CardioGuide™ HF App
U.S. PRIVACY NOTICE
Version Date: August 7, 2026

Abbott Laboratories provides the CardioGuide™ HF mobile application (“App”) for the CardioMEMS™ HF System (a wireless sensor implanted in your pulmonary artery that measures your PA pressure and heart rate). In this Privacy Notice, “Abbott,” “we,” “us,” and “our” refer to Abbott Laboratories. By registering for and using the App or accepting the terms of the End User License Agreement for the App, you confirm that you have read, understand, and acknowledge the terms of this Privacy Notice. This Privacy Notice is not a contract and does not create any legal rights or obligations.

We recognize the importance of data protection and privacy and are committed to protecting personal information, including health-related information. Please read this Privacy Notice carefully before registering to use the App as it applies to the processing, transfer, and retention of your personal information, including health-related data, by Abbott and certain affiliated companies and processors in connection with the App as described below. It also includes limited information about how the App interacts with Merlin.net HF (described below) so that you can understand the relationship between Abbott and your clinic, doctor, or health care professional (your “Healthcare Provider”).

This Privacy Notice does not apply to personal information processed or collected by other Abbott affiliates or subsidiaries or via other methods, such as other Abbott websites and other Abbott customer call centers. As explained below, it also does not apply to our processing of personal information to support your Healthcare Provider or your Healthcare Provider’s use of Merlin.net HF to provide medical care.

+About the App and Merlin.net HF

The App relates to your use of the CardioMEMS™ HF System. Abbott is the manufacturer of the CardioMEMS™ HF System, which is indicated for wirelessly measuring and monitoring pulmonary artery (PA) pressure and heart rate in heart failure patients. The CardioMEMS™ HF System transmits information to your Healthcare Provider via the Merlin.net™ Patient Care Network for Heart Failure (“Merlin.net HF”), a cloud-based remote care system that holds information about your CardioMEMS™ HF System and heart condition. For example, your Healthcare Provider uses Merlin.net HF to monitor your PA pressure and heart rate.

The App also is designed to exchange information with Merlin.net HF in connection with your CardioMEMS™ HF System and heart condition. You may submit information through the App that is transmitted to Merlin.net HF so your Healthcare Provider can view it. The App allows patients to receive daily medication and reading reminders, submit journal entries and other information, and see CardioMEMS™ HF System readings. Your Healthcare Provider can also communicate with you through the App, including by providing custom messages and treatment instructions, medication adjustments and other information.

Most Uses and Disclosures of Information Displayed and Collected Through the App Are Subject to HIPAA And Your Healthcare Provider’s Instructions

Abbott generally processes personal information in the App and Merlin.net HF as your Healthcare Provider’s “business associate” regulated by the Health Insurance Portability and Accountability Act (“HIPAA”) to support your Healthcare Provider’s monitoring and treatment activities. Our processing is subject to and controlled by instructions from your Healthcare Provider and not this Privacy Notice. If you have questions about how your Healthcare Provider processes your personal information, ask your Healthcare Provider for a copy of their notice of privacy practices. You may learn more about how your Healthcare Provider and Abbott use personal information collected through Merlin.net HF at https://www.cardiovascular.abbott/us/en/policies/hf-policies.html.

Other Privacy Laws Apply when HIPAA Does Not Apply

While most of the processing of your information is governed by HIPAA and the instructions from your Healthcare Provider, Abbott collects and uses certain personal information for its own purposes and activities. Examples include administration of the App and meeting Abbott’s legal responsibilities. These purposes and activities are described in +Abbott’s Use of Your Personal Information and +Disclosure of Personal Information. In these instances, Abbott’s processing of your information will be subject to other laws depending on where patients reside, including privacy laws in specific states. Abbott is considered a “business” under the California Consumer Privacy Act and a “controller” under other state privacy laws with respect to this processing. Some of those state privacy laws require additional notices as listed below.

If you are a California Resident, see +Information for California Residents for information provided pursuant to the California Consumer Privacy Act and +Information for Other U.S. Residents for residents of other states that have consumer privacy laws. For clarity, the +Information for California Residents section and +Information for Other U.S. Residents do not apply where HIPAA applies.

Click here to view the Abbott Consumer Health Data Privacy Policy. Note that the Consumer Health Data Privacy Policy does not apply where HIPAA applies.

+Collection of Your Personal Information

To register to use the App, you will need to enter some of your personal information, such as your date of birth, CardioMEMS™ HF System serial number, email address, and telephone number. Before you can use the App, your Healthcare Provider must also register you on Merlin.net HF.

After you have registered to use the App, you will be prompted to allow push notifications. You must enable these notifications if you want to receive messages and medication change notifications from your Healthcare Provider through the App. The App also enables you to receive medication notifications and CardioMEMS™ HF System historical pulmonary artery pressure readings and other information you provide to the App. Please keep “notifications on to receive status updates and reminders. You may also use the App to submit information, such as blood pressure and weight, which will be communicated to your Healthcare Provider.

To submit or receive information through the App, you must keep your mobile device connected to WiFi or to cellular/mobile data.

We (and our service providers) collect and store the following personal information and use it for typical business purposes (including security and anti-fraud purposes), as described more specifically below, and where required by law, we will rely on consent (including implied consent) as a basis for processing your personal information. We have provided examples of how we use these categories of information in this section. Read +Disclosure of Personal Information for a full list of purposes and for more details.

Identifiers. We may collect and use personal identifiers, such as your full name, date of birth, email address, and/or phone number, to provide, operate, and improve the App, for security and anti-fraud purposes, to keep records when you contact us directly, as additionally described in this Privacy Notice, and for purposes related to our legal rights and responsibilities.
Internet or Other Electronic Network Activity Information. We and our service providers collect and use Internet and other network activity information, such as your App preferences and settings; and information and analytics about the App performance and usage, including crash reports, to provide, operate, and improve the App, as additionally described in this Privacy Notice, and for purposes related to our legal rights and responsibilities.
Sensitive Personal Information.
- We collect and use your account log-in and password to provide and operate the App and for security and anti-fraud purposes.
- We also collect information concerning your health, including the data elements listed below. This information is usually processed on behalf of your Healthcare Provider and based on its instructions to support their monitoring and treatment activities and to operate the App, but we may process this information for our own purposes, such as in accordance with applicable law (including laws applicable to medical devices, for research purposes (with your consent, if required), and for purposes related to our legal rights and responsibilities.
  - CardioMEMS™ HF System serial number;
  - PA pressure readings from your CardioMEMS™ HF System;
  - PA pressure goals and thresholds from your Healthcare Provider;
  - systemic blood pressure readings and body weight (provided by you manually or automatically when you allow a mobile health data platform to share data with the App such as Apple Health);
  - medication list from your Healthcare Provider;
  - treatment plans from your Healthcare Provider;
  - messages from your Healthcare Provider, such as a proposed change in medication;
  - messages to remind you to take a PA pressure reading and/or to take medication;
  - acknowledgements of receipt of messages and medication change notifications; and
  - other information from Merlin.net HF your Healthcare Provider chooses to share with you.

The App also may receive personal information from a mobile health data platform, such as Apple Health, when you consent to that sharing. For example, you may choose to share systemic blood pressure and weight information you store in a mobile health data platform with the App. You are not required to share personal information with the App from such mobile health data platforms, and you may choose the personal information shared and/or withdraw your consent for the sharing at any time by changing the settings in the relevant platform or on your mobile device. Any withdrawal of consent for sharing will not affect processing of information already shared with the App based on your consent. Abbott will process information shared via a mobile health data platform only for the purposes described in this Privacy Notice and, where applicable, in accordance with the permissions you select in the relevant application or device settings.

Some other personal information, such as account registration details, your CardioMEMS HF System serial number, and information needed to transmit and receive information through the App, is required to provide services through the App. If you do not provide required information, Abbott may not be able to provide the App or certain App features and services.

+Abbott’s Use of Your Personal Information

In addition to the processing that Abbott does based on your Healthcare Provider’s instructions and in accordance with HIPAA, Abbott processes your personal information, including your health-related personal information, as a “business” or “controller” for the following purposes:

to provide and operate the App in accordance with the App End User License Agreement, including administering App registration, login/authentication, App functionality and App security;
to keep a record of your contact with Abbott when you contact Abbott directly regarding the App or related services;
where required by applicable laws governing the use and classification of medical devices, including for the purposes of medical device post-market surveillance, quality management, including product development and improvement, safety, performance, and vigilance;
to contact you for operational purposes through the App notifications, email, or by phone messaging (e.g., SMS messaging), with your consent where required by applicable law;
for other purposes with your consent;
where necessary to establish, exercise or defend legal claims; and
as otherwise required by applicable law.

De-identified, Aggregated, and/or Anonymized Information. Where permitted by applicable law and subject to relevant contracts with Healthcare Providers and/or your consent, we may use personal information to create de-identified, aggregated, and/or anonymized information, and we may share such information with third parties for any lawful purpose. for example, we may share such information with our affiliates, Healthcare Providers, third party researchers and national health authorities or insurers to demonstrate the effectiveness of the App, Merlin.net HF, our medical devices or related services, or as required for medical reimbursement. Where prohibited by law, we will not attempt to re-identify de-identified information except to ensure our de-identification methods are satisfactory.

Abbott may use de-identified, aggregated, and/or anonymized data for Abbott’s business purposes in accordance with applicable law and with your consent when required by applicable law. Such uses may include developing and improving Abbott’s products and services (such as algorithms and modern technologies like artificial intelligence and machine learning), analyzing how Abbott’s products and services are used, operate, and correlate to certain results and outcomes (for example, by different age groups or other demographics), research and development as further described below, reporting to Healthcare Providers, and as otherwise permitted by applicable law.

Research and Statistical Analysis. In accordance with applicable law (including with de-identified or aggregated data and/or your consent, as required by applicable law), Abbott will conduct research and statistical analysis for the following purposes:

to evaluate and improve the quality, security and effectiveness of the App, Merlin.net HF, and our cardiac and medical devices and systems and to allow for the development of innovative and effective treatment of heart-related conditions in the interests of public health;
to validate the App’s and Merlin.net HF’s functionality and upgrades, including monitoring and improving the safety and security of such services;
to research, develop and test medical devices, including new and existing features and functionality and to test and improve the App, Merlin.net HF and our medical devices for product development, data analysis, statistical and survey purposes;
to conduct real-world evidence studies; and
for public interest in the area of public health, including where the App, Merlin.net HF and medical devices are eligible for medical reimbursement or other funding.

Data used in research may include any of the health information collected in the App, such as the CardioMEMS™ HF System serial number, intervals between implant date and subsequent visit dates, implant date, and demographics such as place of residence and age. We conduct this research and statistical analysis using de-identified or aggregated information where possible. Where these activities require the use of personal information that has not been de-identified or aggregated, Abbott will request consent where required by applicable law.

Where your consent is legally required for Abbott to process health-related personal information for a specific research activity, you can withdraw that consent at any time by contacting us. Any withdrawal of consent will not affect processing based on your consent before the withdrawal. If you withdraw consent, Abbott will stop the processing for which your consent is legally required. Abbott may continue processing your personal information in order to meet its legal obligations or for other purposes where your consent is not legally required.

This Privacy Notice does not apply to research that is part of a clinical trial or as instructed by a Healthcare Provider. Where required by applicable law, you will be asked to provide a separate informed consent to the research site prior to participating in a clinical trial sponsored by Abbott.
Please note that we will also use personal information the App collects as instructed by your Healthcare Provider in our role as a “business associate” to your Healthcare Provider. Such use is not subject to this Privacy Notice.

+Disclosure of Personal Information

As a “business” or a “controller” of personal information, we may share your personal information as follows:
We share personal information with third-party suppliers to provide, maintain, host, and support the App, Merlin.net HF and related services.
We may sell or purchase assets during the normal course of our business. If another entity acquires or intends to acquire us or any of our assets, information we have collected about you may be transferred to such entity. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, such information may be considered an asset of ours and may be sold or transferred to other parties.
We reserve the right to disclose your personal information to comply with the law and respond to authorized information requests from government authorities, to address national security situations, or when otherwise required by law. Furthermore, where permitted or required by law, we may also disclose the information we collect from you where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of this Privacy Notice, or as evidence in litigation in which we are involved. Your personal information may be subject to foreign laws and may be accessible by foreign governments, courts, law enforcement, and regulatory agencies.
We may disclose personal information for the research and statistical analysis purposes described above where the information cannot be de-identified or aggregated in accordance with applicable law (including with your consent, if required by applicable law).

Please note that we will share personal information the App collects with your Healthcare Provider and as instructed by your Healthcare Provider in our role as a “business associate” to your Healthcare Provider. Such sharing is not subject to this Privacy Notice.

+ Retention of Personal Information

Personal information will be retained for as long as necessary for the purposes described in this Privacy Notice, including to provide the App and related services, maintain security, respond to support requests, comply with legal obligations, resolve disputes, and establish, exercise or defend legal claims. The retention of personal information we retain on behalf of your Healthcare Provider is subject to HIPAA and our applicable contracts with your Healthcare Provider.

+Security of Personal Information

Abbott has implemented security controls within App and Merlin.net HF to help protect your personal information from accidental or unlawful destruction or accidental loss, alteration, disclosure, or access. We cannot, however, be responsible for Internet communications that are inherently not completely secure.

Please be aware that the App and Merlin.net HF may be unavailable during periods of routine maintenance.

+How Abbott Uses Personal Information for Sending Marketing and Other Material

We will not knowingly send you advertising or marketing-related information, unless you have opted into receiving these types of communications from us in relation to our other products and services.
Neither Abbott nor its affiliates or licensors will knowingly send advertising or marketing-related information to children.

We do not sell your personal information for money or other consideration.

Please note that we may send you non-marketing related information about necessary App and service updates or issues relating to product safety.

+How Abbott Protects Children’s Privacy

The App and related services are intended to be used by adults or, where permitted, by a parent or legal guardian on behalf of a child. Children can be enrolled in Merlin.net HF by a Healthcare Provider. If you are the parent of a child enrolled in Merlin.net HF, contact your child’s Healthcare Provider for questions related to the processing of your child’s information.

+Information for California Residents

If you are a California resident, please note the following regarding how we collect, use, and disclose your personal information as described in this Privacy Notice, including in the previous 12 months, where the personal information is not being processed based on a Healthcare Provider’s permission or instructions in accordance with HIPAA:

We may collect, use, and disclose for our business and commercial purposes, categories of personal information as set forth in applicable California law, including: Identifiers; internet or other electronic network activity information; and sensitive personal information. See +Collection of Your Personal Information above for additional detail.

We collect and use these categories of personal information for the business and commercial purposes described in +Abbott’s Use of Your Personal Information.

We collect these categories of personal information from the sources described in +Collection of Your Personal Information.

To the extent permitted by applicable law, we may disclose each of the foregoing categories of personal information for the business and commercial purposes and to the categories of parties as described in +Disclosure of Your Personal Information.

We do not “sell” or “share” personal information collected through the App. For purposes of this paragraph, “sell” means the sale of your personal information to an outside party for monetary or other valuable consideration, and “share” means the disclosure of your personal information for cross-context behavioral advertising purposes, subject to certain exceptions set forth in applicable California law.

We may collect, use, and disclose for the purposes described above the following “sensitive personal information” (as defined in the California Consumer Privacy Act): username and password; and information concerning a consumer’s health.

We keep personal information as long as it is necessary or relevant for the practices described in this Privacy Notice, including, for example, for legal compliance, dispute resolution, contract enforcement, backup, archival, and other internal operations purposes. We also keep information as otherwise required by law. For more details, see + Retention of Personal Information.

If you are a California resident, you can make the following requests with respect to your personal information. Note that California residents do not have these rights with respect to personal information that is being processed based on your Healthcare Provider’s permission or instructions. If you have requests about that processing, contact your Healthcare Provider directly.

Access – You can request that we disclose to you the categories of personal information we collected about you, the categories of sources from which we collected the personal information, the categories of personal information we disclosed, our business or commercial
purpose for collecting the personal information, the categories of third parties to whom we disclosed the personal information, and the specific pieces of personal information we collected about you.
Delete – You can request that we delete your personal information that we maintain about you, subject to certain exceptions.
Correct – You can request that we correct inaccurate personal information that we maintain about you, subject to certain exceptions.

Abbott will not discriminate against you because you made any of these requests.

California residents can make these requests online by clicking here or contacting us using any of the methods set out in the section entitled +Contact Us.

We may deny certain requests, or fulfil a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate customer requests.

We will take reasonable steps to verify your identity prior to responding to your requests. For example, we may utilize a third-party verification provider to assist with verifying your identity. The verification steps may vary depending on the sensitivity of the personal information and whether you have an account with us.

California residents may designate an authorized agent to make a request on their behalf. When submitting the request, please ensure the authorized agent is identified as an authorized agent.

We also do not rent, sell, or share “personal information” as defined by California Civil Code §1798.83 about you that we collect on the Service with other people or unaffiliated companies for their direct marketing purposes. If you reside in California, you also have the right to ask us one time each year if we have disclosed personal information to third parties for their direct marketing purposes. To make a request, please send us an email, or write to us at the address listed in the Contact Us Section below. Indicate in your letter that you are a California resident making a “Shine the Light” inquiry.

When your request relates to your Healthcare Provider’s monitoring and treatment activities, you should contact your Healthcare Provider. We are not able to delete, correct, or amend any information maintained in Merlin.net HF.

+Information for Other U.S. Residents

Depending on the state where you reside (for example, Delaware and other states with consumer privacy laws), you may have the right to make the following requests with respect to your personal information in accordance with applicable law. Note that California residents do not have these rights with respect to personal information that is being processed based on your Healthcare Provider’s permission or instructions. If you have requests about that processing, contact your Healthcare Provider directly.

Access/Confirmation: You may have the right to request to confirm whether we process your personal information. Subject to certain exceptions, you may also have the right to request a copy of your personal information you provided to us. Delaware, Minnesota, and Oregon residents may also request a list of third parties (as defined in applicable law) to whom we have disclosed personal information.
Deletion: You may have the right to request that we delete personal information we have from or about you, subject to certain exceptions.
Correction: You may have the right to request that we correct inaccurate personal data we maintain about you, subject to certain exceptions.

If you are a resident of a state with a law that provides some or all of these rights, you may make these requests by clicking here or contacting us using any of the methods set out in the section entitled +Contact Us.

We do not “sell” personal information collected through the App or process such personal information for targeted advertising purposes. For purposes of this paragraph, “sell” means the sale of your personal information to a third party for monetary or other valuable consideration, subject to certain exceptions set forth in applicable state laws.

We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps will vary depending on the sensitivity of the personal information and whether you have an account with us. We use commercially reasonable efforts to authenticate your identity. We may deny certain requests, or fulfil a request only in part, based on our legal rights and obligations. If you are not satisfied with the outcome of your request, you may have the right to submit an appeal by sending an email to privacy@abbott.com with “Data Privacy Appeal” in the subject line.

+Contact Us

If you have questions, comments, or complaints about our privacy practices, including in connection with the App and/or related services, please contact us by clicking on the “Contact Us” link in one of our websites or emailing us at privacy@abbott.com. Alternatively, you may write to us at:

Attn: Abbott Medical Device Privacy Officer, 100 Abbott Park Road, Dept. O36X. Bldg. APo6A, Abbott Park, IL 60064In all communications to us, please include the email address used to register for the App and a detailed explanation of your request.
If you have questions, concerns or complaints about the processing of your personal information for the purpose of your medical care or wish to exercise your HIPAA rights, please contact your Healthcare Provider directly.

+Changes to this Privacy Notice

This Privacy Notice is kept under regular review. If we make material changes to our privacy practices, an updated version of this Privacy Notice will reflect those changes. You will be alerted to updates to this Privacy Notice by email or the App when you next use the App.

Without prejudice to your rights under applicable law, we reserve the right to update and amend this Privacy Notice without prior notice to reflect technological advancements, legal and regulatory changes and good business practices to the extent that it does not change the privacy practices as set out in this Privacy Notice.

Disclaimer