Privacy Notice Rx Prescription Validation

Privacy Notice for Rx Prescription validation test

We inform you below about the processing of your personally identifiable information (PII) and your data privacy rights in the context of collecting your Rx prescription to validate completeness with your prescription provider or eye care professional (ECP).

Who is responsible for PII processing and whom can you contact?

Carl Zeiss Vision International GmbH (“ZEISS”, “us”)
Turnstrasse 27
73430 Aalen, Germany
Contact via email (no confidential content, please): developer.vision@zeiss.com
ZEISS is a member of the ZEISS Group.

What do we process PII for?

The PII processing is carried out for the purpose of reaching out to your Rx prescription provider or ECP to validate prescription completeness.

What types of PII do we process ?

We process the document you provide with the information contained therein. In addition, we collect your name, date of birth as an authentication feature to pass it on to your Rx prescription provider or ECP.

Processing of PII is based on your explicit consent or where it is necessary for our compliance with a legal obligation.

To whom do we transfer your PII?

To the extent necessary, departments within ZEISS will have access to personal information that require it to fulfill their duties, such as such as confirming unclear values due to too poor picture quality, handwriting issues, missing legal fields.

In addition, your PII may be disclosed to carefully selected partners of ZEISS that process PII on our behalf to fulfill the purposes as described above, such as the service provider “Clickworker” collecting your PII, cloud service vendors, and security providers.

Is PII transferred to a third country or to an international organization?

When forwarding PII within the ZEISS Group, transmitting PII abroad and processing PII with external partners, ZEISS observes the applicable data privacy laws and safeguards these activities. A transfer to countries outside the US ("third countries") only takes place to the extent necessary for the respective purpose. Before any transfer of PII to processors or third parties in third countries, we ensure that a transfer mechanism exists in accordance with applicable law. ZEISS has implemented appropriate technical and organizational measures to protect your PII.

Were Categories of PII Disclosed in the Past 12 Months?

In the past 12 months, we have disclosed the following categories of personal information in connection with the Rx Prescription validation test to service providers and contractors for business purposes:

Identifiers, such as name and email address, Rx prescription details such as refraction values disclosed to service providers that provide Infrastructure as a Service as well as to our contractor ”Clickworker” as defined in “To whom do we transfer your PII?”.

We do not sell or share PII as defined under California law.

Is PII of Consumers Under 16 shared?

We do not have actual knowledge that we sell or share the PII of consumers under the age of 16.

How long do we store your PII?

We delete or anonymize your PII when the purpose for which it was collected no longer exists; this could include information collected during the execution of a contract which has been terminated. In order to adhere to commercial and tax law and other legal requirements, it may be necessary to store your PII for longer than the purpose for which it was collected. This may also be necessary for the assertion, exercise and defense of legal claims.

What data privacy rights do you have?

Of course, you retain control over all PII that you provide to us via Clickworker transferred to ZEISS to reach out to participant’s Rx pass provider or ECP to complete missing / confirm unclear data fields.. You have the following rights, which you can exercise free of charge.

Privacy Right	Definition
Rectification/Correction	You may have the right to request that we correct any inaccurate personal information relating to you and to have incomplete data completed.
Deletion	You may have the right to request that your personal information be deleted without undue delay, if: it is no longer necessary for the purposes for which we have collected it, you have withdrawn your consent and no other legal ground for the processing exists, you objected and no overriding legitimate grounds for the processing exist, or the processing is unlawful, or erasure is required to comply with a legal obligation.
Access/Know	You may have the right to obtain from us confirmation if your personal information is being processed by ZEISS in addition to certain related information, as well as the right to obtain a copy of your personal information undergoing the processing.
Transfer	You may have the right to receive your personal information that you have provided to us, in a structured, commonly used and machine-readable format and to transmit it to other data controllers. This right only exists if the processing is based on your consent, or a contract and the processing is carried out by automated means.
Right to Restrict Processing: Use and Disclosure of Sensitive Personal Information	You have the right to limit our use and disclosure of your “sensitive personal information,” as that term is defined in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA), to the extent required by law.
Appeal	Appeal the denial of a privacy rights request under the relevant law.
Right to refuse to provide information	You have the right to refuse to provide information when requested, however please note that where the processing of that information is necessary for the purposes of entering into or performing contractual obligations, or to comply with our legal obligations, then your failure to provide certain information when requested could mean that we are unable to comply with those obligations.
Right to refuse or withdraw consent	In cases we ask for your consent to processing, you are free to refuse to give consent and you can withdraw your consent at any time. The lawfulness of any processing of your personal information that occurred prior to the withdrawal of your consent will not be affected.
Right to complain	You have the right to complain to a supervisory authority or our data protection officer, insofar as you should have a reason to complain. To claim rights against our company, please contact the contact person listed at the beginning of this data privacy notice.

Exercising your rights

To exercise these rights, please submit a verifiable consumer request to us by contacting us via the contact details as provided in “Who is responsible for PII processing and whom can you contact?”.

For consumers in any U.S. jurisdiction that provides consumer privacy rights, ZEISS must be able to verify and authenticate your request to initiate action.

For California consumers, only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for information twice within a 12-month period. The verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Do you have to provide us with PII?

We request your PII to submit your valid Rx prescription via our partner Clickworker.

Failure to provide this information may result in consequences stated by your agreement with Clickworker.

Automated decision making

No automated decision is made based on your provided PII.

PII which has not been obtained from the data subject

In case of mandatory information, that is missing on your provided prescription, your Eye Doctor may share this information with us to fulfill our purposes as described above.

If you have a data privacy concern, please contact

Corporate Data Protection Officer
Carl-Zeiss-Strasse 22
73447 Oberkochen
Contact via email (no confidential content, please): dataprivacy@zeiss.com
Contact by phone: +49 7364 20-0 (keyword “data protection”)

¹
This document was last updated on September 29th, 2025