CardioGuide™ HF App

PRIVACY NOTICE

Version Date: August 7, 2026

Abbott Laboratories provides the CardioGuide™ mobile application (“App”) for the CardioMEMS™ HF System (a wireless sensor implanted in your pulmonary artery that measures your PA pressure and heart rate). For purposes of this Privacy Notice, the “Services” are the App and related Abbott controller activities described in this Privacy Notice. In this Privacy Notice, “Abbott,” “we,” “us,” and “our” refer to Abbott Laboratories and, where applicable, the Abbott affiliate identified in the +COUNTRY SPECIFIC PROVISIONS section for your country or region.

The App exchanges information with the Merlin.net™ Patient Care Network Heart Failure (“Merlin.net HF”). Your healthcare provider (doctors, healthcare professionals and clinics together “Healthcare Provider”) has entered into an agreement with Abbott for Merlin.net HF, which holds information about your CardioMEMS™ HF System and heart condition. Your Healthcare Provider uses Merlin.net HF to monitor your pulmonary artery pressure (“PA”) and heart rate and to provide medical treatment, intervention messages and other information through the App. Your Healthcare Provider is the controller of your personal information when it uses Merlin.net HF to provide medical care to you, and Abbott generally processes that personal information as your Healthcare Provider’s processor.

We recognise the importance of data protection and privacy and are committed to protecting personal information (also referred to as “personal data” in some jurisdictions), including health-related information. This Privacy Notice describes how your personal information is collected and used by Abbott when Abbott acts as a controller in connection with the Services. It also includes limited information about how the App interacts with Merlin.net HF so that you can understand the relationship between Abbott and your Healthcare Provider.

Please read this Privacy Notice carefully before registering to use the App as it applies to the processing, transfer and storage of your personal information, including health-related data by Abbott and certain affiliated companies as described below. It also applies to the processing of your personal information by our affiliated companies and by our processors if required to address a customer service issue related to the Services.

This Privacy Notice does not apply to personal information processed or collected by other Abbott affiliates or subsidiaries or via other methods, such as other Abbott websites and other Abbott customer call centers. It also does not replace privacy information that your Healthcare Provider gives you about its use of Merlin.net HF as controller to provide medical care.

WHERE REQUIRED AND PERMITTED BY THE LAW OF YOUR COUNTRY OF RESIDENCE, BY USING THIS APP YOU: (A) CONFIRM THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY NOTICE; AND (B) CONSENT TO THE PROCESSING AND TRANSFER OF YOUR PERSONAL INFORMATION, INCLUDING HEALTH-RELATED INFORMATION, AS DESCRIBED IN THIS PRIVACY NOTICE.

YOUR CONSENT IS GRANTED AT YOUR FREE WILL AND, WHERE APPLICABLE, YOU ARE NOT UNDER ANY LEGAL OBLIGATION TO PROVIDE PERSONAL INFORMATION TO ABBOTT.

+About Us

Abbott is the manufacturer of the CardioMEMS™ HF System. The CardioMEMS™ HF System is indicated for wirelessly measuring and monitoring PA pressure and heart rate in heart failure patients. Abbott, through its local affiliate, is the provider of Merlin.net HF to your Healthcare Provider.

Your Healthcare Provider is a controller of your personal information for the purposes of providing your medical care. Your Healthcare Provider is responsible for how such personal information is processed and for ensuring that personal information processed through Merlin.net HF for your medical care complies with applicable privacy and data protection laws. The reference to ‘controller’ is based on its definition in the data protection and privacy laws in which you reside.

Abbott is a controller of personal information when we use personal information to: (1) provide and operate the App and administer your App account and login; (2) comply with legal obligations, including those related to medical device safety, quality and improvement; (3) conduct research and statistical analysis for limited purposes, using anonymised information where possible and otherwise using personal information only where Abbott has a lawful basis to do so; (4) send marketing communications relating to Abbott products and services; and for (5) product development and improvement of the App and the Services. For further information see +Abbott’s Own Use of Your Personal Information.

You may learn more about how your Healthcare Provider and Abbott uses personal information collected through Merlin.net HF at https://www.cardiovascular.abbott/int/en/policies/hf-policies.html.

+About the Services and Merlin.net HF

Merlin.net HF is a cloud-based remote care system that holds information transmitted from your CardioMEMS™ HF System. Your Healthcare Provider uses Merlin.net HF as controller to monitor your PA and heart rate and, based on those readings, to communicate with you through the App, including by providing treatment instructions, medication adjustments and other information. Abbott generally processes personal information in Merlin.net HF as your Healthcare Provider’s processor when it supports your Healthcare Provider’s monitoring and treatment activities.

To submit or receive information through the App, you must keep your mobile device connected to WiFi or to cellular/mobile data. Before you can use the App, your Healthcare Provider must register you on Merlin.net HF. To register to use the App, you will need to enter some of your personal information, such as your date of birth, CardioMEMS™ HF System serial number, email address, and telephone number.

After you have registered to use the App, you will be prompted to allow push notifications. You must enable these notifications if you want to receive messages and medication change notifications from your Healthcare Provider through the App. The App also enables you to receive medication notifications and CardioMEMS™ HF System historical pulmonary artery pressure readings and other information you provide to the App. Please keep notification on to receive status updates and reminders. You may also use the App to submit information, such as blood pressure and weight, which will be communicated to your Healthcare Provider.

Some personal information, such as account registration details, your CardioMEMS™ HF System serial number, and information needed to transmit and receive information through the App, is required to provide the Services. Other information, such as information from a mobile health data platform, optional App preferences, and information you choose to submit through the App, may be optional. If you do not provide required information, Abbott may not be able to provide the App or certain App features and Services. If you do not provide optional information or if you disable sharing or notifications, some App features may not be available, and your healthcare provider may have less information to support remote monitoring.

The Services are intended to support your Healthcare Provider’s review of information from your CardioMEMS™ HF System and the App. Abbott does not use your personal information for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Decisions about your medical care are made by your Healthcare Provider.

+Collection and Processing of Your Personal Information

The following categories of your personal information are processed through the App:

• full name (required);
• date of birth (required);
• CardioMEMS™ HF System serial number (required);
• email address and/or phone number (required);
• App password (required);
• PA pressure readings from your CardioMEMS™ HF System;
• PA pressure goals and thresholds from your Healthcare Provider;
• systemic blood pressure readings and body weight (provided by you manually or automatically from your mobile health data platform, such as Apple Health);
• medication list from your Healthcare Provider;
• treatment plans from your Healthcare Provider;
• messages from your Healthcare Provider, such as a proposed change in medication;
• messages to remind you to take a PA pressure reading and/or to take medication;
• acknowledgements of receipt of messages and medication change notifications;
• other information from Merlin.net HF your Healthcare Provider chooses to share with you;
• App preferences and settings; and
• information about the App performance, including crash reports.

As listed above, Merlin.net HF uses additional personal information, including health-related data that your Healthcare Provider inputs when creating a Merlin.net HF patient profile for you, which may be displayed to you through the App. That personal information displayed in the App may include your PA readings from your CardioMEMS™ HF System. Abbott may need to access this personal information as your Healthcare Provider’s processor to support Merlin.net HF and related services, and as controller where necessary to provide, maintain and secure the App and for the limited purposes described in

+Abbott’s Own Use of Your Personal Information.

The App also may receive certain personal information from a mobile health data platform that is connected with the App via a mobile device application, such as Apple Health, when you consent to that sharing. For example, you may choose to share systemic blood pressure and weight information you store in Apple Health with the App. You are not required to share personal information with the App from such applications, and you may choose the personal information shared and/or withdraw your consent for the sharing at any time by changing the settings in the relevant application or on your mobile device. Abbott will continue to process in accordance with this Privacy Notice the personal information you chose to share from other mobile device applications, such as Apple Health, the App received before you withdrew consent for the sharing. Any withdrawal of consent will not affect the lawfulness of the processing based on your consent before the withdrawal. Abbott will process information shared via a mobile health data platform only for the purposes described in this Privacy Notice and, where applicable, in accordance with the permissions you select in the relevant application or device settings.

+Your Healthcare Provider’s Use of Your Information

Your Healthcare Provider will collect your personal information as part of your medical treatment and will input your information into Merlin.net HF. Your Healthcare Provider uses Merlin.net HF and information you submit through the App to help monitor your CardioMEMS™ HF System and your PA pressure and heart rate. This provides your Healthcare Provider with the type of information that may result in them adjusting your treatment or asking you to come in for an appointment.

Your Healthcare Provider processes your personal information for the following purposes:

• to provide medical care, including on-going medical treatment by monitoring your CardioMEMS™ HF System and your PA pressure and heart rate to assist them to provide you with medical care;
• to grant Abbott access to your personal information to provide technical support for Merlin.net HF and the App, including to receive technical and clinical support, such as assistance with debugging, upgrading or troubleshooting Merlin.net HF or the App or interpreting data; and
• where otherwise required by applicable law.

+Abbott’s Access to Personal Information When Providing Merlin.net HF services to Your Healthcare Provider

When we provide Merlin.net HF and related support services to your Healthcare Provider, we process your personal information as a processor on behalf of your Healthcare Provider. Such processing is on the instructions of your Healthcare Provider and relates to the following purposes:

• provide Merlin.net HF and related services for your Healthcare Provider to monitor your CardioMEMS™ HF System and your PA pressure and heart rate;
• provide your Healthcare Provider with technical and clinical support, such as assistance with debugging, upgrading or troubleshooting;
• transmit messages from your Healthcare Provider or clinic to you or from you to your healthcare provider; or
• where authorised by your Healthcare Provider, obtain access to your health information to assist them with interpreting data transmitted from your CardioMEMS™ HF System.

Depending on your location, we may provide support services to your Healthcare Provider from locations in: Belgium; other European locations, particularly if we have operations in your country of residence; or our other support centres located in the United States of America or Belgium (or other European locations). We may also use other third parties to provide technical or clinical support to your Healthcare Provider. Where we use any third party to help us provide support services to your Healthcare Provider, we put in place adequate measures to safeguard the confidentiality, integrity and security of your personal information.

The reference to ‘processor’ is based on its definition in the data protection and privacy laws in which

you reside.

+Abbott’s Use of Your Personal Information

Abbott processes your personal information, including your health-related personal information, as a controller for the following purposes:

• to provide and operate the App in accordance with the App End User License Agreement, including administering App registration, login/authentication, App functionality and App security (however, this does not include Abbott’s processing described above as a processor for your Healthcare Provider);
• to keep a record of your contact with Abbott when you contact Abbott directly regarding the App or Services;
• where required by applicable laws governing the use and classification of medical devices, including for the purposes of medical device post-market surveillance, quality management, including product development and improvement, safety, performance, and vigilance;
• to contact you for operational and service-related purposes through the App, push notifications, email, by phone messaging (e.g., SMS messaging), or other channels, including to provide service updates, transmission status notices, safety-related information, and support communications, with your consent where required by applicable law;
• to pseudonymise, aggregate and/or anonymize the personal information, where permitted by applicable law, for purposes described in this Privacy Notice;
• for other purposes with your consent, where permitted by applicable law and as described to you when your consent is requested;
• where necessary to establish, exercise or defend legal claims; and
• as otherwise required by applicable law.

Abbott may use anonymized information for Abbott’s business, research, product development, analytics, reporting, and other lawful purposes. Such uses may include developing and improving the App, the Services, and the CardioMEMS™ HF System, and related Abbott products and services, including algorithms and technologies such as artificial intelligence and machine learning; analysing

how the App, the Services, the CardioMEMS™ HF System, and related Abbott products and services are used, operate, and correlate to certain results and outcomes, including by age group or other demographic categories; research and development as further described below, reporting to Healthcare Providers; and other purposes permitted by applicable law. Where information has been de-identified, pseudonymised, or aggregated but remains capable of identifying you, Abbott will process it only for the purposes described in this Privacy Notice and only where Abbott has an applicable lawful basis. Where required by applicable law, Abbott will obtain your consent before using health-related personal information for research, development, analytics, or similar secondary purposes.

Where Abbott conducts research or statistical analysis relating to the Services, Abbott will use anonymised information where possible. Where research requires the use of personal information that has not been anonymised, Abbott will apply appropriate safeguards and rely on the lawful basis and special-category condition described in the +Research section, or request consent where required by applicable law.

Apart from the controller processing described above, Abbott may only use your data for other purposes if you have consented for Abbott to do so or where another lawful basis applies.

+Data Storage

We receive data transmitted by the App before it is then stored. Personal information processed through the App and Merlin.net HF is stored either on premises in the United States of America or in a regional deployment in Europe, depending on the location of your Healthcare Provider. If your Healthcare Provider is located in the United States of America or in countries outside of the EEA, the UK or Switzerland, personal information will be stored on servers in the United States of America. For the EEA, the UK and Switzerland personal information will be stored either in a regional deployment in the EEA or on servers in the United States of America.

Personal information transmitted to Merlin.net HF may be hosted in the country closest to your Healthcare Provider’s country location or otherwise in accordance with the data storage and privacy requirements of your Healthcare Provider’s location.

When your personal information is transmitted and hosted on Merlin.net HF servers in a country other than the country location of your Healthcare Provider or your country of residence, it may become subject to the laws of the host country, which may not be equivalent to the laws of the country of your healthcare provider or your country of residence. Abbott has implemented appropriate security measures and controls to protect your personal information. For more information about our global server locations and on which servers your personal information, including health-related information, is stored, please contact your healthcare provider.

See also +Security of Personal Information and +Cross-Border Transfers of Personal Information.

+Medical Devices and other Legal Requirements

Abbott may use personal information where legally required and where possible we will de-identify, pseudonymise, aggregate and/or anonymise information to comply with our legal obligations as a medical device manufacturer. This information is securely held by Abbott and will not be used to identify you individually by your name or email address, except where we are under a legal obligation to include this information. Where such use of personal information is subject to legal requirements, we do not require consent.

The legal requirements for which Abbott will use this information are:

• to ensure the ongoing safety of a CardioMEMS™ HF System and any future development;
• to monitor and improve the quality, security and effectiveness of medical devices and systems;
• to validate upgrades, and to keep Merlin.net HF and/or the App safe and secure;
• to perform broader analysis to detect systemic issues for public interest in the area of public

health;

• where required by applicable laws governing medical devices, to perform device development, validation or testing necessary to comply with those laws; and
• where otherwise required by law, including to respond to any competent regulatory, law enforcement body, governmental authorities, to address national security or epidemics, judicial proceeding, court order, government request or legal process served on us, or to protect the safety, rights, or property of our customers, the public, Abbott or others, and to exercise, establish or defend Abbott’s legal rights or where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of this Privacy Notice, or as evidence in litigation in which we are involved.

We use the terms ‘de-identify’ and ‘pseudonymise’ interchangeably. Pseudonymised data is personal information that can no longer be attributed to a specific individual without the use of additional information kept separately. Anonymised data is information that does not relate to an identified or identifiable and from which a person cannot be identified; this kind of data usually falls outside data protection and privacy laws.

+Research

Abbott conducts research and statistical analysis for limited purposes using anonymised information where possible. Where information has not been anonymised and remains personal information, Abbott uses the minimum information necessary and applies appropriate technical and organisational safeguards, including pseudonymisation where appropriate. Where research involves health-related personal information, Abbott will rely on your explicit and voluntary consent where required by applicable law, unless another lawful basis is available. Where research involves personal information that is not health-related, Abbott may rely on its legitimate interests where permitted by applicable law.

If a data set is used for research purposes, the data will not include your name, address, phone number, or email address. Data used in research may include the CardioMEMS™ HF System serial number, intervals between implant date and subsequent visit dates, implant date, and demographics such as place of residence and age. Where any research data remains personal information, Abbott will apply appropriate safeguards as described in this Privacy Notice.

We conduct research and statistical analysis for the following purposes:

• to improve the quality, security and effectiveness of our cardiac and medical devices and systems and to allow for the development of innovative and effective treatment of heart-related conditions in the interests of public health;
• to conduct research, for statistical purposes and analysis and to disclose to third party researchers, health care entities or professionals, or public health authorities;
• to evaluate the effectiveness of the App, Merlin.net HF and our medical devices and how they are provided and used;
• to validate the App’s and Merlin.net HF’s functionality and upgrades, including monitoring and improving the safety and security of such services;
• to research, develop and test medical devices, including new and existing features and functionality and to test and improve the App, Merlin.net HF and our medical devices for product development, data analysis, statistical and survey purposes; and
• for public interest in the area of public health, including where the App, Merlin.net HF and medical devices are eligible for medical reimbursement or are otherwise entitled to social security, insurance or public funding.

Where Abbott relies on your consent to process health-related personal information for a specific research activity, you can withdraw that consent at any time by contacting us. Any withdrawal of consent will not affect the lawfulness of the processing based on your consent before the withdrawal. If you

withdraw consent, Abbott will stop processing personal information that relates to that consent unless Abbott has another lawful basis to continue processing, such as described in +Medical Devices and other Legal Requirements. This does not affect Abbott’s use of information that has been anonymised so that it no longer identifies you.

If you are ever asked to participate in a clinical trial, and where required by applicable law, you will be asked to provide a separate informed consent to the research site prior to taking place in any such trial and your participation is completely voluntary. The research in this section does not relate to participation in a clinical trial.

+Retention of Personal Information

Information collected from your CardioMEMS™ HF System will be retained for a maximum period of ten (10) years for KSA, Qatar, and Kuwait and twenty-five (25) years for UAE from the date of your most recent transmission (that is, the date you last use your CardioMEMS™ HF System and/or the App), except as may be required by law. Other personal information, such as account registration details, App preferences and settings, support records, manually entered information, information from a mobile health data platform, and App performance information, will be retained for as long as necessary for the purposes described in this Privacy Notice, including to provide the Services, maintain security, respond to support requests, comply with legal obligations, resolve disputes, and establish, exercise or defend legal claims.

The section +Deleting Your Information explains how you can arrange to have your Healthcare Provider delete your information from the Merlin.net Patient Care Network Heart Failure.

+Disclosure of Personal Information by Us

We may share your personal information as follows:

• We share personal information with third-party suppliers solely to provide, maintain, host, and support the App, Merlin.net HF and related services. Depending on the location of your health care provider, Abbott may use Microsoft Azure to receive, process, and store data transmissions from your CardioMEMS™ HF System. Where we provide your personal information to third-party suppliers to assist us with the provision of the App, Merlin.net HF and related services, they are required to keep your personal information confidential and secure and to use your personal information to the minimum extent necessary.
• Where possible, Abbott uses third party service providers to report system errors so that we can support and improve the App, Merlin.net HF and related services and in such instances the information sent to such third parties will not involve the use of your personal information.
• We will not sell or license your personal information to third parties except in connection with the sale, merger, or transfer of a product line or division, so that the buyer can continue to provide you with the App, Merlin.net HF and related services. For the avoidance of doubt, we will not sell your personal information to third parties for commercial purposes.
• We may share de-identified, pseudonymised, aggregated, and/or anonymised information with our affiliates, your Healthcare Provider, third party researchers and national health authorities or insurers to demonstrate the effectiveness of the App, Merlin.net HF, our medical devices or related services or as required for medical reimbursement. This information will not be used to identify you individually.
• We reserve the right to disclose your personal information to respond to authorised information requests from government authorities, to address national security situations, or when otherwise required by law. Furthermore, where permitted or required by law, we may also disclose the information we collect from you where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of this Privacy Notice, or as evidence in litigation in which we are involved. Your personal information may be subject to foreign laws and may be accessible by foreign governments, courts, law enforcement, and regulatory agencies.

+Security of Personal Information

Abbott has implemented appropriate security controls within App and Merlin.net HF to protect your personal information from accidental or unlawful destruction or accidental loss, alteration, disclosure, or access.

App and Merlin.net HF include various security measures to enhance the security of your patient profile and to prevent unauthorised access to, or disclosure of, your personal information. Only those authorised by your Healthcare Provider, including their authorised staff, will have access to your patient profile and only through unique IDs and passwords. Abbott has implemented various security and access controls to ensure that only authorised persons within Abbott may access pseudonymised, aggregated and de-identified data.

Please be aware that the App and Merlin.net HF may be unavailable during periods of routine maintenance.

+Cross-Border Transfers of Personal Information

Depending on the location of your clinic and the deployment used for the Services, information collected through the App and Merlin.net HF may be transferred to and stored in the United States of America or another country outside your country of residence. The data protection laws of those countries may not offer protections for personal information equivalent to those of your country of residence.

If you contact us directly and request technical support, your personal information (including health-related data) may be accessible by our remote care teams in the United States of America and Belgium (or other European locations). Abbott intracompany data transfers are governed by a data transfer agreement providing adequate safeguards to protect personal information. If you would like more information about the relevant transfer safeguards or how to obtain a copy of them, you may contact us using the details in +Contact Us.

We also refer you to +COUNTRY SPECIFIC PROVISIONS, for additional provisions that apply to international transfers of personal information depending on your country of residence.

THIS PRIVACY NOTICE INFORMS YOU THAT YOUR PERSONAL INFORMATION MAY BE TRANSFERRED TO, STORED IN, OR ACCESSED FROM THE UNITED STATES OF AMERICA AND BELGIUM (OR OTHER EUROPEAN LOCATIONS), INCLUDING WHERE ACCESS TO YOUR PERSONAL INFORMATION, INCLUDING HEALTH-RELATED INFORMATION, MAY BE REQUIRED IN EXCEPTIONAL CIRCUMSTANCES TO RESPOND TO ANY SUPPORT REQUESTS YOU OR YOUR HEALTHCARE PROVIDER REQUESTS. THESE COUNTRIES MAY NOT OFFER AN EQUIVALENT LEVEL OF PROTECTION FOR YOUR PERSONAL INFORMATION WHEN COMPARED WITH DATA PROTECTION OR PRIVACY LAWS IN WHICH YOU RESIDE.

+How Abbott Sends Marketing and Other Material

We will not knowingly send you advertising or marketing-related information, unless you have opted into receiving these types of communications from us in relation to our other products and services.

Neither Abbott nor its affiliates or licensors will knowingly send advertising or marketing-related information to children.

We do not sell your personal information to third parties for direct marketing.

Please note that we may send you non-marketing related information about necessary App and service updates or issues relating to product safety.

+How Abbott Protects Children’s Privacy

The App and Services are intended to be used by adults or, where permitted, by a parent or legal guardian on behalf of a child. Children can be enrolled in Merlin.net HF by a Healthcare Provider. At any time, a parent/guardian may stop the collection of a child’s personal information, including health-

related information, by contacting the Healthcare Provider and requesting that the account be deleted. This action will delete the Merlin.net HF account associated with the child and will affect the App functionality available in relation to that child, but we will retain aggregated and de-identified information and may need to retain certain personal information as required by law.

+How Individual Users Can Access and Correct Personal Information and Your Rights

To exercise any data protection or privacy rights in relation to Abbott’s processing of your personal information as a controller in connection with the App and Services, you may contact us using any of the methods set out in the section entitled +Contact Us. Where your request relates to personal information processed by your Healthcare Provider through Merlin.net HF for your medical care, you should contact your Healthcare Provider in the first instance. We are not able to correct or amend any readings from your CardioMEMS™ HF System that have been uploaded.

Depending on your place of residence, you may have the right to: (a) access the personal information we hold about you; (b) request we correct any inaccurate personal information we hold about you; (c) delete any personal information we hold about you; (d) restrict the processing of personal information we hold about you; (e) object to the processing of personal information we hold about you; and/or (f) receive any personal information you have provided to us on the basis of your consent in a structured and commonly used machine-readable format or have such personal information transmitted to another company. Please note that Abbott is not required by law to adopt or maintain systems that are technically compatible with other companies. It may not be possible for Abbott to directly transmit your personal information to another company.

Children may also have the right to access the personal information held about them. Where we receive a request for access for a child’s personal information from the child’s parent/guardian, we may respond directly to the child’s parent/guardian or recommend that they contact their child’s Healthcare Provider. We will always seek to verify the identity of person seeking access to a child’s information, whether it is from the child him/herself or from a parent or guardian.

+Deleting Your Information

For Merlin.net HF Data: If you have been implanted with the CardioMEMS™ HF System, the only way your Healthcare Provider can monitor you is via Merlin.net HF. Therefore, if you elect not to be enrolled in Merlin.net HF it will affect your Healthcare Provider’s ability to monitor your condition and may affect their ability to treat you.

If you would like to have your information deleted from Merlin.net HF, you may do so by contacting your Healthcare Provider. If you request deletion of your information from Merlin.net HF and still have the CardioMEMS™ HF System, your Healthcare Provider will not be able to remotely monitor your PA pressure and heart rate. Please be aware that if your Healthcare Provider deletes your information in Merlin.net HF, we will retain aggregated and de-identified information and may need to retain certain personal information as required by law.

For In-App Data: Use of the App is not required for your Healthcare Provider to monitor your CardioMEMS™ HF System via Merlin.net, unless you are enrolled in the Dynamic Treatment Plan feature or submit blood pressure and weight using the App. If you choose not to use the App or no longer wish to use it, you may delete the App from your mobile device at any time. Deleting the App will not affect the data transmitted to or stored in Merlin.net HF by your Healthcare Provider, and your Healthcare Provider will continue to be able to monitor your CardioMEMS™ HF System remotely. Deleting the App will also not affect your App account.

To terminate your App account or delete your personal information, you can use the account-deletion function in the App (where provided) or contact Abbott Technical Services at myCardioMEMS@abbott.com or your Abbott representative. You may also exercise your right to request deletion of your personal information using any of the contact methods set out in +Contact Us. Please be aware that any personal information that you have previously downloaded to your mobile device or have sent to a third party will not be deleted if you delete the App. If you delete your personal information in the App, Abbott will retain aggregated, pseudonymized, and anonymized information and may need

to retain certain personal information as required by law (such as for medical device regulatory compliance).

+Contact Us

If you have questions, concerns or complaints about the processing of your personal information for the purpose of your medical care or wish to exercise your data protection rights, please contact your Healthcare Provider directly.

If you have questions, comments, or complaints about our privacy practices, including in connection with the App and/or the Services, please contact us by clicking on the “Contact Us” link in one of our websites or emailing us at privacy@abbott.com. Alternatively, you may write to us at:

Attn: Privacy Officer, Abbott, One St. Jude Medical Drive, St. Paul, MN 55117, USA

In all communications to us, please include the email address used to register for the App and a detailed explanation of your request.

+Changes to this Privacy Notice

This Privacy Notice is kept under regular review. If we make material changes to our privacy practices, an updated version of this Privacy Notice will reflect those changes. You will be alerted to updates to this Privacy Notice by email or the App when you next use the App.

Without prejudice to your rights under applicable law, we reserve the right to update and amend this Privacy Notice without prior notice to reflect technological advancements, legal and regulatory changes and good business practices to the extent that it does not change the privacy practices as set out in this Privacy Notice.

+COUNTRY SPECIFIC PROVISIONS

+Saudi Arabia (KSA)

In accordance with Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H and amended by Royal Decree No. (M/148) dated 5/9/1444H ("PDPL"), the Implementing Regulations of the Personal Data Protection Law, issued by SDAIA, 7 September 2023 (the “Implementing Regulations”), and the Regulations on Personal Data Transfers outside of the Kingdom, your explicit and individual consent is required for Abbott to process your personal information. By accepting or agreeing to this Privacy Notice, you are deemed to have been informed of and have explicitly consented to all of the contents herein. This Privacy Notice sets out information on the collection, use, disclosure to third parties, outsourcing of the processing, and cross-border transfer of your personal information, including health-related information (which is classified as sensitive data under the PDPL), by Abbott, in connection with the provision of the App and the Services. It also includes limited information about Abbott’s role as processor where Abbott provides Merlin.net HF and related support services to your healthcare provider or clinic.

Abbott acts as an independent controller of your personal data for the purposes described in this section, including: providing and operating the App; providing technical support; complying with medical device legal obligations; conducting research; sending marketing communications; and product development and improvement.

The Controller of your personal data for purposes of this Privacy Notice under the PDPL is Abbott S.A. ,

P.O. Box 8897, Jeddah, 21492, Saudi Arabia and privacy@abbott.com.

Data Protection Officer: The contact details of our Saudi Arabia data protection officer along with other useful contact information are available at www.eu-dpo.abbott.com.

We process your personal information as a processor when providing our services to your Healthcare Provider and may have access to your health data to provide your Healthcare Provider with technical and customer support.

Legal basis for the processing of your personal information: Abbott processes your personal information, including your health-related personal information on the basis of your relevant, explicit, informed and voluntary consents as well as the following:

• Merlin.net HF and related support services as necessary so that your Healthcare Provider can provide a better service or benefit to you (including, without limitation, for remote monitoring, transmitting messages, medication notifications);
• so that your healthcare provider can provide medical care, including on-going medical treatment by monitoring your condition;
• medical device post-market surveillance, quality management, safety, performance, and vigilance;
• providing technical support and operating the App; and
• product development and improvement of the App, the Services and the CardioMEMS TM HF System.

For more information, see the +Research section. For sake of clarity, anonymisation is the removal of all direct and indirect identifiers that indicate your identity in a way that permanently makes it impossible to identify the Data Subject.

In accordance with the requirements under the PDPL and specifically Article 26 of the Implementing Regulations, both Abbott and your Healthcare Provider have taken the appropriate organisational, technical and administrative measures to protect your Health Data from any unauthorised use, misuse, use for purposes other than for which it was collected, or breach, and any procedures or means that guarantee the preservation of the privacy of its owners; and it has adopted and implemented the requirements and controls issued by the Ministry of Health, the Saudi Health Council, the Saudi Central Bank, the Council of Health Insurance, and other related entities involved in regulating Health Services and health insurance services, that specify the tasks and responsibilities of employees of health care providers, health insurance companies, health insurance claims management companies and those which are contracted by them carrying out the processing of the health data. Abbott limits health data processing to the minimum necessary to provide the Services and to comply with its legal obligations.

In addition to the rights set out in the section entitled +How Individual Users Can Access and Correct Personal Information and Your Rights, you have a right to request that your personal information be provided to you in a readable and clear format, you have the right to request correction of inaccurate or incomplete personal data, you have the have the right to request destruction of your personal data if it is no longer necessary to achieve the purpose for which it was collected, you have the right to obtain from us a restriction of processing when you are contesting the accuracy of your personal data and you have the right to lodge a complaint (within ninety days of your coming to know of any breach) with your local data protection authority (the Saudi Data and AI Authority) via the National Data Governance Platform (dgp.sdaia.gov.sa) if you have concerns with Abbott’s processing of your personal information. You also have a right to withdraw your consent for the processing of personal information at any time by contacting your Healthcare Provider. Please be aware that if you withdraw consent, it will affect your Healthcare Provider’s ability to see the personal information you submit in the App and may affect your treatment and the Services. If you withdraw your consent, Abbott may retain aggregated and de-identified (anonymised data) information and may need to retain certain personal information as required by law. Where we have de-identified, pseudonymised, aggregated and/or anonymised data from your personal data on Merlin.net HF, we will not attempt to re-identify any individuals from anonymised data.. Please note that either Abbott or your Healthcare Provider may request any necessary supporting documents or evidence to verify the request for update, correction, or complete the personal data.

Data transfers: Information collected via the Services will be transferred to and stored in the United States of America. If you request technical support your personal information (including health-related data) will be accessible by our remote care teams in the United States of America or Belgium (or other European locations). Your personal data will be transferred on the basis of Saudi Arabia Standard Contractual Clauses.

If your personal data is transferred outside the Kingdom of Saudi Arabia to the United States of America or Belgium (or other European location), your Healthcare Provider and Abbott will ensure that such transfers are carried out in accordance with applicable data protection laws and are subject to appropriate safeguards and transfer mechanisms.

In addition to the information under +Retention of Personal Information, please note that upon the expiration of the retention period or upon fulfilment of the purpose for which your personal information was collected (whichever is later), we will securely destroy your personal information using industry-standard techniques. These destruction methods render your personal information permanently irrecoverable and inaccessible.

+Kuwait

Kuwait does not currently have a single, comprehensive data protection statute. Instead, the collection, processing, disclosure and cross-border transfer of your personal information, including health-related information, by Abbott in connection with the App and the Services is governed primarily by Law No. 20 of 2014 Regarding Electronic Transactions (the "E-Transactions Law") and its Executive Regulations issued under Decision No. 48 of 2014, together with Law No. 63 of 2015 Regarding Combating Information Technology Crimes (the "Cybercrime Law") and, in relation to the confidentiality of health information handled by your Healthcare Provider, Law No. 70 of 2020 on the Practice of the Medical and Paramedical Professions and the Rights of Patients and Health Facilities. By accepting or agreeing to this Privacy Notice, you confirm that you have been informed of, and consent to, the processing of your personal information, including health-related information, as described in this Privacy Notice and this section.

This Privacy Notice sets out information on the collection, use, disclosure to third parties, outsourcing of the processing, and cross-border transfer of your personal information, including health-related information, by Abbott, in connection with the provision of the App and the Services. It also includes limited information about Abbott’s role as processor where Abbott provides Merlin.net HF and related support services to your Healthcare Provider or clinic.

Abbott acts as an independent controller of your personal information for the purposes described in this section, including: providing and operating the App; providing technical support; complying with medical device legal obligations; conducting research; sending marketing communications; and product development and improvement.

The Controller of your personal information for purposes of this Privacy Notice is St Jude Medical Middle East DMCC, ONE JLT Tower Jumeirah Lakes Towers Level 1, First Al Khail Street, DMCC Free Zone Office 102, Dubai, United Arab Emirates and privacy@abbott.com.Data Protection Officer: The contact details of our data protection officer along with other useful contact information are available at www.eu-dpo.abbott.com.

We process your personal information as a processor when providing our services to your Healthcare Provider and may have access to your health data to provide your Healthcare Provider with technical and customer support.

Legal basis for the processing of your personal information: Abbott processes your personal information, including your health-related personal information, on the basis of your consent, given in accordance with Article 32 of the E-Transactions Law, as well as the following purposes:

• Merlin.net HF and related support services as necessary so that your Healthcare Provider can provide a better service or benefit to you (including, without limitation, for remote monitoring, transmitting messages, medication notifications);
• so that your Healthcare Provider can provide medical care, including on-going medical treatment by monitoring your condition;
• medical device post-market surveillance, quality management, safety, performance, and vigilance;
• providing technical support and operating the App; and
• product development and improvement of the App, the Services and the CardioMEMS™ HF System.

For more information, see the +Research section. For the sake of clarity, anonymisation is the removal of all direct and indirect identifiers that indicate your identity in a way that permanently makes it impossible to identify you.

Abbott and your Healthcare Provider have implemented appropriate organisational, technical and administrative measures to protect your personal information, including health-related information, from unauthorised access, use, disclosure, alteration, loss or destruction, consistent with the security obligations under Article 35 of the E-Transactions Law and its Executive Regulations. Abbott limits the processing of health-related information to the minimum necessary to provide the Services and to comply with its legal obligations.

In addition to the rights set out in the section entitled +How Individual Users Can Access and Correct Personal Information and Your Rights, under the E-Transactions Law you have the right to: (a) request access to, and a record of, the personal information we hold about you; (b) request correction or updating of any inaccurate or outdated personal information we hold about you; and (c) request deletion of your personal information, subject to Abbott's ability to retain information as required by applicable law. You also have the right to withdraw your consent for the processing of your personal information at any time by contacting your Healthcare Provider or Abbott using the details in +Contact Us. Please be aware that if you withdraw consent, it will affect your Healthcare Provider's ability to see the personal information you submit in the App and may affect your treatment and the Services. If you withdraw your consent, Abbott may retain aggregated and de-identified (anonymised) information and may need to retain certain personal information as required by law. Where we have de-identified, pseudonymised, aggregated and/or anonymised information from your personal information on Merlin.net HF, we will not attempt to re-identify any individuals from anonymised data. Abbott or your Healthcare Provider may request supporting documents or evidence to verify your request before update, correction or deletion is completed.

If you have concerns about Abbott's processing of your personal information that cannot be resolved by contacting us directly, you may raise a complaint with the competent Kuwaiti authorities, including the Communication and Information Technology Regulatory Authority (CITRA) or, in relation to unlawful access, disclosure or misuse of your personal information, the Electronic and Cyber Crime Combating Department of the Ministry of Interior.

Data transfers: Information collected via the Services will be transferred to and stored in the United States of America. If you request technical support, your personal information (including health-related data) will be accessible by our remote care teams in the United States of America or Belgium (or other European location). Where your personal information is transferred outside Kuwait, Abbott will inform you of the transfer and will ensure that appropriate contractual and technical safeguards are in place so that your personal information continues to benefit from a level of protection consistent with the E-Transactions Law, before any such transfer takes place.

In addition to the information under +Retention of Personal Information, please note that upon the expiration of the retention period or upon fulfilment of the purpose for which your personal information was collected (whichever is later), we will securely destroy your personal information using industry-standard techniques. These destruction methods render your personal information permanently irrecoverable and inaccessible.

+Qatar

This section applies if you are located in the State of Qatar, in addition to the rest of this Privacy Notice. The processing of your personal information in connection with Merlin.net is subject to Law No. (13) of 2016 Concerning Personal Data Privacy Protection (“PDPPL”), administered by the competent department of the National Cyber Security Agency (“NCSA”). Information about your health, physical or psychological condition, and personal information relating to children, is “personal data of a special nature” under Article 16 of the PDPPL and requires the prior permission of the NCSA to process such data.

For the purposes of the PDPPL, the full name and address of the controller is St Jude Medical Middle East DMCC, ONE JLT Tower Jumeirah Lakes Towers Level 1, First Al Khail Street, DMCC Free Zone Office 102, Dubai, United Arab Emirates.

Withdrawal of consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Following withdrawal, Abbott shall not retain any personal data for a period of time that exceeds the necessary period for achieving the purpose.

In addition to the rights described under +How Individual Users Can Access and Correct Personal Information and Your Rights, you have the right under Articles 5 and 6 of the PDPPL to: (a) withdraw consent at any time; (b) object to processing that is not necessary for the purposes for which your personal information was collected, or that is excessive, discriminatory, unfair or unlawful; (c) request the erasure of your personal information in those cases, or where the purpose for which it was collected has ended or there is no longer any justification for retaining it; (d) request the correction of inaccurate or incomplete personal information, accompanied by evidence supporting the correction; (e) be notified of how your personal information is processed and for what purposes; (f) be notified of any disclosure of inaccurate personal information; and (g) obtain a copy of your personal information, for which Abbott may charge an amount that shall not exceed the service charge.

Complaints. Patients may lodge a complaint with the NCSA through www.ncsa.gov.qa if they consider that their personal information has been processed in breach of the PDPPL.

International transfers. The PDPPL permits the transfer of personal information outside the State of Qatar provided that the processing complies with the PDPPL and would not cause serious damage to the patients or to the patient’s personal information.

Retention. Abbott retains personal information for no longer than is necessary for the purposes for which it was collected, or as required by applicable law.

Children. The App is intended for adults (persons aged 18 or over). Where a child uses the App with a Healthcare Provider’s approval, Abbott will process the child’s personal information only with the explicit consent of the child’s parent or legal guardian. A parent or legal guardian may, after verification of their identity and relationship to the child, request a description and a copy of the child’s personal information and request that its processing be stopped or that it be deleted.

+United Arab Emirates (“UAE”)

Abbott has incorporated appropriate safeguards within its contracts with parties (including Abbott affiliates) located outside of the UAE with whom it may share your personal data as described within this Privacy Notice (see +Data Storage, +Disclosure of Personal Information by Us, and +Cross-Border Transfers of Personal Information) to ensure that your personal data is processed in line Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data. [Abbott also separately secures your consent for such international transfers.]

If and to the extent to which Abbott requires your consent to perform processing activities which we perform as controller (see +Abbott’s Own Use of Your Personal Information), we secure that consent separately.

Where Abbott relies upon your consent to process your personal information you can revoke your consent at any time, but this may impact your ability to continue to use our Services.

For the purposes of the applicable health data legislation, Abbott relies upon various exceptions to lawfully transfer your health information outside of the UAE, such as, entering into an agreement with your Healthcare Provider for processing of your health data as well as your consent, and in relation to provision of remote services where your Healthcare Provider can access your health information via the App and transfer it into their electronic health record systems, as necessary, for them to provide you medical care.

+ Definition of “Abbott”

For the purposes of this Privacy Notice, Abbott means Your local Abbott affiliated company as below:

For technical support, please contact the local Abbott affiliated company as listed in the table above.

END OF PRIVACY NOTICE – THIS PRIVACY NOTICE IS FOR THE PURPOSE OF DISCLOSING TO YOU HOW YOUR PERSONAL DATA IS USED AND PROCESSED BY ABBOTT. IT IS NOT AN AGREEMENT AND DOES NOT FORM PART OF THE END USER LICENSE AGREEMENT THAT FOLLOWS.