In keeping with its philosophy, the protection of your personal data is essential to Invasix UK Limited, private limited company whose registered address is Unit 7, Oliver Business Park, Oliver Road, NW10 7JB, London, United Kingdom,registered Company House under number 08844669. Invasix UK Limited (“InMode”) who wishes to inform you, through this privacy policy (“Privacy Policy”), of how they collect and process your personal data and the means you have to control that use and exercise your rights.
1. Glossary
Unless otherwise stated in the Privacy Policy, the following terms and words have the meanings stated below:
MA: means Marketing Authorisation.
Intermediate Archiving: refers to isolation by a logical separation (management of access rights and limited access to a specific service) and/or physical separation of Personal Data that InMode still has an administrative interest in.
Direct Customer: means a natural person who has purchased or expressed interest in the devices from InMode.
ICO: means the Information Commissioner’s Office.
Personal Data: refers to any information that directly or indirectly relates to a natural person.
Sensitive Data: means any Personal Data that discloses either the racial or ethnic origin of the natural person, their political opinions, religious or philosophical beliefs, trade union membership, state of health, sexual orientation, or things about their sex life.
DPO: Data Protection Officer.
Data Importer: means the stakeholder established in a country outside the UK that receives from Inmode Personal Data that is to be processed after it is transferred.
Notifier: refers to the patient, the member of an approved association of patients, the Health Professional or the member of a health authority who has reported adverse effects that may be attributed to a Product.
Data Subject: means the natural person whose Personal Data is processed.
Devices: any medical and surgical devices developed by InMode.
Healthcare Professional: means any doctor, nurse, dentist, manager of a medical establishment (medical office, clinic, …) or any other profession who has purchased a device directly from InMode on their patient’s behalf.
Social media: refers to InMode’s social networking pages.
Regulations: This section refers to the General Data Protection Regulation (GDPR), the Data Protection Act (2018), and the Data Protection and Digital Information Bill (2024).
Access Point: refers to the hardware (computer, tablet, smartphone, phone, etc.) that you use to
visit or view the Site.
Processing: means collecting, saving, organising, structuring, storing, adapting, modifying, extracting, viewing, using or any other form of making available, reconciling or interconnecting, limiting, deleting, and destroying.
User: refers to the person browsing the Site and/or the Social Media pages. These definitions are capitalised and shall apply to both the singular and plural forms.
2. Scope of the Privacy Policy
The Privacy Policy applies to all Sites, social media, and Devices developed by InMode. Accordingly, this Privacy Policy is for:
• Healthcare Professionals who order the Products or use the Application published by InMode
• Direct Customers
• Patients
• Distributors
• Users
Therefore, by accessing and browsing the Sites and the social media, ordering or using Devices, you acknowledge that you have accepted all the terms of the Privacy Policy and therefore the collecting, use, and transfer of your Personal Data.
You may view the Privacy Policy by clicking on a link entitled “Privacy Policy” located at the bottom of each page of the Sites, social media, and on the application’s download page.
3. Data Protection Contacts at InMode
The Personal Data controller is:
• For the Personal Data of Direct Customers, Patients and Distributors: INVASIX UK Ltd whose registered address is Unit 7, Oliver Business Park, Oliver Road, NW10 7JB, London, United Kingdom, registered Company House under number 08844669.
InMode’s DPO, which guarantees the Regulations are complied with, is your preferred contact person for any and all questions concerning the protection of your Personal Data.
You can contact him by sending an email to the following address: info@inmodemd.co.uk or by mail at the following address: To the DPO Attention, Unit 7, Oliver Business Park, Oliver Road, NW10 7JB, London, United Kingdom.
4. Nature of the Personal Data processed by InMode
InMode considers the principles of data minimisation, data protection from the design stage, and data protection by default. As a result, relevant Personal Data is collected which is adequate and limited to what is necessary for the purposes for which it is processed.
This Personal Data is collected when you order a Product, when you create or modify your customer account, when you browse one of the Sites, when you contact InMode, when you participate in an event, or when filling out forms.
When you fill out the fields on a form, the mandatory nature of a response is indicated using an asterisk (*) at the end of the question. If you do not answer a question marked with an asterisk, your request cannot be processed.
When you choose to spontaneously send your Personal Data to InMode without the latter having asked you, you agree to assume full responsibility for the Personal Data transmitted. InMode recommends that you do not send or disclose any Sensitive Data to the Sites or through them.
4.1 Direct Customer
InMode may collect and process a Direct Customer’s first and last name, title, delivery address, telephone number, email, date of birth, customer account passwords created by the Direct Customer, information concerning their order or possible complaints as well as information concerning the payment of invoices.
4.2 Patient
InMode may be required to process a patient’s Personal Data, especially medical data and data relating to their ethnic origin to enable InMode to know the patient’s general health, meet its pharmacovigilance obligations, use the before and after photos of patients who have consented to these images being disseminated, or to know the Personal Data collected by Healthcare Professionals in charge of a clinical study.
When transferring the patient’s Personal Data to InMode, the Healthcare Professional agrees to ensure that the transfer of this Personal Data is appropriate and complies with the Regulations and agrees to provide the patient with the necessary information beforehand in accordance with the Regulations. InMode declines all liability in this regard.
4.3 Healthcare Professional
InMode may be required to process a Healthcare Professional’s Personal Data, particularly their first and last name, specialisation, GMC and NMC, (Registering Body) number and physician number, email, and phone number.
4.4 User
Cookies (“Cookies”) are small computer files stored on the hard drive of your Access Point that record certain information to make your browsing experience easier. They are placed on your Access Point when you browse the Site.
Depending on your access point’s settings, InMode uses the following cookies:
• Browsing Cookies: These are Cookies that are necessary for browsing the Site. These Cookies enable InMode to ensure the Site works properly.
• Feature Cookies: These are Cookies that store your chosen preferences and settings to ensure a smooth user experience. For example, they allow you to directly access your personal areas on the Site without having to enter your connection settings several times or allow you to store purchases in your shopping basket.
Subject to your agreement, InMode may place the following Cookies:
• Audience Measurement Cookies: These are Cookies used to track your browsing to get statistics of views and monitor the performance of the Sites and each of their pages. These Cookies enable InMode to improve its services to provide a better user experience.
• Targeting/Advertising Cookies: These are Cookies for offering content and advertising tailored to your needs, considering your preferences and your latest purchases.
For more information about managing Cookies (see Clause 9 of the Privacy Policy).
InMode collects and processes the content created by the User on social media: photos, texts, videos, symbols, hashtags.
5. Purposes and Legal Basis of Processing
5.1 Purposes of Processing:
InMode always processes your Personal Data for specific purposes and only Processes it to achieve these purposes. InMode processes your Personal Data for the following purposes:
• Responding to your requests for information, questions, comments, fulfilling your requests, and providing you with effective help.
• Managing your customer account.
• Establishing, maintaining, and managing the customer relationship and ensuring follow-up.
• Processing and delivering your orders.
• Doing the accounting.
• Managing billing and payments.
• Managing payment incidents or non-payments and debt collection.
• Registration, evaluation, reporting and treatment of adverse events and claims relating to the Products.
• Contact management with the Notifier to obtain additional information on the adverse effect.
• Giving you access to InMode’s training modules (in person or online).
• Managing your requests to access, rectify, limit processing, erase, object to the processing of
your personal data or its portability.
• Providing you with adequate, up-to-date information on InMode’s devices.
• Improving the quality of interactions and the quality of InMode’s Products.
• Sending you satisfaction surveys or conducting internal analyses.
• Inviting you to events.
• Managing subscriptions to InMode’s newsletters and webinars.
• Training InMode’s employees.
• Conducting analytical studies and commercial statistics.
• Establishing, exercising, or defending a right in court, whether in a legal, administrative, or
extrajudicial proceeding of any kind.
• Managing the archives.
• Sending commercial or promotional offers for Devices like those purchased. You may object to
your Personal Data being used for commercial marketing purposes at any time, free of charge,
without having to give a reason for this request by sending an email to InMode at the following
address:
info@inmodemd.co.uk. InMode would like to draw your attention to the fact that exercising your
right to object does not prevent InMode from continuing to contact you for other purposes,
especially due to a legal obligation or for performance of the contract.
• Improving the relevance of the information sent.
• Managing merger and acquisition transactions involving InMode.
• Ensuring that InMode complies with its activities.
• Exchanging your Personal Data with the Distributors so that they offer you InMode’s Devices.
• Exchanging your Personal Data with the companies belonging to the group InMode is a member of in order to provide you with relevant, personalised advertising for goods and services that are likely to interest you (by mail, phone and email).
• And all other purposes required by law and the authorities.
5.2 Legal Basis:
InMode collects and processes Personal Data only if:
• It has obtained your consent beforehand.
• Processing is necessary for the performance of a contract.
• Processing is necessary to comply with InMode’s legal or regulatory obligations.
• Processing is necessary for InMode’s legitimate interests and does not unduly affect your interests or fundamental rights and freedoms.
6. How long Personal Data is kept
InMode keeps your Personal Data for the time that is necessary to fulfil the purposes to be achieved, subject to the legal archiving options, obligations to keep certain Personal Data and/or anonymisation obligations.
The Personal Data of Direct Customers, Patients, and Healthcare Professionals that are not related to a specific contract are kept for a period of two (2) years from your last interaction with InMode, except for the personal pharmacovigilance data kept by InMode for the duration of the achievement of the defined goals and 8 years after the conclusion of treatment or death.
The Personal Data of Distributors, Direct Customers, and Healthcare Professionals relating to a specific contract are kept for the duration of the contract.
At the end of the aforementioned periods, the Personal Data are subject to an Intermediate Archiving for the legal or regulatory statute of limitations.
At the end of the legal or regulatory statute, InMode agrees to erase the Personal Data from its databases or to anonymise it.
7. Recipients of your Personal Data
InMode never transmits your Personal Data to third parties who may use it for their own purposes, especially for commercial purposes and/or direct advertising.
InMode may share your Personal Data, only to the extent necessary, with:
• Its employees authorised to process your Personal Data who are all bound by a confidentiality obligation.
• The companies from the group InMode belongs to.
• Its suppliers, service providers and subcontractors for performing the tasks related to the purposes described above.
• Organisations responsible for conducting polls or surveys.
• Other partner pharmaceutical companies involved in using the Devices.
• National and European public authorities: InMode may have to communicate your Personal Data in response to a specific request made by a competent administrative or judicial authority, as well as more generally in all situations where the law, regulations, or an administrative or
judicial decision so requires.
• Other third parties: subject to your express consent, InMode gives your Personal Data to carefully selected third parties, including partners for marketing services that may be of interest to you, or to third parties you have subscribed to or accepted a service from InMode.
In addition, in the event of a reorganisation, merger, sale, joint venture or other transfer or assignment of all or part of our business, InMode may communicate or transfer your Personal Data to the purchaser.
8. Personal Data Security
During its activities and in accordance with the Regulations, InMode agrees to ensure the protection, confidentiality, and security of Personal Data.
InMode takes the necessary precautions in light of the state of knowledge, the costs of implementation and the nature, scope, context and purposes of the Processing and the likelihood of each risk in order to maintain the security and confidentiality of the Personal Data
that you communicate to it and in particular to prevent them from being distorted, damaged or communicated to third parties (unless you have consented).
InMode therefore implements all technical, logical, physical and organisational measures to ensure a level of security that is in line with the risk and to prevent any loss, alteration, disclosure of Personal Data or access by unauthorised third parties.
However, given the intrinsic characteristics of the Internet, no transmission of information over the Internet is completely secure. The Personal Data transmitted to InMode is subject to measures that cannot protect against all risks of hijacking and/or hacking. The transmission of your Personal Data is therefore at your own risk.
In case of violation of Personal Data and in accordance with the Regulations, InMode agrees to notify the ICO.
9. Cookies
9.1 Use of Cookies
Several options are available for managing Cookies. Any settings that you enter will likely modify your internet browsing and access to some services that require the use of Cookies.
You may at any time express and modify your choices regarding Cookies by the means described below.
You can configure your Access Point’s browser so that Cookies are saved on your Access Point or rejected, either automatically or depending on the issuer. In each Access Point, you can also configure your browser to ask you if you’d like to accept or reject Cookies before they are placed on your Access Point.
9.2.1 Accepting Cookies
You do not expose yourself to any risk by accepting the use of this system. Cookies do not damage your computer. You can express and modify your choices in your Access Point’s browser at any time, free of charge.
If in your browser you have agreed for Cookies to be placed on your Access Point, the Cookies embedded in the content and pages that you have viewed may be temporarily stored in a dedicated area on your Access Point for no more than thirteen (13) months. They will only be
readable by their issuer.
9.2.2 Rejecting Cookies
If you reject Cookies being placed on your Access Point or if you delete them from it, you will not be able to benefit from a certain number of features which are nevertheless necessary to be able to browse certain areas of our Site. (if you try to access InMode content or services that require you to log in)
Where applicable, InMode accepts no liability for the consequences of our services functioning poorly due to the fact that it is impossible for us to place Cookies on your Access Point or consult them when they are necessary for those services to operate and you have rejected or deleted them.
You may deny the use of cookies by configuring your Access Point’s browser as follows: For
Mozilla Firefox:
1. Click on the Tools menu then select Internet Options.
2. Click on the Privacy icon.
3. Click on the Show Cookies menu and select the desired options.
Invasix UK LTD is a private limited company registered in England and Wales under the number 08844669 whose registered office is at Unit 7 Oliver Business Park, Oliver Road, London, England, NW10 7JB, United Kingdom.
• Tel. 07483 130370
• Mail: info@@inmodemd.co.uk
• https://www.inmodemd.co.uk
For Microsoft Internet Explorer:
1. Click on the Tools menu then select Internet Options.
2. Click on the Privacy tab.
3. Select the desired options using the cursor.
10. Social Media
InMode is present on social media including Facebook, YouTube, Instagram and LinkedIn.
InMode would like to remind you that Processing is done by the social media when you access or use that social media, which requires that you read and accept the privacy policy of each social media you use.
Depending on the social media used, you will be able to access many features such as signing up for InMode events, following InMode news, commenting or sharing InMode content on your personal page within the social media, etc.
For these purposes, InMode will process some of your Personal Data, including your first name, last name, and any information made public on your personal page.
11. Transfers of Personal Data to a country outside the European Union
Following Brexit, the UK is no longer bound by the EU GDPR. Instead, the UK GDPR, which mirrors the EU GDPR with certain amendments, now governs data protection within the UK. InMode complies with both the EU GDPR and the UK GDPR to ensure the protection of Personal Data.
InMode may transfer Personal Data of Data Subjects located within the European Union or the UK to countries outside these jurisdictions, provided such transfers follow the applicable regulations.
For such transfers, InMode agrees to:
• Ensure that appropriate safeguards, in accordance with the EU GDPR or UK GDPR as applicable, are in place to protect Personal Data.
• Guarantee enforceable rights and effective remedies for Data Subjects to ensure their Personal Data has an adequate level of protection.
Personal Data may be transferred for the aforementioned purposes:
1. Within the European Union and the UK.
2. To countries outside the European Union or the UK that are subject to adequacy decisions: These are countries that have been deemed to provide an adequate level of data protection by the European Commission (for the EU GDPR) or the UK Secretary of State (for the UK GDPR).
3. To countries outside the European Union or the UK that are not subject to adequacy decisions: Such transfers will only occur if appropriate safeguards are implemented, such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or other mechanisms recognized by the respective regulatory frameworks.
InMode remains committed to ensuring the security and protection of Personal Data across all jurisdictions and will take all necessary steps to maintain compliance with applicable laws.
Invasix UK LTD is a private limited company registered in England and Wales under the number 08844669 whose registered office is at Unit 7 Oliver Business Park, Oliver Road, London, England, NW10 7JB, United Kingdom.
• Tel. 07483 130370
• Mail: info@@inmodemd.co.uk
• https://www.inmodemd.co.uk
12. Protecting Children’s Confidentiality
InMode’s Products and Application are not intended for children and do not target children under fifteen (15) years of age. If you are under fifteen (15), you are prohibited from ordering Products, using the Application, and sending InMode information about yourself.
13. Your Rights
Pursuant to the terms and conditions provided for in the Regulations, InMode hereby informs you that you have:
- A right of access: a right to question InMode to find out if it has your Personal Data and ask to know what data it is.
- A right to rectification: a right to ask InMode to rectify information about you in case of errors or inaccuracies.
- A right to object: when Processing is based on InMode’s legitimate interests, you have a right to object to Personal Data Processing for legitimate reasons, except for commercial marketing where no reason is required.
- A right to restriction of processing: a right to ask InMode not to keep some of your Personal Data during future processing when:
- You dispute the accuracy of your Personal Data.
- You consider and can prove that the Processing of Personal Data is unlawful, and you oppose the erasure of the Personal Data and request the restriction of their Processing instead.
- InMode does not need your Personal Data anymore, but it is still necessary for you to establish, exercise, or defend your legal claims.
- You object to the Processing that is based on InMode ‘s legitimate interest pending the verification whether InMode legitimate grounds override those of the data subject.
- A right to erasure: subject to the exceptions provided for by the Regulations, the right to obtain from InMode the erasure of your Personal Data when one of the following grounds applies:
- Your Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
- You wish to withdraw your consent on which the Processing of your Personal Data was based and there is no other legal ground for this processing.
- You object to the Processing and there are no overriding legitimate grounds for the Processing or you object to commercial offers being sent to you. o You consider and can prove that your Personal Data has been subject to unlawful Processing.
- Your Personal Data must be erased for compliance with a legal obligation.
- A right to data portability: when the Processing is based on your consent or a contract, the right to receive your Personal Data from InMode in a structured, commonly used format, and to transmit this Personal Data to another data controller without hindrance from InMode.
Invasix UK LTD is a private limited company registered in England and Wales under the number 08844669 whose registered office is at Unit 7 Oliver Business Park, Oliver Road, London, England, NW10 7JB, United Kingdom.
• Tel. 07483 130370
• Mail: info@@inmodemd.co.uk
• https://www.inmodemd.co.uk
You may request that this Personal Data be directly transmitted by InMode to another data controller, where technically feasible.
• A right to withdraw consent: When the Processing is based on your consent, you have the right to withdraw your consent at any time, without this withdrawal affecting the lawfulness of InMode Processing prior to it.
• A right to decide the fate of your Personal Data upon your death: Finally, you have the right to organise the fate of your Personal Data after your death by adopting general or specific instructions. InMode is committed to following these instructions. If there are no instructions, InMode grants the heirs the possibility of exercising certain rights, particularly the right to access,
if it is necessary for settling the estate of the deceased; and the right to object to close the deceased’s user accounts and oppose to the processing of their data.
You can exercise your rights by sending an email to InMode at the following address:
info@inmodemd.co.uk, along with a copy of your ID.
If, despite InMode ‘s efforts to preserve the confidentiality of your Personal Data, you consider your Personal Data has been breached under the Regulations, you may file a complaint with the ICO.
14. Changes to the Privacy Policy
InMode reserves the right to modify its Privacy Policy. Any modifications will be published on the Sites, Social Networks, and the download page of the Application. If necessary, updates will also be communicated via email. By continuing to browse the Sites, engage with social media, subscribe to a Product, or use the Application after the date of notification, you acknowledge your unconditional acceptance of the updated Privacy Policy.
As of July 16, 2020, the Court of Justice of the European Union (CJEU) upheld Standard Contractual Clauses (SCCs) as a valid mechanism for the international transfer of personal data, provided they offer “essentially equivalent” protection to that provided within the EU, including appropriate additional measures.
Post-Brexit, the UK has implemented the UK GDPR, which mirrors the EU GDPR and ensures high standards of data protection. The UK has also secured an adequacy decision from the European Commission, recognizing the UK as providing an adequate level of protection for personal data transferred from the EU to the UK. This adequacy decision facilitates the seamless transfer of data while maintaining regulatory alignment.
InMode complies with these standards and ensures that personal data transferred internationally is safeguarded by appropriate mechanisms, including SCCs or other recognized tools under the UK GDPR and EU GDPR. For transfers beyond jurisdictions covered by adequacy decisions, InMode implements additional safeguards to guarantee the security and confidentiality of personal data.
This policy will remain active unless further regulatory updates necessitate changes. Updates to this document will be communicated as required. For further information, please refer to the Information Commissioner’s Office (ICO) website or consult our detailed explanatory documents available online.
