R3 and R4 serve for this purpose, they limit current through the in-built ESD diode which is 5mA maximum. V=180k*5m= 900V.
Using standard TVS may spoil the measurement due to leakage currents.
Read the document:
INPUT PROTECTION
All terminals of the AD8232 are protected against ESD. In
addition, the input structure allows for dc overload conditions
that are a diode drop above the positive supply and a diode
drop below the negative supply. Voltages beyond a diode drop
of the supplies cause the ESD diodes to conduct and enable
current to flow through the diode. Therefore, use an external
resistor in series with each of the inputs to limit current for
voltages beyond the supplies. In either scenario, the AD8232
safely handles a continuous 5 mA current at room temperature.
For applications where the AD8232 encounters extreme overload voltages, such as in cardiac defibrillators, use external series
resistors and gas discharge tubes (GDT). Neon lamps are commonly used as an inexpensive alternative to GDTs. These devices
can handle the application of large voltages but do not maintain
the voltage below the absolute maximum ratings for the AD8232.
A complete solution includes further clamping to either supply
using additional resistors and low leakage diode clamps, such as
BAV199 or FJH1100.
As a safety measure, place a resistor between the input pin and
the electrode that is connected to the subject to ensure that the
current flow never exceeds 10 µA. Calculate the value of this
resistor to be equal to the supply voltage across the AD8232
divided by 10 µA.