Common use of Personal Data (Privacy) (Amendment) Ordinance 2012 Clause in Contracts

Personal Data (Privacy) (Amendment) Ordinance 2012. The new provisions on data processors under the Amendment Ordinance had come into effect on 1 October 2012 and as such, I/we certify the following:- (a) I shall/We will and shall/will procure my/our employees, agents or representatives to comply with the provisions of the Personal Data (Privacy) Ordinance (the “Ordinance”) (including any amendments thereon from time to time), and any applicable codes of practice, guidance notes or regulations in the handling of personal data (as defined in the Ordinance from time to time) (“Personal Data”) collected by and provided to me/us for the purpose of this Tender/Agreement. (b) I/We shall not keep Personal Data longer than is necessary for the fulfilment of the purpose (including any directly related purpose) for which the same are or to be used. I shall/we will: (i) return, destroy or permanently erase all such Personal Data; (ii) destroy or permanently erase all copies of such Personal Data made by me/us; and (iii) use all reasonable endeavours to ensure that anyone who has received any such Personal Data destroys or permanently erases such Personal Data and any copies made by it or him, in each case, save to the extent that I am/we or the recipients are required to retain any such Personal Data by any applicable law, rule or regulation or by any competent judicial, governmental, supervisory or regulatory body. (c) I shall/We will take all practical steps and have in place and maintain appropriate security measures to prevent unauthorised or accidental access, processing erasure, loss or use of Personal Data collected by or transferred to it having particular regard to: (i) the kind of Personal Data and the harm that could result if any of those things should occur; (ii) the physical location where the Personal Data are stored; (iii) any security measures incorporated (whether by automated means or otherwise) into any equipment in which the Personal Data are stored; (iv) any measures taken for ensuring the integrity, prudence and competence of persons having access to Personal Data; and (v) any measures taken for ensuring the secure transmission of Personal Data. Name of Seller : Seller’s Name : Position Signature : E-mail

Personal Data (Privacy) (Amendment) Ordinance 2012. The new provisions on data processors under the Amendment Ordinance had come into effect on 1 October 2012 and as such, I/we certify the following:-followings:-- (a) I shall/We will and shall/will procure my/our employees, agents or representatives to comply with the provisions of the Personal Data (Privacy) Ordinance (the “Ordinance”) (including any amendments thereon from time to time), and any applicable codes of practice, guidance notes or regulations in the handling of personal data (as defined in the Ordinance from time to time) (“Personal Data”) collected by and provided to me/us for the purpose of this Tender/Agreement. (b) I/We shall not keep Personal Data longer than is necessary for the fulfilment of the purpose (including any directly related purpose) for which the same are or to be used. I shall/we will: (i) return, destroy or permanently erase all such Personal Data; (ii) destroy or permanently erase all copies of such Personal Data made by me/us; and (iii) use all reasonable endeavours to ensure that anyone who has received any such Personal Data destroys or permanently erases such Personal Data and any copies made by it or him, in each case, save to the extent that I am/we or the recipients are required to retain any such Personal Data by any applicable law, rule or regulation or by any competent judicial, governmental, supervisory or regulatory body. (c) I shall/We will take all practical steps and have in place and maintain appropriate security measures to prevent unauthorised or accidental access, processing erasure, loss or use of Personal Data collected by or transferred to it having particular regard to: (i) the kind of Personal Data and the harm that could result if any of those things should occur; (ii) the physical location where the Personal Data are stored; (iii) any security measures incorporated (whether by automated means or otherwise) into any equipment in which the Personal Data are stored; (iv) any measures taken for ensuring the integrity, prudence and competence of persons having access to Personal Data; and (v) any measures taken for ensuring the secure transmission of Personal Data. Name of Seller : Name : Authorized Signature : Seller’s Name Chop : Position Signature Held : E-mailmail Address : Date : Tel. No: Fax No.: Name of Seller : Name : Authorized Signature : Seller’s Chop : Position Held : E-mail Address : Date : Tel. No: Fax No.: Ref. : L/M(NPS007-20) to HAHO(S)/T/15 Schedule D Consumption Report NPS Agreement no. PO No. PO Date Hospital Name Department HA Item Code HA Item Description Model No. Serial No. Batch No. Order Quantity UOM Unit Price (HKD) Total Amount (HKD) Name of Seller : Name : Authorized Signature : Seller’s Chop : Position Held : E-mail Address : Date : Tel. No: Fax No.: Describe the safety alert system and provide the details of the product recall system, which must have been approved by the relevant regulatory authority. The Seller must also provide the names, email addresses and telephone numbers of the representatives of the manufacturer and (in case the Seller is a local distributor) the Seller with whom HA can contact in the event of Safety Alert Notice or Product Recall Notice. Name of Seller : Name : Authorized Signature : Seller’s Chop : Position Held : E-mail Address : Date : Tel. No: Fax No.: I, hereby declared on (Name of Company responsible, Title) (Date) that my company, , has *^/does not have * the offered device(s) with the history of product recall or alert in the past 24 months. Cat No. Category Sub-category Model No. History of Product Recall or Alert in the past 24 months Report on the Latest Progress Please indicate “Yes” or “No” below If Yes, please indicate the number of reported cases Causes of the defect Impact to individual patient, if any Event Rate Any Remedial Plan taken to solve the problem, please specify in details 1. Implantable Valve 1.1 Self- expanding

Personal Data (Privacy) (Amendment) Ordinance 2012. The new provisions on data processors under the Amendment Ordinance had come into effect on 1 October 2012 and as such, I/we certify the following:-followings:- (a) I shall/We will and shall/will procure my/our employees, agents or representatives to comply with the provisions of the Personal Data (Privacy) Ordinance (the “Ordinance”) (including any amendments thereon from time to time), and any applicable codes of practice, guidance notes or regulations in the handling of personal data (as defined in the Ordinance from time to time) (“Personal Data”) collected by and provided to me/us for the purpose of this Tender/Agreement. (b) I/We shall not keep Personal Data longer than is necessary for the fulfilment of the purpose (including any directly related purpose) for which the same are or to be used. I shall/we will: (i) return, destroy or permanently erase all such Personal Data; (ii) destroy or permanently erase all copies of such Personal Data made by me/us; and (iii) use all reasonable endeavours to ensure that anyone who has received any such Personal Data destroys or permanently erases such Personal Data and any copies made by it or him, in each case, save to the extent that I am/we or the recipients are required to retain any such Personal Data by any applicable law, rule or regulation or by any competent judicial, governmental, supervisory or regulatory body. (c) I shall/We will take all practical steps and have in place and maintain appropriate security measures to prevent unauthorised or accidental access, processing erasure, loss or use of Personal Data collected by or transferred to it having particular regard to: (i) the kind of Personal Data and the harm that could result if any of those things should occur; (ii) the physical location where the Personal Data are stored; (iii) any security measures incorporated (whether by automated means or otherwise) into any equipment in which the Personal Data are stored; (iv) any measures taken for ensuring the integrity, prudence and competence of persons having access to Personal Data; and (v) any measures taken for ensuring the secure transmission of Personal Data. Name of Seller Tenderer : Seller’s Name : Authorized Signature : Tenderer’s Chop : Position Signature Held : E-mailmail Address : Date : Tel. No: Fax No.: