Effective date: September 1, 2026 Last reviewed: September 24, 2026

1. Who we are and what this policy covers

Kato Medical Inc. (“Kato Medical,” “we,” “us,” or “our”) is a medical technology company headquartered in San Diego, California. We develop software-driven surgical navigation systems, including the FasTrack™ navigation platform.

This Privacy Policy explains how we collect, use, share, retain, and protect personal information when you visit our website at katomed.ai (the “Website”), contact us, or otherwise interact with us as a surgeon, hospital or health system representative, ambulatory surgery center, distributor, investor, job applicant, or other business contact. It also describes the privacy rights available to you and how to exercise them.

Patient information is handled separately. When a hospital, surgery center, or other healthcare provider uses Kato Medical products or services, any patient information we process (including medical images) is processed on behalf of that provider and under our written agreements with it, including business associate agreements where required by the Health Insurance Portability and Accountability Act (“HIPAA”). That information is governed by those agreements and by the provider’s own privacy notices, not by this Privacy Policy. Patients with questions about their health information should contact their healthcare provider.

Regulatory status. Kato Medical’s technologies are in the final development phase and have not yet received clearance from the U.S. Food and Drug Administration (“FDA”). Nothing in this Privacy Policy is a claim about the safety or effectiveness of any product.

2. Information we collect

We collect only the personal information we need to respond to you and run our business. We do not ask for health information through the Website, and we ask that you not submit any.

Information you give us. When you use our contact form, email us, meet with us, or attend an event where we are present, we may collect:

your first and last name;
your email address, phone number, and mailing address;
your professional role (for example, surgeon, hospital or health system, ambulatory surgery center, distributor, or investor), employer, title, and specialty;
the content of your message and any follow-up correspondence; and
if you apply for a job, your résumé, work history, education, and references.

Information collected automatically. Like most websites, our Website and its hosting provider automatically record certain technical information in server logs when you visit. This may include your IP address, general location derived from your IP address (such as city or region), browser type, operating system, referring page, pages viewed, and the date and time of your visit.

Information from other sources. We may receive information about you from publicly available professional sources (such as LinkedIn or hospital and practice directories), from colleagues or partners who refer you to us, from our distributors, and from conferences and industry events. This typically adds details about your employer, specialty, or professional background.

3. How we use information

We use personal information for the purposes below. If you are in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, the right-hand column shows the legal basis we rely on.

Purpose	Legal basis (EEA, UK, Switzerland)
Responding to your inquiries and requests for information or demonstrations	Our legitimate interest in responding to you; steps you request before entering a contract
Managing relationships with surgeons, clinical advisors, healthcare facilities, distributors, and investors	Performance of a contract; our legitimate interest in running our business
Sending product, clinical, and company updates you have asked for or that relate to your relationship with us	Consent, where required; otherwise our legitimate interest in keeping business contacts informed
Evaluating job applications	Steps you request before entering a contract; our legitimate interest in hiring
Operating, securing, and improving the Website, including diagnosing technical problems and preventing fraud or misuse	Our legitimate interest in a secure, working Website
Meeting legal, regulatory, and quality obligations, including FDA and other medical device requirements, and responding to lawful requests	Compliance with a legal obligation
Establishing, exercising, or defending legal claims and enforcing our agreements	Our legitimate interest in protecting our rights

We do not use personal information collected through the Website for automated decision-making that produces legal or similarly significant effects on you, and we do not use it to build advertising profiles. If we want to use your information for a purpose that is materially different from those described here, we will tell you first and, where required, ask for your consent.

4. Cookies and similar technologies

Our Website uses only the cookies and similar technologies it needs to function and stay secure. We do not currently use advertising cookies, cross-site tracking pixels, or third-party analytics tools on the Website.

Strictly necessary technologies. Our website platform and contact form may set small files or use similar technologies to deliver pages, keep the site secure, prevent spam form submissions, and remember basic settings. The Website will not work properly without them.
Web fonts. Our Website displays fonts provided by Google Fonts. To deliver those fonts, your browser connects to Google’s servers, which receive your IP address and browser information. Google’s handling of that information is described in the Google Privacy Policy.

You can set your browser to block or delete cookies, although some parts of the Website may then not work as intended. If we add analytics, advertising, or other non-essential cookies in the future, we will update this Privacy Policy and, where required by law, ask for your consent first.

Browser signals. We treat a Global Privacy Control (“GPC”) signal as a request to opt out of any sale or sharing of personal information, where the law recognizes it. Because we do not sell or share personal information for targeted advertising, a GPC signal will not change how the Website works. There is no common industry standard for “Do Not Track” signals, and the Website does not respond to them differently.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising.We disclose personal information only as described below.

Service providers. Companies that host and maintain our Website, provide email, cloud storage, and business software, or otherwise perform services for us. They may use personal information only to provide services to Kato Medical, under written contracts that require confidentiality and appropriate security. A current list of our subprocessors is available on request at hhill@katomed.ai.
Professional advisors. Our lawyers, accountants, auditors, and insurers, who are bound by professional or contractual confidentiality duties.
Distributors and business partners. If you ask about our products in a region served by an authorized distributor, we may pass your contact details to that distributor so it can respond to you.
Regulators and legal requests. Where we believe disclosure is required by law, regulation, subpoena, court order, or other legal process, including requests from the FDA or other health or data protection authorities.
Protection of rights and safety. To enforce our agreements, investigate fraud or security incidents, or protect the rights, property, or safety of Kato Medical, our personnel, patients, or others.
Corporate transactions. In connection with a merger, financing, acquisition, reorganization, or sale of all or part of our business, subject to confidentiality obligations. Any successor will remain bound by this Privacy Policy for information it receives, unless you are notified otherwise.
With your consent or at your direction.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you. We will not attempt to re-identify de-identified information.

6. Data retention

We keep personal information only as long as we need it for the purposes described in this Privacy Policy, or longer where the law requires. When information is no longer needed, we securely delete it or de-identify it.

Type of information	How long we keep it
Website inquiries from people who do not become customers, partners, or investors	Up to 3 years after our last contact with you
Records of customer, clinical advisor, distributor, and investor relationships	For the length of the relationship, plus 7 years for contract, tax, and audit purposes
Job application materials	4 years after the hiring decision, as required by California law
Server and security logs	Up to 12 months, unless needed to investigate a security incident
Records required by FDA or other regulations	For the period the applicable regulation requires

We may keep information longer where needed to resolve disputes, enforce our agreements, or comply with a legal hold. You may ask us to delete your information at any time, as described in Section 8.

7. How we protect information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. Our security program is aligned with the SOC 2 Trust Services Criteria and includes:

encryption of personal information in transit and at rest;
role-based access controls based on least privilege, with multi-factor authentication for systems that hold personal information;
security awareness and privacy training for our personnel, who are bound by confidentiality obligations;
security and privacy review of service providers before we engage them;
continuous monitoring, logging, and vulnerability management of our systems; and
a documented incident response plan, including notice to affected individuals and authorities where the law requires.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your interaction with us is no longer secure, please contact us right away at hhill@katomed.ai.

8. Your privacy rights

Depending on where you live, you may have the right to:

Know and access the personal information we hold about you, including the categories of information, its sources, the purposes for which we use it, and the categories of recipients;
Correct inaccurate personal information;
Delete personal information, subject to legal exceptions;
Receive a copy of your personal information in a portable, commonly used format;
Object to or restrict certain processing, and withdraw consent where we rely on it;
Opt out of marketing communications at any time, using the unsubscribe link in any email or by contacting us; and
Opt out of any sale of personal information, sharing for targeted advertising, or profiling with legal or similarly significant effects (we do not engage in these activities).

How to make a request. Email hhill@katomed.ai or write to us at the address in Section 12. We will respond within the time the law requires (generally 45 days in the United States and one month in the EEA and UK), and will tell you if we need more time. We do not charge a fee unless a request is clearly unfounded or excessive.

Verification and authorized agents. To protect your information, we will ask you to confirm your identity, usually by matching information we already hold. You may use an authorized agent to make a request on your behalf; we will ask for proof of the agent’s authority and may ask you to verify your identity directly.

Appeals. If we decline your request, we will explain why. You may appeal by replying to our decision or emailing hhill@katomed.ai with the subject line “Privacy Request Appeal.” We will respond to your appeal within the time the law requires. If you are not satisfied, you may contact your state attorney general or data protection authority.

No discrimination. We will not treat you differently for exercising any of your privacy rights.

Additional information for California residents

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies, this section is our notice at collection. In the past 12 months we collected the following categories of personal information:

CCPA category	Examples	Sources	Disclosed for a business purpose to
Identifiers	Name, email address, phone number, mailing address, IP address	You; your device; referrals and public professional sources	Service providers; professional advisors; distributors (at your request)
Professional or employment information	Role, employer, title, specialty; job application materials	You; public professional sources	Service providers; professional advisors
Internet or network activity	Browser type, pages viewed, referring page, visit date and time	Your device	Service providers
General geolocation	City or region derived from IP address	Your device	Service providers

We use these categories for the purposes in Section 3 and keep them for the periods in Section 6. We have not sold or shared personal information in the past 12 months, and we have no actual knowledge of selling or sharing information of anyone under 16. If a job applicant gives us sensitive personal information, we use it only as permitted by law and not to infer characteristics about them.

California “Shine the Light.” We do not disclose personal information to third parties for their own direct marketing purposes.

9. International users and data transfers

Kato Medical is based in the United States, and we store and process personal information in the United States. If you contact us from another country, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

EEA, UK, and Switzerland. Kato Medical Inc. is the controller of the personal information described in this Privacy Policy. When we transfer personal information from the EEA, the UK, or Switzerland to the United States or another country that has not received an adequacy decision, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or on another lawful transfer mechanism. You may request a copy of the relevant safeguards by contacting us. In addition to the rights in Section 8, you have the right to lodge a complaint with the data protection supervisory authority where you live or work, or where you believe a violation occurred. We encourage you to contact us first so we can try to resolve your concern.

Mexico. If you are in Mexico, you may exercise your rights of access, rectification, cancellation, and opposition (“ARCO rights”) and revoke your consent under Mexico’s federal personal data protection law by contacting us as described in Section 8.

Other countries. If you live in another country with data protection laws that give you additional rights, please contact us and we will honor those rights as the law requires.

10. Children’s privacy and third-party sites

Children. Our Website and services are intended for healthcare professionals and other business audiences. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, please contact us and we will delete it.

Third-party sites. Our Website links to sites we do not operate, such as LinkedIn profiles of our team members. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

11. Changes to this policy and annual review

We review this Privacy Policy at least once a year, and whenever we make a significant change to how we collect, use, or protect personal information. The “Last reviewed” date at the top shows when we last completed that review, and the “Effective date” shows when the current version took effect.

If we make material changes, we will post the updated policy on this page and, where appropriate, notify you by email or through a notice on the Website before the changes take effect.

12. Contact us

Kato Medical has appointed a Privacy Officer who is responsible for this Privacy Policy and for responding to privacy questions, requests, and complaints. Please contact:

Hannah Hill, CLO and Privacy Officer

Email: hhill@katomed.ai