Consumer health data privacy policy

Effective April 2025

This Consumer Health Data Privacy Policy applies to “Consumer Health Data,” as that term has been defined under applicable law, that Cook Group Incorporated and its affiliated companies and subsidiaries, including Cook Medical Holdings, LLC, Cook Research Incorporated, Cook MyoSite, and MED Institute (collectively, “Cook,” “we,” “us,” “our”) Collects from Consumers (collectively, “you”). Any term appearing in this Consumer Health Data Privacy Policy that has been defined under applicable Consumer Health Data laws shall have the meaning afforded to it therein.

Collection of consumer health data

We may Collect the following categories of Consumer Health Data from you:

• Individual health conditions, treatment, diseases, or diagnosis
• Social, psychological, behavioral, and medical interventions
• Data that identifies a Consumer seeking health care services
• Health-related data that have been derived or inferred from the above

Use of consumer health data

We may Collect and use the above-mentioned categories of Consumer Health Data for the following purposes:

• Operate, manage, and maintain our business
• Provide, develop, improve, repair, and maintain our products and services
• Personalize, advertise, and market our products and services
• Conduct research, clinical studies, analytics, and data analysis
• Conduct investigations
• Undertake quality and safety assurance measures
• Conduct risk and security controls and monitoring
• Detect and prevent fraud
• Service accounts
• Comply with law, legal process, and internal policies
• Fulfill contracts
• Maintain records
• Provide customer service
• Provide analytic services
• Exercise and defend legal claims
• Otherwise accomplish our business purposes and objectives
• Provide our Services to you

We may also aggregate or anonymize personal information for purposes permitted by law. When we do so, we take reasonable measures to ensure that the information cannot be associated with a consumer or household, and we maintain and use the information in a deidentified form. We will not attempt to reidentify the information, except that we may attempt to reidentify the information solely for determining whether our deidentification processes satisfy applicable legal requirements. After such information has been deidentified, the information is no longer personal information and is not subject to this Consumer Health Data Privacy Policy.

Categories of consumer health data that we share

We may Share all of the categories of Consumer Health Data that we Collect.

• To our affiliates and subsidiaries. We disclose Consumer Health Data to our affiliates and subsidiaries, listed above, to provide and improve our services, personalize our products and services, and otherwise manage and maintain our business.
• To third parties for marketing purposes. We disclose Consumer Health Data to third parties, such as third-party marketing and analytics providers, and other organizations for marketing purposes, including to support our advertising efforts.
• To other third parties, at your direction or with your consent. We may disclose your Consumer Health Data to any other third parties at your direction or with your consent.

We may also disclose personal information in the following situations:

• Pursuant to a change of control. We may disclose Consumer Health Data to a successor entity or purchaser upon a merger, consolidation, or other reorganization in which we participate, or a sale of all or a portion of our assets. In this situation, we will seek assurances that the successor entity or purchaser will process personal information collected by us in accordance with this Consumer Health Data Privacy Policy.
• For legal purposes. We may disclose Consumer Health Data to protect our rights, defend or pursue a legal claim, investigate or prosecute illegal activities, comply with a subpoena, court order, governmental inquiry, legal process, or other legal obligation, or to protect the rights, property, or safety of us, you, or any other consumers.

To the extent required by applicable law, we will obtain your consent prior to making such disclosures of your personal information. We may also disclose aggregated or anonymized data to other entities to the extent permitted by law.

How to exercise your consumer health data rights

To exercise your rights with respect to your Consumer Health Data, depending on your state of residence, you can submit a Data Subject Request detailed in Cook’s Privacy Statement or email us at Privacy@CookGroup.com.

Supplement to Consumer Health Data Privacy Policy

For Nevada consumers

This Supplement applies to Nevada Consumers for purposes of providing additional disclosures required by Nevada’s Consumer Health Data privacy law. Terms used herein that are defined terms under Nevada’s Consumer Health Data privacy law shall have the meanings afforded to them therein.

1. Purposes and manner of processing. We Collect, use, process, and Share Consumer Health Data for the purposes and in the manners described in our Consumer Health Data Privacy Policy, which also provides additional disclosures relevant to Nevada Consumers.
2. Review and revision of Consumer Health Data. If you would like to review and/or revise your Consumer Health Data, you may submit a request to us via the method listed in our Consumer Health Data Privacy Policy above. We will respond to your requests to exercise your rights in accordance with applicable law, but in any case, no later than 45 days after receiving your request. We may extend this period up to 45 days only where doing so is permitted under applicable law.
3. Changes to this Supplement. We will notify you before making any changes to our privacy practices with respect to your Consumer Health Data by posting an updated notice on this page, with an updated effective date.
4. Third Party collection of Consumer Health Data. Please note that some Third Parties may Collect Consumer Health Data about you over time and across different websites or online services you may visit.