Privacy Policy

Last updated: June 2026

At TELA Bio, Inc., we understand that your privacy is important to you, and we are committed to protecting your privacy to the fullest extent of the law.

This Privacy Policy (“Privacy Policy”) explains how TELA Bio, Inc. and our affiliates (“TELA Bio,” “us,” “we,” “our,” or the “Company”) may collect, use, disclose, and otherwise Process Personal Data. This Privacy Policy applies when you: (i) visit our websites and mobile applications that link to it (each, a “Site”), and/or (ii) interact with us online or offline when this Privacy Policy is provided (collectively, use our “Services”).

This Privacy Policy does not apply:

• To websites, applications, or other points of contact with you that have a different privacy policy or notice posted or otherwise available.
• To your health care providers’ and health plan’s uses and disclosures of, and your rights regarding, the health information they or their processors create, receive, maintain, or transmit about you. We are not a “covered entity” or “business associate” as defined by HIPAA: while we may collect and process individually-identifiable health information as described in this Privacy Policy, it is not “protected health information”/PHI in our hands. Please review your providers’ and plan’s Notices of Privacy Practices and consult with them for more information about how they use and disclose your health information, and your personal rights.

Except as otherwise provided in Section VIII.B. with respect to data subjects in the European Union, European Economic Area, and the United Kingdom this Privacy Policy does not apply:

• If you represent a business entity that is interacting with us in a business-to-business capacity, unless you are a resident of California.
• To our Processing of your Personal Data as our job applicant, employee, owner, officer, director, or independent contractor.

Please also review our Terms of Use, which include guidelines and limitations that may affect your use of the Services. This Privacy Policy is integrated with and incorporates our Terms of Use.

By using our Services, you agree that you have read, understood, and accepted the Terms of Use and this Privacy Policy and to any updates to these documents posted from time to time. By continuing to use our Services after we update this Privacy Policy or our Terms of Use, you accept the documents as updated. If you do not agree, your only recourse is to not use or to stop using the Services.

Depending on where you live, you may be entitled to individual rights regarding some or all of your Personal Data. Please see Additional Notice to Certain Consumers of Processing and Data Subject Rights, below, for information that may apply to you.

I. DEFINITIONS

1. “Automated decision-making technology” or “ADMT” means any technology that Processes Personal Data and uses computation to replace or substantially replace human decision-making.
2. Except as otherwise provided in Section VIII.B., “Personal Data” (sometimes called “personal information”) is information that identifies, relates to, describes, is reasonably capable of being associated with or linked to, a particular individual or household. Personal Data includes Sensitive Personal Data, but does not include aggregated, deidentified, or publicly-available information.
3. “Process” means to perform an operation or set of operations on Personal Data, including collecting, using, storing, disclosing, analyzing, deleting, or modifying.
4. “Processor” means a person or entity that Processes Personal Data on our behalf. The term includes service providers and contractors as defined by applicable data protection laws.
5. “Sell” means to exchange Personal Data for monetary or other valuable consideration where we receive a material benefit and the recipient is not restricted in its further uses of the Personal Data. The following disclosures are not a “Sale” of Personal Data:

• When we disclose Personal Data to:
  • Our Processor.
  • Our affiliate.
  • A Third Party:
    • consistent with the consumer’s reasonable expectations, considering the context in which the consumer provided the Personal Data to us;
    • to provide a product or service requested by the consumer;
    • as an asset that is part of an actual or proposed merger, acquisition, bankruptcy, or other transaction in which the Third Party assumes control of all or part of our assets; or
    • to provide analytics or marketing services solely to us.
• When a consumer tells us to disclose their Personal Data to a Third Party, or intentionally uses us to interact with a Third Party.
• When we disclose information that a consumer has intentionally made available to the public via mass media and has not restricted to specific audience.

6. “Share” means to communicate (orally, in writing, or by electronic or other means) a consumer’s Personal Data to a Third Party for Targeted Advertising, whether or not for monetary or other valuable consideration, including transactions between us and a Third Party for Targeted Advertising for our benefit in which no money is exchanged.
7. “Significant Decision,” for purposes of our business operations, means a decision that results in the provision or denial of employment or independent contracting opportunities or compensation, or healthcare services.
8. “Targeted Advertising” means displaying an advertisement to a consumer where the advertisement is selected based on Personal Data obtained from the consumer’s activities over time and across nonaffiliated websites or online applications to predict the consumer’s preferences or interests. Targeted Advertising does not include:

• Advertising
  • based on a consumer’s activities within our Site or any affiliated website or online application;
  • based on the context of a consumer’s current search query or visit to a website or online application; or
  • directed to a consumer in response to the consumer’s request for information, product, a service, or feedback; or
• Processing Personal Data only to measure or report advertising performance, reach, or frequency.

9. “Third Party” means a natural or legal person, public authority, agency, or body other than us, the consumer, our Processor, or an affiliate of us or our Processor.

To the extent other terms used in this Privacy Policy are defined terms under applicable privacy law, they shall have the meanings given to them under those laws, whether or not capitalized in this Privacy Policy. Because there are variations among such definitions, the definitions applicable to you are those provided in the statute for the jurisdiction in which you are a consumer.

II. HOW WE COLLECT AND PROCESS PERSONAL DATA

 A. Notice at Collection of Personal Data

This section is designed to provide consumers with timely notice, at or near the point of collection of Personal Data, of certain information to help them exercise control over our use of their Personal Data:

1. Categories of Personal Data We Collect

The Personal Data we collect about a specific consumer, and the sources from which we collect it, depend on our relationship or interaction with that person. During the past twelve (12) months, we have collected the following categories of Personal Data:

• Customer records, including Personal Data described in Cal. Civ. Code § 1798.80(e), such as name, signature, email address, postal address, telephone number, employment, financial information (for payment), medical information.

• Characteristics of protected classifications under state or federal law, such race, color, ethnicity, sex, gender, medical condition, ancestry, age (over 40).

• Commercial information, such as records of products and services purchased, used, obtained, and/or considered, and purchasing or consuming histories and tendencies.

• Sensory information (audio, electronic, visual), such as call and video recordings, and, for visitors to our facilities, CCTV footage.

• Professional or employment-related information (primarily from health care providers and their representatives interested in our products), such as employer, job title, area of expertise.

• Sensitive Personal Data (primarily to meet our regulatory and other compliance obligations regarding the use of our products), such as race, ethnicity, age (>40), health information, and/or genetic information. Although we may collect information in this category, it is generally not considered to be “sensitive” under applicable law because we do not use or disclose it to infer characteristics about consumers.

During the past twelve (12) months, we also may have collected the following category of Personal Data:

• Internet or other electronic network activity information, such as IP addresses.

2. Our Purposes for Collecting and Using Personal Data

Our purposes for collecting and using Personal Data depend on our relationship or interaction with the particular consumer. We may collect and use Personal Data for the following business and commercial purposes, and for compatible purposes as permitted by applicable law. Our Processing may involve the use of automated methods such as artificial intelligence, but we do not use ADMT to make Significant Decisions about consumers:

We may also collect and process Personal Data for any other business and/or commercial purpose disclosed at the time of collection, or, when required by law, with consent.

3. Selling and Sharing Personal Data

We do not Sell or Share Personal Data.

4. Personal Data Retention

The length of time we retain a particular category of Personal Data varies, depending on the purpose for which we collected it, our business need for it, and our legal obligations with respect to it. We generally keep Personal Data for as long as is needed for the specific purpose(s) for which we collected it. In some cases, we may be required to retain Personal Data for a longer period of time by law or for other necessary or required purposes, such as our regulatory compliance. The criteria used to determine our retention periods include:

• the length of time we have an ongoing relationship with a consumer;
• whether there is a legal obligation to which we are subject that affects the length of time we need to keep Personal Data;
• whether we have determined that we must retain the information due to limitation periods, legal claims or litigation, or other legal or regulatory obligations; and
• whether the Personal Data is stored in our backup and/or disaster recovery systems.

TELA Bio takes commercially reasonable steps to securely delete or destroy Personal Data when we no longer need to keep it.

We may delete or destroy certain records that contain Personal Data in accordance with our routine retention policies. We are under no obligation to store Personal Data indefinitely and disclaim any liability arising out of, or related to, the destruction of Personal Data according to our retention policies.

B. Categories of Sources of Personal Data

We may collect Personal Data from the following categories of sources:

1. Consumers, including from persons, agencies, or companies acting on their behalf. We may collect Personal Data directly from the individual (for example, when the individual calls customer service or fills out a form), or from the device(s) the individual uses to access our Sites (see Cookies and other Website Technologies below).
   If you provide Personal Data about someone other than yourself, you represent that you are authorized to do so, and understand and agree that we will rely on that representation.
2. Our Affiliates.
3. Our Processors.
4. Third Parties, such as:
   • Health care providers related to a consumer’s use of or experience with our products.
   • Social media providers when consumers access our social site pages.
   • Internet service providers.
   • Data analytics providers.
   • Government entities.
   • Operating systems and platforms.

We may combine Personal Data we collect from one source with information collected from other sources.

III. HOW WE DISCLOSE PERSONAL DATA

 A. Categories of Personal Data We Disclose for a Business Purpose

During the past twelve (12) months, we may have disclosed the following categories of Personal Data (described in Section II.A.1.) for one or more business purposes:

• Identifiers
• Customer records, including Personal Data described in Cal. Civ. Code § 1798.80(e)
• Characteristics of protected classifications under state or federal law
• Commercial Information
• Internet or other electronic network activity information
• Sensory information
• Professional and employment information about health care providers and representatives interested in our products
• Inferences drawn from other Personal Data
• Sensitive Personal Data

B. Categories of Recipients

During the past twelve (12) months, we may have disclosed Personal Data in the categories listed in Section III.A. to the following categories of Third Parties:

• Health care providers and payers (e.g., to facilitate treatment, verify benefits, or process payments, and to investigate and respond to reported adverse events and product complaints reported to us).
• Government entities that regulate our company, products, and services.
• Successors to all or part of our business (e.g., in the event of a merger, acquisition, or asset sale).
• Law enforcement and other third parties, as necessary to protect health and safety and report crime.
• Insurance companies (e.g., to evaluate, secure, and maintain coverage and make claims).
• As required by law or in response to court orders or legal process.
• Internet service providers.
• Operating systems and platforms.
• Data analytics providers.
• Social networks when you interact with our social sites.

Although they are not Third Parties, we may also disclose Personal Data to Processors, such as:

• IT and information security vendors.
• Customer service vendors.
• Product development vendors.
• Logistics and fulfillment (e.g., product delivery, order fulfillment, and patient support) vendors.
• Professional advisors (e.g., attorneys, tax professionals, accountants, auditors, and consultants that provide legal, financial, forensics, investigation, or compliance advice).
• Marketing and advertising support vendors.

Our Processors have entered into written agreements with us that require them to safeguard Personal Data, and to restrict uses and further disclosures.

C. Business and Commercial Purposes for Disclosing Personal Data

We may disclose Personal Data about consumers for the following business and commercial purposes (described in Section II.A.2.):

• Internal operations
• Legal and regulatory compliance
• Detecting and preventing fraud and other illegal activity
• Marketing and advertising
• Product and service fulfillment
• Customer service

IV. COOKIES AND OTHER WEBSITE TECHNOLOGIES

 A. Use of Cookies and Other Website Technologies

We and/or certain Processors working on our behalf may collect Personal Data about consumers’ activity, or activity on devices associated with you over time, on our Sites. We collect this Personal Data by using technologies like “cookies,” which are small data files placed on the hard drive of your computer when you visit our Sites. Cookies are placed to recognize your specific browser/computer combination when you return to a Site.

We use both first-party and third-party cookies on our Sites. First-party cookies send data directly to us and our Processors, and include cookies used to monitor, analyze, and administer the Sites. We also use third-party cookies to help us analyze how you use the Sites, to store your preferences, and to provide the content most relevant to you. We do not allow Third Parties to place cookies on our Sites for their own commercial use.

You can decline most cookies by changing the cookie profile on your browser—you must reset your preferences if you change devices or browsers.

We also provide a cookie management tool (indicated by the icon on our homepage, www.telabio.com) that describes the cookies we set and allows you to customize your consent preferences. You cannot reject “Necessary” cookies because they are needed to enable the basic functions of our Site. If you reject or clear other cookies, some features of the Sites may not be available to you or may not function well.

We may use Google Analytics to provide us with information about traffic to and use of our Sites. You can find out more information about Google Analytics cookies here: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage. You can opt-out of having your activity on our Sites made available to Google Analytics by installing the Google Analytics opt-out add-on for your web browser by visiting: https://tools.google.com/dlpage/gaoptout for your web browser.

 B. “Do Not Track” Signals

The Do Not Track (DNT) signal is a setting in certain browsers that allows users to indicate that they do not want their online activities tracked across websites over time. Our Sites do not respond to DNT signals. However, our Sites do not collect tracking information except identification of the referring page and exiting page for each Site visit (i.e., the pages you navigate from and to when you visit or leave a Site).

V. THIRD PARTY LINKS AND PUBLIC COMMUNICATIONS

Our Services may contain links to other websites or services that we do not own or control, including links to social media platforms like LinkedIn, Facebook, X (formerly Twitter), or Instagram. These links may redirect you off our Services.

If you use any bulletin board, chat room, comment posting feature, or other public communication service, forum, or feature made available through (but outside) the Services, or post any information available for viewing by other visitors, the information you disclose will be visible to others, who may send you unsolicited messages outside of the Services. We are not responsible for how others use and disclose the information you choose to disclose outside the Services.

This Privacy Policy only applies to information collected by our Services. We are not responsible for the privacy and security practices of those other websites or social media platforms or the information they may collect. You should contact such Third Parties directly to determine their respective privacy policies. Links to any Third Party websites, social media platforms, or content do not constitute or imply our endorsement or recommendation of the linked website, social media platform, and/or content.

VI. DATA SECURITY

We have implemented and maintain commercially reasonable safeguards to protect the Personal Data we collect and otherwise Process. However, no information system or on-line transmission is or can be 100% secure or error-free. We cannot eliminate all privacy and security risks associated with our Processing of your Personal Data; therefore, we cannot and do not promise, represent, warrant, or guarantee—and you should not reasonably expect—that your Personal Data or private communications will remain private or secure, or will not be obtained or misused by unauthorized Third Parties.

If you believe that your Personal Data has been accessed or acquired by an unauthorized person, please contact us immediately so that we can investigate. If we discover an unauthorized access to or use or disclosure of Personal Data that we have collected or otherwise Process, we will promptly assess our responsibilities under applicable law and take all required actions.

VII. FINANCIAL INCENTIVES

We do not currently provide financial incentives to consumers who allow us to Process their Personal Data.

VIII. ADDITIONAL NOTICE TO CERTAIN CONSUMERS OF PROCESSING AND DATA SUBJECT RIGHTS

 A. Additional Information For Certain U.S. Residents

Residents of certain U.S. states may have rights and choices regarding their Personal Data. To the extent any data protection law applies to our Processing of your Personal Data, this supplemental section describes the rights to which you may be entitled, and how to exercise them.

 1. Individual Rights You May Have

Depending on where you live and subject to certain exceptions and limitations, you may have some or all of the following rights regarding your Personal Data:

• The right to know and access the specific pieces of Personal Data we have collected about you.
• The right to request deletion of Personal Data we have collected from you.
• The right to request correction of inaccurate Personal Data we maintain about you.
• The right of portability (the right to request that Personal Data be sent to you or someone else in a common file format).
• The right to opt-out of our use ADMT to make certain decisions about you, typically decisions with significant legal or other impact.

We will not discriminate against you for exercising any right you have under applicable law regarding your Personal Data.

Under California Civil Code Section 1798.83 (the “Shine the Light” law), California residents have the right to request certain information about our disclosure of Personal Data to Third Parties for their direct marketing purposes. We do not disclose Personal Data to third parties for their direct marketing purposes. We are therefore exempt from the requirement to provide a standard annual list of shared data. If you have any questions about our compliance with this law, please contact us at telaprivacy@telabio.com with “California Shine the Light Request” in the subject line.

2. Verifying Requests

We must be able to verify a request to exercise your individual rights, in other words, to confirm that you are the person about whom we have collected Personal Data, or that person’s authorized representative. The verification steps we take may differ depending on the request you make. Whenever possible, we will verify your identity by matching the information you provide in your request (including your email and physical address) with information we already have about you. If necessary, we may ask you for additional information to help us verify your request.

3. To Learn More or to Make a Request

You can submit a request to exercise your data protection rights using the methods below. Your request must:

• Provide enough information to allow us to reasonably verify you are the person about whom we collected Personal Data, or that person’s authorized agent. We will need to know your State of residence to determine the scope of your individual rights and how we must respond.
• Describe your request with enough detail to allow us to properly understand, evaluate, and respond to it.

We will use Personal Data provided in a request only to verify the requestor’s identity or authority to make the request, the scope of the requestor’s rights, and how we must respond. Making a request does not require the requestor to create an account with us.

If you make a request to exercise your data protection rights, we will respond within the time allowed by law.

We may charge a reasonable fee to process or respond to your request if permitted by applicable law, such as if your request is excessive, repetitive, or manifestly unfounded. If a fee is warranted, we will tell you why we are charging it and provide a cost estimate before completing your request.

Depending on where you live, you may have additional options if you are not satisfied with our response.

How to make a request:
Call us toll-free: 1-844-835-2246
Email us: telaprivacy@telabio.com

B. Additional Information for Individuals In the EU/EEA/UK

This section applies only to Personal Data we collect about data subjects located in the European Union (EU), the European Economic Area (EEA), or the United Kingdom (UK), and only to the extent our processing activities are subject to the GDPR and/or the UK GDPR.

1. Controller and Data Protection Officer

Unless otherwise stated, we are the Data Controller for the Personal Data we process:

TELA Bio, Inc.
1 Great Valley Parkway, Suite 24
Malvern, PA 19355
USA
Telephone: +1 (484) 320-2930

Optional but recommended. Even though you likely do not need a “formal” DPO, assigning a data protection lead to oversee EU processing would bolster compliance. Because TELA is “established” in the EEA/UK and processes Personal Data in connection with its European establishment, it is strongly recommended to engage a team member with GDPR issue-spotting acumen, even if you rely on outside counsel to ultimately analyze and resolve compliance issues.

2. Our Purposes and Legal Bases for Processing Personal Data

We process Personal Data for the purposes described in Section II.A.2. of this Privacy Policy.

Our legal bases for processing Personal Data are:

• Performing a contract with you, or taking steps at your request before entering into a contract with you.
• Complying with a legal obligation to which we are subject.
• Pursuing our legitimate interests, or those of a third party, which are not overridden by your interests or fundamental rights.
• For special categories of Personal Data, including health information:
  • your explicit consent, where required (see below);
  • public health; or
  • scientific research.

We generally do not rely on consent as a legal basis for processing your Personal Data, although we will get your consent if and as required by applicable law.

We will only process your Personal Data for the purposes for which we collect it, unless we reasonably determine that we need to process it for another purpose that is compatible with the original purpose. Please contact us if you would like us to explain how use for the new purpose is compatible with the original purpose. If we need to process your Personal Data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. We may process your Personal Data without your knowledge or consent where applicable law permits or requires us to do so.

3. Marketing

You have the right at any time to stop us from contacting you for marketing purposes by clicking here.

4. Your Data Protection Rights

Subject to certain exceptions and limitations, you have the right to:

• Request access to your Personal Data. This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
• Request corrections of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of any new data you provide.
• Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data when (i) there is no legitimate reason for us to continue processing it, (ii) you have successfully exercised your right to object to processing (see below), (iii) we may have processed your information unlawfully, and/or (iv) we are required to erase your Personal Data to comply with local law. We may not always be able to comply with your request for specific legal reasons, of which we will notify you.
• Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party), and you object to this processing because you feel it impacts your fundamental rights and freedoms. You may also object to our processing your Personal Data for direct marketing purposes. In some cases, we may deny your objection if we can demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your Personal Data. You may ask us to suspend the processing of your Personal Data when (i) you want us to establish the data’s accuracy, (ii) our use of the data is unlawful but you do not want us to erase it, (iii) you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims, or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your Personal Data to you or to a third party. Upon request, we will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. This right applies only to automated information that you initially consented for us to use, or that we used in performing our obligations under a contract with you.
• Withdraw consent at any time where we are relying on consent to process your Personal Data. This withdrawal will not, however, affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Make a complaint to a regulator. You have the right to make a complaint at any time to your local supervisory authority with regard to data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach any supervisory authority, so please contact us in the first instance.

If you make a request to exercise your data protection rights, we will respond within the time allowed by law.

We may charge a reasonable fee to process or respond to your request if permitted by   applicable law, such as if your request is excessive, repetitive, or manifestly unfounded. If a fee is warranted, we will tell you why we are charging it and provide a cost estimate before completing your request.

In some locations, you may have additional options if you are not satisfied with our response. We will not discriminate against you for exercising a right.

You can make a request to exercise your personal rights by emailing use at: telaprivacy@telabio.com

5. Right to Lodge a Complaint

You have the right to lodge a complaint with the supervisory authorities applicable to you and your situation, although we invite you to contact us with any concern as we would be happy to try to resolve it directly.

If you wish to report a complaint or feel that we have not addressed your concerns in a satisfactory manner, you may contact your local Data Protection Supervisory Authority, or the UK Information Commissioner’s Office.

6. Consent to Transfer

Our principal place of business is located in the United States, and we used U.S.-based service providers to operate our business and manage customer and consumer relationships. The Personal Data we collect will be transferred to, stored, and processed in the United States, whose privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen. We maintain measures to address the transfer of your Personal Data between us and our third-party service providers in accordance with applicable data protection laws and regulations.

VII. YOUNG PEOPLE’S PERSONAL DATA

Although the Sites do not contain objectional material, they are intended for use by adults and are not directed to minors. We comply with all applicable privacy laws regarding the collection of Personal Data from minors.

We do not direct our Sites or online Services to knowingly collect Personal Data from, anyone under 13 years old. If we become aware that we have inadvertently received Personal Data from a person under the age of 13, we will delete that information from our records as quickly as possible unless we are required by law to keep it. If you are a parent or guardian and believe that your child under 13 has provided Personal Data to us, please contact us immediately at telaprivacy@telabio.com so we can take necessary action.

We do not Sell or Share the Personal Data of any person, regardless of age.

VIII. COMMUNICATIONS AND CONSENT TO RECORD

Telephone calls, online chats, text messages, and other similar electronic communications between you and us and/or our Processors may be recorded, transcribed or monitored for training, administrative, and security purposes and/or other business purposes. We collect and process such recordings or transcriptions according to this Privacy Policy. By communicating with us through these methods, you consent to such recording, monitoring, collection, and/or use.

IX. DIFFICULTY ACCESSING OUR PRIVACY POLICY

Individuals with disabilities who are unable to usefully access our Privacy Policy online may contact us to inquire how they can obtain a copy of our policy in another, more easily readable format.

X. QUESTIONS

Any questions, comments, or concerns about this Privacy Policy may be sent to telaprivacy@telabio.com or by mail at TELA Bio, Inc., 1 Great Valley Parkway, Suite 24, Malvern, Pennsylvania 19355, Attn: Compliance.

XI. AMENDMENTS TO THIS POLICY

If our Privacy Policy changes, we will post those changes on our website as notification to you. Your use of the Services following any such change will constitute your acknowledgment of the modifications and your consent to our privacy practices as described in the modifications. If we decide to use particular Personal Data collected about you in a manner materially different from that stated at the time it was collected, we will let you know through the Services, by email, or other communication. We suggest that you check this Privacy Policy frequently.