Public Data Privacy Notice – Summary

This section provides a summary of how Canon Medical Systems Ltd processes personal data relating to individuals who interact with us outside of our websites.

If you would like more detailed information about how we collect, use, share and retain personal data — including fuller descriptions of our legal bases, data sharing arrangements, and your rights — please refer to the detailed privacy notice set out below.

Canon Medical Systems Ltd is committed to protecting the privacy rights of anyone whose personal data is processed by Canon Medical Systems Ltd. This Data Privacy Notice explains how we collect, use, and protect personal data in accordance with applicable data protection law.

Who We Are

Canon Medical Systems Ltd is the data controller responsible for processing your personal data.

Canon Medical Systems Ltd
Boundary Court
Gatwick Road
Crawley, West Sussex
RH10 9AX

Local Data Privacy Officer

Email: data.protection.uk@eu.medical.canon
Post: at the address above

Website Use

This privacy notice does not cover personal data collected when you use our websites, including information collected automatically through cookies or similar technologies.

When you visit our websites, certain information may be collected automatically (such as browser type, pages visited, and device information) or using cookies, as described in our Website and Cookie Privacy Notice.

For full details of how personal data is collected and used when you access our websites, please refer to our Website and Cookie Privacy Notice, available on our website.

How We Use Personal Data and Our Legal Bases

We process your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the EU GDPR where applicable, the Data Protection Act 2018, and other relevant data protection laws.

We process personal data for a range of business purposes, including:

Customers and Business Relationships

managing contracts and service delivery
customer support and account management
business communications
supplier management

Events, Exhibitions and Lead Generation

recording attendance and interactions
following up interest in our products or services
creating contact records within CRM systems
evaluating engagement and return on investment (ROI)
dietary information for event catering and safety purposes

Recruitment and Job Applicants

managing recruitment processes
assessing candidate suitability
communicating with applicants

Customer Portal Use and Communications

managing accounts and interactions
providing services and support
direct marketing
managing communications and preferences

We rely on the following legal bases:

Contract / Pre‑contractual Steps – Article 6(1)(b)

Legitimate Interests – Article 6(1)(f)

Consent – Article 6(1)(a)

Legal Obligations – Article 6(1)(c)

Special Category Data – Dietary Requirements – Article 9(2)(a) and Article 6(1)(a)

What Personal Data We Collect

We may process:

identification and contact details
contractual and professional information
marketing and CRM data
event attendance and interaction data
payment information (where applicable)
recruitment data (e.g. CVs, interview notes, references)
right to work or compliance information
dietary requirements and other limited special category data (where applicable and with explicit consent)

Where We Obtain Personal Data

We may collect personal data:

directly from you
from your employer
from publicly available sources
from event or conference organisers
from recruitment agencies
from referees or professional contacts

Data Accuracy

We take reasonable steps to ensure personal data is accurate and up to date and encourage you to notify us of any changes.

Customer Portal and Communications

Canon Medical Systems Group operates Customer Portals for managing services and communications.

Data entered into the portal may be transferred into CRM systems for:

account management
customer support
relationship management
preferences

We may communicate with you using a variety of business communication channels, including:

email,
telephone
postal correspondence
video conferencing platforms
collaboration tools
customer portals
event management systems
other communication methods used during our business relationship.

Who We Share Personal Data With

We may share personal data:

within Canon Medical Systems Group Companies
with IT and system providers
with marketing and communications partners
with recruitment agencies (where applicable)
with business or operational partners
with professional advisers
with regulators or authorities where required

Only necessary data is shared, and appropriate safeguards are applied.

International Transfers

Personal data may be processed outside your country of residence.

Where this occurs, appropriate safeguards are applied, such as:

adequacy decisions
standard contractual clauses

Retention Periods

Personal data is retained only as long as necessary.

contractual data: retained in accordance with legal obligations
prospect data: retained for a limited period after last interaction
recruitment data: typically retained for a limited period unless retained longer lawfully
marketing communications will cease where an individual withdraws consent or objects to receiving marketing. Personal data may continue to be retained where it is required for other lawful business purposes, including contractual, customer service, legal, regulatory, or record-keeping requirements

Your Rights

You have rights including:

access
rectification
erasure
restriction
data portability
objection to processing

Automated Decision‑Making

We do not conduct automated decision‑making or profiling that has legal or significant effects.

Complaints

You may raise concerns with our Local Data Protection Officer or lodge a complaint with the Information Commissioner’s Office (ICO).

Communication Preferences

Registered users can manage communication preferences via Customer Portal

Public Data Privacy Notice – Detailed Notice

Canon Medical Systems Ltd is committed to protecting the privacy rights of anyone whose personal data is processed by Canon Medical Systems Ltd. The following provides detailed information regarding our data processing activities.

Controller Details

Canon Medical Systems Ltd
Boundary Court
Gatwick Road
Crawley, West Sussex
RH10 9AX

Local Data Privacy Officer

Email: data.protection.uk@eu.medical.canon
Post: at the address above

Website Use

This privacy notice does not cover personal data collected when you use our websites, including information collected automatically through cookies or similar technologies.

For full details of how personal data is collected and used when you access our websites, please refer to our Website and Cookie Privacy Notice, available on our website.

Purpose of processing and legal basis:

We process your personal data in compliance with the provisions of the UK General Data Protection Regulation (UK GDPR), the EU GDPR where applicable, the Data Protection Act 2018, and any other relevant data protection laws.

We process personal data for a range of business purposes, including:

Customers and Business Contacts

Personal data is processed to:

establish and manage contractual relationships
deliver products and services
manage customer accounts and support
maintain customer relationship management (CRM) records
Post-service engagement
Customer satisfaction surveys
Educational and customer events
Business communications relevant to our business activities through common communication channels

Legal basis:

Article 6(1)(b) – contract
Article 6(1)(f) – legitimate interests

Where marketing communications are sent:

Article 6(1)(a) – consent (where required)

Events, Exhibitions and Lead Generation

Where you attend or interact with us at an event, conference, or exhibition:

We may collect personal data directly from you or receive it from event organisers.

We process this data to:

record attendance or interaction
follow up on interest in our services
create or update CRM records
evaluate engagement and return on investment (ROI)

You can object to this processing at any time, including objecting to receiving further communications from us. Where required by law, we will seek your consent before sending direct marketing communications.

If you do not wish your details to be recorded or used following an event, you may inform us at the time of collection or contact us using the details provided in this notice.

Legal basis:

Article 6(1)(f) – legitimate interests

Where marketing communications are sent:

Article 6(1)(a) – consent (where required)

Recruitment and Job Applicants

We process personal data relating to job applicants to:

assess suitability for roles
manage recruitment processes
communicate with candidates

This may include:

CVs and application data
qualifications and employment history
interview notes
references (where applicable)

Sources include:

candidates directly
recruitment agencies
referees
publicly available professional sources

Legal basis:

Article 6(1)(b) – pre‑contractual steps
Article 6(1)(f) – legitimate interests
Article 6(1)(c) – legal obligations
Article 6(1)(a) – consent

Customer Portal and Communications

We process data provided via Customer Portals to:

manage accounts and services
support customer relationships
manage communications and preferences
support business-to-business communications
educational events, training courses, and related activities
direct marketing

We may also use your contact details to communicate with you about educational events, relevant updates, and customer engagement activities, such as satisfaction surveys.

These communications may be received via email or other contact methods and are intended to support our relationship with you, including understanding your experience with our products and services and identifying areas for improvement.

Where these communications constitute direct marketing, they will be sent in accordance with applicable laws, including the Privacy and Electronic Communications Regulations (PECR), and you will have the ability to opt out at any time.

Data may be transferred into CRM systems where appropriate.

Legal basis:

Article 6(1)(b) – contract (where applicable)
Article 6(1)(f) – legitimate interests
Article 6(1)(a) – consent (for marketing preferences)

Special category data – dietary requirements

Where you register to attend an event, training course, conference, or similar activity organised by Canon Medical Systems Ltd, we may collect information relating to your dietary requirements. This information may reveal health-related information or religious or philosophical beliefs and is therefore treated as special category personal data under Article 9 UK GDPR / GDPR. We process this information only:

for the purpose of organising catering and ensuring your safety and inclusion at the event; and
where you have provided your explicit consent (Art. 9(2)(a) UK GDPR / GDPR, in conjunction with Art. 6(1)(a) UK GDPR / GDPR). Where your explicit consent is not provided, we may not be able to take dietary requirements into account. Note: this would not prevent you from attending the event.

Dietary requirement information is accessed only by staff and shared with relevant service providers who require it for event organisation and deleted as soon as the event has taken place unless a longer retention period is required by law.

Our legal obligations

Lastly, we process your personal data if this is necessary to comply with our legal obligations for example:

To prevent and investigate criminal offences (e.g. fraud)
To submit investigation data to regulatory authorities (e.g. MHRA, ICO)
For commercial and tax storage obligations or documentation obligations.
The legal basis for this is Art. 6 Para. 1 c) UK GDPR / GDPR.
If we process your personal data for a purpose not mentioned above, we will inform you in advance.

In each case, we have considered whether our interests override your interests, rights and freedoms, and we believe that the processing described above is proportionate and has a minimal privacy impact.

Data categories and data origin:

We process the following categories of data:

identification and contact details (name, job title, employer, email address, telephone number)
contractual data and data from the contractual relationship (such as product interest, type of contract)
professional information (role, department, area of clinical or business interest)
marketing and CRM data (product interests, communication history, preferences)
event-related information (event attendance, sessions attended, interactions with our representatives)
claim data
payment information (bank details)
dietary requirements (where applicable and with explicit consent)
recruitment data

Data may originate from:

you directly
your employer
event organisers
recruitment agencies
publicly available sources
professional networking platforms
business referrals
customer introductions

As a rule, we collect the data directly from you within the framework of the pre-contractual contractual relationship or during the business relationship, but in individual cases it may also have been, or be transmitted, to us by your company. If the data processing is based on address purchases, we have checked their legality before acquisition and point out their origin. In addition, we process personal data that we have legitimately obtained from publicly accessible sources (e.g. professional networks).

We may receive your contact details indirectly from third‑party event organisers or conference providers where we are a sponsor, exhibitor, or participant. In such cases, we will inform you within our first communication with you or otherwise within the periods required by data protection law about the source of your data, the purpose of contacting you, and provide a link to this privacy notice.

Data accuracy and updates

We take reasonable steps to ensure that the personal data we hold is accurate and up to date. This includes updating records where we are notified of changes, providing individuals with opportunities to correct their information, and correcting inaccurate or incomplete data where identified. Please inform us using the contact information referenced above if your personal data changes so that our records can be updated accordingly

Recipients:

Within our company and the Canon Medical Systems Group Companies, only those persons who need your personal data to fulfil our contractual and legal obligations will receive your personal data. We may also share the information you have provided to Canon Medical Systems Ltd with a limited number of partners. However, this only happens if it is necessary to process your data for the intended purpose. We also use the services of several different partners (e.g. in such cases where we provide non-Canon equipment, or where we work as or for an MES provider) to meet our contractual and legal obligations.

These could include:

IT and systems service providers

Where required to host, maintain, or support our IT systems and customer databases (e.g. secure cloud hosting, CRM platforms).
Only the minimum data necessary is shared, and providers are subject to contractual confidentiality and data protection obligations.

Marketing and communications partners

Where we engage third parties to support the distribution of communications or campaigns on our behalf (e.g. mailing, email delivery, event communications).
Such sharing only occurs where lawful and individuals have the right to object.

Business and operational partners
In limited cases, with authorised distributors or service partners where this is necessary to respond to an enquiry, provide information, or manage a legitimate business relationship.
Recruitment partners/agencies

As part of the recruitment process.

Professional advisers and auditors
Including legal, compliance, or audit service providers, where necessary for governance, regulatory compliance, or defending legal claims.
Regulators or authorities
Where disclosure is required by law or to comply with a regulatory obligation.

What is more, we transmit your personal data to other recipients outside the company provided it is necessary to meet our contractual and legal obligations as an employer.

These could include:

Authorities (e.g. tax and customs authorities, courts)
Bank of the contracting party (SEPA payment medium)
Assignees and credit agencies
Third-party debtors and bailiffs in seizures
Insolvency administrator

International Transfers

Canon Medical Systems Ltd uses external service providers to technically process your data as per the examples detailed under the ‘Recipients’ section above. We may transmit or process your data outside the country in which you reside or in one of the countries in which Canon Medical Systems operates (https://eu.medical.canon/contact/index). ln the event that we transmit personal data to service providers or Group companies outside the European Economic Area (EEA), the transmission will only take place if the EU Commission confirmed that the third country has an adequate level of data protection or if there are other appropriate data protection guarantees in place (e.g. binding internal company data
protection provisions or standard EU contractual clauses). You can also request detailed information using the contact information provided below.

Customer Portal and Communications

Canon Medical Systems Group operates Customer Portals that allows customers to register for and manage their interactions with us, including access to information, services, and support.

Personal data provided when registering for and using the Customer Portals is processed in accordance with the specific privacy notice made available at the point of registration and within the portal itself.

Information collected via the Customer Portals may also be transferred to and used within our customer relationship management (CRM) systems for purposes such as account administration, customer support, relationship management, where applicable, business-to-business communications, and preferences..

Details of how personal data is used within the Customer Portals, including security measures and user controls, are provided in the dedicated Customer Portals privacy notice.

Outside of the customer portal, we may communicate with you using a variety of business communication channels, including email, telephone, postal correspondence, video conferencing platforms, collaboration tools, customer portals, event management systems, and other communication methods used during our business relationship.

The communication channel used will depend on the nature of the interaction, the services provided, and your communication preferences where applicable.

Retention period

Canon Medical Systems Ltd only saves your personal data for as long as required for the purposes named above. Concerning personal data relating to a contract, once the contractual relationship has ended, your personal data is saved for as long as we have a legal or regulatory obligation to do so. This can usually be ascertained based on the legal accountability and retention requirements that are regulated by local laws, which stipulate certain retention periods of up to ten years. Moreover, personal data may be retained for as long as claims can be made against us (e.g. statutory limitation period up to 30 years).

Personal data relating to prospective customers, event attendees or exhibition leads who do not enter a contractual relationship with us will generally be retained for a limited period after the last relevant interaction, after which it will be deleted or anonymised unless there is a lawful reason to retain it longer.

Marketing communications will cease where an individual withdraws consent or objects to receiving marketing. Personal data may continue to be retained where it is required for other lawful business purposes, including contractual, customer service, legal, regulatory, or record-keeping requirements.

Recruitment data will generally be retained for a limited period following completion of the recruitment process, unless there is a lawful basis to retain it for longer.

Rights and duties of affected persons

Provided the legal conditions are met, you have the following rights arising from Article 14 (2) (c), 15 to 22 UK GDPR / GDPR: the right to access, the right to rectification, the right to erasure, the right to restriction of processing, and the right to data portability.

Right to object

You have the right to object without cause to the processing of your personal data for the purposes of direct advertising. If we process your data to safeguard legitimate interests, you can object to this processing by providing reasons relating to your specific situation. We will then stop processing your personal data, unless we can prove that there are compelling reasons to process it that are worthy of protection and that outweigh your interests, rights, and freedoms, or if the purpose of the processing is to assert, exercise, or defend legal claims.

Automated decision-making/profiling

We do not conduct fully automated decision-making or profiling that has legal, or similarly significant effects on individuals.

Right to complain to the supervisory authority

You have the option to contact the above-named Local Data Privacy Officer or a data protection supervisory authority (e.g. the ICO) with a complaint.

Individual communication preferences

Registered users can manage their communication preferences by visiting Customer Portal

Last Updated: July 2026