AliveCor Data Privacy Framework Notice
DATA PRIVACY FRAMEWORK NOTICE
Addendum to AliveCor, Inc. Privacy Policy (www.alivecor.com/privacy)
Effective Date: October 12, 2026
This Data Privacy Framework Notice (this “Notice”) supplements AliveCor, Inc.’s (“AliveCor”) Privacy Policy available at www.alivecor.com/privacy. This Notice describes AliveCor’s practices regarding personal data received from the European Union, the United Kingdom, and Switzerland in reliance on the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), collectively referred to as the “Data Privacy Framework” or “DPF.” Where any conflict exists between the terms of this Notice or AliveCor’s Privacy Policy and the DPF Principles, the DPF Principles shall govern. For more information about the DPF, please visit: https://www.dataprivacyframework.gov/.
1. DPF Participation and Certification
AliveCor, Inc. (“AliveCor”) participates in and has certified its compliance with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), as set forth by the U.S. Department of Commerce (collectively, the “Data Privacy Framework” or “DPF”).
AliveCor has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (the “DPF Principles”) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. AliveCor has also certified that it adheres to the Swiss-U.S. Data Privacy Framework Principles with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.
If there is any conflict between the terms of this privacy policy and the DPF Principles, the DPF Principles shall govern.
To learn more about the Data Privacy Framework program, please visit https://www.dataprivacyframework.gov/. To view AliveCor’s certification on the Data Privacy Framework List, please visit https://www.dataprivacyframework.gov/list.
2. Types of Personal Data Collected
AliveCor collects the following categories of personal data from individuals located in the European Union, the United Kingdom, and Switzerland:
| Category | Examples |
|---|---|
| Contact Information | Name, email address, mailing address, phone number |
| Account Credentials | Username, password, account preferences |
| Device and Usage Data | Device identifiers, operating system, app usage logs, Kardia device interaction data |
| ECG and Cardiac Health Data (Sensitive Data) | ECG recordings, heart rhythm classifications, cardiac health reports, clinical overread results |
| Payment Information | Credit or debit card number, billing address, transaction history |
| Customer Support Records | Inquiries, correspondence, support ticket details |
| Website and App Analytics | IP address, browser type, pages visited, in-app activity, cookies |
ECG and cardiac health data constitutes sensitive information under the Data Privacy Framework. AliveCor will not disclose sensitive data to third parties or use it for purposes materially different from those for which it was originally collected without first obtaining the individual’s affirmative express consent (opt-in). For information on exercising choices regarding personal data, see Section 5 (Choice) below.
3. Purposes of Processing
AliveCor processes personal data collected from individuals in the EU, UK, and Switzerland for the following purposes:
- Providing cardiac monitoring products and services, including the operation of KardiaMobile, KardiaMobile 6L, Kardia 12L, the Kardia app, KardiaPro, KardiaStation, KardiaComplete, and KardiaCare.
- Processing ECG recordings and delivering heart rhythm analysis results to users.
- Facilitating clinical overread services through Cardiac Health Medical Group, AliveCor’s cardiologist network.
- Managing user accounts, processing orders, and administering subscriptions.
- Providing customer support and responding to inquiries.
- Product improvement, research and development, and internal analytics to improve the quality and functionality of AliveCor’s products and services.
- Sending service-related communications, including product updates, safety notices, and, where consent has been obtained, marketing communications.
- Complying with applicable legal and regulatory obligations, including medical device regulations, tax requirements, and reporting obligations.
4. Disclosure to Third Parties
AliveCor may disclose personal data collected from individuals in the EU, UK, and Switzerland to the following categories of third parties:
- Service Providers: AliveCor engages third-party service providers, including cloud hosting providers and payment processors, that process personal data on AliveCor’s behalf. These service providers act as agents and are contractually required to provide the same level of protection as required by the DPF Principles.
- Healthcare Professionals: AliveCor may disclose ECG and cardiac health data to licensed healthcare professionals providing clinical overread services through Cardiac Health Medical Group, AliveCor’s affiliated cardiologist network. Because such data constitutes sensitive information under the DPF, AliveCor obtains affirmative express consent (opt-in) before any such disclosure, as described in Section 5 (Choice).
- Research Partners: AliveCor may share personal data with research partners for purposes of product improvement and clinical research, subject to applicable consent requirements and contractual safeguards.
- Regulatory Authorities: AliveCor may disclose personal data to regulatory authorities as required for compliance with applicable laws and regulations, including medical device reporting obligations.
- Disclosures Required by Law: AliveCor may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
For information regarding individuals’ rights to opt out of disclosures to non-agent third parties, see Section 5 (Choice). For information regarding AliveCor’s liability in cases of onward transfers, see Section 7 (Accountability for Onward Transfer, Security, and Data Integrity).
5. Choice
AliveCor provides individuals in the EU, UK, and Switzerland with the opportunity to choose (opt out) whether their personal data may be (a) disclosed to a third party (other than an agent performing services on AliveCor’s behalf), or (b) used for a purpose that is materially different from the purpose(s) for which the data was originally collected or subsequently authorized by the individual.
For sensitive personal data, including ECG recordings, cardiac health data, and other health-related information, AliveCor obtains affirmative express consent (opt-in) from the individual before (a) disclosing such data to any third party (other than an agent), or (b) using such data for a purpose materially different from the purpose(s) for which it was originally collected or subsequently authorized.
To exercise opt-out or opt-in choices, or to withdraw consent at any time, individuals may contact AliveCor at privacy@alivecor.com.
6. Right of Access
Individuals in the EU, UK, and Switzerland whose personal data AliveCor has collected have the right to access that personal data. Upon request, AliveCor will confirm whether it holds personal data about the requesting individual and, where it does, will provide the individual with a copy of such data. AliveCor will also provide information regarding the purposes for which the data is processed and the types of third parties to whom the data has been disclosed, to the extent reasonably available.
AliveCor may limit or deny access requests where the burden or expense of providing access would be disproportionate to the privacy risks in question, or where the rights of persons other than the requesting individual would be violated. Any such limitation will be consistent with the Access Principle of the DPF.
To exercise the right of access, individuals should submit a written request to privacy@alivecor.com. AliveCor will respond to access requests within a reasonable timeframe.
7. Accountability for Onward Transfer, Security, and Data Integrity
7.1 Accountability for Onward Transfer. AliveCor transfers personal data to third parties acting as agents only for limited and specified purposes consistent with the consent provided by the individual. AliveCor enters into written contracts with each agent requiring the agent to provide at least the same level of privacy protection as required by the DPF Principles. AliveCor takes reasonable and appropriate steps to (a) ensure that the agent effectively processes personal data in a manner consistent with AliveCor’s obligations under the DPF Principles, and (b) stop and remediate any unauthorized processing by the agent upon notice. AliveCor remains liable under the DPF Principles if an agent processes personal data in a manner inconsistent with the Principles, unless AliveCor proves that it is not responsible for the event giving rise to the damage.
7.2 Security. AliveCor maintains reasonable and appropriate administrative, technical, and physical security measures to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the personal data.
7.3 Data Integrity and Purpose Limitation. AliveCor limits the collection of personal data to information that is relevant for the purposes of processing. AliveCor does not process personal data in a way that is incompatible with the purposes for which it was collected or subsequently authorized by the individual. AliveCor takes reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and current, and retains personal data in a form identifying or rendering an individual identifiable only for as long as it serves a purpose of processing consistent with the DPF Principles.
8. Recourse, Enforcement, and Binding Arbitration
8.1 Independent Recourse Mechanism. AliveCor has designated JAMS as its independent recourse mechanism for complaints regarding non-HR personal data under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. Individuals who have an unresolved complaint after contacting AliveCor directly may file a complaint with JAMS at https://www.jamsadr.com/DPF-Dispute-Resolution at no cost to the individual.
8.2 Enforcement. AliveCor is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) with respect to its compliance with the DPF Principles.
8.3 Binding Arbitration. Under certain conditions, after exhausting other available dispute resolution procedures (including the independent recourse mechanism described above), an individual may invoke binding arbitration before a Data Privacy Framework Panel, as described in Annex I of the DPF Principles.
8.4 Disclosure to Public Authorities. AliveCor may be required to disclose personal information in response to lawful requests by public authorities, including requests made to meet national security or law enforcement requirements.
9. Relationship to Other Data Protection Laws and Contact Information
9.1 Relationship to Other Data Protection Laws. AliveCor’s participation in the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF is in addition to, and does not replace, AliveCor’s obligations under applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where applicable law provides greater protection than the DPF Principles, AliveCor will comply with such law.
9.2 Contact Information. For questions or concerns regarding this Data Privacy Framework Notice or AliveCor’s data privacy practices, individuals may contact AliveCor using any of the following methods:
- Email: privacy@alivecor.com
- Mail: General Counsel, AliveCor, Inc., 189 N. Bernardo Ave. Ste. 100, Mountain View, CA 94043
- Telephone: (855) 338-8800
AliveCor will respond to inquiries within a reasonable timeframe and in accordance with applicable legal requirements.