8.3.1 Data Security. Each Party shall implement administrative, technical, physical and organizational data security measures and controls designed to protect the Data received from the other Party with at least the same degree of care as protecting its own user data and confidential information, but no less than reasonable care, and specifically including measures and controls designed to protect Personal Data collected, transmitted, stored or otherwise processed in connection with this Agreement against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access, and as required by Privacy Laws.
8.3.2 Security Incidents. Upon becoming aware of a Security Incident, each Party (“Notifying Party”) agrees to provide written notice to the other Party without undue delay. The Notifying Party shall be solely responsible for remediating the Security Incident, including the provision of any legally required notice to affected individuals and (without limiting Section 4.2) any Regulatory Authority required under Data Protection Laws. Notwithstanding the foregoing, if a Security Incident affects both Parties, the Parties agree to coordinate with respect to any communications or notifications that are sent to government authorities and/or data subjects regarding such Security Incident. The Notifying Party agrees to provide the other Party with such information as may be reasonably requested by such other Party with respect to the Security Incident, and any investigation, corrective action, and remediation process, in each case, as it relates to such other Party’s Data and the Combined Platform and to consider in good faith any comments provided by such other Party with respect thereto. For purposes of this Section 8.3.2, “Security Incident” means any actual (a) unauthorized access to, acquisition of, transmission, or use of Personal Data; (b) unauthorized or accidental loss, alteration, disclosure, or destruction of Personal Data; (c) compromise, intrusion, interference with, or unauthorized access to networks, systems, databases, servers, or electronic or other media on which Personal Data is processed or from which Personal Data may be accessed, including those of an agent or subcontractor.
8.4 | Data Use and Disclosure. |
8.4.1 Beta Bionics or DexCom may, upon request of a user of the Combined Platform and subject to Privacy Laws, export Beta Bionics [***] Data for that user to the user’s HCP, caregivers, and/or clinical investigators.
8.4.2 Beta Bionics may not, unless required under Privacy Laws, transfer any DexCom [***] Data to [***].
8.4.3 DexCom may not, unless required under Privacy Laws, transfer any Beta Bionics [***] Data, to [***].
8.4.4 License to DexCom.
25