Data Protection Information for the Use of the Medela Website Chatbot LANI
Last updated: 1 March 2026
Introduction
Your privacy is important to us and we are committed to protecting your personal data that we receive when we provide our services. We therefore wish to make the following information available to you.
This Data Protection Information explains how we collect, process and use your personal data when you interact with us. It also explains how we store and share that data, and how we keep it safe.
We may change this Data Protection Information from time to time and we therefore encourage you to review this Data Protection Information periodically.
Who is LANI?
Medela provides an AI based chatbot (hereinafter referred to as "LANI") on the Medela website, which provides virtual support for product advice and customer care. LANI will not provide any information related to health or diseases, including questions regarding symptoms, therapy recommendations or disease prevention.
Furthermore, you can ask LANI to connect you with a live agent, if available, or to redirect you to the “Medela Contact Us” form on the website to submit a request.
1. Entity responsible for data processing and contact details (controller)
Medela AG (hereinafter referred to as "Medela")
Lättichstrasse 4b
6340 Baar
Switzerland
privacy@medela.com
2. Purpose and legal base of processing your personal data
LANI does not require any of your personal data in order to provide the information you request. Therefore, when you start a chat, you are advised not to share any personal data and in particular not to share any sensitive personal data (e.g., health information, genetic/biometric data).
If you request LANI to be connected with a live agent (customer service employee), you may provide your personal data in order to explain your issue/request to the live agent. After completing a chat — whether exclusively with LANI or with a live agent — you may be invited to participate in a satisfaction survey, in which you may voluntarily disclose personal data.
In any case, if you voluntarily disclose any sensitive personal data you explicitly consent to the processing of such data by Medela. You may withdraw your consent at any time by submitting a data protection rights request as described in the Section, Your rights / How to contact us. The withdrawal of consent does not affect the lawfulness of the processing carried out based on your consent prior to the withdrawal nor does it affect any processing carried out on another legal base.
The processing of your personal data is based on our legitimate interest in improving our services and resolving customer issues.
Legitimate interests pursued include:
· Enhancing the customer experience
· Improving customer satisfaction
· Strengthening customer relationships
· Providing better service to our customers
· Managing customer complaints
All personal data collected will be processed exclusively for the purposes mentioned above. They are neither processed automatically nor analyzed in relation to personal aspects (profiling).
3. Cookies
Cookies are small text files that our website and/or LANI ask to place on your computer or other internet enabled devices, such as tablets or smartphones. If your browser is set to accept cookies, then your browser adds the text in a small file.
When you access our website, we will ask for your consent to place cookies on your device by displaying a cookie banner ("Cookie Consent"). The cookie banner informs you about the main purposes of the cookies and provides you with information about your choices and where you may access further information.
These cookies will be either strictly necessary for the functioning and performance of our website including LANI or will help us to collect some of your personal data relating to your website usage behaviour in order to improve our website offering and services and/or to provide you with more personalized information and services. We explain the cookies that may be placed on your device, the purpose of the different cookie categories and the duration of the cookies saved on your device in the following cookie list: Cookie list.
At all times, you have the right to withdraw your Cookie Consent and individually opt-out from the placement of cookies and any collection of your information for the different purposes at any time with effect for the future.
Most browsers are initially set to accept cookies. If you prefer, you can change your settings to generally refuse cookies, to delete cookies that have already been placed on your device, or to warn you before a cookie is placed. Please refer to your browser instructions or to http://www.aboutcookies.org or www.allaboutcookies.org to learn more about how to adjust or modify your browser settings.
If you choose not to accept cookies, this may impair the usability of the website/LANI and you may not be able to take advantage of some of the features and services offered.
If you use different devices to access our website/LANI (e.g., smartphone, tablet, computer, etc.) you will need to ensure that each browser on each device is adjusted to reflect your cookie preferences.
4. Types of personal data
- Identification details (e.g., first name, last name)
· Contact details (e.g., address, email, phone)
· Birth information
· Complaint/request details
· Transaction details
5. Recipients or categories of recipients
Medela has engaged a service provider based in the United States to run, host and maintain the chatbot. As the United States is not subject to an adequacy decision by the European Commission, any transfer of personal data is carried out using the Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional safeguards where required.
The service providers may not disclose your personal data to unauthorized third parties or use your personal data for purposes other than as instructed.
Medela may share your personal data with other Medela Local Group Companies. Some of these Medela Local Group Companies are located in countries outside Switzerland and the EU/EEA which may not provide for the same level of data protection as in your country of residence. However, Medela has entered into an agreement with these Medela Local Group Companies to ensure appropriate safeguards for your personal data.
6. Location and duration of the storage of your personal data
LANI will not learn from your personal data you may have shared within an active chat. It will only remember your personal data as long as the chat is active. As soon as the chat has terminated it will forget all your personal data. However, the complete chat will be stored in the EU (Germany and Ireland) for 365 days and will be deleted thereafter.
7. U.S. State Law Requirements
Some U.S. state privacy laws such as the California Consumer Privacy Act (CCPA) and Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA) and the Connecticut Personal Data Privacy and Online Monitoring (2022 S.B.6) require specific disclosures for state residents. State laws like the CCPA, VCDPA, CPA and 2022 S.B.6 also provide the right to request information about how we collect, use and disclose your information. These laws also provide the right to request deletion or anonymization. We do not discriminate against individuals for exercising these privacy rights. Medela fully complies with all applicable State Privacy Laws, including, but not limited to the California Consumer Privacy Act (“CCPA”), Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Virginia Consumer Data Protection Act, and any other United States state privacy laws, together with applicable implementing regulations, that provide general privacy protection to consumers.
8. Medela Does Not Sell Personal Data
Medela has never sold Personal Data and does not intend to sell any Personal Data in the future. If this intent changes, we will update this Privacy Notice accordingly. “Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. "Personal data" does not include de-identified data or publicly available information.
From time to time we may collect “Sensitive Personal Information” (SPI). SPI includes, but is not limited to, racial origin, religious beliefs, sexual orientation, ethnicity, religion, genetic data, private communications, specified health information and precise geolocation. We do not sell SPI or utilize automated decision making.
9. HIPAA Notice of Privacy Policy for Protected Health Information
To the extent that you are a U.S. citizen and may disclose “protected health information” as defined under U.S. law while you make a complaint with us, please refer to our HIPAA Privacy Policy and Notice of Privacy Practices to understand your rights and how we may use and disclose your protected health information.
10. Your rights / How to contact us
The following data protection rights describe the commonly known privacy standards. However, some rights may not apply according to local privacy law.
Right to access personal data: You have the right to request and receive information on the personal data collected on you or processed or, where applicable, shared with third parties.
Right to rectification: You have the right to have any inaccurate personal data corrected.
Right to erasure ("right to be forgotten"): You have the right to have your personal data deleted – for example, if your personal information is no longer required for the original purpose it was collected – subject to statutory retention obligations.
Right to restrict data processing: You have the right to request the restriction of the processing of your personal data, for example if the processing is unlawful or the accuracy of your personal data is contested.
Right to data portability: You have the right to receive a copy of the personal data you have provided us. You can request to have your personal data transmitted to you or, where technically feasible, to another data controller of your choice.
Right to object: You have the right to object to having your personal data processed for certain purposes or to withdraw your consent to such processing.
Please note that in exceptional cases, your right to exercise the above rights may not be guaranteed due to statutory or regulatory requirements.
If you would like to exercise any of the above rights, please use the following Privacy Request Webform:
For US residents: Click here
Residents of any other country: For any other state residents: Click here
Privacy rights requests sent by email will not be processed.
In case of any questions about the collection, processing and/or use of your personal information, please send your request to Medela AG, Global Data Protection Officer, Lättichstrasse 4b, 6340 Baar, Switzerland or email us at privacy@medela.com.
To file an official complaint, please contact the data protection authority in your jurisdiction (For Switzerland: Federal Data Protection and Information Commissioner / Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB; for the EU and EEA, the current list of National Data Protection Authorities, members of the European Data Protection Board, can be found here; for the UK: Information Commissioner's Officer - ICO).
