InspireMD Privacy and Cookie Policy

Effective Date: October 20, 2026 | Last Updated: October 20, 2026

Version POL-0002982 1.0

About This Policy

This Privacy and Cookie Policy (“Policy”) describes how InspireMD, Inc. and its affiliated entity InspireMD Ltd. Or any other future affiliated entity (collectively “InspireMD”, “we”, “our”, or “us”) collect, use, share, and protect personal data in connection with our website at www.inspiremd.com and its subdomains (the “Website”) and other business activities of us.

This Policy complies with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Israeli Privacy Protection Law (Amendment No. 13). Where specific provisions apply to particular jurisdictions, these are noted explicitly.

If you are a resident of the Adequacy List Country, the UK and other states, additional rights may apply to you and are described in this Policy.

Data Controller	InspireMD, Inc. 6303 Waterford District Drive, Suite 215, Miami, FL 33126, USA, and in referenced with affiliated entity above: InspireMD Ltd. 4 Menorat Hamaor St. Tel Aviv, Israel 6744832 Tel Aviv, Israel.
Privacy Contact / DPO	privacy@inspiremd.com
Last Updated	October 20, 2026

1. Who We Are
2. Scope of This Policy
3. What Personal Data We Collect
4. How We Collect Your Personal Data
5. Purposes and Legal Bases for Processing
6. Special Categories of Personal Data
7. How We Share Your Personal Data
8. International Data Transfers
9. Data Retention
10. Your Rights
11. Cookie Policy
12. Security
13. Links to Third-Party Websites
14. Children’s Privacy
15. Direct Marketing
16. Changes to This Policy
17. How to Contact Us

1. Who We Are

InspireMD is a medical device company dedicated to reducing stroke risk through innovative carotid artery stenting solutions. Our flagship product, the CGuard™ Embolic Prevention System, features a dual-layer micro-mesh stent designed to capture embolic material during and after carotid artery stenting procedures.

We operate globally, selling mainly in Europe through distribution and direct and primarily for the United States, with distribution partners across the rest of the world. We interact with hospitals, medical centers, surgeons, clinicals, interventional cardiologists and other medical professionals, regulatory authorities, distributors, and investors worldwide, and act in accordance with acceptable standards of medical devices industry, regulated by FDA and more.

2. Scope of This Policy

This Policy applies to:

Personal Data processed through our website (https://inspiremd.com) (the “Website“), including Contact Us forms, Subscribe Alerts;
Personal Data and Special Categories of Personal Data processed in connection with our products and services, including adverse event and complaint handling process or other customer services;
Personal Data of healthcare professionals, distributors, vendors, and business contacts;

“Personal Data” shall mean any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, including Special Categories of Personal Data (as specified below).

“Special Categories of Personal Data” shall mean additional types to general Personal Data (also known as sensitive personal data) which are highly relevant because they are subject to a higher level of protection. These data include genetic, biometric and health data, as well as personal data revealing racial and ethnic origin, political opinions, religious or ideological convictions.

Pay attention:

Such definitions (from GDPR) may be changed with modifications between different states, so that we may collect more data types of Personal Data and Special Categories of Personal Data in accordance with other jurisdictions regulations.

This Policy does not cover data processing in clinical trial contexts, which is governed by separate clinical trial agreements and ethics committee approvals. If you are a participant in a clinical trial sponsored or co-sponsored by InspireMD, please refer to the Informed Consent Form you received. Where InspireMD acts as Sponsor of a clinical trial, data processing related to trial participation is governed exclusively by the applicable Informed Consent Form and trial-specific agreements.

3. What Personal Data We Collect

We collect different categories of personal data depending on your relationship with us. Below is a description of each data subject group.

3.1 Website Visitors and Inquiries

When you use our Contact Us form or otherwise reach out to us via the Website, we collect data as follows:

Contact type (e.g., clinician, researcher, patient, distributor, investor,3rd party)
Contact interest.
Full name
Email address
Phone number
Address
Free-text message content.

When you use our investor relations page, you may choose to subscribe to our alerts, mainly as a traded entity on SEC. As you request, you will be required to mark fields of your personal interest as follows:

Quote
SEC filing
Event
News
Weekly Summary.
Email.

Following that stage, an initial email sent by us to you will ask you to affirm your subscription to such interests. For more details, please review section 15 (Direct Marketing).

3.3 Healthcare Professionals and Distributors

In connection with our sales, marketing, and customer support activities, we collect data about healthcare professionals and distributor contacts, including:

Full name, professional title, and medical specialization
Contact details: phone number, email, institutional affiliation, address
Records of interaction, meeting notes, and event attendance

We receive this information directly from the individuals, through distributor partners, or at medical conferences and events.

3.4 Patients (Complaint and Adverse Event Reporting)

As a medical device manufacturer, we are required by law (likewise EU Health Authorities and FDA) to collect and process information about adverse events and product complaints. When we receive a complaint through our official complaint channel (complaints@inspiremd.com) or through a distributor, we may process (as provided by your discretion as the reporting healthcare professional) personal information. Including special category as follows:

A clinical case description, including a description of the medical condition and health impact following product use, including clinical signs and symptoms.
Age, medical history, pre-existing conditions, and current medications.
Anatomical data and diagnostic imaging files, more familiar as Digital Imaging and Communications in Medicine (DICOM)
Procedure details and patient outcome.

Important Notice on Patient Data

Patient data received in this context constitutes Special Categories of Personal Data under GDPR Article 9 and other privacy regulations. We take safeguard actions like anonymization procedure for all DICOM files and related imaging data.

Our complaint forms include a clear instructions to healthcare professionals NOT to include identifying patient information (such as name, ID number or any identifiable data) in submitted materials. Only data strictly necessary for initial or post-implementation procedure and regulatory compliance are processed. We also urge the person completing the form to redact/remove any such identifiers before uploading and submitting the document.

Processing of this data is based on our legal obligation under medical device regulations and, where required, explicit consent.

That said, should any such information reach us mistakenly or other reasons, it will be handled with appropriate protection safeguard and confidentiality in line with our security standards.

3.5 Clinical Trials Participants

As a clinical trial Sponsor, we are required by applicable regulations (including FDA and CFR) to collect and process information about individuals participating in InspireMD-sponsored clinical trials. When we receive data through the trial site, or directly via trial-specific channels, we may process (as provided under the Informed Consent Form signed by the participant) personal information, including special categories, as detailed under the Informed Consent Form. We may inform participants under separate documents, subject to applicable laws.

If you subscribe to our Investor Alerts or Email Updates through the Website, we collect:

Full name and email address
Company affiliation (optional)
Chosen content preferences (events, news, weekly summaries, SEC filings)

We may use a double opt-in process (powered by our suppliers) to verify your consent before adding you to any distribution list.

4. How We Collect Your Personal Data

We collect personal data through the following channels:

Directly from you, when you complete a form on our Website, contact us by email or phone, subscribe to our mailing list for events alerts or attend a conference where we are present.
From our distributors and direct customers, who may relay product complaints or adverse event reports from patients or healthcare professionals, through dedicated emails also.
From our telephone system, which logs calls for follow-up purposes.
From your browser or device, automatically via cookies and similar tracking technologies when you visit our Website (see Section 11).

5. Purposes and Legal Bases for Processing

The table below sets out the key purposes for which we process personal data, and the legal basis we rely on under GDPR Article 6 (and Article 9 where applicable for Special Categories of Personal Data).

Purpose	Legal Basis (GDPR Art. 6)	Data Subjects
Responding to contact form enquiries and general communications	Legitimate interests / Performance of a contract	Website visitors, customers
Post-market surveillance and complaint handling (adverse events)	Legal obligation (regulators) / Vital interests	Patients, Healthcare professionals
Clinical trial conduct and participant safety monitoring	Consent (opt-in)/ Medical study/ Legal obligation	Clinical trials Participants
Sales, marketing and business development (targeted communications. mailing lists)	Consent (direct digital marketing – opt-in)	Investors, Distributors, Leads and subscribers, Potential business partners
Investor relations and regulatory filings	Legal obligation / Legitimate interests Consent (opt-in)	Investors, Patients, Healthcare professionals
Providing and improving the Website (analytics, cookies)	Consent (opt-in)/ Legitimate interests	Site visitors
Complying with legal requests (regulators, courts)	Legal obligation	All data subjects

Some of legal basis above may be changed or not be relevant in certain jurisdictions.

6. Special Categories of Personal Data

Certain categories of data are subject to enhanced protection under GDPR Article 9. InspireMD processes the following Special Categories of Personal Data:

Health and medical data: collected via the complaint and adverse event reporting process, as required by medical device regulation. Processing is based on Article 9(2)(i) (public health and patient safety) and Article 9(2)(c) (vital interests), and where required, on explicit consent (Article 9(2)(a)).

We apply access controls, anonymization, and data minimization principles to all Special Categories of Personal Data.

We share personal data only where necessary and under appropriate legal safeguards. The categories of recipients are:

7.1 Regulatory Authorities

We may be required by law to disclose complaint, adverse event, or product recall data to health authorities, including the NASDAQ (or through Trustee, by applicable law), Health regulators: FDA (USA), European, and the Israeli Ministry of Health and parallel governmental entities in EU. Such disclosures are made on the basis of our legal obligations under applicable medical device regulations.

We may share complaint and adverse event data with our designated Notified Body as part of our conformity assessment and post-market surveillance obligations under EU MDR.

As a non-EU manufacturer, we use EU Authorized Representative services before EU authorities. Relevant safety and vigilance information may be shared with or processed through our Authorized Representative as required by EU medical device regulations.

In the event of a field safety corrective action “FSN” (such as a product recall or field safety notice), we may share relevant safety information with the competent health authorities, to be in compliance with applicable medical device regulations. Such information may include the business contact details of affected healthcare professionals and distributors and limited complaint and incident data, which does not directly identify patients.

7.2 Distributors

Our distribution partners worldwide relay complaints and adverse event reports on behalf of healthcare professionals and patients. Distributors are bound by contractual provisions requiring them to handle personal data in accordance with applicable law. In the EEA, distributors act as data processors.

7.3 Service Providers (Data Processors)

We work with vetted third-party providers who process personal data on our behalf under written Data Processing Agreements. These include:

Website analytics: Google Analytics
Cloud infrastructure: Microsoft, Azure.
Product and Financial ERP: Priority.
Communication and call-logging: AnswerConnect
Email marketing: SendGrid (Twilio)
IT infrastructure and support: SubIT (US-based MSP)

All processors are required to implement appropriate technical and organizational security measures and may not sub-process data without our written authorization.

7.4 Investors and Capital Markets

Our American entity, InspireMD, Inc. is a publicly listed company (NASDAQ), certain disclosures to investors and the SEC are legally required and do not involve personal data beyond what is mandated by securities law. Usually, investor contact regarding securities, trade options and relative rights shall be proceed with Trustee, while Company reports and conference data shall be proceed through Investor Contacts.

Investor Contacts:

Jeff Warren, LifeSci Advisors

jwarren@lifesciadvisors.com; investor-relations@inspiremd.com

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections.

7.6 Legal Proceedings

We may disclose personal data to courts, law enforcement, or other health authorities where required by applicable law, subpoena, or legal process.

8. International Data Transfers

InspireMD operates globally. Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA) or the United Kingdom, including the United States and Israel.

We ensure that such transfers are conducted with appropriate safeguards, including:

Standard Contractual Clauses (SCCs) approved by the European Commission – for transfers from the EEA to third countries;
Israel is recognized as an adequate country by the European Commission under Article 45 GDPR – transfers to our Israeli entity do not require additional safeguards;
Transfers to the United States are made under SCCs and, where applicable, along supplementary technical measures.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by applicable law. The following general retention periods apply:

Data Category	Retention Period
Website contact form data	Up to 3 years from last contact
Complaint / adverse event records (patient data)	Life of product + regulatory minimum (typically 10+ years), per EU MDR and FDA requirements
Healthcare professional contact data	Until termination, unless consent is withdrawn
Investor / mailing list data / leads	Until unsubscribe or deletion request is received. Leads – up to 1 year (subject to non-conversion).
Cookie data	As described in Section 11 (varies by cookie type)

At the end of the applicable retention period, personal data is securely deleted or anonymized. We review our retention practices annually.

10. Your Rights

Depending on your country of residence, you may have the following rights regarding your personal data. To exercise any of these rights, please see Section 10.4.

If you are located in the EEA or the UK, you have the following rights under Articles 15–22 GDPR:

Right of Access (Art. 15): You may request a copy of the personal data we hold about you, free of charge in most cases.
Right to Rectification (Art. 16): You may request that we correct inaccurate or incomplete data.
Right to Erasure (Art. 17): You may request deletion of your personal data where it is no longer necessary for the original purpose, consent has been withdrawn, or processing is unlawful.
Right to Restriction of Processing (Art. 18): You may ask us to restrict processing pending verification of accuracy or an objection.
Right to Data Portability (Art. 20): Where processing is based on consent or contract, you may receive your data in a structured, machine-readable format.
Right to Object (Art. 21): You may object to processing based on legitimate interests, including for direct marketing purposes.
Right Not to Be Subject to Automated Decision-Making (Art. 22): We do not currently make legally significant decisions about individuals using fully automated processing.
Right to Withdraw Consent (Art. 7(3)): Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We will respond to your request within one month. In complex cases, we may extend this by a further two months and will notify you accordingly.

10.2 Israeli Residents (Amendment No. 13 to the Privacy Protection Law)

If you are subject to Israeli law, you have the following rights under the Privacy Protection Law, 5741-1981 (as amended):

Right to Access (Section 13): You have the right to review the personal data we hold about you, in Hebrew, Arabic, or English.
Right to Correction (Section 14): You may request that inaccurate, incomplete, or outdated personal data be corrected or deleted.

To exercise these rights, please contact us at privacy@inspiremd.com. We will respond within 30 days.

10.3 California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

Right to Know: You may request details about the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties with whom it has been shared.
Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
Right to Opt-Out of Sale or Sharing: InspireMD does not sell personal information. We do not share personal information for cross-context behavioral advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
Right to Correct Inaccurate Information: You may request correction of inaccurate personal information.

To submit a CCPA request, contact us at privacy@inspiremd.com or use the contact details in Section 17.

10.4 How to Exercise Your Rights

To exercise any of the above rights, please fill our Data Subject Request Form (DSR) and send it to us by email at privacy@inspiremd.com or in writing at our address in Section 17. Please include your full name, contact details, and a description of your request. We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests, though we reserve the right to charge an administrative fee for manifestly unfounded or excessive requests.

11.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. They enable websites to recognize your device, remember your preferences, and provide certain functionality. Some cookies are strictly necessary for the Website to work; others are used only with your consent.

11.2 Types of Cookies We Use

Cookie Type	Purpose	Duration	Consent Required?
Strictly Necessary	Required for core functionality (navigation, forms, security), managing and protecting against unauthorized automated traffic on the website, maintaining session consistency to ensure a stable and user experience across interactions, detecting whether the browser supports display configuration to ensure content renders correctly. Records user’s accept/reject decision on cookie banner Cannot be disabled.	Session / up to 1 year	No consent required
Functionality / Preference	Stores per-category cookie consent preferences (WPConsent plugin). Remember and store your settings, consent preferences and other preferences (e.g., language, location).	30 days / Up to 1 year	Consent required
Analytics & Performance	Statistics: Understand how visitors use our website (e.g., Google Analytics). Data is aggregated and anonymized where possible.	Session	Consent required
Marketing / Targeting	Website traffic analytics via Google Site Kit -consent-gated. Google Analytics uses a set of cookies to identify and track users across sessions, distinguishing between new and returning visitors and measuring overall engagement over time. It captures traffic source and campaign data, allowing marketers to understand which channels – organic search, paid ads, or referrals – drive users to the Website. Short-lived cookies manage server request rates to ensure accurate and efficient data collection. Additional cookies support A/B and multivariate testing, ensuring users are consistently served the same experience within an experiment. Custom variable cookies allow developers to define tailored tracking beyond standard metrics, while link-level cookies measure which specific elements on a page users interact with. Together, these cookies form the backbone of data-driven decisions around marketing, user experience, and Website performance.	Session	Consent required

We use Google Analytics to analyze how the Website is accessed and used. Google Analytics collects information such as how often users visit, what pages they view, and what other websites they visited previously. We do not combine Google Analytics data with personally identifying information. For more information, see Google’s Privacy Policy at policies.google.com/privacy.

When you first visit our Website, you will be presented with a Cookie Consent Banner allowing you to choose which categories of cookies to accept. You can update your preferences at any time by clicking the “Cookie Settings” link in the footer of our Website.

You can also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Website. For more information about cookies and how to manage them, visit www.allaboutcookies.org.

12. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures are reviewed and updated periodically to reflect current risks and industry standards. While we take these steps to protect your data, no system is completely secure. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately at privacy@inspiremd.com.

13. Links to Third-Party Websites

Our Website may contain links to websites operated by third parties, including distributors, medical associations, and regulatory bodies. This Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party website you visit.

14. Children’s Privacy

Our Website is not directed at people under the age of 18, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us at privacy@inspiremd.com and we will promptly delete it.

15. Direct Marketing

The information collected by us may be used for direct marketing purposes (building a marketing profile to tailor advertisements and other communications based on personal characteristics). We send direct marketing communications (such as event invitations and investor updates) only to individuals who have provided explicit consent, via our double opt-in subscription process on the Website.

You may unsubscribe at any time by clicking the “Unsubscribe” link in any marketing email, or by contacting us at privacy@inspiremd.com. Unsubscribe requests are processed automatically and/ or monitored manually .

16. Changes to This Policy

We review this Policy at least annually and whenever there is a material change to our processing activities. When we make significant changes, we will update the “Last Updated” date at the top of this Policy and, where appropriate, notify you by email or by posting a notice on our Website.

We encourage you to review this Policy periodically. Your continued use of the Website after a change has been posted constitutes your acceptance of the revised Policy.

17. How to Contact Us

If you have any questions, concerns, or requests regarding this Policy or our data practices, please contact us:

Email (preferred)	privacy@inspiremd.com
Postal Address (US)	InspireMD, Inc. 6303 Waterford District Drive, Suite 215 Miami, FL 33126, USA
Postal Address (Israel)	InspireMD Ltd. 4 Menorat Hamaor St. Tel Aviv, Israel

— End of Policy —

InspireMD. | privacy@inspiremd.com | www.inspiremd.com