Outset Medical Privacy Notice

• Introduction and Scope

  This Notice describes our practices regarding the collection and handling of personal information that we collect through our websites (“Sites”), as well as from our offline interactions and our other business relationships with you. It only applies to situations where we decide the purposes and means of how we collect and process your personal information (the “Services”).

  If you are a patient or caregiver of a patient who uses an Outset Medical Tablo product, please refer to additional information in the Tablo Hub User Agreement, and any information provided to by your health care provider regarding your personal health information collected by Outset Medical via the Tablo Portal. If you have additional questions, you can contact us using this form. Please note that Outset Medical does not have access to your complete medical records, and that if you have questions about your medical records or your medical care, you should contact your healthcare provider directly.

  By using our Sites and otherwise interacting with us, you agree to the terms of our Terms of Use, including this Notice.

  “Personal information” generally means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked with you. In some places, “Personal Information” may include not just you, but the members of your household. The laws in some places may define personal information more broadly than described above. Finally, other places’ laws may exclude certain information about you, such as your business contact details, from the definition of personal information. In interpreting this Notice, we will apply the definition of personal information in the laws that apply to you.

  This Notice is meant to apply generally, but there may be additional information available if you are providing us with your personal information because you are a job applicant, employee or independent contractor engaged with us. If you are an applicant for a job at Outset Medical, please refer to the Outset Medical Applicant Privacy Notice in our job application site for additional information specific for you. Alternatively, you can submit a request using this form for more information, or reach out to us using the methods described below. Current employees and contractors of Outset Medical should review the Associate Privacy Notice available on our intranet, or contact your People Operations representative for more information.

• Business Data

  When we perform work for our customers, we may collect and use personal information to provide our services to them. The terms of our customer contracts, and not this Notice, may govern our collection, use, and disclosure of that personal information. This Notice is not intended to address the handling of confidential information that is not personal information, such as financial information or technical data that may be proprietary or constitute a trade secret.

• Information We Collect About You

  Below we describe the categories of personal information we may collect from or about you

  Identifiers	Name, alias, personal pronouns, contact details (such as e-mail addresses, phone numbers, physical addresses, and fax numbers), unique personal identifier, medical record number, online identifier, account name, IP address, date of birth, social media handles, instant messaging account, signature, physical characteristics or description, passport number, driver’s license or state identification card number, insurance policy number, and similar information.
  Commercial Information	If you reach out to us via social media, we will collect information you make available or that references you on the internet, including on social media, blogs, websites, news and educational journal articles. We may collect information about you if you indicate that you are interested in learning more about our products, such as your experience with our products or with hemodialysis, your current kidney health status, whether you are a potential patient or a caregiver of a patient, and your current healthcare provider information and geographic location to direct you to a participating facility to discuss your options. We may also collect contact information to respond to your request for more information.
  Professional or Employment Information	If you are interested in working for or with us, we may obtain information such as details about the programs and activities in which you have participated, including conferences, focus groups, speaker programs and other events, and opinion data such as survey responses. We will also collect professional and employment-related information, such as a description of your current or prospective positions, job title, employer, location, specialty, salary and primary working location (e.g., hybrid, remote, or in-office); and professional history, including professional certifications and licenses, and institutional or other affiliations.
  Educational Information	If you are interested in working for or with us, we will collect your educational history, such as education level obtained, school attended, certifications, awards and degrees received, years attended, major/minor and any specialties, and performance at school.
  Audio, electronic, visual, thermal or similar sensory information	If you visit one of our offices, we will obtain CCTV footage according to our policies. With notice to you in advance we may prepare recordings during audio or video calls, focus groups, user groups, usability testing, conferences or events, testimonials, and otherwise. If necessary during a disease outbreak, pandemic, or other public health crisis we may obtain temperature readings and similar sensory data to determine whether you are exhibiting signs of fever or infection.
  Protected Classification Characteristics	If required by law, or to provide you with services that you request, we may obtain your age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition (such as COVID-19 status, disability and accommodation information), physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status.
  Internet and Other Electronic Activity Information	When you access our Sites, we may collect information about your use of systems or devices, including your system or network ID, IP address, operating system type and version number, manufacturer and model, screen resolution, browser type, browser version, the pages of a Site you visit, the time and date of your access to a Site, unique device identifiers, user name and passwords, and usage activity (such as clicks and views) and diagnostic information, including access logs, activity logs, and electronic content produced using our systems. We may also collect other diagnostic data along with information your browser sends us when you visit our Sites including when you access our Sites through a mobile device, or when you click on an ad for our products or visit a partner site that you accessed via a link on our Site. We also use cookies and other similar technologies on our Sites. Refer to our Cookie Policy for further details.
  Inferences, preferences, and other information	This category of information includes the use of information, data, assumptions, or conclusions from any other category of personal information to create a profile about you that reflects your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes. We may make inferences about you based on combing your personal information and additional information about you, such as your contact mode preferences, calendar availability, contact time preferences, language preferences, and other similar information.
  Consumer Health Data	Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This includes (but is not limited to) the following examples: information about your health conditions, treatment, diseases, or diagnosis; social, psychological, behavioral, and medical interventions; health-related surgeries or procedures; use or purchase of prescribed medication; bodily functions, vital signs, symptoms, or measurements of your body; diagnoses or diagnostic testing, treatment, or medication; gender-affirming care information; reproductive or sexual health information including reproductive health care; biometric data; genetic data; precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies; and data that identifies you when seeking health care services. If you attend a conference or event that we host, we may collect information about your dietary preferences or health conditions necessitating special accommodations (such as a food allergy). Click here for more information about how we process Consumer Health Data.
  Sensitive Personal Information	This category of Personal Information may be specifically defined under applicable privacy laws in the place where you live. We will apply the definition of Sensitive Personal Information that applies to you based on where you live. Sensitive Personal Information may include your government ID numbers, such as your social security, driver’s license, state identification card, or passport number; your account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; your precise geolocation (generally, location data within a specified radius of your exact location or location within a certain radius of sensitive places such as hospitals or family planning centers); your racial or ethnic origin, religious or philosophical beliefs; your union membership affiliation; your biometric information where it is used to uniquely identify you; information about your mental or physical health or diagnoses, including information that may indicate access to reproductive healthcare, including pregnancy, fertility, termination, or contraception; genetic data; information regarding your sex life or sexual orientation; and in some cases, the contents of your mail, emails and text messages unless we are the intended recipient of the communication. Please note, we do not collect genetic information or neural data at this time, and have not done so for at least 12 months prior to the date of this Notice.

  We have collected the same categories of personal information in the 12 months prior to the date of this Notice.

• Categories of Sources From Which We Collect Personal Information

  The source of this information may be directly from you via a webform or submission of a request, or gathered from your internet browser as you use our website. For more information about how we collect data and personal information from your internet browser or your use of our website, please read our Cookie Policy.

  We collect personal information from you whenever you interact with our Services (such as when you create an account, register for events, download content, or answer a survey) or when we interact with you offline, such as when you visit a facility, attend an event or trade show, or talk to us over the phone.

  We also may collect information about you from other sources in the ordinary course of business, including, for example, data aggregators who may not have a direct relationship with you or from other third parties who collect information about you on behalf of Outset Medical.

  We also may collect information about you automatically, such as when we log certain information about your interactions with a Site or Service or from other systems, such as when you are in a facility that has installed CCTV security cameras.

• How We May Use Your Personal Information

  We may use your personal information for the following purposes:

  Pursuant to a contract or other agreement with you	To prepare to enter into, or to perform, a contract or other relationship with you, including the development, compliance, undertaking and performance of a contract, such as when you agree to participate in usability testing, market research, speak at a forum or provide audio-visual testimonial data, or provide other services to us.
  To provide information about our business, the industry, and our solutions	With your consent, to provide you with news, special offers, contests, sweepstakes, events, marketing communications, and general information about our products and services and the industry; to advertise online and offline, which may be targeted to you based on your use of the Site(s), Services, or your activity elsewhere online and offline; to communicate with you about products, Sites, and Services, including by sending you announcements, updates, security alerts, and support and administrative messages; to communicate with you about events, surveys, or questionnaires; to assign a unique identifier to the personal information we collect about you, or combine this data or other information that we collect from or about you with other personal information about you, and use that information to supplement our existing databases; to undertake analytics and insights for purposes consistent with this Notice; to understand your needs and interests, and personalize your experience with our Sites, Services, advertisements and other communications. If you have reached out to us because you are interested in learning more about our products, we may collect contact information to respond to you, and obtain information about your location and experience with dialysis in order to direct you to the most appropriate healthcare provider to discuss your options, including our products.
  To engage in research and development	To engage in research and development purposes, including collection of information about your experiences with or opinions about Outset Medical or topics of importance in the industry via surveys, focus groups and other online or offline research activities; to engage in social listening (reviewing information about us, our products and the industry posted to public sources, such as social media), to understand how Outset Medical, its products, and the dialysis market are perceived, and to address market needs including product enhancements; to recruit for, enroll, or conduct clinical studies or to gather real-world evidence. With the exception of information that we are required to provide to by law, you may opt out of receiving these contacts from us.
  To operate our business, including our Sites, Services and products	To process transactions associated with our Services; to provide, manage, and receive products and services; to provide support and maintenance for our Sites, Services and products; to improve and develop our business processes, Sites and Services; to create and administer your accounts with us; to attend to and manage your requests to us; to answer questions you have asked us and address concerns you have raised; to otherwise communicate with you; to provide recall and safety notices; to report adverse events and complaints; and to complete regulatory filings. If you are an existing user of our products, we may contact you with information that we believe will make your use of our products safer and easier. With the exception of information that we are required to provide to by law, you may opt out of receiving these contacts from us. We also use cookies and other similar technologies on our Sites. Refer to our Cookie Policy for further details.
  To protect ourselves and others and comply with laws	To protect our, your, or others’ rights, privacy, health, safety, or property, including, as permitted by law, by collecting reasonable information about vaccinations and infectious disease symptoms and exposure; to undertake reasonable efforts to monitor the use and security of our Sites, networks, assets, and facilities; to deter, identify, and investigate alleged fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft; to pursue and/or defend legal claims and manage disputes; to audit our internal processes for compliance with our legal and contractual requirements and internal policies; to enforce the terms and conditions that govern our Sites, Services and agreements; to create reports and information required to comply with product safety and efficacy, including clinical study reporting, pre-market authorization information, and post market reporting, including adverse event reporting; to respond to lawful requests from governmental authorities, including writs, subpoenas, or legal discovery processes; and to undertake other efforts to protect ourselves and others and to comply with applicable law.
  Sensitive Personal Information	We collect and process Sensitive Personal Information only with your consent, or when permitted or required by law. Use and disclosure of Sensitive Personal information is restricted within Outset and our partners to those individuals with a job-related need to know. Examples of reasons we may collect Sensitive Personal Information include performing services for you (including providing you with information you request) or providing goods or services to you or with your consent; to prevent, detect, and investigate security or privacy incidents; to resist crimes, cyberattacks, or malicious, deceptive, fraudulent, or illegal actions directed at Outset and to prosecute those responsible for those actions; to ensure the physical safety of persons; and to perform customer service activities on your behalf, such as to direct you to providers of our products in your area, to maintain or service accounts, provide repairs or troubleshooting assistance, or to verify a user’s account information or identity. We may use technologies that tell us when you have clicked on certain pages or forms on our website for the purpose of determining whether the forms on our website are useful and interesting, and for the purpose of counting how many unique visitors we receive to the pages and content on our website. We also track the number of visitors to our Site who request additional information about our products. Some of this technology may be present on pages or webforms where you are also able to provide Sensitive Personal Information to us. You may continue to use our Sites, including these pages and forms, without interacting with these technologies by setting your preferences in our cookie banner, and any Sensitive Personal Information that you provide to us via our Sites will be used solely to respond to your request and to ensure that our Sites are functioning as intended. We do not collect Sensitive Personal Information for the purpose of inferring characteristics about you, such as by combining it with other publicly available information to create a profile of you. If we engage in other uses we will do so with your consent (or explicit consent as required) or as otherwise required or permitted by law.

  We may de-identify or collect de-identified data for these purposes described in this Notice. When collecting de-identified data, we will only process such data in a de-identified fashion and will not make any attempts to re-identify the data.

  We do not knowingly collect, process, use, disclose, share, or sell the personal information of minors under the age of 18. Our website and our products are not intended for use by anyone under the age of 18.

• How We May Disclose Your Personal Information

  We may disclose your personal information with others in the following situations:

  • Service Providers and Consultants: We may disclose your personal information to service providers and consultants who need it to perform their services for us. For example, we may host our Sites and Services on a service provider’s computers or process payment or use analytics companies to help us analyze data we collect from our Sites and Services. We also may work with third parties to ensure our Sites are functioning properly, and to assist us with administering them.

  • Business transfers: We may disclose or transfer your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of our business to another company.

  • Our Advisors: We may disclose your personal information to our professional advisors, such as our lawyers, tax advisors, technical advisors, bankers, auditors and insurers, when necessary in the course of providing the professional services that they render to us.

  • Business Partners: We may disclose your personal Information to our current or potential customers or with our other business partners, such as third-party advertisers, in the course of pursuing business or to offer you certain products, services or promotions. This may include partners who help us to understand how people find our Sites, where they go after they leave our Sites, what they do while on our Sites, and how they interact with our Sites. If you choose to opt in to social media or targeted tracking technologies, these partners may obtain information about your internet activity after you have left our Sites. For more information, please review our Cookie Policy.

  • Law Enforcement, Regulators, or Others as Required by Law: In certain circumstances, we may disclose your personal information if we are required to do so by law or in response to valid requests by public authorities (such as a court or a government agency), or in connection with an investigation of fraud, for the administration of justice, to prevent or address potential intellectual property infringement, or other activity that is unlawful or that could, in our reasonable judgment, expose us or you to legal liability. We may also release personal information if, in our reasonable judgment, it may prevent the death or serious injury of an individual.

• Personal Information We Sold or Shared in the Previous Twelve Months

  We do not Sell or Share consumer health data or personal health information.

  If you choose to allow the use of cookies while using our Sites, from time to time we may sell personal information by allowing third parties that facilitate digital advertising to place cookies and other trackers that collect information about your browsing and interactions with other websites and to use that information to deliver information to you about products and services in which you may be interested. This allows us to reach people that are most likely to be interested in the products or Services we provide. The data may be used to provide you with personalized content and present you with third party products or services in which you may be interested. For more information about the use of cookies and trackers, see our Cookie Policy.

  You may change your options in our cookie banner at any time.

  To exercise your right to opt out of sales and sharing of personal information, please click here.

• Retention of Your Personal Information

  We consider several factors in determining how long we retain personal information. For example, we retain your personal information for as long as your account is active; for as long as is necessary to fulfill the purpose described in this Notice or for which it was collected, or as otherwise required or permitted by law (for example, to resolve disputes, protect our assets, and enforce our legal agreements and policies). We also may retain information to support retention policies and processes designed to accommodate availability of information, or to enable us to pursue or defend our rights or those of others during applicable limitations periods. At the end of the retention period, we will either securely delete or destroy your personal information, or we will de-identify it so that it no longer constitutes personal information.

• Use or Disclosure of Sensitive Personal Information

  We do not use or disclose sensitive personal information to create inferences or profiles about individuals or for any purposes other than providing our Services or with your consent.

• Automated Processing

  Automated decisions: (a) are made about individuals; (b) are based exclusively on the automated processing of personal information; and (c) produce legal effects that significantly impact the individuals about whom they are made. Although we may use automated tools to help facilitate our decision making, all consequential decisions about individuals are overseen by a member of our workforce. If we engage in automated decision making, we will inform you that your personal information is subject to automated processing, and, as required by law, provide you with an opportunity to engage with us, and object to, the outcome of the automated decision-making process.

• Our Legal Bases

  In some jurisdictions, we must inform you of the legal bases we may rely upon to collect and further process your personal information. Accordingly, the following legal bases apply to the personal information that we may collect from you:

  • To prepare to enter into an agreement or relationship with you, or to perform our agreements with you;

  • To comply with a legal obligation;

  • For our legitimate business interests, which will be assessed in connection with the specific use of your personal information; or

  • With your consent (or with your explicit consent if required by law), which we will request from you.

• Withdrawing your Consent

  When we process your personal information based on your consent or your explicit consent, you may always withdraw your consent in whole or in part at any time. Once we have received your notice to withdraw your consent, we will no longer process the personal information for the purpose(s) to which you originally consented unless there are compelling legitimate grounds that override your interests, rights and freedoms. For example, we may continue to process your personal information to comply with a legal obligation, or for the establishment, exercise, or defense of legal claims. If we process your personal information for direct marketing purposes, you have the right to object at any time, in which case we will stop processing your information for such purposes. Withdrawal of your consent does not affect the lawfulness of any processing that we undertook prior to your action to withdraw consent. If you withdraw consent to future processing of your personal information, we may not be able to contact or interact with you as originally planned when you first provided your consent. You may use the form here to withdraw your consent, or contact us directly at the addresses provided in the Contact Us section of this Notice.

• Transfer of Your Personal Information

  Outset Medical is based in California, USA and has offices in California, USA and Tijuana, Mexico. Your personal information is processed at our operating offices and in any other places where the parties involved in the processing are located, such as where our service providers are located. As a result, your personal information may be transmitted to, accessed from and/or stored in locations outside of where you live, where the data privacy laws may be different.

  When we transfer your personal information to another jurisdiction, it is our practice to take steps designed to ensure that your personal information is treated in accordance with this Notice, and that transfers of your personal information to an organization or a country will be subject to adequate controls designed to protect the confidentiality, integrity, and availability of your personal information.

• Security of Your Personal Information

  The security of your personal information is important to us, and we maintain reasonable administrative, technical and physical safeguards that are designed to protect your personal information from accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

• Your Individual Rights

  In some jurisdictions, you may be entitled to exercise certain rights relating to your personal information. Even where applicable law provides for these rights, they may be subject to certain conditions, limits, and exceptions. These rights may include the following:

  • Request that we confirm whether we process your personal information, and if we do, to obtain access to and certain information about it;

  • Require us to correct your personal information if it is inaccurate or incomplete;

  • Direct us to stop processing your personal information under certain circumstances;

  • Request that we erase or delete your personal information, for example, where it is no longer needed to achieve the purpose for which it was collected;

  • Request that we restrict the further processing of personal information, including under some laws, to opt out of the processing of the personal information for purposes of (i) targeted advertising, or (ii) the sale of personal data;

  • Request that you not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you; or

  • Request to receive your personal information for transmission to, or if required by law, to directly transmit it on your behalf to another data controller in a structured, commonly used and machine-readable format.

  You may make seek to exercise your individual rights by clicking here or by contacting us via one of the mechanisms provided in the Contact Us section of this Notice. We will process your requests in accordance with applicable law.

  If you wish to exercise your rights related to the medical or other personal health information that we process as a service provider to your healthcare provider, please contact your healthcare provider directly.

  To protect your privacy, we will take reasonable steps to verify your identity before complying with any rights requests. We will ask for your name and the nature of your relationship with Outset in order to identify you in our systems. We will also ask for your state of residence to confirm which specific laws are applicable to your request. Finally, we will ask for a method of contacting you for additional information or to confirm that your request has been received and acted upon. If you fail to verify your identity, we may be unable to fulfill your request.

  In certain jurisdictions, we are required to honor a request made about you by your personal representative. We may ask that individual for additional information to verify that they are legally entitled to receive your personal information or to exercise your rights on your behalf.

  Your requests will typically be fulfilled at no charge to you. However, in certain cases, applicable law may entitle us to charge a fee. If we are entitled to charge a fee and intend to do so, we will notify you before charges are incurred, and follow procedures required by law.

  In certain circumstances, applicable law may permit us to deny your request. If we deny your request, we will inform you of the reasons why we did so. You may appeal a denial by contacting the Outset Medical Data Privacy Office at [email protected]. You may also be entitled to file a complaint with your local regulator.

  You may have additional rights based on the state or country of your residence, which are described in separate sections of this Notice.

• Your Privacy Choices

  You may elect to receive recurring marketing or promotional communications from us. Our communications will include instructions on how to update information about yourself, and how to unsubscribe from our e-mails. You may also contact us at [email protected] to unsubscribe or to adjust your marketing preferences. If you elect to unsubscribe from some or all communications, we will complete your request within 30 business days, or sooner if required by law.

  In addition, some of our business partners that collect information about your activity on or through our Sites may participate in programs that provide you with choices regarding the use of your browsing behavior or mobile application usage for purposes of targeted advertising. You may opt out of receiving targeted advertising on websites through members of the Network Advertising Initiative by clicking here, the Digital Advertising Alliance by clicking here, the European Interactive Digital Advertising Alliance by clicking here, or the Digital Advertising Alliance of Canada, by clicking here. Please note that we also may work with companies that offer their own opt-out mechanisms who therefore may not participate in the opt-out mechanisms linked above.

  Finally, your browser or mobile device settings may provide functionality to limit our ability to use cookies, to alert you before a cookie is dropped onto your computing device, or to limit our ability to otherwise engage in ad tracking or targeted advertising, including by location, using the advertising ID associated with your mobile device and/or location settings. If you choose to turn on settings blocking cookies or opting-out of targeted advertisements and/or if you turn off location settings, you may still see advertisements online, but they may not be relevant to you.

  Please refer to our Cookie Policy for more information about our cookies practices, and more information regarding how to change your cookie settings.

• Do Not Track Signals

  Global Privacy Control signals are opt-out signals communicated through the browser-based extension offered through the Global Privacy Control, a non-profit that has developed a technological tool that can be used universally to signal a user’s privacy preferences. Due to the technical limitations of the Global Privacy Control’s extension, requests made through their extension apply only to the device on which the request is made (e.g., a specific computer) and will only work with the browser used to activate the opt-out setting.

  Our Sites recognize and will respond to Global Privacy Control signals.

  Please refer to our Cookie Policy for more information about our cookie practices, and more information regarding how to change your cookie settings.

• Children’s Privacy

  Our Sites are not designed for, and we do not knowingly collect personally identifiable information from, users under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal information via our Site(s), please contact us via email at [email protected]. If we become aware that we have collected personal information from anyone under the age of 18 without verification of parental consent, we will take steps to remove it from our systems.

• Changes to this Notice

  We may update this Notice from time to time. When we do so, we will update the Effective Date at the top of this Notice. In addition, when there are material changes to this Notice, we will post a notice on our Site advising you of the update. We encourage you to review this Notice periodically for any changes. Changes to this Notice are effective when they are posted on this page. Your continued use of the Site after the posting of any amended Notice constitutes your agreement to be bound by any changes.

• Third Party Websites

  Our Sites may contain links to other third-party websites, which may have privacy policies that differ from our own. We are not responsible for the activities and practices that take place on these websites. Accordingly, we recommend that you review the privacy policies posted on any website that you may access through our Sites.

• SMS Text Messaging

  Certain people may have the option to receive SMS (text) messages from us or our service assistance vendor. These messages are sent solely for technical support, troubleshooting, and customer service purposes related to our products and services – for example, equipment troubleshooting assistance, service requests, parts inquiries, and work order updates. We do not use this SMS service to send marketing, promotional, or advertising messages. Your mobile phone number and any personal information collected in connection with this SMS service will be used only to provide the support and service assistance described above. We do not sell, rent, or share your phone number or SMS opt-in data with third parties for marketing or any other purpose. Your information is shared only with our service assistance vendor, and only as necessary to deliver these support services to you.

  Currently, opting into SMS messaging is restricted to our employees who use our service assistance vendor. Opting in is entirely voluntary. If you do not agree with what is described in this section, please do not opt in to receiving SMS messages from us. Your choice to receive or not receive SMS messages will not affect your relationship with us, your ability to use our Sites or our products, or your rights in relation to us.

  Either Outset or our vendor may send you an initial message with details about the support service. After that, message frequency will vary depending on your support and service interactions, such as requesting a follow-up response via text. We will not charge you for messages you receive through this service, but standard message and data rates may apply from your wireless carrier depending on your plan. If you no longer want to receive text messages, you may simply stop initiating them, or reply STOP at any time to unsubscribe, and interact with us or our vendor through another channel. If you opt out, we may send you a one-time text confirming your choice. You can reply HELP at any time for assistance.

• Accessibility

  We are committed to ensuring that our communications are accessible to people with disabilities. To make accessibility-related requests or report barriers, please contact us at [email protected].

• Contact Us

  We value your input and feedback. If you have any questions, comments or concerns about this Notice or our personal information handling practices, you can contact us via the webform on our website, or using these methods:

  By E-mail at:	[email protected]
  By Post at:	Attn: Privacy Officer c/o Outset Medical Legal Department 3052 Orchard Drive San Jose, CA 95134
  By Phone at:	+1-844-MY TABLO (+1-844-698-2256)

• California Resident Information And Rights

  If you are a resident of California, the following information and rights may apply to you. In this section of this Notice, we may also refer to California Residents as “Consumers.”

  Excluded Information

  Certain information is not subject to this section. The excluded information includes:

  • Consumer information that is lawfully made available from federal, state, or local government records or information that we have a reasonable basis to believe is lawfully made available to the general public from widely distributed media or by you; or information made available by a person to whom you have disclosed the information if you have not restricted the information to a specific audience;

  • Consumer information that is de-identified or aggregated;

  • Certain healthcare information, including information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) or the California Confidentiality of Medical Information Act (CMIA);

  • Personal information covered by certain privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or the California Financial Information Privacy Act, and the Driver’s Privacy Protection Act of 1994;

  • Personal information that is processed for scientific research purposes, including clinical trials, provided that the information is processed subject to applicable ethics, confidentiality, privacy and security requirements;

  • Any information that we process on behalf of another company, including healthcare information, in which case that company’s privacy statement, policy, and/or notice will control; and

  • Any other information that is excluded by applicable California laws.

  Categories of Personal Information We Collect and Disclose

  We summarize below the categories of personal information that we collect from you and the third parties who may receive personal information about you when disclosed by us. For more information about the categories of personal information (including specific examples of each category), see the Information We Collect About You section in this Notice.

  Category of Personal Information Collected	Categories of Third Parties to Whom we have Disclosed Personal Information for a Business Purpose
  Identifiers	Service Providers such as IT providers, SaaS providers, banking providers who process payments or reimbursements, and other providers who help us operate our business, including our Sites and Services; Advisors such as our legal counsel or insurers, who help to ensure we operate our business in compliance with the law, who help us to defend ourselves against claims, demands, or lawsuits, and who provide counsel and advice to us and have a need to know your personal information to fulfill their tasks; Consultants such as business process consultants; Business Partners such as travel booking partners and customers or potential customers (for example, in the case of healthcare practitioners who engage with customers or potential customers); Advertising partners, as described in this Notice.
  Customer Information	Service Providers such as IT providers, SaaS providers, banking providers who process payments or reimbursements, and other providers who help us operate our business, including our Sites and Services; Consultants such as business process consultants; Business Partners such as travel booking partners and customers or potential customers (for example, in the case of healthcare practitioners who engage with customers or potential customers)
  Commercial Information	Service Providers such as IT providers, SaaS providers, banking providers who process payments or reimbursements, and other providers who help us operate our business, including our Sites and Services; Consultants such as business process consultants; Business Partners such as travel booking partners and customers or potential customers (for example, in the case of healthcare practitioners who engage with customers or potential customers); Advertising partners, as described in this Notice
  Professional or Employment Information	Service Providers such as IT SaaS providers, Service Providers who help us operate our business, and Consultants such as business process consultants
  Audio, electronic, visual, thermal, or similar sensory information	Service Providers such as IT SaaS providers and Service Providers who help us operate our business such as CCTV providers, photographers and videographers; Business Partners such as customers and potential customers (for example, in the case of healthcare practitioners who engage with customers or potential customers)
  Protected Classification Characteristics	Service Providers such as IT SaaS providers, Service Providers who help us operate our business, and Consultants such as business process consultants; Advisors such as our legal counsel or insurers, who help to ensure we operate our business in compliance with the law, who help us to defend ourselves against claims, demands, or lawsuits, and who provide counsel and advice to us and have a need to know your personal information to fulfill their tasks; Business Partners such travel booking partners
  Internet and Other Electronic Activity Information	Service Providers such as IT SaaS providers, Service Providers who help us operate our business, and Consultants such as business process consultants or IT consultants; Business Partners such as benefits providers and travel booking partners; Advertising partners, as described in this Notice and in our Cookie Policy.
  Inferences, preferences, and other information	Service Providers such as IT SaaS providers, Service Providers who help us operate our business such as skills, aptitude or other assessment providers, and Consultants such as business process consultants; Business Partners such as travel booking partners, customers or potential customers (for example, in the case of healthcare practitioners who engage with customers or potential customers); Advertising partners, as described in this Notice and in our Cookie Policy.

  We may also disclose the above categories of personal information (a) to our Affiliates, including any parent or subsidiary corporations; (b) to comply with federal, state, or local laws; (c) to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities; (d) to cooperate with law enforcement agencies concerning conduct or activity that we believe may violate federal, state, or local law; (e) when we sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction); or (f) to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.

  Individual Rights of California Residents

  As a California Resident you have certain rights in relation to your personal information.

  Your Right to Request Disclosure of Information We Collect and Share About You. We are committed to ensuring that you know what personal information we collect. To that end, you can ask us for any or all of the following types of information regarding the personal information we have collected about you in the previous 12 months:

  • Specific pieces of personal information we have collected about you;

  • Categories of personal information we have collected about you;

  • Categories of sources from which such personal information was collected;

  • Categories of personal information that the business sold, shared, or disclosed for a business purpose about the consumer;

  • Categories of third parties to whom the personal information was sold, shared, or disclosed for a business purpose; and

  • The business or commercial purpose for collecting or selling your personal information.

  Your Right to Correct Inaccurate Personal Information. Upon your request, we will correct personal information we have about you, taking into account the nature of the personal information and the purposes of the processing of the personal information. We will take steps to determine the accuracy of the personal information that is the subject of your request to correct, and in doing so will consider the totality of the circumstances relating to the personal information you have identified as being incorrect. We may ask that you provide documentation regarding your request to correct in order to assist us in evaluating the request.

  Your Right to Request Deletion of Personal Information We Have Collected About You. Upon your request, we will delete the personal information we have collected about you, subject to certain legal exceptions.

  Your Right to Ask Us Not to Sell or Share Personal Information We Have Collected About You.

  Our Sale or Sharing of Personal Information

  From time to time we may sell personal information by allowing third parties that facilitate digital advertising to place cookies and other trackers that collect information about your browsing and interactions with other websites and to use that information to deliver information to you about products and services in which you may be interested. We may also share personal information in certain instances where we disclose it for purposes of engaging in cross-context advertising.

  We do not knowingly sell the personal information of minors under the age of 18.

  We do not knowingly sell consumer health data or protected health information.

  Opting Out of the Sale of Personal Information

  You can direct us not to sell your personal information by submitting an opt-out request through our Data Request Form, or by contacting us at [email protected] or 844-MY TABLO (844-698-2256). We will act on your request within the timeframes set forth below.

  Your Right to Ask us Not to Share Personal Information We Have Collected About You. You can direct us not to share your personal information by submitting an opt-out request through our Data Request Form, or by contacting us at [email protected] or 844-MY TABLO (844-698-2256). We will act on your request within the timeframes set forth below.

  Global Privacy Control. We recognize and respect Global Privacy Control browser settings.

  Exercising Your Rights and How We Will Respond

  To exercise any of the rights above, or to ask a question, contact us at [email protected] or 844-MY TABLO (844-698-2256), complete and submit our Data Request Form, or use the contact details set out in this Notice.

  For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We will provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than 45 days to fulfill, we will let you know.

  For requests to stop the sale or sharing of your personal information, we will comply no later than 15 business days after receipt of your request.

  We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

  If you believe your privacy rights have been violated, you can submit a complaint to the California Privacy Protection Agency or to the California Attorney General.

  Our Commitment to Honoring Your Rights

  If you exercise any of the rights explained in this policy, we will continue to treat you fairly.

  Identity Verification

  We are required to verify the identity of the individual submitting a request to access or delete personal information before providing a substantive response to the request. Where possible, we will attempt to verify your identity by asking you to confirm information that we have on file about you or your interactions with us. Where we must ask for additional personal information to verify your identity, we will only use it to verify your identity or your authority to make the request on behalf of another consumer. You do not need to create an account with us to exercise your rights. If you fail to verify your identity, we cannot fulfill your request. We will notify you to explain the basis of the denial.

  Authorized Agents

  You can designate an “authorized agent” to submit verifiable consumer requests on your behalf. The agent can be a natural person or a business entity.

  If you would like to designate an agent to act on your behalf, you and the agent will need to comply with our verification process:

  • Requests to Know, Delete or Correct Personal Information: If the agent submits a request, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the request on your behalf. We will also require that you verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request.

  • Requests to Opt-Out of Sale or Sharing: If the agent submits a request to opt out of the sale of your personal information or the sharing of your personal information for purposes of cross-context behavioral marketing, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf.

  Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with California law pertaining to powers of attorney.

  Shine the Light

  California Civil Code Section 1798.83, also known as the “Shine the Light” law, permits California residents to annually request, free of charge, information about certain categories of personal information a business has disclosed to third parties for direct marketing purposes in the preceding calendar year.

• Washington Residents – Additional Information and Rights

  Residents of the state of Washington have additional rights related to the collection and use of Consumer Health Data. Click here for more information about how we process Consumer Health Data.

• Colorado Residents – Additional Information and Rights

  Outset Medical does not process neural information. If at any time in the future we do begin to collect this information, we will obtain your consent prior to collection and processing.

• Connecticut Residents – Additional Information and Rights

  Outset Medical may use artificial intelligence tools to conduct its business. However, we will not use personally identifiable information to train artificial intelligence systems such as large language models (LLMs). We do not permit the use of protected health information in artificial intelligence systems.