Privacy Statement

Last updated: June 30, 2026 · Cardiac Biotech Solutions, Inc.

Scope of this Privacy Statement

This Privacy Statement explains how Cardiac Biotech Solutions, Inc. and its affiliates and subsidiaries (collectively, ‘Cardiac Biotech,’ the ‘Company,’ ‘we,’ ‘us,’ or ‘our’) collect, use, disclose, retain, and protect personal information when you access or use cardiacbiotech.com and other online pages, forms, or electronic communications that link to this Privacy Statement (collectively, the ‘Site’).

The Site is a corporate informational website intended for healthcare professionals, healthcare organizations, prospective distribution partners, investors, media representatives, and other business contacts. The Site is not a patient portal, remote monitoring portal, clinical-service portal, emergency reporting system, product complaint intake system, or substitute for device labeling, medical advice, or physician direction.

This Privacy Statement does not apply to the My-Cardia portal, mobile applications, patient monitoring services, product support systems, clinical trial systems, employment or recruiting systems, distributor websites or services, healthcare provider systems, or other third-party websites or applications unless they expressly link to this Privacy Statement. Those services may be governed by separate privacy notices, consents, contracts, business associate agreements, device labeling, healthcare provider privacy practices, or other terms.

Do not submit patient or health information through general website forms

Please do not use general website forms, newsletter forms, investor inquiry forms, partnership inquiry forms, or demo request forms to submit patient names, ECG recordings, medical history, symptoms, treatment information, insurance information, patient identifiers, product complaint details containing patient identifiers, or other protected, sensitive, or consumer health information.

If you are a patient, contact your physician or other qualified healthcare provider with questions about your health, monitoring, diagnosis, or treatment. In an emergency, call 911 or your local emergency number. Product complaints, suspected device malfunctions, or adverse events should be reported through the contact information in the applicable product labeling or other designated reporting channel; do not include patient identifiers unless specifically requested through an authorized channel.

Personal information we collect

Depending on how you interact with the Site, we may collect the following categories of personal information:

Contact and identifiers — name, email address, telephone number, mailing address, organization, job title, country or region, and similar contact details.
Inquiry and relationship information — information you provide when you request a demo, submit a contact form, ask about distribution or partnerships, contact investor relations, request information about products, subscribe to news updates, or communicate with us.
Business and professional information — organization name, role, market, professional interests, healthcare or distribution affiliation, investor or media interest, and related business context.
Subscription and communication information — email preferences, newsletter subscriptions, opt-in and opt-out records, and records of messages we send to or receive from you.
Device, usage, and analytics information — IP address, browser type, operating system, device type, referring and exit pages, pages viewed, links clicked, timestamps, approximate location inferred from IP address, and information collected through cookies, pixels, scripts, tags, local storage, analytics tools, and similar technologies.
Information from third parties — information from service providers, public sources, business partners, distributors, investor relations vendors, event organizers, or professional databases when permitted by law.
Sensitive information — the corporate Site is not intended to collect sensitive personal information, protected health information, ECG recordings, consumer health data, government identification numbers, financial account credentials, or precise geolocation. If you voluntarily submit such information through a general website channel, we may use it only to route, respond to, delete, document, or comply with applicable legal, regulatory, safety, or security obligations.

How we use personal information

We may use personal information for the following purposes:

To operate, maintain, secure, troubleshoot, and improve the Site.
To respond to inquiries, demo requests, partnership requests, distribution inquiries, healthcare professional communications, media requests, investor relations requests, and general business communications.
To send press releases, investor updates, company news, newsletters, event notices, or other communications you request or that are permitted by law.
To evaluate and manage distributor, supplier, customer, healthcare organization, investor, media, and other business relationships.
To manage consent records, cookie preferences, subscriptions, opt-outs, and communication preferences.
To analyze Site traffic, user engagement, and Site performance, subject to applicable consent and cookie settings.
To protect the security, integrity, and availability of the Site and our systems; detect, investigate, and prevent fraud, abuse, security incidents, or unlawful activity.
To maintain business records, comply with legal, securities, medical device, quality, tax, accounting, audit, regulatory, reporting, and corporate governance obligations, and respond to lawful requests from regulators or authorities.
To enforce our Terms and Conditions, protect our rights and the rights of others, and support transactions such as corporate financing, mergers, acquisitions, reorganizations, or asset transfers.

Legal bases for processing

For individuals in jurisdictions that require a legal basis for processing personal information, including the European Economic Area, United Kingdom, and Switzerland, we rely on one or more of the following legal bases, depending on the context:

Consent — for example, where you consent to receive marketing communications or to the use of non-essential cookies.
Contract or pre-contract steps — for example, where we respond to your request for information, a demo, a distributor discussion, or a business relationship.
Legitimate interests — for example, operating and securing the Site, responding to business inquiries, managing investor and business communications, improving Site performance, preventing fraud, and maintaining appropriate business records, where those interests are not overridden by your rights.
Legal obligations — for example, complying with securities, corporate, medical device, quality, accounting, tax, regulatory, litigation, product safety, and other legal obligations.
Vital interests or public interest — where applicable and legally permitted, for example in limited circumstances involving safety or emergency matters.

How we disclose personal information

We may disclose personal information to the following categories of recipients:

Affiliates and subsidiaries — for the purposes described in this Privacy Statement.
Service providers and processors — including website hosting, cloud infrastructure, security, analytics, consent management, email delivery, newsletter, CRM, form processing, investor relations, communications, data storage, IT support, auditing, legal, compliance, and professional service providers.
Distributors, business partners, and healthcare organizations — when you request information about product availability, distribution, commercial opportunities, demos, or follow-up in a particular region, subject to appropriate legal and contractual safeguards.
Regulators, authorities, and safety channels — where required or appropriate for legal compliance, medical device quality, product safety, adverse event reporting, product complaint handling, securities disclosure, public-company obligations, litigation, or lawful government requests.
Professional advisors and transaction parties — including lawyers, auditors, accountants, insurers, lenders, investors, potential transaction counterparties, and other advisors in connection with business operations, financing, corporate transactions, or legal matters.
Successors or assignees — in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or other corporate transaction.
With your direction or consent — where you ask us to disclose information or otherwise authorize disclosure.

No sale of personal information

We do not sell personal information for money. We do not knowingly sell or share the personal information of minors under 16. Certain analytics, advertising, embedded content, or similar technologies may be considered a ‘sale,’ ‘sharing,’ or ‘targeted advertising’ under some privacy laws, even where no money is exchanged. Where required, you may opt out through the cookie banner, Cookie Settings link, ‘Do Not Sell or Share My Personal Information’ link, Global Privacy Control or other legally required opt-out mechanism implemented on the Site.

Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. You can manage non-essential cookie preferences through the consent banner or Cookie Settings link, and you can adjust browser settings to block or delete cookies. Blocking cookies may affect Site functionality.

HIPAA, clinical portal data, and regulated product information

Cardiac Biotech may, in some contexts, receive, create, maintain, or transmit protected health information on behalf of healthcare providers, healthcare organizations, or other HIPAA-regulated parties. When we handle protected health information in that capacity, that information is governed by applicable law, business associate agreements, healthcare provider instructions, product or service terms, device labeling, and other contractual or regulatory requirements, not by the general corporate website provisions alone.

This Privacy Statement is not a HIPAA Notice of Privacy Practices and does not describe how your healthcare provider uses or discloses protected health information. Healthcare providers are responsible for their own notices and patient privacy practices.

International transfers

Cardiac Biotech is based in the United States, and the Site and our service providers may process personal information in the United States and other countries. These countries may have data protection laws that differ from those in your jurisdiction. Where required, we use appropriate safeguards for cross-border transfers, such as contractual safeguards, consent, adequacy mechanisms, or other mechanisms permitted by applicable law.

Data retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Statement, including to respond to your request, provide requested communications, maintain business and investor records, comply with legal, regulatory, audit, accounting, securities, medical device, quality, product safety, dispute-resolution, and security obligations, and enforce our rights. Retention periods vary based on the type of information, the purpose for which it was collected, applicable law, and operational needs. When personal information is no longer needed, we delete, de-identify, aggregate, or otherwise dispose of it in accordance with applicable requirements.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. No website, network, system, transmission, or storage method is completely secure. You are responsible for using caution when transmitting information online and for avoiding submission of sensitive or health information through general website channels.

Your choices and privacy rights

Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of, or portability of your personal information; to opt out of marketing communications; to opt out of sale, sharing, targeted advertising, or certain profiling; to restrict or object to certain processing; to withdraw consent; to limit certain sensitive personal information uses; and to appeal a denied request. These rights may be subject to verification, exceptions, limitations, and retention obligations under applicable law.

To exercise privacy rights, contact us at info@cardiacbiotech.com with the subject line ‘Privacy Request’ or write to Cardiac Biotech Solutions, Inc., Attn: Privacy, 10845 Griffith Peak Drive, Suite 200, Las Vegas, Nevada 89135. Please identify your country and state or province of residence and describe the request you are making. We may need to verify your identity and authority before responding. Authorized agents may submit requests where permitted by law, subject to verification of authority.

California and U.S. state notice at collection

For residents of California and other U.S. states with comprehensive privacy laws, the following notice summarizes the categories of personal information we may collect, the purposes for which we may use them, and the categories of recipients to whom we may disclose them. We collect and disclose only as reasonably necessary for the purposes described in this Privacy Statement.

Identifiers and contact information — such as name, email address, organization, job title, country or region, IP address, and similar identifiers. Used for communications, Site operations, security, business records, investor relations, and legal compliance. Disclosed to affiliates, service providers, advisors, business partners where relevant to your request, and authorities where required.
Professional and business information — such as employer, role, healthcare provider or distributor affiliation, investor or media interest, and related business context. Used to evaluate and respond to business, healthcare, distribution, investor, and media inquiries. Disclosed to affiliates, service providers, advisors, and relevant business partners.
Internet or network activity information — such as browser, device, pages viewed, referral data, cookie identifiers, and interactions with the Site or emails. Used for Site operations, analytics, security, consent management, and improvement. Disclosed to service providers and analytics or technology providers as permitted by law and your choices.
Approximate geolocation — such as location inferred from IP address. Used for Site security, analytics, regional routing, and legal compliance. Disclosed to service providers as needed.
Communications and inquiry content — such as messages submitted through contact forms or emails. Used to respond, maintain records, route requests, and comply with legal or regulatory obligations. Disclosed to affiliates, service providers, advisors, relevant business partners, and authorities where required.
Sensitive personal information or consumer health data — not intentionally collected through the corporate Site. Do not submit this information through general website channels. If submitted, it may be used only as needed to route, respond to, delete, document, protect safety or security, or comply with law.
Retention — retained for the period reasonably necessary for the disclosed purposes and legal obligations.
Sale/share — we do not sell personal information for money. If any analytics, advertising, embedded content, or similar technology is considered a sale, sharing, or targeted advertising under applicable law, you may opt out through available Site controls.

International privacy rights

Individuals in the European Economic Area, United Kingdom, Switzerland, Canada, and other jurisdictions may have additional rights under applicable privacy laws, including rights to access, rectify, erase, restrict, object to processing, data portability, withdraw consent, and lodge a complaint with a supervisory authority. We will respond to requests in accordance with applicable law.

Children

The Site is not directed to children under 16, and we do not knowingly collect personal information from children under 16 through the Site. If you believe a child has provided personal information to us, contact us and we will take appropriate action.

Third-party websites and services

The Site may link to third-party websites, platforms, app stores, social media pages, stock quote tools, embedded media, distributors, healthcare providers, or other services. We do not control third-party privacy practices. Review the privacy notices and terms of those third parties before providing information to them.

Changes to this Privacy Statement

We may update this Privacy Statement from time to time. The ‘Last updated’ date above identifies the latest revision. Changes are effective when posted unless a different effective date is stated or applicable law requires additional notice or consent.

Contact

Questions or privacy requests may be sent to info@cardiacbiotech.com with the subject line ‘Privacy Request’ or by mail to Cardiac Biotech Solutions, Inc., Attn: Privacy, 10845 Griffith Peak Drive, Suite 200, Las Vegas, Nevada 89135. General inquiries may also be made by telephone at +1 (888) 225-0870.