U.S. Consumer Health Data Privacy Notice

Last Updated: November 19th, 2025

Introduction

This Consumer Health Data Privacy Notice (“Notice”) supplements our Privacy Notice and applies to Consumer Health Data that Madrigal Pharmaceuticals (“Madrigal”, “we”, “our”) collects, including with respect to residents of Washington and Nevada and other individuals whose Consumer Health Data (defined below) is collected in Washington and Nevada.

“Consumer Health Data” as used in this Notice means any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in the Laws. The data we collect depends on the context of your interactions with us.

Categories of Consumer Health Data We Collect

We collect the following categories of Consumer Health Data:

  • Information about health-related conditions, treatment, diseases, or diagnosis
  • Medical interventions, treatments, and medication obtained or prescribed
  • Other information that may be used to identify your health condition

The Purposes For Which We Collect Consumer Health Data

We collect and use Consumer Health Data for the following purposes:

  • To provide information about and provide our products, services and programs, including our patient support programs
  • To manage our relationship with you, including customer service or to respond to your inquiries about our products and services
  • Undertake activities to verify or maintain the quality or safety of our product or services
  • For internal business analysis
  • To comply with the law and our legal obligations, to respond to legal process and related legal proceedings
  • To prevent fraud and provide security, including preventing activities that violate our Terms of Use or that are illegal, and to protect our rights and the rights and safety of our users and others

Sources From Which We Collect Consumer Health Data

Depending on which of our services you use, we collect Consumer Health Data from the following sources:

  • Consumer Health Data that we collect from you directly, including when you interact with us on our website or participate in our patient support programs;
  • Your health care providers, pharmacies, or insurance companies, with your consent
  • Authorized/legal representatives, family members, and caregivers

Consumer Health Data We Share With Third Parties or Affiliates

Aside from third party service providers or processors who assist us in our everyday business operations, we may share each of the categories of Consumer Health Data identified above as you may direct (e.g., to your healthcare provider), as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities, to private attorneys who issue subpoenas or otherwise serve us with legal process and, to the extent required, the individuals or entities they represent, or in the event a merger, acquisition or other corporate restructuring.

What are Consumers’ Rights With Respect to Consumer Health Data

In addition to certain privacy rights, depending on your state of residence, as described in our general Privacy Notice, you may also have the following rights with respect to your Consumer Health Data:

  • Right to Know: The right to know if we are collecting, sharing, or selling your Consumer Health Data
  • Right to Access: The right to a copy of the Consumer Health Data we have about you
  • Right to Know Third Parties: The right to obtain a list of all third parties and/or affiliates with whom we have shared or sold your Consumer Health Data, if any
  • Right to Delete: The right to request that we delete your Consumer Health Data

Additionally, to the extent consent has been obtained to collect or share Consumer Health Data, the right to withdraw consent.

To exercise these rights, please contact Madrigal at privacy@madrigalpharma.com. We may require additional information to authenticate that you made the request(s). We will respond to such requests within 45 days from when we receive your request. In some circumstances, we may need additional time to process your request. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

If your request is denied, you may appeal that decision as specified in our letter of denial. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable attorney general:

Contact Us

If you have questions about this Notice or want to obtain more information about our privacy practices, please contact us at privacy@madrigalpharma.com.

Material Changes To This Notice

We may change this Notice from time to time and will notify you by a notice on our website and in this Notice of material changes.