CardioGuide™ HF App

AUSTRALIA PRIVACY NOTICE

Version Date: August 7, 2026

Abbott Laboratories provides the CardioGuide™ HF mobile application (“App”) for the CardioMEMS™ HF System (a wireless sensor implanted in your pulmonary artery that measures your PA pressure and heart rate). In this Privacy Notice, “Abbott,” “we,” “us,” and “our” refer to Abbott Laboratories. By registering for and using the App or accepting the terms of the End User License Agreement for the App, you confirm that you have read, understand, and acknowledge the terms of this Privacy Notice. This Privacy Notice is not a contract and does not create any legal rights or obligations.

We recognize the importance of data protection and privacy and are committed to protecting personal information, including health-related information. Please read this Privacy Notice carefully before registering to use the App as it applies to the processing, transfer, and retention of your personal information, including health-related data, by Abbott and certain affiliated companies and processors in connection with the App as described below. It also includes limited information about how the App interacts with Merlin.net HF (described below) so that you can understand the relationship between Abbott and your clinic, doctor, or health care professional (your “Healthcare Provider”).

This Privacy Notice does not apply to personal information processed or collected by other Abbott affiliates or subsidiaries or via other methods, such as other Abbott websites and other Abbott customer call centers. As explained below, it also does not apply to our processing of personal information to support your Healthcare Provider or your Healthcare Provider’s use of Merlin.net HF to provide medical care.

+About the App and Merlin.net HF

The App relates to your use of the CardioMEMS™ HF System. Abbott is the manufacturer of the CardioMEMS™ HF System, which is indicated for wirelessly measuring and monitoring pulmonary artery (PA) pressure and heart rate in heart failure patients. The CardioMEMS™ HF System transmits information to your Healthcare Provider via the Merlin.net™ Patient Care Network for Heart Failure (“Merlin.net HF”), a cloud-based remote care system that holds information about your CardioMEMS™ HF System and heart condition. For example, your Healthcare Provider uses Merlin.net HF to monitor your PA pressure and heart rate. You may learn more about how your Healthcare Provider and Abbott use personal information collected through Merlin.net HF at https://www.cardiovascular.abbott/us/en/policies/hf-policies.html.

The App also is designed to exchange information with Merlin.net HF in connection with your CardioMEMS™ HF System and heart condition. You may submit information through the App that is transmitted to Merlin.net HF so your Healthcare Provider can view it. The App allows patients to receive daily medication and reading reminders, submit journal entries and other information, and see CardioMEMS™ HF System readings. Your Healthcare Provider can also communicate with you through the App, including by providing custom messages and treatment instructions, medication adjustments and other information.

+Collection of Your Personal Information

To register to use the App, you will need to enter some of your personal information, such as your date of birth, CardioMEMS™ HF System serial number, email address, and telephone number. Before you can use the App, your Healthcare Provider must also register you on Merlin.net HF.

After you have registered to use the App, you will be prompted to allow push notifications. You must enable these notifications if you want to receive messages and medication change notifications from your Healthcare Provider through the App. The App also enables you to receive medication notifications and CardioMEMS™ HF System historical pulmonary artery pressure readings and other information you provide to the App. Please keep “notifications on to receive status updates and reminders. You may also use the App to submit information, such as blood pressure and weight, which will be communicated to your Healthcare Provider.
To submit or receive information through the App, you must keep your mobile device connected to WiFi or to cellular/mobile data.

We (and our service providers) collect and store the following personal information and use it for typical business purposes (including security and anti-fraud purposes), as described more specifically below, and where required by law, we will rely on consent (including implied consent) as a basis for processing your personal information. We have provided examples of how we use these categories of information in this section. Read +Disclosure of Personal Information for a full list of purposes and for more details.

• Identifiers. We may collect and use personal identifiers, such as your full name, date of birth, email address, and/or phone number, to provide, operate, and improve the App, for security and anti-fraud purposes, to keep records when you contact us directly, as additionally described in this Privacy Notice, and for purposes related to our legal rights and responsibilities.
• Internet or Other Electronic Network Activity Information. We and our service providers collect and use Internet and other network activity information, such as your App preferences and settings; and information and analytics about the App performance and usage, including crash reports, to provide, operate, and improve the App, as additionally described in this Privacy Notice, and for purposes related to our legal rights and responsibilities.
• Sensitive Personal Information.
  • We collect and use your account log-in and password to provide and operate the App and for security and anti-fraud purposes.
  • We also collect information concerning your health, including the data elements listed below. This information is usually processed on behalf of your Healthcare Provider and based on its instructions to support their monitoring and treatment activities and to operate the App, but we may process this information for our own purposes, such as in accordance with applicable law (including laws applicable to medical devices, for research purposes (with your consent, if required), and for purposes related to our legal rights and responsibilities.
    • CardioMEMS™ HF System serial number;
    • PA pressure readings from your CardioMEMS™ HF System;
    • PA pressure goals and thresholds from your Healthcare Provider;
    • systemic blood pressure readings and body weight (provided by you manually or automatically when you allow a mobile health data platform to share data with the App such as Apple Health);
    • medication list from your Healthcare Provider;
    • treatment plans from your Healthcare Provider;
    • messages from your Healthcare Provider, such as a proposed change in medication;
    • messages to remind you to take a PA pressure reading and/or to take medication;
    • acknowledgements of receipt of messages and medication change notifications; and
    • other information from Merlin.net HF your Healthcare Provider chooses to share with you.

The App also may receive personal information from a mobile health data platform, such as Apple Health, when you consent to that sharing. For example, you may choose to share systemic blood pressure and weight information you store in a mobile health data platform with the App. You are not required to share personal information with the App from such mobile health data platforms, and you may choose the personal information shared and/or withdraw your consent for the sharing at any time by changing the settings in the relevant platform or on your mobile device. Any withdrawal of consent for sharing will not affect processing of information already shared with the App based on your consent. Abbott will process information shared via a mobile health data platform only for the purposes described
in this Privacy Notice and, where applicable, in accordance with the permissions you select in the relevant application or device settings.

Some other personal information, such as account registration details, your CardioMEMS HF System serial number, and information needed to transmit and receive information through the App, is required to provide services through the App. If you do not provide required information, Abbott may not be able to provide the App or certain App features and services.

+Abbott’s Use of Your Personal Information

In addition to the processing that Abbott does based on your Healthcare Provider’s instructions, Abbott processes your personal information, including your health-related personal information, for the following purposes:

• to provide and operate the App in accordance with the App End User License Agreement, including administering App registration, login/authentication, App functionality and App security;
• to keep a record of your contact with Abbott when you contact Abbott directly regarding the App or related services;
• where required by applicable laws governing the use and classification of medical devices, including for the purposes of medical device post-market surveillance, quality management, including product development and improvement, safety, performance, and vigilance;
• to contact you for operational purposes through the App notifications, email, or by phone messaging (e.g., SMS messaging), with your consent where required by applicable law;
• for other purposes with your consent;
• where necessary to establish, exercise or defend legal claims; and
• as otherwise required by applicable law.

De-identified, Aggregated, and/or Anonymized Information. Where permitted by applicable law and subject to relevant contracts with Healthcare Providers and/or your consent, we may use personal information to create de-identified, aggregated, and/or anonymized information, and we may share such information with third parties for any lawful purpose. for example, we may share such information with our affiliates, Healthcare Providers, third party researchers and national health authorities or insurers to demonstrate the effectiveness of the App, Merlin.net HF, our medical devices or related services, or as required for medical reimbursement. Where prohibited by law, we will not attempt to re-identify de-identified information except to ensure our de-identification methods are satisfactory.

Abbott may use de-identified, aggregated, and/or anonymized data for Abbott’s business purposes in accordance with applicable law and with your consent when required by applicable law. Such uses may include developing and improving Abbott’s products and services (such as algorithms and modern technologies like artificial intelligence and machine learning), analyzing how Abbott’s products and services are used, operate, and correlate to certain results and outcomes (for example, by different age groups or other demographics), research and development as further described below, reporting to Healthcare Providers, and as otherwise permitted by applicable law.

Research and Statistical Analysis. In accordance with applicable law (including with de-identified or aggregated data and/or your consent, as required by applicable law), Abbott will conduct research and statistical analysis for the following purposes:

• to evaluate and improve the quality, security and effectiveness of the App, Merlin.net HF, and our cardiac and medical devices and systems and to allow for the development of innovative and effective treatment of heart-related conditions in the interests of public health;
• to validate the App’s and Merlin.net HF’s functionality and upgrades, including monitoring and
  improving the safety and security of such services;
• to research, develop and test medical devices, including new and existing features and functionality and to test and improve the App, Merlin.net HF and our medical devices for product development, data analysis, statistical and survey purposes;
• to conduct real-world evidence studies; and
• for public interest in the area of public health, including where the App, Merlin.net HF and medical devices are eligible for medical reimbursement or other funding.

Data used in research may include any of the health information collected in the App, such as the CardioMEMS™ HF System serial number, intervals between implant date and subsequent visit dates, implant date, and demographics such as place of residence and age. We conduct this research and statistical analysis using de-identified or aggregated information where possible. Where these activities require the use of personal information that has not been de-identified or aggregated, Abbott will request consent where required by applicable law.

Where your consent is legally required for Abbott to process health-related personal information for a specific research activity, you can withdraw that consent at any time by contacting us. Any withdrawal of consent will not affect processing based on your consent before the withdrawal. If you withdraw consent, Abbott will stop the processing for which your consent is legally required. Abbott may continue processing your personal information in order to meet its legal obligations or for other purposes where your consent is not legally required.

This Privacy Notice does not apply to research that is part of a clinical trial or as instructed by a Healthcare Provider. Where required by applicable law, you will be asked to provide a separate informed consent to the research site prior to participating in a clinical trial sponsored by Abbott.

Please note that we will also use personal information the App collects as instructed by your Healthcare Provider in our role as a “business associate” to your Healthcare Provider. Such use is not subject to this Privacy Notice.

+Disclosure of Personal Information

We may share your personal information as follows:

• We share personal information with third-party suppliers to provide, maintain, host, and support the App, Merlin.net HF and related services.
• We may sell or purchase assets during the normal course of our business. If another entity acquires or intends to acquire us or any of our assets, information we have collected about you may be transferred to such entity. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, such information may be considered an asset of ours and may be sold or transferred to other parties.
• We reserve the right to disclose your personal information to comply with the law and respond to authorized information requests from government authorities, to address national security situations, or when otherwise required by law. Furthermore, where permitted or required by law, we may also disclose the information we collect from you where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of this Privacy Notice, or as evidence in litigation in which we are involved. Your personal information may be subject to foreign laws and may be accessible by foreign governments, courts, law enforcement, and regulatory agencies.
• We may disclose personal information for the research and statistical analysis purposes described above where the information cannot be de-identified or aggregated in accordance with applicable law (including with your consent, if required by applicable law).

Please note that we will share personal information the App collects with your Healthcare Provider and as instructed by your Healthcare Provider in our role as a “business associate” to your Healthcare Provider. Such sharing is not subject to this Privacy Notice.

+ Retention of Personal Information

Personal information will be retained for as long as necessary for the purposes described in this Privacy Notice, including to provide the App and related services, maintain security, respond to support requests, comply with legal obligations, resolve disputes, and establish, exercise or defend legal claims. The retention of personal information we retain on behalf of your Healthcare Provider is subject to applicable law and contracts with your Healthcare Provider.

+Security of Personal Information

Abbott has implemented security controls within App and Merlin.net HF to help protect your personal information from accidental or unlawful destruction or accidental loss, alteration, disclosure, or access. We cannot, however, be responsible for Internet communications that are inherently not completely secure.

Please be aware that the App and Merlin.net HF may be unavailable during periods of routine maintenance.

+How Abbott Uses Personal Information for Sending Marketing and Other Material

We will not knowingly send you advertising or marketing-related information, unless you have opted into receiving these types of communications from us in relation to our other products and services.

Neither Abbott nor its affiliates or licensors will knowingly send advertising or marketing-related information to children.

We do not sell your personal information for money or other consideration.

Please note that we may send you non-marketing related information about necessary App and service updates or issues relating to product safety.

+How Abbott Protects Children’s Privacy

The App and related services are intended to be used by adults or, where permitted, by a parent or legal guardian on behalf of a child. Children can be enrolled in Merlin.net HF by a Healthcare Provider. If you are the parent of a child enrolled in Merlin.net HF, contact your child’s Healthcare Provider for questions related to the processing of your child’s information.

+Information for Australian patients

If you are located in Australia, this section applies to you in addition to the rest of this Privacy Notice.

Abbott collects, uses, and discloses your personal information in accordance with the Privacy Act 1988 (Cth) (“Australian Privacy Act”) and the Australian Privacy Principles (“APPs”). Health information processed through the App may also be subject to applicable state and territory health privacy legislation.
To the extent of any inconsistency between this section and the rest of this Privacy Notice, this section prevails for Australian patients.

Processor/controller distinction

Australia does not recognise a ‘controller/processor’ distinction. Where we collect, hold, use and disclose your personal information, we will comply with our obligations under the Australia Privacy Act and APPs to the extent they apply, irrespective of our role as controller or processor under other laws. However, where we are described as a ‘processor’, third parties who are ‘controllers’ under the laws of
other jurisdictions may also have obligations to you under the Australian Privacy Act or APPs as well, as they collect or direct us in our handling of that personal information in that context.

Grounds for collection, use, and disclosure of personal information

Abbott collects, uses, and discloses personal information (including health information) for the purposes described in this Privacy Notice, and where necessary, relies on the following grounds under Australian law as appropriate: (a) with the individual’s consent; (b) where necessary to provide a health service to the individual; (c) where required or authorized by or under an Australian law or a court or tribunal order; or (d) for research, or the compilation or analysis of statistics, relevant to public health or public safety, in accordance with guidelines issued by the Australian Information Commissioner.

If a patient does not provide personal information (including name, email address, and telephone number) to Abbott, Abbott will be unable to create a user account in the App for that patient, and the patient will be unable to access and use the App and its associated services.

Consent for collection of health information
Health information (including information about cardiac devices, diagnoses, conditions, medications, and hospitalizations) is sensitive information under the Australian Privacy Act. Where consent is required under applicable law, by uploading or authorizing the upload of health information to the App (as applicable), patients consent to Abbott collecting, using, and disclosing their health information for the purposes described in this Privacy Notice. Where collection, use, or disclosure is undertaken on another ground permitted under applicable law, Abbott may rely on that ground instead of consent.
Consent may be withdrawn at any time as described in this Privacy Notice, subject to any overriding legal obligations, but please be aware that if you withdraw consent, we may not be able to provide the App (or all of the features of the App) to you.

Overseas Disclosure and Cross-Border Data Transfers

Abbott is likely to disclose personal information to overseas recipients, including Abbott affiliates and third-party service providers in the Asia-pacific region, the European Economic Area, the United Kingdom and the United States of America.

Retention periods

Abbott retains personal information for as long as necessary to fulfil the purposes described in this Privacy Notice and to comply with applicable legal requirements including under applicable state and territory health records legislation and relevant professional standards. Following the expiry of applicable retention periods, personal information will be de-identified or securely destroyed.

Access or Correction Requests
Under the Australian Privacy Act and applicable state health privacy laws, you have the right to: (a) request access to personal information (including health information) that Abbott holds about you; and
(b) request correction of personal information that Abbott holds about you that is inaccurate, out of date, incomplete, irrelevant, or misleading. To make an access or correction request, please contact Abbott using the details in Contact Us (Australia Patients) below. Abbott will respond to access and correction requests within a reasonable time and in accordance with the Australian Privacy Act. Abbott may charge a reasonable fee for providing access to personal information but will not charge a fee for the making of a request.

Complaints (Australian Patients)
If you have a concern or complaint about the way Abbott has handled your personal information in connection with the App, you may contact Abbott in the first instance using the details in Contact Us (Australia Patients) below. Abbott will acknowledge your complaint promptly, investigate it, and respond to you within 30 days (or such longer period as agreed with you in writing).
If you are not satisfied with Abbott’s response to your complaint, or if Abbott fails to respond within a
reasonable time, you may lodge a complaint with the relevant regulatory body, as follows, including:

Office of the Australian Information Commissioner (“OAIC”) for complaints relating to a breach of the Australian Privacy Act or the APPs at www.oaic.gov.au or by telephone on 1300 363 992;

Health Complaints Commissioner (Victoria) for complaints relating to health information handled by a health service provider in Victoria under the Health Records Act 2001 (Vic) at www.hcc.vic.gov.au or by telephone on 1300 582 113;

Information and Privacy Commission NSW for complaints relating to health information handled by a health service provider in New South Wales (“NSW”) under the Health Records and Information Privacy Act 2002 (NSW) at www.ipc.nsw.gov.au or by telephone on 1800 472 679; and

ACT Human Rights Commission for complaints relating to the handling of health records in the Australian Capital Territory under the Health Records (Privacy and Access) Act 1997 (ACT), at https://www.hrc.act.gov.au.

Contact Us (Australian Patients)
Abbott is responsible for the collection, use, and disclosure of personal information described in this Privacy Notice. For all privacy enquiries from patients in Australia, Abbott can be contacted by email at privacy@abbott.com.

+Contact Us

If you have questions, comments, or complaints about our privacy practices, including in connection with the App and/or related services, please contact us by clicking on the “Contact Us” link in one of our websites or emailing us at privacy@abbott.com. Alternatively, you may write to us at:

Attn: Abbott Medical Device Privacy Officer, 100 Abbott Park Road, Dept. O36X. Bldg. APo6A, Abbott Park, IL 60064In all communications to us, please include the email address used to register for the App and a detailed explanation of your request.

If you have questions, concerns or complaints about the processing of your personal information for the purpose of your medical care or wish to exercise your privacy rights related to your health care data, please contact your Healthcare Provider directly.

+Changes to this Privacy Notice

This Privacy Notice is kept under regular review. If we make material changes to our privacy practices, an updated version of this Privacy Notice will reflect those changes. You will be alerted to updates to this Privacy Notice by email or the App when you next use the App.

Without prejudice to your rights under applicable law, we reserve the right to update and amend this Privacy Notice without prior notice to reflect technological advancements, legal and regulatory changes and good business practices to the extent that it does not change the privacy practices as set out in this Privacy Notice.

+Definition of “Abbott”

For the purposes of this Privacy Notice, Abott means Your local Abbott affiliated company as below:

Abbott Australasia Pty Ltd
299 Lane Cove Road
Macquarie Park, NSW 2113
Australia