zimvie.com.

You can also file a complaint before the competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The address of the European supervisory authorities can be found here. 

We may update this Notice from time to time without notice. As such, you should review this Notice periodically. We will indicate by the date below when this Notice was most recently updated. 

If you have any questions, including how to access this Notice in an alternative format, please email us at privacy.emea@zimvie.com or write to us at ZimVie, Attn: Privacy Officer, 4555 Riverside Drive, Palm Beach Gardens FL 33410, USA.

If you are located outside of the United States, such as in the European Economic Area or the United Kingdom, you may contact our Data Protection Officer at privacy.emea@zimvie.com. For Germany, you may contact our German Data Protection Officer at dpo.germany@zimvie.com.com.  For APAC countries, you may contact our Data Protection Officer at privacy.apac@zimvie.com.You may also write to us at ZimVie, Attn: Privacy Officer, 4555 Riverside Drive, Palm Beach Gardens FL 33410 USA.