Privacy Notice

Seattle Children’s Hospital of 4800 Sand Point Way NE, Seattle, WA 98105 USA (“SCH” or “we”) collects and processes your personal information that is provided by you, as staff (“data subjects” or “you”) employed or engaged by third-parties with whom we work (our “partners”), or generated by you in your use of our services. This Privacy Notice is provided to you in accordance with applicable privacy laws including, but not limited to, the General Data Protection Regulation 2016/679 (GDPR) and laws implementing the GDPR (the “Data Privacy Laws”). SCH is the data controller under the Data Privacy Laws. It applies only to data subjects who are residents in the European Economic Area, Switzerland and the UK and it explains what information you or our partners provide to us and how we use your information. This Privacy Notice is not applicable to data subjects in any other territory other than in the European Economic Area, Switzerland and the UK.

SCH provides the clinical and research services to children and, as a result, liaises with partners and third-parties in the course of our business operations. We are a data controller of the data subjects’ personal data where we determine how it is used. This Privacy Notice only relates to our processing of personal data where we act as a data controller. We include in this Privacy Notice a summary of your rights to control how we use your personal information.

Your Personal Information

Your personal information includes any information relating to you where you are identified or from which you are identifiable. This includes your name, contact information, information about where you work and, if applicable, where you live. If applicable it may also include payment information, purchasing history and about your use of our services and our website.

We collect various types of personal information from different sources, including:

• Information you provide directly to us when you use Seattle Children's website;
• Information we collect about your activities on behalf of our partners.

Some of the personal information you provide to us may include health information or other sensitive or special categories of personal information where provided by you, with your consent, such as disability information or religious data for purposes required by you such as scheduling of meetings or access to Seattle Children's premises.

What We Do With Your Personal Information

We use your personal information for the following key purposes:

• to contact you: subject to applicable law, we and/or our third-party service providers may contact you and send you communications relating to our services, website; where required under applicable data privacy laws, we will not send you marketing communications without your prior consent;
• for legal purposes: we may use and share personal information for legal purposes, including financial, regulatory, tax and other legal obligations and to respond to governmental or regulatory requests or subpoenas or for litigation purposes;
• for contractual purposes (including taking pre-contractual steps): we will use your personal information to perform our contractual requirements and obligations and to take any required pre-contractual steps;
• for our legitimate interests and those of a third-party: we may use your personal information to manage our legal, regulatory, financial and business requirements, including obtaining legal advice, in the course of disputes and litigation, internal and/or regulatory investigations and other legitimate interests;
• for our business purposes: we may use your personal information to help us manage the lawful requirements of our business;
• for other purposes: subject to applicable law, we may use your personal information for additional purposes in connection with the website or our organization, where you have provided your prior consent.

All the personal information we collect from you or generated by you is used to provide the services you have requested or for our partners or for communications to which you have subscribed or otherwise as described in this Privacy Notice. SCH will safeguard the privacy and security of special categories of personal information as required under Data Privacy Laws. You may also consent to us using your personal information for additional purposes not described in the Privacy Notice but which we consider may be of interest to you from time to time. We will not use your personal information for these additional purposes without your consent. You have the right to tell us that you do not want to be contacted by us for these additional purposes any time after you initially provide your consent. We also use your information for marketing purposes where you have consented to receive marketing communications.

Your personal information is processed by us in the United States. You expressly acknowledge and agree to the transfer of your personal information to us in the United States, which may have a lower standard of data privacy laws in your country of residence. Our security measures are described below in this Privacy Notice.

We do not allow any third-parties to have access to your personal information, except as required or permitted by applicable laws or in accordance with the Privacy Notice. We may disclose your personal information to our subcontractors, agents, or payment service providers (who may be located in the United States) that we contract with to assist us in providing the services, provided that any such subcontractors or agents shall agree in writing to comply with the privacy and security standards described in this Privacy Notice. We have in place safeguards to protect your personal information agreed with our customers.

There may be instances when we disclose your personal information to other recipients:

• to comply with the law or respond to compulsory legal process (such as a search warrant or court order) or request for information from a regulator or otherwise for legal purposes;
• to verify or enforce compliance with the policies governing the services; or
• to protect the rights, property or safety of SCH, or any of our respective affiliates, business partners, or customers or otherwise in the legitimate business interests of SCH and/or our affiliates and in accordance with Data Privacy Laws.

We may share your personal information with other entities in connection with the sale, assignment, merger or other transfer of all or a portion of SCH's business to that other entity.

In any instance where we need to share your personal information with third parties, such as legal or financial advisors including auditors, and we will restrict the nature and categories of personal information to that which is required to comply with our contractual obligations to you or our legal and/or regulatory requirements. We may de-identify your personal information to protect your privacy.

How We Protect Your Personal Information

SCH understands that storing data in a secure manner is essential. SCH stores personal information and other data using reasonable physical, technical and administrative safeguards to secure data against foreseeable risks, such as unauthorized use, access, disclosure, destruction or modification. Although we make good faith efforts to store the information we collect in a secure operating environment that is not available to the public, we cannot guarantee complete security. Further, while we work to ensure the integrity and security of our network and systems, we cannot guarantee that our security measures will prevent third-party "hackers" from illegally obtaining this information.

How Long We Keep It

We retain your personal data relating to the use of our services for the duration of the customer relationship and for [seven] years after the customer account is closed for legal, regulatory, audit and tax requirements. After this period has expired, the personal information relating to your account and your use of the services will be deleted. Any personal information which you have provided to us for marketing purposes will be kept until you notify us that you no longer wish to receive this information.

What are your rights?

You have some rights to make requests, which are all subject to exemptions and qualifications under the Data Privacy Laws. You have the right to ensure your personal information is accurate. You have the right to request that we delete your personal information (although we may still need to retain your personal information as described above in this Privacy Notice for contractual and/or legal purposes). You have the right to request that we restrict the processing of your personal information (although we will still need to process your personal data during the duration of the contract and beyond for legal purposes). If you wish to raise a complaint on how we have handled your personal information, you can contact us and we will investigate the matter and respond to you promptly. If you are not satisfied with our response, or if you prefer not to engage with us first, you can complain to any applicable data privacy authority in your country of residence.

If you have any questions about this Privacy Notice or about SCH’s handling of your information, please contact the Data Privacy Officer, currently Ms. Sara Brown, who is responsible for ensuring SCH’s compliance with the Data Privacy Laws and with this Policy. Ms. Brown can be reached via telephone on 206-987-1200 or via email at privacy.questions@seattlechildrens.org.