Privacy Policy

This is the Inspire Medical Systems, Inc. ("Inspire") privacy policy. This privacy policy explains (i) how we collect, use and share the information that you provide to us; and (ii) how you can exercise applicable privacy rights. Please read this privacy policy before using any Inspire services, including the Inspire Website (as defined below), or submitting personal information to us.

This privacy policy covers the operation of Inspire and, except when otherwise specifically stated in connection with a particular activity, applies to any information collected by Inspire about you, including any and all information provided or collected on www.inspiresleep.com (the "Inspire Website"), other websites, mobile applications, devices, platforms, phone, email, chat, or text message communications, Inspire pages or ads on social media networks, such as our Facebook or Twitter pages, or other online service that displays, links to, or references this privacy policy (each of these collectively referred to as "Services" or "Inspire Services", and individually referred to herein as a "Service" or "Inspire Service"). By accessing, visiting, browsing, using, submitting information through, or otherwise interacting with any of these Services, you agree to the terms of this privacy policy. Whenever you submit information via any of these Services, you consent to the collection, use, and disclosure of that information in accordance with this privacy policy.

This privacy policy does not apply (i) to information collected from you offline, (ii) to Inspire websites that do not link to this privacy policy, or (iii) to third-party websites or services to which Inspire websites may link. Your use of these Services is governed by the terms and conditions of use located at https://www.inspiresleep.com/terms/.

The following types of information are examples of information that Inspire may collect that is not subject to this privacy policy, but rather to other agreements with you or a third-party governing how it is used or disclosed:

- Information collected pursuant to a Business Associate Agreement with a HIPAA Covered Entity;

- Information collected in the course of a clinical trial pursuant to an Informed Consent Agreement; and

- Information that you have authorized us to use or disclose under circumstances that are different than those specified in this policy.

Such information will be collected, used, and shared by Inspire as stated in such agreements, rather than those stated in this privacy policy.

Information Collection

Information you provide directly to Inspire. Inspire collects information that you enter into data fields on any of Inspire Services. Inspire collects a variety of information that may qualify as personal information under various laws, including the California Consumer Privacy Act ("CCPA"). We may have collected the following categories of personal information from consumers through Inspire Services:

Personal Information Category

• Identifiers such as
• Name
• Address
• Unique personal identifier (e.g., online identifier)
• Internet Protocol address
• Date of Birth
• Phone Number
• Email address
• Account name
• Social security number
• Driver's license number, or
• Other similar identifiers
• Characteristics of protected classifications under California/federal law (e.g., age, race, sex, disability status, veteran status, medical condition, etc.)
• Medical information (e.g., present diagnosis such as OSA diagnosis and whether you have or are attending a CHT screening, selection of a screening location and date, course of treatment such as a history of use of a CPAP, and other treatment related information such as doctor name and address, and how you heard about Inspire)
• Health insurance information
• Financial information, including employee banking information and commercial credit card numbers
• Biometric information (e.g., height, weight, BMI, sleep apnea analytics, medical history, or other data that contain identifying information)
• Commercial information (e.g., purchase history)
• National Provider Identification (NPI) number
• Internet or other electronic network activity information (e.g., browsing history, interaction with our website, computer and connection information such as browser type and version, operating system, and platform, the full Uniform Resource Locator (URL) clickstream to, though, and from the website, including date and time, cookie identifier and related cookie information, information you viewed or searched for, your mobile carrier and device type, etc.)
• Geolocation data
• Audio, electronic, visual, thermal, or similar information (e.g., call recordings)
• Professional, employment-related, or other similar information
• Educational information
• Inferences based on data analytics

Categories of Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from individuals' interactions with us, including with the website, our devices and software, desktop and mobile applications, by email, and phone, and through our patient ambassadors and representatives. For example, Inspire collects personal information that you enter into data fields on any Inspire website or app, or provide to Inspire in connection with the Inspire Services. When you engage with our online chat service through a website, a transcript of the conversation may be stored by us. When you engage in a phone or online chat conversation with us in connection with any of the Inspire Services, we may record the call, such conversation and your contact information may be stored by us. When you attend an Inspire online or in-person educational or informational session, we may record the session.
• Social media sites (for example, if you access third-party services, such as Facebook, Google, or Twitter, through the Inspire Services to login to Inspire Services or to share information about your experience on Inspire Services with others, or if you access Inspire Services while logged into those third-party services, we may collect information from these third-party services)
• Web browsers
• Advertising, marketing, and analytic service providers
• Mailing list providers
• Technology service providers
• Publicly available sources
• Health care providers (such as a sleep clinic or doctor, where permitted by law)
• Insurance providers
• Organizations with whom we partner to provide services to consumers
• Employees
• Human resources service providers
• Mailing list vendor

To protect your privacy, you should not provide Inspire with any information that is not specifically requested.

You understand that information you submit through the Inspire app, device, websites, and any Inspire platform generally will not be protected under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). However, there may be specific features or aspects of the app that relate to information governed by HIPAA. In such instances, you may be presented within the app or otherwise with patient directives or HIPAA authorizations that direct or allow medical providers to share information with Inspire.

Information Inspire Automatically Collects.

Certain information may be automatically collected (that is, gathered without you actively providing the information) using various technologies, such as cookies, Internet tags, web beacons, local storage objects, and navigational data collection (log files, server logs, clickstream).

Cookies.
Like many websites, we may use cookie technology to collect additional website usage data and to improve our services. A cookie is a small data file that is transferred to your computer's hard disk. Most Internet browsers automatically accept cookies. If you do not want cookies from Inspire or other websites, you can instruct your browser, by changing its settings, to stop accepting cookies or to prompt you before accepting a cookie from the websites you visit. Each browser differs, so check with your browser's manufacturer to understand how these controls function. However, some services may not function properly if you disable cookies.

Web Beacons.
Inspire may employ web beacons (also called single-pixel gifs), which are customized links or similar technologies, when sending you messages, newsletters, or promotional e-mails. We may keep track of how you interact with links across our services, including our email notifications. Web beacons allow Inspire to (a) determine whether you have opened, or acted upon, a promotional e-mail and which links you have clicked on in order to deliver to you more focused communications and other content, (b) allow Inspire to count the number of users who have visited certain web pages and effectively deliver co-branded services, and (c) enable Inspire to compile aggregated statistics and determine the efficacy of promotions by using web beacons from third parties, without allowing such third parties to use web beacons to collect or access your personal information.

Local Storage Objects.
Local storage objects (sometimes referred to as flash cookies) are similar to standard cookies except that they can be larger and are downloaded to a computer or mobile device by the Adobe Flash media player. Local storage objects can be controlled through the instructions on Adobe's Setting Manager page.

Third-Party Service Providers.
Inspire may use a variety of third-party services to help provide Inspire Services, such as developing and hosting the Inspire Website, any other websites, operating a call center to support the Inspire Services, to help us understand the use of Inspire Services, and to provide you with advertising. We may also collect or otherwise gather information related to you from these third-party service providers. These third-party service providers may collect, store, and share information as further dictated by the privacy policies of those third parties.

The Inspire Services, including our websites, may contain links to other websites and embedded content that comes from other websites and services, and now or in the future we may use buttons from other websites and services such as social media websites, and these third parties may use cookies or other tracking devices to collect and track information about you across the Internet. In general, you can identify these social media buttons and the companies they represent by their logos. Several of these third parties may use cookies or other tracking devices to collect and track information about you over time and across the Internet. We are not responsible for the privacy practices or the content of these other websites or companies or their data collection practices. You should check the privacy policies of these other websites and companies when providing personally identifiable information or to find out what other information they collect from users, whether while on their platform or website or in relation to links, buttons, or embedded media. We are not responsible for the privacy practices or the content of these other websites or entities or their data collection practices.

Google, Inc. may use the data collected to track and examine the use of our websites to prepare reports on its activities and share them with other Google, Inc. services. We may use Fabric and Crashlytics and its integration into Firebase in certain parts of our apps, each of which are subject to Google's privacy policy. Google, Inc. may also use the data collected to contextualize and personalize the ads of its own advertising network to serve ads to you based on your visit to our websites and other sites on the Internet. You may view Google's privacy policy here: https://policies.google.com/privacy?hl=en, with more information located here: https://www.google.com/policies/privacy/partners/ (including information regarding how to control how information is shared through your Ads Settings) and here: https://support.google.com/analytics/answer/6004245?hl=en

You can prevent the collection of the data generated by Google Analytics in relation to your use of our websites and the processing of this data by downloading and installing the browser plug-in, with more information regarding how you can opt-out of Google Analytics data collection as instructed here: https://tools.google.com/dlpage/gaoptout This link provides instructions for installing an opt-out cookie on your device. As a result, the collection of data by Google Analytics is prevented in future for the website and browser as long as the opt-out cookie remains installed in your browser.

We also use Zoom for operating our online educational or informational session and use of the Zoom platform is subject to Zoom's own Privacy Policy, which can be viewed here: https://zoom.us/privacy, along with Zoom's general legal and privacy terms here: https://zoom.us/privacy-and-legal

We may also use various Facebook services in relation to the Inspire Services. For example, we may live stream our online educational or informational sessions on Facebook. In addition, using the pixel tracking, we can keep track of what users do after they see or click on a Facebook advertisement. The pixel tracking enables us to monitor the effectiveness of Facebook ads for purposes of statistics and market research. Facebook may connect this data with your Facebook account and use it for its own advertising purposes, in accordance with Facebook's Data Policy which can be found at https://www.facebook.com/about/privacy/. You can allow Facebook and its partners to place ads on and outside of Facebook. A cookie can also be saved on your device for these purposes. You can opt-out of various Facebook advertising options here: https://www.facebook.com/settings?tab=ads

Additional general information regarding opt-out from interest-based advertising from companies belonging to the Network Advertising Initiative can be found here: http://optout.networkadvertising.org/#!/, information regarding opting out through the Digital Advertising Alliance can be found here: http://optout.aboutads.info/#!/.

Storage of Information

Inspire may store any of the information collected pursuant to this privacy policy on its own servers or those of its vendors. Personal information you provide by filling out forms on our websites or in connection with Inspire Services are stored in encrypted form. This information will be decrypted and used to provide and enhance the Inspire Services and as otherwise indicated in this privacy policy.

Our Use and Disclosure of Information Collected

We have used or disclosed the personal information we collect for our operational purposes and for one or more of the following business purposes:

• To develop, provide and improve products and services to consumers
• To respond to consumer requests
• To provide customer service
• To connect you with medical providers
• To share information collected through the Inspire Services with medical providers for purposes such as their understanding your familiarity with Inspire therapy
• To improve and personalize consumer access to and experience on our websites, for example, by telling and surveying consumers about new features, products, or services that may be of interest to them
• To enhance products and Inspire Services
• To develop and maintain records, including records of consumers' personal information
• To contact consumers, through phone calls, emails, SMS (Short Message Service), or messaging apps, with information that might be of interest to them, including information about their doctor appointments, clinical trials, and about products and services of ours and of others
• For advertising and marketing
• For analytical purposes and to research, develop, and improve programs, products, services and content
• For activities to monitor and maintain the quality or safety of our products and the Inspire Services
• For activities described to consumers when collecting their personal information or as otherwise permitted under CCPA
• For U.S. healthcare providers, to link name, National Provider Identifier (NPI), state license number, and/or IP address to web pages they visit, for compliance, marketing, and sales activities
• To conduct audits and perform troubleshooting activities of our websites, products, and services
• To detect and protect against security incidents and deceptive, malicious, or fraudulent activity
• To protect someone's health, safety or welfare
• To ensure the websites, products, and apps, and other Inspire Services function as intended, including debugging and repairing
• To combine with other information and to create data that does not have any personal identifiers, such as names, e-mail address, or social security number, that identify you as a unique individual. Once we have de-identified information, it is non-personal information and we may treat it like other non-personal information.
• For human resources purposes, employment application and hiring, and employee-related activities. When you submit an inquiry about a job through an Inspire website, we may use the information you provide to match your experience and preferences with the job openings we have, and someone from Inspire may contact you about a possible employment opportunity. Please note that by submitting your information regarding employment opportunities with Inspire, you authorize us to transmit and store your information in our recruitment database.
• For training purposes
• For verifying customer information
• Evaluating ambassadors and patient representatives
• To comply with a law or regulation, court order or other legal process or to protect our rights or property, including without limitation to enforce this privacy policy and other terms and conditions regarding your use of the Inspire Services. We may use and disclose personal information in special instances when we have reason to believe disclosing this information is necessary to investigate, identify, contact, or bring legal action against someone who may be causing injury to or interfering with our rights or property, other website visitors, or anyone else. We may disclose visitor information when subpoenaed, if ordered or otherwise required by a court of law, arbitrator, or other similar proceeding or the rules governing such a proceeding, for government investigations, with government agencies if required by law, and when Inspire otherwise believes in good faith that any applicable law requires it.
• If you are enrolled in a clinical study, as described in the clinical study informed consent.
• If you have directed your provider to provide personal information for use in Inspire's Care Tracker Program, to administer that program in accordance with the separate authorization you completed when you enrolled in that program.
• In connection with an actual or potential sale, merger, acquisition, assignment, or other transfer of the business of Inspire, or as part of a reorganization, bankruptcy, or change in ownership or control, in which case we will require any such recipient to use personal information in accordance with this privacy policy.
• We also may disclose personal information to any other person with your consent.

How We Share Personal Information

Inspire may share personal information with any member of our corporate group.

In the ordinary course of business, we will share some personal information with companies that we hire to perform services or functions on our behalf such as marketing and advertising service providers, technology service providers, security service providers, analytics service providers, mailing and shipping providers, and employee-related service providers.

We may be required to release consumers' personal information in response to a court order, subpoena, search warrant, law, regulation, or government investigation. In addition, we may keep, disclose, and use consumers' personal information to comply with U.S. FDA and other governmental guidance, directions, regulations, and laws.

Inspire may share your information with health care providers to assist or aid in your treatment. For example, we may share personal information: with non-Inspire staff at health care providers' offices for the purpose of setting appointments or finding area providers, when you have requested that we do so, and contacting you to set appointments or attend a community health talk after you have completed a form to make such a request; with medical providers and their staff for purposes such as their understanding of your level of education regarding the Inspire products and services or so that they can assist with and track your therapy journey through the Care Tracker or otherwise; with Inspire therapy patient ambassadors, when you indicate an interest in contacting them; and as described in any informed consent that you have executed as a study subject. When you use our find a doctor feature and e-mail a doctor, the information you provide to be e-mailed will be sent to that doctor. If you are enrolled in a clinical study, we may keep, use and disclose personal information as described in the clinical study informed consent.

If you engage with an Inspire therapy patient ambassador by choosing, for example, to send them an e-mail, the information you provide will be sent to that ambassador. When you attend an in-person or online educational session sponsored by Inspire, you understand that your identity, and any information that you choose to disclose about yourself, either visually, verbally or in writing, will not be private. Other participants and presenters may be able to see and/or hear you or your communications, the presentation may be recorded and shared, the presentation may be live-streamed on Facebook or other platforms, and the online platform may not be secure.

Security

We use reasonable measures to help protect information from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. You should understand that no data storage system or transmission of data over the Internet or any other public network can be guaranteed to be 100 percent secure. Please note that information collected by third parties may not have the same security protections as information you submit to us, and we are not responsible for protecting the security of such information.

International Transfers

By using our websites and providing us with information, you understand and agree that your information may be transferred to and stored on servers located outside your resident jurisdiction and, to the extent you are a resident of a country other than the United States, that you consent to the transfer of such data to the United States for processing by us in accordance with this privacy policy.

Children

Protecting the privacy of children is very important to us. For that reason, our websites and the Inspire Services do not solicit, collect, or maintain personally identifiable information from users we actually know are under age 18. If you are a parent or guardian, please contact us if you believe information regarding a child has been collected by us through Inspire Services.

Do Not Track

At this time, our websites do not honor ‘do not track' requests from web browsers.

ADDITIONAL STATE-SPECIFIC PRIVACY NOTICES

NEVADA

We do not sell your personal information, but nevertheless we offer an opt-out to sales of your data in an overabundance of caution to ensure compliance with Nevada law. Verified requests under Nevada law (NRS 603A) to not make any sale of any covered information we have collected or will collect regarding you may be sent to info@inspiresleep.com. Please include in your email "Request for Nevada Opt-Out" in the subject line and in the body of your message and please indicate in the body of your e-mail that the message is Attn: Privacy Officer.

CALIFORNIA

This notice for California residents supplements the information contained in our privacy policy and applies solely to residents of the State of California. Under the CCPA, you have certain rights in relation to some of your personal information, including the right to certain disclosures and explanations of rights. This section explains your rights under California law.

California consumers have the right to request that we disclose the personal information we collect, use, disclose, and sell. Please see the Submit a Request section below to request the personal information we collect, use, and disclose. Please also review the information generally in this policy regarding the categories of personal information we collect, the sources of personal information, the business or commercial purposes for which personal information is used, and the categories of third parties with whom personal information is shared.

The CCPA states it does not apply to a variety of types of information, such as health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data.

Categories of Personal Information We Sell

We do not sell personal information.

Rights under California Law

1. Right to Know. If you are a California consumer, you have the right to ask us to disclose to you the following information up to two times in a twelve-month period:

• The categories of personal information we have collected about you.
• The categories of sources from which we collected the personal information.
• Our business or commercial purpose for collecting personal information.
• The categories of third parties with whom we share personal information.
• What categories of personal data we disclose about you for business purposes.
• What categories of personal information we sell about you.
• The specific pieces of personal information we have collected about you, subject to certain limitations under CCPA regulations.

2. Right to Delete. If you are a California consumer, you have the right to ask us to delete the personal information about you we have collected. We may deny the request based on applicable exemptions.

3. Right to Opt-out. If a business sells personal information to third parties, California consumers have the right, at any time, to opt-out of the sale or disclosure of their personal information to third parties. Inspire does not sell personal information to third parties.

Submit a Request. To submit a request to know the personal information we have about you or to submit a request to delete your personal information, please email info@inspiresleep.com or call us at 763-205-7970. When you submit a request to know or delete, you must provide your first name, last name, and email address.

Authorized Agent. You may designate an authorized agent to make a request under the CCPA on your behalf. To be able to act, authorized agents must submit proof that they are authorized to act on your behalf. We may deny requests from claimed authorized agents who do not submit adequate proof that they are authorized to act on your behalf.

Verifying Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before complying with your requests. For example, for requests to know and delete, we will attempt to match your identity to the information stored in our files. If we cannot, we will ask you to provide additional identifying information. We will use information you provide in your request for the purpose of verifying your identity or authority to make the request.

Right to non-discrimination. You have the right not to receive discriminatory treatment by Inspire for exercising privacy rights conferred by the CCPA.

Contact for Inspire

If you have questions about our use of personal information, please contact us by any of the following:

- Emailing us at info@inspiresleep.com

- Sending a letter to the following address:

Inspire Medical Systems

Attn: Privacy Officer

5500 Wayzata Blvd., Suite 1600

olden Valley, MN 55416

Privacy Policy Changes

Inspire reserves the right to amend this privacy policy without prior notice for any reason including without limitation to reflect technological advancements, legal and regulatory changes, and good business practices. Please check back periodically, and especially before you provide any personal information.

This privacy policy was last updated and is effective on 13 May 2022.

800-772-000 rev B