Privacy Policy
AXOGEN CORPORATION PRIVACY POLICY AND COOKIE NOTICE
(Updated and Effective: July 2026)
Introduction
Axogen Corporation and its affiliates (together, “Axogen,” “we,” “us,” or “our”) is committed to respecting the privacy of individuals and protecting personal information. This Privacy Policy and Cookie Notice (“Policy”) describes how we collect, use, disclose, retain, and otherwise process personal information in connection with our websites (axogeninc.com, avancenervegraft.com, resensation.com, numbaftermastectomy.com, ir.axogeninc.com), applications, other sources and related interactions with individuals, including customers, healthcare professionals, business contacts, website visitors, event attendees, and other individuals who interact with us (collectively, the “Services”). Please read this Policy carefully to understand our privacy practices and your rights and choices regarding your personal information. Where required by applicable law, we will obtain consent for specific processing activities.
Updates to This Policy
We may update this Policy from time to time to reflect changes in our privacy practices, technologies, legal requirements, or business operations. When we do, we will revise the “Updated and Effective” date above. Where required by applicable law, we will provide additional notice of material changes and/or seek consent. By continuing to use the Services after the posting of such changes, you accept the Policy as modified.
Who We Are / Data Controller
Unless a different Axogen entity is identified in a separate notice, Axogen Corporation is the controller of personal information covered by this Policy. If you are located in a jurisdiction that requires identification of a local controller, representative, or similar contact, Axogen will provide that information in a jurisdiction-specific supplement or at the point of collection.
Information We Collect
Depending on the nature of your interaction with us, we may collect the following categories of personal information:
- Identity Data such as first and last name, username or similar identifier, title, and date of birth where relevant to the interaction.
- Contact Data such as business contact details, billing address, delivery address, email address, and telephone number.
- Commercial and Transaction Data such as transaction details, order history, payment-related information, and records relating to products or services provided to you or your organization.
- Technical Data such as internet protocol (IP) address, browser type and version, time zone setting, device information, operating system and platform, cookie identifiers, and information about how you use our Services.
- Professional or Employment-related Data such as employer, job title, specialty, credentials, and professional affiliations.
- Profile, Preference, and Communications Data such as communication preferences, event registrations, feedback, survey responses, and correspondence with us.
- Usage Data such as information about how you use our websites or Services and your interactions with content.
- Marketing Data such as your preferences for receiving information about Axogen products, services, or events.
- Sensitive Personal Information / Special Categories of Personal Data may be collected in limited circumstances where permitted or required by law, including information relevant to product complaints, adverse events, safety, quality, legal, or regulatory reporting obligations. Where required by applicable law, we provide additional notice, obtain consent, or offer applicable rights and choices in relation to such processing. “Personal Data” means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly — in particular, by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity. “Special Categories of Personal Data” pertains to personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and the processing of data concerning health or sexual orientation. “Sensitive Personal Information” either indicates “Special Categories” or is Personal Data of which the sensitivity level has been assessed and classified, indicating potential severe impact on an individual when confidentiality of such data is breached.
We strive to let you know in advance what will happen to your Personal Data. We will not use your Personal Data for a purpose that is materially different from the purposes listed in this Policy or disclose it to a third party acting as a controller not previously identified, without first offering you the opportunity to opt-out of such uses and/or provide disclosures. If we intend to use your Sensitive Personal Data for a purpose not identified in this Policy, we will reach out to you to get your explicit consent before doing so.
How We Collect Personal Information
We may collect personal information through direct interactions with you when you visit our website(s) or use our Services. Some of this information is provided by you and some is collected automatically.
We may also collect information from our affiliates, from service providers acting on our behalf, from business partners, healthcare institutions or other organizations with which you interact, and from persons who report product complaints, safety events, or similar matters to us.
Axogen collects Personal Data about you in connection with many of our Services, with the goal of improving our Service to you and providing you with the best possible experience. When contacting us, you may be required to submit contact information. When communicating with us, all communications will be transmitted and stored by us. To be clear, you may be providing personal data when: (i) communicating with us via phone calls, chats, emails, web forms, social media, and other methods of communication; (ii) subscribing to Axogen’s marketing materials; or (iii) applying for a job.
Axogen may also collect information about you from other sources to help us correct or supplement our records, improve the quality of personalization of our Services to you, and prevent and detect fraud.
How We Use Personal Information
We use personal information to provide and administer the Services; respond to inquiries and requests; manage our relationships with customers, healthcare professionals, business contacts, vendors, investors, and other stakeholders; administer events, training, and educational activities; send communications and marketing in accordance with applicable law and your preferences; operate, maintain, secure, troubleshoot, analyze, and improve our Services, products, and business operations; conduct auditing, compliance, risk management, and recordkeeping activities; comply with legal, regulatory, safety, quality, and reporting obligations, including complaint handling and adverse event reporting where applicable; and protect our rights and interests and those of others.
In the course of corporate divestures, mergers, acquisitions, bankruptcies, dissolutions, reorganizations, liquidations, or general business transactions or proceedings, we may buy/sell/divest/transfer your personal data including your name or email address.
In the past twelve months we have not sold any personal information.
Legal Bases for Collecting and Using Information
If you are located in the EEA, UK, or Switzerland, we process personal data only where we have a lawful basis to do so. Depending on the context, our lawful bases may include your consent; performance of a contract or steps taken at your request before entering into a contract; compliance with a legal obligation; protection of vital interests; and our legitimate interests, such as operating and improving our business, maintaining the security of our Services, communicating with customers and professional contacts, administering events and training, preventing fraud, complying with product quality and safety obligations, and protecting our rights, provided that such interests are not overridden by your rights and freedoms. Where we rely on consent, you may withdraw consent at any time, although withdrawal will not affect the lawfulness of processing before withdrawal.
Disclosure of Personal Information
We may disclose personal information to our workforce personnel and affiliated companies; vendors and service providers that support our business operations (such as hosting, IT support, analytics, communications, event administration, payment processing, security, and professional services providers); business partners and other counterparties with whom we collaborate; auditors, consultants, insurers, and legal advisers; regulators, governmental authorities, courts, law enforcement, and similar third parties where required or appropriate; and parties involved in actual or proposed corporate transactions. We may also disclose personal information where necessary to protect our rights, safety, property, or the rights, safety, or property of others.
Cookies and Similar Technologies
We and our partners may use cookies, pixels, tags, web beacons, software development kits, local storage, and similar technologies to operate the Services, remember preferences, authenticate users, maintain security, measure performance, understand how users interact with the Services, improve functionality, personalize content, and, where permitted, support analytics and advertising activities. Some of these technologies are set by Axogen and others are set by third parties acting on our behalf or providing services to us. Depending on your location and applicable law, we may request your consent before using non-essential cookies or similar technologies. You can manage your preferences through our cookie settings tool, and through your browser settings, although disabling certain technologies may affect functionality.
Where required by applicable U.S. state law, we honor legally recognized opt-out preference signals, such as Global Privacy Control, for processing that constitutes targeted advertising or a sale or sharing of personal information under applicable law. We may also use server logs and similar technologies to collect device and browsing information for security, troubleshooting, and fraud prevention.
| Cookie Category | Purpose | Examples of Data Collected | Your Choices |
| Essential (Strictly necessary) | Enable basic website features such as displaying content, security, network management, accessibility, session management, and fraud prevention | Session identifiers, authentication data, security signals, load-balancing information | These technologies are generally required for the Services to function and cannot be turned off through our preference tool |
| Functional and preference / Personalization | Remember choices and improve the user experience / provide enhanced personal features | Language preferences, region preferences, form settings, accessibility choices | You may control these technologies through our cookie settings tool or your browser settings |
| Analytics and performance | Measure usage, improve content and navigation, and understand how visitors interact with the Services | IP address, device identifiers, browser details, pages visited, referring URLs, time spent, clicks, and general interaction data | Where required by law, we request consent before using these technologies; you may also change your choices through our settings tool or browser controls |
| Targeted Advertising and social media (Marketing) | Deliver and measure advertising, limit repetitive ads, support audience creation, and enable social media features | Cookie identifiers, device identifiers, browsing activity, interactions with content, inferred interests | Where required by law, we request consent before using these technologies; you may opt out through our settings tool, recognized opt-out preference signals, and certain browser controls |
Security
Security of your information is of the utmost importance to Axogen. Axogen maintains administrative, technical, and physical safeguards designed to protect personal information appropriate to the nature of the information and the risks involved. While Axogen is committed to protecting your personal information, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure.
Data Retention
We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain our business relationship with you, comply with legal, regulatory, tax, accounting, safety, and reporting obligations, resolve disputes, enforce our agreements, and protect our rights. Retention periods vary depending on the type of information, the context in which it is collected, the sensitivity of the information, the risk of harm from unauthorized use or disclosure, and applicable legal requirements.
International Data Transfer Mechanisms
Axogen is headquartered in the United States, and personal information may be transferred to, stored in, or accessed from the United States and other jurisdictions where Axogen or its service providers operate. Those jurisdictions may not provide the same level of data protection as your home jurisdiction. Where required by applicable law, we take steps to ensure that international transfers are protected by appropriate safeguards, which may include adequacy decisions, standard contractual clauses, or other legally recognized transfer mechanisms. You may contact us for additional information about applicable transfer safeguards.
Children’s Privacy
Axogen understands the importance of protecting children’s privacy. The Services are not directed to children under the age of thirteen (13), and we do not knowingly collect personal information from children under thirteen (13) through the Services without legally required consent. If you believe that a child has provided personal information to us in violation of this Policy, please contact us so that we can take appropriate steps in accordance with applicable law. For more information about the Children’s Online Privacy Protection Act (“COPPA”), please visit the Federal Trade Commission website.
“Do Not Track” and Global Privacy Control
Do Not Track (“DNT”) is a browser setting that was designed to signal a preference not to be tracked across websites over time. Because there is no uniform industry standard for responding to DNT signals, our Services do not respond to or honor DNT signals. This does not affect our practices regarding legally recognized opt-out preference signals, such as Global Privacy Control, which we honor where required by applicable law.
Links to Other Websites
Our websites may link to other sites not affiliated with Axogen. Their privacy policies apply, and we are not responsible for their practices. This Policy only applies to information collected on our websites. We have no control over third-party websites and are not responsible or liable for the content, privacy practices, or use of any websites that are not affiliated with Axogen.
Your Privacy Rights
Depending on your location and applicable law, you may have certain rights regarding your personal information. These may include the right to request access to, correction of, deletion of, restriction of, or objection to the processing of your personal information; the right to receive a portable copy of certain personal information; the right to withdraw consent where processing is based on consent; the right to opt out of targeted advertising, sale, sharing, or certain profiling activities; and the right to lodge a complaint with a competent regulator or supervisory authority. You may exercise your applicable privacy rights by submitting a request through our request portal. To submit a request, please click this Data Subject Access Request Form Link: DSAR Form. The request portal is our preferred method for DSAR communications, as it helps us collect the information needed to verify, route, and respond to your request. You, however, may also submit a request by contacting us at privacy@axogeninc.com. We may take reasonable steps to verify your identity, residency and authority before responding.
Appointing an authorized agent/Appeals
Where permitted by law, an authorized agent may submit a request on your behalf. We may request information to verify your identity, confirm your residency, and validate the authority of an authorized agent before processing a request. Where applicable law provides an appeal right and we deny your request, we will explain how you may appeal the decision. If you have questions about your rights or a request, please contact our Privacy Office using the contact information in this Policy.
Unsubscribe from Marketing
You can opt out of receiving certain marketing or promotional communications from Axogen at any time by using the unsubscribe link in the email communications we send or by contacting us using the information in this Policy. Transactional or service-related communications may still be sent where necessary.
How to Contact Us
You may contact Axogen’s Privacy Office regarding this Policy or the processing of personal information by emailing privacy@axogeninc.com or writing to the mailing address listed below.
Axogen Corporation
Attn: Data Privacy Officer
111 West Oak Avenue, 5th Floor
Tampa, Florida 33602
Email: privacy@axogeninc.com
Phone: (888) 296-4361
In addition, you may exercise your applicable privacy rights by submitting a request through our request portal using this Data Subject Access Right Form Link: DSAR Form. This request portal is our preferred method for DSAR communications, as it helps us collect the information needed to verify, route, and respond to your request. We may take reasonable steps to verify your identity, residency and authority before responding.
All communications will be evaluated, and a reply will be sent as soon as appropriate. If contacting us does not resolve your concern and your inquiry relates to personal data collected about you in the EEA, UK, or Switzerland, you may have the right to lodge a complaint with the supervisory authority in your usual place of residence, place of work, or place of the alleged infringement.
U.S. State Privacy Disclosures
For residents of certain U.S. states, additional disclosure regarding privacy rights and data practices are provided below.
We provide you with certain rights regarding your Personal Data, subject to certain exceptions and limitations. Those rights include:
(1) Right to request access to the Personal Data we have collected about you, restrict the processing of specific pieces of personal information we collected about you and learn how we collect this information, our purpose in collecting it,
(2) Right to correct or delete the Personal Data we have collected from you,
(3) Right to opt-out of the sale or sharing of your Personal Data,
(4) Right to limit use and disclosure of sensitive personal information, if applicable and
(5) Right not to receive discriminatory treatment for the exercise of the relevant privacy rights conferred by applicable laws.
Under CPRA, residents of California may exercise employee rights. If applicable, we provide employees with certain rights regarding your personal data, subject to certain exceptions and limitations. Those rights include:
(1) Right to request access to the Personal Data we have collected about you, restrict the processing of specific pieces of personal information we collected about you and learn how we collect this information, our purpose in collecting it,
(2) Right to correct or delete the Personal Data we have collected from you,
(3) Right to opt-out of our sale(s) of your Personal Data,
(4) Right to limit use and disclosure of sensitive personal information, if applicable and
(5) Right not to receive discriminatory treatment for the exercise of the relevant privacy rights conferred by applicable laws.
Some uses of cookies and similar technologies for analytics or advertising may constitute a “sale,” “sharing,” or “targeted advertising” under certain U.S. state laws. We disclose personal information to service providers, contractors, affiliates, advisers, and business partners for the business and commercial purposes described in this Policy. The table below summarizes our current categories of personal information, sources, purposes, and disclosure practices. The examples listed are illustrative and may not apply in every context.
| Category of Personal Information | Examples | Sources | Business or Commercial Purposes | Categories of Recipients | Retention |
| Identifiers and contact information | Name, postal address, email address, telephone number, online identifiers, account, or form identifiers | Directly from you; automatically through the Services; affiliates; service providers; business partners; public sources | Operate the Services; respond to inquiries; relationship management; account administration; security; legal compliance | Affiliates; service providers; advisers; regulators; transaction counterparties | Retained as needed for the relevant relationship, service, and legal obligations |
| Professional or employment-related information | Employer, title, specialty, credentials, professional affiliations | Directly from you; employer or institution; business partners; event organizers; public sources | Professional engagement; training and events; relationship management; compliance; communications | Affiliates; service providers; business partners; advisers | Retained based on the nature of the professional relationship and applicable legal or business needs |
| Commercial, financial, and transaction information | Order details, payment-related data, transaction records, service history | Directly from you; service providers; business partners | Fulfill requests; administer transactions; accounting; auditing; legal compliance; fraud prevention | Service providers; payment processors; affiliates; advisers; regulators | Retained in accordance with accounting, tax, contractual, and legal requirements |
| Internet or other electronic network activity information | IP address, browser type, device information, cookie identifiers, usage data, interactions with the Services | Automatically through the Services; analytics providers; advertising or technology partners | Website operation; security; analytics; troubleshooting; performance measurement; personalization; advertising where permitted | Service providers; analytics providers; technology and advertising partners; affiliates | Retained for periods appropriate to the cookie or technology used, security needs, and operational requirements |
| Communications and preference information | Correspondence, preferences, survey responses, marketing choices, event registrations | Directly from you; service providers acting on our behalf | Communications; customer service; event administration; marketing; preference management; recordkeeping | Affiliates; service providers; advisers | Retained according to the nature of the communication, applicable preferences, and recordkeeping obligations |
| Sensitive personal information or special categories of personal data | Limited information relevant to safety, quality, adverse event, complaint, legal, or regulatory reporting obligations; other sensitive information where permitted by law | Directly from you; healthcare institutions; complaint or safety reporters; service providers; other third parties involved in the matter | Safety and quality investigations; legal and regulatory compliance; protection of rights; incident management | Affiliates; specialized service providers; professional advisers; regulators and governmental authorities | Retained according to the sensitivity of the data and applicable legal, regulatory, and recordkeeping obligations |
You may exercise your applicable privacy rights by submitting a request through our request portal. To submit a request, please click this Data Subject Access Right Form Link: DSAR Form. This request portal is our preferred method for DSAR communications, as it helps us collect the information needed to verify, route, and respond to your request. You, however, you may also submit a request by contacting us at privacy@axogeninc.com.
We may need to verify your identity, residency and authority before completing a request. Where permitted by law, an authorized agent may submit a request on your behalf. We will not discriminate against you for exercising privacy rights. If we deny your request, we will explain how you may appeal the decision where applicable law grants an appeal right.
Legal Bases for Processing (EEA, UK, and Switzerland)
If you are located in the EEA, UK, or Switzerland, we process personal information where we have a lawful basis to do so. Depending on the context, our lawful bases may include your consent; performance of a contract or steps taken at your request before entering into a contract; compliance with a legal obligation; protection of vital interests; and our legitimate interests, such as operating and improving our business, maintaining the security of our Services, communicating with customers and professional contacts, administering events and training, preventing fraud, and protecting our rights, provided that such interests are not overridden by your rights and freedoms. Where we rely on consent, you may withdraw consent at any time, although withdrawal will not affect the lawfulness of processing before withdrawal.
EEA/UK/Switzerland Supplement
If you are located in the EEA, UK, or Switzerland, you may have the right to request access to your personal data, rectification of inaccurate personal data, erasure of personal data, restriction of processing, portability of certain personal data, and objection to processing based on legitimate interests, including processing for direct marketing. You also have the right to withdraw consent at any time where processing is based on consent. If Axogen obtains personal data indirectly, we will provide the additional information required by applicable law, including the categories of personal data concerned and the source of the data, within the time period required by law unless an exception applies.
Where we ask you to provide personal data, we will indicate whether the information is required to comply with a legal or contractual requirement or is otherwise necessary to manage the relevant interaction, and we will explain the possible consequences if you choose not to provide it where required by law. If you believe that our processing of your personal data violates applicable law, you may lodge a complaint with the supervisory authority in your usual place of residence, place of work, or place of the alleged infringement. If Axogen engages in solely automated decision-making that produces legal or similarly significant effects, we will provide any additional notices and rights required by law.
Thank you for reading our Privacy Policy and Cookie Notice. We appreciate the opportunity to explain how we collect, use, disclose and protect your personal information.