Privacy Policy

Effective Date: 20 July 2026        Last Updated: 23 July 2026 

Iridex Corporation ("Iridex," "we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit or interact with our website, and describes the privacy rights available to you, including rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA").

1. Information We May Collect

We collect the following categories of personal information. The labels correspond to the statutory categories under the CCPA.

• Identifiers — name, email address, address, phone number, company name, job title directly from you when you complete a contact or inquiry form. IP address, and online identifiers may be collected automatically from your device.
• Internet or other electronic network activity — pages visited, time spent on the site, referring URLs, interactions, and browser/device information.
• Commercial information — inquiries you submit and products or services you express interest in.
• Professional or employment-related information — company name and job title provided when you complete a contact or inquiry form.
• Geolocation data — approximate location inferred from your IP address.
• Inferences — limited inferences drawn from the above to understand visitor interests and improve our website.

Sensitive Personal Information. We do not collect or process sensitive personal information (as defined by the CCPA) for the purpose of inferring characteristics about you, and we do not use or disclose sensitive personal information for purposes that require offering a "Limit the Use of My Sensitive Personal Information" option.

2. Sources of Personal Information

We collect personal information from the following categories of sources:

• Directly from you — when you complete a contact or inquiry form, request information, or otherwise communicate with us.
• Automatically from your device — through cookies and similar technologies when you interact with our website.
• From service providers — such as our website hosting, analytics, and customer relationship management providers that operate on our behalf.

3. How We Use Your Information

We use your information to:

• Respond to inquiries and provide requested information
• Operate, maintain, and improve our website
• Enhance website functionality and user experience
• Analyze website usage, trends, and visitor interactions
• Communicate with visitors about our products, services, and company updates
• Support our marketing and advertising efforts
• Protect the security and integrity of our website and comply with legal obligations

4. Disclosure of Personal Information

In the preceding 12 months, we have disclosed the categories of personal information described in Section 1 (primarily Identifiers and Internet or other electronic network activity) to the following categories of recipients:

• Service providers that support our website and business operations, such as website hosting, analytics, information technology, and customer relationship management providers.
• Advertising and marketing partners — such as Google/YouTube — that help us measure and deliver advertising.
• Business partners and distributors, where relevant to your inquiry.
• Legal and governmental authorities, when required by law or to protect our rights.

We require service providers to process personal information only for authorized business purposes and in accordance with applicable contractual and legal requirements.

5. Sale and Sharing of Personal Information

We do not sell your personal information for monetary or other valuable consideration.

Sharing. We use advertising and analytics technologies — including YouTube — that may involve the “sharing” of personal information (Identifiers and Internet or other electronic network activity) for cross-context behavioral advertising under the CCPA. You can opt out by rejecting Marketing cookies through our Cookiebot consent tool, accessible through the “Do Not Sell or Share My Personal Information” / Cookie Settings link in our website footer (see Section 13), and by using the opt-out preference signals described below.

Opt-out preference signals (Global Privacy Control). We recognize and honor opt-out preference signals, including the Global Privacy Control (GPC), transmitted by your browser or a browser extension. When we detect a GPC signal, we treat it as a valid request to opt out of any sale or sharing of personal information for that browser and device.

Minors. Our website is directed to a business and professional audience, not to minors. We do not knowingly collect, sell, or share the personal information of individuals under 18.

6. Your California Privacy Rights

If you are a California resident, you have the following rights, subject to certain exceptions:

• Right to know / access — request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients.
• Right to delete — request deletion of personal information we have collected from you.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — direct us not to sell or share your personal information (see Section 5).
• Right to limit use of sensitive personal information — to the extent we process sensitive personal information for non-exempt purposes (we currently do not; see Section 1).
• Right to non-discrimination — we will not discriminate or retaliate against you for exercising any of your privacy rights, including by denying services, charging different prices, or providing a different level or quality of service.

How to Exercise Your Rights

You may submit a request through either of the following methods:

• Online request form: https://iridex.com/PrivacyRequest.aspx, and
• Email: info@iridex.com

Verification. To protect your information, we will take steps to verify your identity before fulfilling a request, which may require you to provide information that matches what we hold. We will respond to verifiable consumer requests within 45 days; if we need more time (up to an additional 45 days), we will notify you.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written authorization and may require you to verify your own identity directly with us.

7. Privacy Rights in Other U.S. States

Residents of certain other U.S. states may have similar rights to access, correct, delete, or opt out of the processing of their personal information for targeted advertising, and a right to appeal a decision on their request. To exercise any of these rights, please use the methods described in Section 6. If we deny your request, you may appeal by replying to our response, and we will inform you of any action taken.

8. California “Shine the Light”

California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

9. Your EEA and UK Privacy Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, this section applies to you and supplements the information above.

Legal Bases for Processing

We process your personal data on one or more of the following legal bases:

• Consent — for example, for non-essential cookies and for optional marketing communications; you may withdraw consent at any time. 
• Legitimate interests — to operate, secure, and improve our website and understand how it is used, where these interests are not overridden by your rights.
• Performance of a contract — to respond to your inquiries and take steps at your request.
• Legal obligation — to comply with applicable law.

Your Rights

Subject to applicable law, you have the right to access; rectify; erase; restrict or object to processing (including for direct marketing); receive your data in a structured, commonly used, and machine-readable format; and withdraw consent at any time without affecting processing carried out before withdrawal. You also have the right to lodge a complaint with your local data protection supervisory authority.

International Transfers

Because Iridex corporate headquarters is based in the United States, any personal data you provide will be processed in the United States. When you contact us or request a demo, we transfer this information as necessary to respond to and fulfill your request, and, where applicable, on the basis of your consent. We take reasonable administrative, technical, and organizational measures to protect your personal data in connection with these transfers. If you would like more information about how we handle international transfers, contact us at info@iridex.com.

Controller and Contact

The data controller is Iridex Corporation. To exercise your rights or contact us about data protection, email info@iridex.com.

10. Cookies and Tracking Technologies

What are cookies? Cookies are small text files stored on your device that help websites function and collect information about usage. We also use related technologies such as pixels, tags, and scripts.

We use cookies and similar technologies to enable core website functionality, keep the site secure, analyze website usage and performance, and support our marketing and advertising. Non-essential cookies (Statistics and Marketing) are set only after you provide consent through our Cookiebot consent banner.

Cookie Categories

• Necessary — required for the website to function and remain secure; always active.
• Preferences — enable the website to remember choices you make and provide enhanced, more personal features.
• Statistics — help us understand how visitors interact with the website by collecting and reporting information.
• Marketing — used to track visitors across websites to support advertising and measure campaigns.

11. Cookies We Use

Below is a representative list of the cookies and tracking technologies used on our website, organized by category. This list may change as technologies evolve.

Necessary (Always Active)

Statistics

Marketing

Preferences

12. Third-Party Tracking

Our website uses third-party analytics and advertising services — including Google Analytics 4 (via Google Tag Manager), HubSpot, and YouTube — that may collect your IP address, device and browser information, browsing behavior, and unique identifiers. These providers process this information in accordance with their own privacy policies. Non-essential cookies are set only after you provide consent through our Cookiebot consent banner.

13. Cookie Choices and Controls

You have control over how cookies are used on our website. Using our Cookie Settings link, you can:

• Accept all cookies
• Reject non-essential cookies
• Customize your preferences by category

You can change your choices at any time via the Cookie Settings link in our website footer. As described in Section 5, we also honor Global Privacy Control (GPC) signals. You may additionally manage cookies through your browser settings.

14. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the information; the purposes for which we process it; whether we can achieve those purposes through other means; and applicable legal, accounting, or reporting requirements. Cookie lifespans vary by cookie and are reflected in our Cookiebot cookie declaration.

15. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no method of transmitting information over the internet or storing information electronically is completely secure, and we cannot guarantee its absolute security.

16. International Data Transfers

Iridex corporate headquarters is based in the United States. If you are located in another country, the personal information you provide will be transferred to and processed in the United States. Privacy and data protection laws in the United States may be different from — and in some cases less protective than — the laws in your home country. We take reasonable administrative, technical, and organizational measures to protect your personal information wherever it is processed, consistent with this Privacy Policy.

17. Children’s Privacy

Our website is intended for a business and professional audience and is not directed to children. We do not knowingly collect personal information from children under 16, and we do not knowingly sell or share the personal information of minors under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

18. Automated Decision-Making

We do not use your personal information to make decisions through automated decision-making technology that produce legal or similarly significant effects concerning you. If this changes, we will update this policy and provide any notices and choices required by applicable law.

19. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will post the revised policy on this page and update the “Effective Date” and “Last Updated” date above. We review this policy at least every 12 months.

20. Contact Information

Iridex Corporation

1212 Terra Bella Avenue

Mountain View, CA 94043 USA

Privacy requests: info@iridex.com  |  Online form: https://iridex.com/PrivacyRequest.aspx

General: info@iridex.com | 650-940-4700