UPMC Salvator Mundi International Hospital Video Surveillance Extended Information Note

INFORMATION NOTE PURSUANT TO ART. 13 OF EU REGULATION 2016/679 ("REGULATION") CCTV SURVEILLANCE

Dear Sir/Madam,

As provided for by art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “GDPR”), Salvator [N.d.T., in italiano "Salvador"] Mundi International Hospital, (VAT number 09023871008), with registered office in Via delle Mura Gianicolensi 67/77, 00152 Rome, Italy (hereinafter “SMIH”), in its role of data controller informs you that a video surveillance system (hereinafter "System") has been installed at its registered office in Rome.

The aforementioned system was installed to ensure the safety of patients, employees, and assets contained in the aforementioned premises and to facilitate the exercise of SMIH's right of defense.

The system is active within the premises, in the areas opposite the entrance, as well as in the vehicle access areas. Areas equipped with surveillance cameras are indicated with a specific sign.

Images are stored for a maximum of 72 hours, except in the case of specific investigations requested by the judicial authority or judicial police or should the storage be necessary for the protection of SMIH's interests. After these storage periods, images are recorded over previous images.

The processing of the data through the System does not require data subjects’ consent, since it is in the legitimate interest of the data controller (art. 6(1)(f) of the Regulation (“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”), as required by EDPB Guidelines 3/2019 on processing of personal data through video surveillance systems - version 2.0, 29 January 2020, as well as the guidelines on video surveillance and personal data protection, in FAQ format, published by the Italian Personal Data Protection Authority ("Garante") on 3 December 2020.

Only appointed staff may access recorded images, and exclusively in one of the following cases:

• In the event of a suspected or committed offense;
• in the event of system maintenance;
• if a data subject has requested to access them;
• upon request from the competent judicial authority or judicial police.

As a data subject in the context of personal data processing, the GDPR guarantees you specific rights. As a data subject, you have the right to obtain from the data controller authorization to access or delete, and to limit or deny the processing of your personal data (art. 15 and following, GDPR).

Should you deem your personal data has been processed in breach of the Regulation, you have the right to file a complaint to the Italian Personal Data Protection Authority ("Garante") pursuant to art. 77, GDPR

The rights may be exercised contacting the Internal reference person for data processing - Office of the Director of Health Care Activities at: Salvator Mundi International Hospital S.r.l., Via delle Mura Gianicolensi 67/77, 00152 Rome, Italy or emailing smih_direzionesanitaria@upmc.it or contacting the DPO at: Salvator Mundi International Hospital - Responsabile della Protezione dei dati personali, Viale delle Mura Gianicolensi 67/77, 00152 Rome, Italy or emailing smih_dpo@upmc.it

Last update: July 2022