Privacy Policy

Medesto Health, LLC (“Medesto,” “us,” “we” or “our”) has created this Privacy Policy (“Policy”) that describes how Medesto collects, uses, discloses, transfers, stores, retains or otherwise processes your information when you (whether in your individual or business capacity) access or use, in any manner, any of our content, products, services or related activities (collectively “Services”), including through our Internet domains owned or operated by Medesto, which include, but are not limited to medesto.ai/ and medestohealth.com/ (collectively, our “Websites” or “Sites”), and our platforms, which includes Medesto Pulse and Medesto Bridge (collectively, our “Platforms”). This Policy does not describe our practices regarding your protected health information covered by federal laws like the Health Insurance Portability and Accountability Act (HIPAA), which are controlled and are subject to your individual health provider’s HIPAA privacy and security obligations. Medesto acts as a Business Associate to your healthcare provider under HIPAA. Your provider’s own Notice of Privacy Practices also governs how your PHI is used and disclosed. This Privacy Policy supplements, but does not replace, your provider’s notice.

We encourage you to read this Policy carefully for a description of our privacy practices, your rights with regards to your personal data and information about how you can exercise your rights with us. However, in general:

• We collect and process your personal data through our Websites and Platforms, which we use to provide you with access to our Websites and Platforms, advertise our Services, perform analytics and to improve and secure our Websites and Platforms.
• We collect and process your personal data when you engage with our Services through Medesto Pulse as a patient of your healthcare provider, which we use to provide these Services to you, our services to your healthcare provider, perform analytics, enhance and improve our Services, as well as to market our products and Services.
• We collect and process your personal data when you engage with our Services through Medesto Pulse as a direct user independent of your role as a patient of your healthcare provider, which we use to provide these Services to you, perform analytics, enhance and improve our Services, as well as to market our products and Services.
• We collect and process your personal data when you engage with our Services in a business capacity, such as an employee of one of our healthcare customers, which we use to provide these Services to you, our services to your employer, perform analytics, enhance and improve our Services as well as to market our products and Services.
• We don’t sell your personal data for money, but we will disclose your online browsing data to our online analytics, advertising and marketing partners in exchange for services and analytics.
• We use and disclose your online browsing data for targeted and cross-behavioral advertising purposes.
• You can contact our privacy officer at privacy@medestohealth.com

Finally, if you’d like to review a specific section of our Policy, please use the below table of contents:

This Policy is supplemented by our:

• Website Technology Disclosures
• Washington Consumer Health Data Privacy Notice

1. General Disclosures

When we are deciding why we collect, process and disclose your personal data, we are called a “data controller.” Where we are the data controller with regards to the personal data that we process, applicable law may require us to provide you with this Policy and receive your requests for data rights. However, we primarily collect and process your personal data as a sub-processor or service provider on behalf of other businesses (like your healthcare providers), i.e., as a “data processor”. This means that we collect, process and disclose your personal data at the direction of our customers and not for our own purposes.

Where we collect, process and disclose your personal data on behalf of another entity (i.e., we are the data processor and not the data controller), we will provide you with the identity of the data controller to the extent we are required to do so by law so that you can review the applicable data controller’s privacy policy and submit your requests for data rights to them directly.

Please note that our Websites are hosted in the United States. If you are visiting our Websites from outside of the United States, your information is being stored or processed in the United States where our data center and servers are located and operated. The United States may not have privacy laws that are as strong or comprehensive as the privacy laws in your own country.

2. What Information We Collect And Disclose And For What Purposes

In the course of performing our Services, we collect a variety of different kinds of personal data from a variety of different individuals. What information we collect and the purposes for which it is collected will depend on the context of our activities or the Service that is being performed. Therefore, just because this Policy lists a particular data collection practice does not mean that we have necessarily collected that data from you. Instead, please review the applicable disclosures below to learn about how we may have collected personal data from you depending on how you have interacted with us.

All personal data that we collect, regardless of context of collection, may be used for the following purposes:

• For corporate transactions. We may use and disclose all or part of your personal data with other entities in connection with the sale, assignment, merger or other transfer of all or a portion of our organization or assets to such entities (including due to a sale in connection with a bankruptcy).
• For legal purposes. We may use and disclose all or part of your personal data to courts, litigants, regulators, arbitrators, administrative bodies or law enforcement when we have reason to believe that disclosing this information is necessary to resolve actual or suspected claims. We may also disclose your personal data in order to identify, contact or bring legal action against someone who may be violating any agreement with us, or may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users of the Services, or anyone else that could be harmed by such activities. We may disclose information in response to a subpoena, search warrant, in connection with judicial proceedings, or pursuant to court orders, legal process or other law enforcement measures.
• Deidentification. We may process your personal data into aggregated, anonymized or de-identified form for any purpose. Aggregated, anonymized or de-identified information is information that can no longer reasonably identify a specific individual and is no longer “personal data.” We will only maintain and use this type of information in deidentified form and we will not attempt to reidentify this information, except for the purposes of validating our deidentification process.

3. Personal Data Relating To Children

It is our policy to refrain from knowingly collecting personal data directly from any person under the age of 18 through our Websites or Platforms (although, our healthcare provider customers and adult users may provide information about minors to Medesto). Therefore, if you are under the age of 18, please do not supply any personal data through the Websites and you may not access the Platforms. If you are under the age of 18 and have already provided personal data through the Websites, please have your parent or guardian contact us immediately using the information provided under Contact Us so that we can remove such information from our files. Please delete all Medesto related cookies and restrict further collection of cookies using the methods outlined in the section How To Opt-Out Of Tracking And Restrict Cookies in our Website Technology Disclosures.

4. How Long We Retain Your Information

We may retain your personal data for a period of time that is consistent for us to perform our Services, as well as to comply with applicable law, applicable statute of limitations and our data retention practices. We may also retain your personal data as we believe is reasonably necessary to comply with legal process or governmental request, to detect or prevent fraud, to collect fees owed, to resolve disputes, to address problems, to assist with investigations, to enforce other applicable agreements or policies or to take any other actions consistent with applicable law. Cookies are stored on your own device. You can find out more information about the retention of cookies in our Website Technology Disclosures.

In some cases we are legally required to retain personal data and cannot delete it on request. For example, certain health information is subject to retention requirements under the Health Insurance Portability and Accountability Act (HIPAA) and related state laws, and other records may be subject to tax, recordkeeping, or statute-of-limitations requirements. Where a request to delete personal data conflicts with our legal obligation to retain it, we will retain the information for the period required by law and delete it when that obligation ends.

5. Marketing And Promotional Communications

You may opt-out of receiving marketing and promotional messages from us, if those messages are powered by us, by following the instructions in those messages. If you decide to opt-out, you will still receive non-promotional communications that are necessary in the performance of our Services.

6. SMS Texting

By submitting your phone number in a web form or signing up for text alerts, you consent to receive transactional text messages (e.g., account notifications and alerts) from Medesto at the number provided. Message frequency varies. Message and data rates may apply.

You can unsubscribe from our SMS program at any time by replying STOP, END, CANCEL, UNSUBSCRIBE, or QUIT to any message you receive. You may receive one final text confirming your request. Your mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. If you need assistance, reply HELP to the message or let us know via Contact Us.

7. Integrations And Links To Other Sites

This Policy applies only to our Websites and Platforms, and not to other companies’ or organizations’ websites, platforms or other properties to which we link from our Websites or Platforms. Medesto is not responsible for the privacy practices or the content of such websites or organizations, including any websites that may indicate a special relationship or partnership with us (such as co-branded pages or “powered by” or “in cooperation with” relationships). Other linked websites may collect personal data from you that is not subject to our control. To ensure protection of your privacy, always review the privacy policy of the websites you may visit.

8. Your Privacy Rights

There are a number of states that provide specific consumer rights to residents of those jurisdictions regarding personal data. This section of this Policy describes the rights available to those individuals who are entitled to them.

Note that health data that we hold and process on behalf of your healthcare providers will be subject Health Insurance Portability and Accountability Act (HIPAA). Therefore, we are only able to offer limited data rights to individuals with regards to this data due to legal restrictions. Therefore, this section does not describe your data rights with regards to this HIPAA health information. You can find information about your rights relating to your HIPAA health data in your healthcare provider’s HIPAA Notice of Privacy Practices.

What U.S. Data Rights Do You Have (Non-California)?

Please note that if you are a resident of California, you have access to special data rights and disclosures that are described in this Policy under a separate section titled Your California Privacy Rights and Disclosures.

If you are a consumer living in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and Washington, you have the following rights with regards to your personal data. These rights are explained in further detail below:

• Right to Confirmation and Access. You may have the right to confirm whether or not Medesto is processing your personal data and to access such personal data. The general categories of personal data that we collect, process and disclose are listed above under the section: What Information We Collect And Disclose And For What Purposes. If you wish to access the specific pieces of personal data that we process about you, please submit a request as directed in the section titled How To Submit A Data Rights Request.
• Right to Correct. You may have the right to request that Medesto correct inaccurate personal data that we maintain about you, taking into account the nature of the personal data and the purposes of the processing of the personal data.
• Right to Delete. You may have the right to request that Medesto delete the personal data that Medesto maintains about you.
• Right to Portability. You may have the right to request to receive your personal data in a portable and readily usable format, to the extent technically feasible.
• Right to Opt-Out of Sale/Targeted Advertising. You may have the right to request to opt out of a “sale” of your personal data or processing of your personal data for purposes of targeted advertising (if any). “Targeted advertising” generally means displaying advertisements where the advertisement is selected based on personal data obtained from your activities over time and across websites or online applications to predict your preferences or interests.
• Right to Opt-Out of Profiling. You may have the right to request to opt out of automated profiling using your personal data that produces legal or similarly significant effects concerning you (if any). Applicable state laws allow you to opt out of the application of automated profiling when it relates to substantive decision making, such as denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health-care services, or access to essential goods or services.
• Right to Information About Third Parties. Oregon, Maryland and Delaware residents may have the right to request, at our option, a list of specific third parties, other than natural persons, to which Medesto has disclosed either your personal data or any personal data in general. Washington and Navada residents may request a list of all third parties with whom the we have shared or sold (if any) your sensitive health data.
• Right to Question the Results of Profiling. Minnesota residents may have the right to question the results of any automated processing of their personal data to evaluate, analyze, or predict personal aspects related to their economic situation, health, personal preferences, interests, reliability, behavior, location, or movements in furtherance of decisions that produce legal or similarly significant effects concerning them.

If we engage in this profiling practice, you may have the right to (i) question the result of that profiling and (ii) be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions you might have taken to secure a different decision and the actions that you might take to secure a different decision in the future. You also may have the right to (iii) review your personal data used in the profiling and (iv) correct any incorrect personal data used to perform the profiling and have the profiling decision reevaluated based upon the corrected personal data.

Your California Privacy Rights And Disclosures

Your California Consumer Privacy Act Rights

The California Consumer Privacy Act (“CCPA”) provides the residents of California with the right to request the data rights as described in this section. For more information, or if you have questions, you can contact us using the information provided under Contact Us.

• Right to Know: California residents have the right to know what personal data Medesto has collected about them, including the categories of personal data, the categories of sources from which the personal data is collected in the past 12 months, the business or commercial purpose for collecting, selling, or sharing personal data, the categories of third parties to whom Medesto discloses personal data, and the specific pieces of personal data Medesto has collected about them.
• Right to Delete: California residents have the right to request the deletion of their personal data maintained by Medesto.
• Right to Correct: California residents have the right to request that a business correct inaccurate personal data about them.
• Right to Non-Discrimination: California residents have the right to not be discriminated against due to the exercise of their privacy rights under the CCPA.
• Right to Opt-Out: California residents have the right to opt-out of the “sale” or “sharing” of their personal data. “Sharing” here means the disclosure of your personal data for the purposes of cross-context behavioral advertising.
• Right to Limit Use and Disclosure of Sensitive Personal data: California residents have the right to direct a business to limit its use and disclosure of their “sensitive” personal data.
• Right to Make Requests Through an Authorized Agent: California residents can designate an authorized agent to make a request under the CCPA on their behalf.

9. How To Submit A Request

You can submit your request to exercise your data rights through the below:

• E-mailing us at privacy@medestohealth.com;
• Calling us at (734) 855-6739; and
• Opting Out of targeted advertising or “sale” of online browsing information: How To Opt-Out Of Tracking And Restrict Cookies.

10. How We Process Data Rights Requests

Once we receive your request to exercise a right, we will confirm receipt and begin to evaluate, and if appropriate, process the request. Please note that:

• We may require that you provide additional information to confirm your identity, including providing us with at least two or more pieces of personal data to match against personal data that we currently maintain about you. We reserve the right to reject your request if we are unable to verify your identity to a sufficiently high level of certainty. The information you provide to verify your identity will only be used for verification purposes, and a record of your request, including certain information contained within it, will be maintained by Medesto for our files.
• To authenticate any request to correct personal data, you may be required to provide authentication information.
• Certain laws or other legal requirements might prevent some personal data from being disclosed or deleted.

If you fail or refuse to provide the necessary information, we may not be able to process your request.

If we reject a request for any reason, we will inform you of the basis of the rejection. Not all individuals about whom we possess information will have access to these rights and we may not be able to provide these rights to everyone due to legal and jurisdictional limitations. We may not be able to comply with your request for a number of reasons, including:

• you do not live in a jurisdiction that grants you the specific right that you have requested;
• the information that you’ve requested is not subject to the regulation that grants you the right to make a request in relation to your personal data;
• we are prevented or exempted by law, regulation or rule from complying with your request;
• we are not the owner or controller of the data about which you are requesting;
• we do not maintain your personal data in a manner that is connected to your identity;
• we are not able to comply with your request without incurring disproportionate burden or expense; or
• if complying with your request conflicts with our proper and reasonable ability to administer our sites, to administer our business and related relationships or to establish, defend or administer legal claims.

If any of the above reasons apply, we will let you know in our response to your request.

Submitting A Request Through An Authorized Agent

Some states allow you to designate an authorized agent to make a request on your behalf. An authorized agent should make a request through the same mechanisms that are available to individuals as described in this Policy. The request should clearly identify that the request is being made by an authorized agent and must include evidence of authorization. If we receive a request from an individual or an entity purporting to make the request on behalf of another individual, we can only comply with the request if we are allowed by applicable state law and able to sufficiently authenticate both the identity of the individual as well as the authorized agent’s authority to act on that individual’s behalf.

11. Appeals and Complaints

If you disagree with our decision to reject your request or with any portion of our response, you have the right to appeal within a reasonable period of time. If you wish to appeal, please clearly and plainly describe your basis of disagreement with our decision by responding through the same means by which we communicated our refusal or by submitting your appeal through the information provided under Contact Us. We will review your appeal and either change our decision or reject your appeal, and in either case, we will provide a written explanation of the reason for the decision. This decision will be final.

For U.S. residents, if you still disagree with our decision, you have the right to submit a complaint to your attorney general of your state of residence.

12. Changes To This Privacy Policy

We may amend this Policy at any time by posting revisions on our Websites. If we make any material changes in the way we collect or process your personal data, we will notify you by prominently posting notice of the changes on our Websites.

13. Contact Us

To submit questions, you can contact us by:

• Calling us at (734) 855-6739
• E-mailing us directly at privacy@medestohealth.com

Website Technology Disclosures

Last Modified: June 19, 2026

Effective as of the date listed above, Medesto, and its subsidiaries & affiliates, (collectively, the “Medesto ” or “we” or “us” or “our”) have adopted this Website Technology Disclosure. This Disclosure is designed to be read in conjunction our general Privacy Policy. For the purposes of this Website Technology Disclosure, we say the “Websites,” we mean https://medesto.ai/ and https://medestohealth.com.

Like many website operators, Medesto and its analytics vendors use server logs and automated data collection tools, such as browser cookies, pixel tags, scripts and web beacons. These tools are used for analytics purposes to enable us to understand how users interact with the Websites and for advertising our services and organization on the Internet.

What is a cookie?

A cookie is a small text file that is placed on your hard drive by a web page server. Cookies contain information that can later be read by a web server in the domain that issued the cookie to you. There are several types of cookies:

• Session cookies provide information about how a website is used during a single browser session while a user is visiting a website. Session cookies usually expire after the browser is closed.
• Persistent cookies remain on your device between different browser sessions for a set amount of time in order to enable the website to remember user preferences, settings, or actions across other sites. A persistent cookie will remain on a user’s device for a set period of time specified in the cookie.
• First-party cookies are cookies set by the operator of the website you are visiting.
• Third-party cookies are cookies set by third parties that are different from the operator of the website you are visiting.

Our collection of cookies.

We, our marketing partners, affiliates, and analytics or service providers use cookies and other similar technologies. We group the cookies that we collect into the following categories based upon their function (note that all types of cookies, as described above, may be found in each category):

Third-party cookies.

The Websites allow third-parties to place cookies on your Internet-connected device in order to deliver advertisements based upon your web-browsing habits and history. Further, in order to provide interoperability and plug-ins from various social media websites (like Facebook), the Websites allow these third-parties to place and collect cookies on your Internet-connected device. However, you can restrict the third-party collection of cookies through the instructions provided in the section How To Opt-Out Of Tracking And Restrict Cookies below.

Analytics Technologies.

We may use service providers to provide site metrics and other analytics services. These service providers may use cookies (see above); web beacons (also called clear GIFs or pixels), which are small blocks of code that allow us to measure the actions of visitors using Medesto’s sites; and other technologies to collect information, such as your IP address, identifiers associated with your device, other applications on your device, the browsers you use to access our sites and Services, webpages viewed, time spent on webpages, links clicked and conversion information (e.g., transactions entered into). This information may be used by Medesto and its service providers on behalf of Medesto to analyze and track usage of our sites and Services to determine the popularity of certain content and to better understand how you use our sites and Services.

We use Google Analytics on the Site to analyze how individuals use the Site. We will package up information about how individuals interact with our Site and send it to Google Analytics to be processed into reports. This information includes basic pageviews and visit data such as device type, operating system, and browser type. When Google Analytics processes data, it aggregates and organizes the data based on particular criteria like whether a user’s device is mobile or desktop, or which browser they’re using. If, at any time, you choose not to participate in the use of analytics software, please use your web browser’s available opt-outs as described in the section How To Opt-Out Of Tracking And Restrict Cookies.

Advertising Technologies.

We use remarketing and targeted advertising services through our marketing partners to advertise online. These vendors may show our ads on websites across the internet or use your information to show advertising for third parties.

For example, we use Google Analytics Advertising cookies to identify what advertisements you see when you browse the Internet and how you have interacted with them. We may use this information for our own advertising or it could be pooled together by Google from your interactions with other websites to determine what kind of advertisements you may see on the Internet.

We utilize Google advertising services on our Websites. Google uses cookies and other technologies for advertising purposes, including to show personalized ads. When you visit our Websites, Google’s cookies and related technologies pass information about you to Google. Online identifiers (IP addresses, cookie IDs, mobile advertising IDs and other unique identifiers), your browsing and interaction information with our Websites and information about your computer, device and web browser are all provided to Google and used for advertising purposes. For more information on how Google manages user data, please consult Google’s Privacy Policy.

If, at any time, you choose not to participate our advertising programs, please use your web browser’s available opt-outs as described in the section How To Opt-Out Of Tracking And Restrict Cookies.

Do Not Track.

Do Not Track (“DNT”) is an optional browser setting that allows you to express your preferences regarding tracking across websites. Most modern web browsers give you the option to send a Do Not Track signal to the websites you visit, indicating that you do not wish to be tracked. However, there is no accepted standard for how a website should respond to this signal, so we do not take any action in response to this signal. Medesto does not have a mechanism in place to respond to DNT signals. Instead, in addition to publicly available external tools, we offer you the choices described in this Website Technology Disclosures to manage the collection and use of information about you.

Web beacons, pixels, tags and scripts.

In addition to cookies, we use other technologies to recognize and track visitors to Medesto’s websites. A web beacon (also known as a “tracking pixel” or “clear GIF”) is a clear graphic image (typically a one-pixel tag) that is delivered through a web browser or HTML email, typically in conjunction with a cookie. Web beacons allows us certain functionality, for example, monitoring how users move from one page within a website to another, to track access to our communications, to understand whether users have come to a website from an online advertisement displayed on a third-party website, to measure how ads have been viewed and to improve site performance.

These technologies may be used on our Websites or in our emails to help us to deliver cookies, count visits, understand usage of our sites, campaign effectiveness and determine whether an email has been opened and acted upon.

Third-Party/Embedded Content.

These cookies are set by third parties whose content is embedded our Websites (e.g., video). They may track your online activity in order to enhance your experience or assess the success of their application. We have no direct control over the information these cookies collect. Please review the third party’s privacy policy and privacy settings before clicking on embedded content in our site.

Social Media Plug-ins.

These plug-ins allow us to integrate social media functions into our Websites and may also be used for advertising purposes by those social media companies. If you visit our Websites while logged into your social media accounts, information about your visit to our Websites, your social media identifier and information about your browser may be provided to those third-party social media companies. You should review the privacy policy of any social media entity with whom you have an account to learn about how they may use your data.

How To Opt-Out Of Tracking And Restrict Cookies.

You can see what cookies we place and/or collect and for what purposes by clicking “Cookie Settings” on the cookie banner when you first visit the site. If you are not presented with a cookie banner, please delete your cookies and re-visit the site. You can choose to restrict all non-necessary cookies by clicking “Reject All” on the cookie banner when you first visit the site or choose which specific non-necessary cookies to accept or reject by clicking “Cookie Settings.”

You can opt-out of the tracking of your online behavior by:

• visiting the Network Advertising Initiative (NAI) website opt-out page: http://www.networkadvertising.org/choices;
• visiting the Digital Advertising Alliance (DAA) opt-out page: http://www.aboutads.info/; and
• downloading and installing the Google browser plug-in from the following link: http://tools.google.com/dlpage/gaoptout.

Our website is configured to recognize and honor opt-out preference signals, including the Global Privacy Control (GPC). When we detect a GPC signal from your browser or device, we treat it as a request to opt out of the sale or sharing of personal data and the use of tracking technologies for targeted advertising in connection with that browser or device. This signal applies to our website and does not apply to the Medesto Pulse or Bridge products.

You can control and delete cookies through your browser settings through the following:

• Google Chrome
• Mozilla Firefox
• Safari
• Opera
• Microsoft Internet Explorer
• Microsoft Edge
• Safari for iOS (iPhone and iPad)
• Chrome for Android

Please be aware that restricting cookies may impact the functionality of the Websites. For example, refusing cookies will not allow Medesto to present the Websites in your preferred language or remember your log-in information. Additional general information about cookies, including how to be notified about the placement of new cookies and how to disable cookies, can be found at www.allaboutcookies.org.

Alternatively, you may visit the U.S. Federal Trade Commission’s website www.consumer.ftc.gov to obtain comprehensive general information about cookies and how to adjust the cookie settings on various browsers.