Vera Health™ Privacy Policy

Please read this Privacy Policy to learn how we process your personal data. By using or accessing our Services in any manner, you acknowledge the practices and policies outlined below.

Your use of Vera Health’s Services is at all times subject to our Terms of Use (https://www.verahealth.ai/terms), which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Use.

We may change this Privacy Policy from time to time. We will alert you of material changes by placing a notice on the Vera Health website, by sending you an email, or by some other means. If you use the Services after the effective date of any posted changes, that means you have acknowledged the changes.

1. Key Terms

“Vera Health,” “We,” “Us,” “Our” means Veracity-Health Inc., a Delaware corporation with an address at 2261 Market Street, Suite 22644, San Francisco, California 94114 USA.

“Personal data” means any information relating to an identified or identifiable individual

“Sensitive personal data” means personal data that is qualified as sensitive under applicable law (for example, certain health information, genetic and biometric information, and other categories defined by law).

2. Scope and Our Role

This Privacy Policy covers how we process personal data that we gather when you access or use our Services, including our public websites and business-facing services. This Policy does not cover the practices of companies we don’t own or control or people we don’t manage. It also does not apply to information we collect or maintain relating to Vera Health’s employees or contractors.

3. Personal Data

3.1 Categories of Personal Data We Collect

The categories of personal data we collect depend on how you interact with us. The chart below summarizes categories we may collect and categories of third parties to whom we may disclose such information.

3.2 Our Purposes and Legal Bases

We collect and use personal data for the commercial or business purposes described below. Where GDPR/UK GDPR applies. Accordingly, we also identify the lawful basis for processing.

a) Providing the Services and ensuring that they function properly

We collect and use your personal data for, for example:

• Creating and managing your account;
• providing requested products and information;
• Providing AI Services, customer support fraud protection, security, and debugging.

The lawful bases are contractual necessity (Article 6(1)(b) GDPR) and legitimate interest in ensuring an adequate level of security of the Services (Article 6(1)(f) GDPR, as applicable.

b) Customizing and improving the Services

We collect and use your personal data for, for example:

• Internal analytics and product development;
• Personalization;
• Testing, research.

Lawful bases are consent (Article 6(1)(a) GDPR), and legitimate interest in improving the quality of the Services (Article 6(1)(f) GDPR, as applicable.

c) Marketing the Services and sending targeted marketing communications

We collect and use your personal data for, for example:

• marketing and providing the Services and
• where applicable, showing advertisements including interest-based or targeted advertising.

The lawful basis is consent (Article 6(1)(a) GDPR).

d) Communicating with you

We collect and use your personal data for, for example:

• responding to requests and inquiries,
• verifying your identity, and
• administering your account.

The lawful basis is contractual necessity (Article 6(1)(b) GDPR).

e) Aggregating & anonymizing data

We collect and use your personal data for the creation of aggregated, de-identified, or anonymized data relating to physicians’ use of the Service (e.g. statistics on access patterns and usage frequency, and other metadata associated with physicians’ activities, as well as Input and Output), which we may use or disclose for lawful business purposes. For instance, we may aggregate this data and share insights derived from such aggregated data with our business partners/research organizations.

Lawful bases include VeraHealth’s legitimate interests in using data for its own business purposes (Article 6(1)(f) GDPR).

f) Other permitted purposes

We may process personal data to comply with law and enforce legal terms, including preventing, detecting, and investigating security incidents and potentially illegal or prohibited activities; protecting rights, property, or safety; enforcing agreements; responding to claims; and resolving disputes. The lawful bases are: legitimate interests in ensuring an adequate level of security and prevent illicit activities (Article 6(1)(f) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR), as applicable.

The provision of Personal data is not mandatory, unless it is required to comply with legal obligations but, in case of Personal data necessary for the performance of the contract between you and VeraHealth, any refusal of providing Personal data may result in the impossibility for VeraHealth to provide you with the Services and the AI Services.

3.3 Sources of Personal Data

We collect personal data from: (a) you (directly and automatically via cookies and similar technologies); (b) vendors (e.g., analytics and support providers); (c) customers (e.g., employers or organizations that refer you to the Services); and (d) advertising/marketing partners where applicable.

4. How We Share Personal Data

We may share personal data with the following categories of recipients, depending on the context:

4.1 Service Providers

• Hosting, technology and communications providers;
• security and fraud prevention consultants; and
• support and customer service vendors.

4.2 Advertising Partners

Ad networks and marketing providers that help us market the Services and provide offers or advertising, including interest-based or targeted advertising.

4.3 Analytics Partners

Providers that help us understand web traffic and how users interact with the Services.

4.4 Parties you authorize, access, or authenticate

4.5 Third parties you access through the Services and social media services, where applicable.

VERA HEALTH HAS WRITTEN AGREEMENTS WITH ALL OF THE SERVICE PROVIDERS, ADVERTISING PARTNERS, AND ANALYTICS PARTNERS WHO ASSIST WITH THE PROVISION OF THE SERVICES (COLLECTIVELY, “PROCESSORS”). OUR AGREEMENTS WITH PROCESSORS LIMIT THEIR USE OF ANY PERSONAL DATA TO THE SERVICES THEY PROVIDE TO VERA HEALTH. A LIST OF PROCESSORS IS AVAILABLE UPON REQUEST.

4.6 Legal obligations; business transfers; affiliates

We may disclose personal data to comply with law, enforce agreements, protect rights and safety, and in connection with corporate transactions (e.g., merger, acquisition, asset sale, or bankruptcy), subject to appropriate protections.

4.7 Aggregated / de-identified data

We can disclose with third parties aggregated, de-identified or anonymized data in a manner that could not identify you.

4.8 Third Party Services

Our Services may contain third party content, integrations or links to third party websites operated by organizations not affiliated with Vera Health. Through these integrations, you may be providing information to the third party as well as to Vera Health. Since we can only control our own Services, we are not responsible for how those third parties collect or use your information so please review the privacy policies of every third-party service that you visit or use, including those third parties you interact with through our Services.

5. Tracking Tools, Cookies, Advertising, and Opt-Out

Vera Health publishes a comprehensive Cookie Notice that describes cookies used on the Vera Health website and provides information on how you can accept or reject them. The Cookie Notice is available at https://www.verahealth.ai/cookies.

6. Data Security

General

We seek to protect your personal data from unauthorized access, use, and disclosure using appropriate physical, technical, organizational, and administrative security measures based on the type of personal data and how we process it.

You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account.

Although we work to protect the security of your account and other data that we hold in our records, no method of transmitting data over the internet or storing data is completely secure. Of course, Vera Health cannot secure personal data that you disclose or that you request us to release.

7. Data Retention

We retain personal data for as long as necessary to provide the Services or for our business purposes. When establishing retention periods, we consider who we collected the data from, our need for the data, why we collected it, and its sensitivity. We may retain personal data longer where necessary to comply with legal obligations or resolve disputes, and we may retain information in aggregated or de-identified form.

8. Data Minimization and Safeguards

We apply data minimization principles, ensuring that only the necessary amount of data is processed to achieve the intended purpose. Additionally, technical and organizational measures are implemented to protect the data used for training, including encryption, access controls, and anonymization or pseudonymization where feasible.

9. AI Systems

The Services include features powered by artificial intelligence systems we provide (the “AI Systems”). We do not use your personal data for training our AI Systems.

10. HIPAA

HIPAA is a U.S. federal law designed to protect the privacy and security of Protected Health Information (“PHI”). HIPAA applies to covered entities and their business associates, including service providers like Vera Health in certain contexts. If you are a covered entity or business associate (or agent for such an organization), upon request, Vera Health will enter into a Business Associate Agreement (BAA) with you to protect PHI and clarify permissible uses and disclosures based on the services being performed.

Vera Health’s BAA is available at https://www.verahealth.ai/baa.

11. International Transfers

The Services are hosted and operated in the United States (“U.S.”) by Vera Health and its service providers, and if you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside.

By using the Services, you acknowledge that any personal data, regardless of whether provided by you or obtained from a third party, is being provided to Vera Health in the U.S. and will be hosted on servers located in the U.S. In addition, your personal data may be further transferred to other countries outside the European Economic Area, to the extent one of the entities identified under para. 6 is located outside the European Economic Area.

When Vera Health transfers personal data to countries outside the European Economic Area, the transfer complies with Articles 45 ff of the GDPR, by relying on recognized transfer mechanisms such as adequate decisions adopted by the European Commission, standard contractual clauses with its service providers, suppliers, and customers whenever appropriate. Please contact us at privacy@verahealth.ai for more information about the safeguards we use.

12. User Rights and Request Process

12.1 User Rights

We are committed to respecting the privacy and data rights of all our users, regardless of their location. In particular, you have the right to request access to, rectification of, deletion of, restrictions on our use of your personal data from our systems, where applicable to receive personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller (data portability), to object against the use of your personal data (collectively, “User Rights”). To exercise the User Rights, please follow the steps set out below. In responding to your User Rights requests, (a) we will provide the applicable information in a commonly used, machine-readable format, and (b) we may redact or limit the information provided to maintain our proprietary rights or comply with legal requirements.

As part of your User Rights, you may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Vera Health might have received the data from Vera Health; what the source of the information was (if you didn’t provide it directly to Vera Health); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by Vera Health if it is inaccurate. You may request that Vera Health erase that data or cease processing it, subject to certain exceptions. You may also revoke your consent to processing your data for direct marketing purposes at any time, without prejudice of the processing already carried out. In many countries, you have a right to lodge a complaint with the appropriate data protection authority (“Supervisory Authority”) if you have concerns about how Vera Health processes your personal data. When technically feasible, Vera Health will—at your request—provide your personal data to you or transmit it directly to another controller. To find your local Supervisory Authority, see https://iapp.org/resources/global-privacy-directory.

If you are a California resident, your User Rights are more fully set out in Section 13 (California Resident Rights), below.

12.2 How to Submit a Request

To make a request pursuant to your User Rights, contact us by emailing privacy@verahealth.ai with the subject line “User Rights Request.”

Include your full name, email address associated with your account, and any additional information that could help us verify your identity and process your request.

For security purposes, we may need to verify your identity before processing your User Rights request. We may ask for additional information to confirm your identity.

We will acknowledge your request and reply to you within one month from the receipt. In certain circumstances, where more time is needed, we will inform you and provide an updated timeline.

In general, we will work to respond to your User Rights request within the time period required by applicable law. We will not charge you a fee for making a User Rights request unless your request is excessive, repetitive or manifestly unfounded. If we determine that your User Rights request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

Once the request is processed, we will modify our handling of your personal data as described in the response. Note that we may always retain personal data as necessary to comply with legal obligations, resolve disputes, or as otherwise described in this Privacy Policy.

You may also authorize an agent (an “Authorized Agent”) to exercise User Rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.

To exercise your User Rights, you or your Authorized Agent must send us a request that (a) provides sufficient information to allow us to verify that you are the person about whom we have collected personal data, and (b) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. We may not respond to requests that do not meet these criteria. We will only use personal data provided in connection with a User Rights Request to verify your identity and complete your request. You do not need an account to submit a User Rights Request.

For further assistance, or if you encounter any issues with your data User Rights request, please reach out to us at privacy@verahealth.ai.

13. California Resident Rights

If you are a California resident, you have the rights set forth in this section. Please note that we may process personal data of our customers’ authorized users or employees in connection with our provision of certain services to our customers. Additionally, please note that these rights are subject to certain conditions and exceptions under applicable law, which may permit or require us to deny your request.

If there are any conflicts between this section and any other provision of this Privacy Policy and you are a California resident, the portion that is more protective of personal data shall control to the extent of such conflict.

13.1 Access

You have the right to request certain information about our collection and use of your personal data. In response, we will provide you with the following information in the past 12 months:

The categories of personal data that we have collected about you.

The categories of sources from which that personal data was collected.

The business or commercial purpose for collecting and using your personal data.

The categories of third parties with whom we have shared your personal data.

The specific pieces of personal data that we have collected about you.

If we have disclosed your personal data to any third parties for a business purpose over the past 12 months, we will identify the categories of personal data shared with each category of third-party recipient.

You may request the above information beyond the 12-month period, but no earlier than January 1, 2022. If you do make such a request, we will provide that information unless doing so proves impossible or would involve disproportionate effort.

13.2 Deletion

You have the right to request that we delete the personal data that we have collected about you. Under the CCPA, this right is subject to certain exceptions: for example, we may need to retain your personal data to provide you with the Services or complete a transaction or other action you have requested, or if deletion of your personal data involves disproportionate effort. If your deletion request is subject to one of these exceptions, we may deny your deletion request.

To request deletion of your personal data, send an email from a verified email address associated with your account to privacy@verahealth.ai requesting the deletion.

13.3 Correction

You have the right to request that we correct any inaccurate personal data we have collected about you. Under the CCPA, this right is subject to certain exceptions: for example, if we decide, based on the totality of circumstances related to your personal data, that such data is correct. If your correction request is subject to one of these exceptions, we may deny your request.

13.4 Personal Data Shares Opt-Out

As described in the “Tracking Tools, Advertising and Opt-Out” section above, we have incorporated Cookies from certain third parties into our Services. These Cookies allow those third parties to receive information about your activity on our Services that is associated with your browser or device. Those third parties may use that data to serve you relevant ads on our Services or on other websites you visit. You can opt out of such sharing by following the instructions in this section.

We share your personal data to the following categories of third parties:

• Ad Networks (i.e. retargeted advertising cookie providers).

Over the past 12 months, we have shared the following categories of your personal data to categories of third parties listed above:

• Web Analytics Data.
• Device/IP Data.

We have shared the foregoing categories of personal data for the following business or commercial purposes:

• Marketing and providing the Services.
• Showing you advertisements, including interest-based or online behavioral advertising.

If you are a California resident, you may opt-out from any “shares” of personal data by emailing us at privacy@verahealth.ai.

Once you have submitted an opt-out request, we will not ask you to reauthorize the sharing of your personal data for at least 12 months.

To our knowledge, we do not share the personal data of minors under 16 years of age.

13.5 Limit the Use of Sensitive Personal Data

Consumers have the right to request that we limit the use or sharing disclosure of their sensitive personal data (“Right to Limit”). However, since our use and disclosure of Sensitive Information are limited to the purposes set forth in section 7027(m) of the CCPA regulations, including: (a) performing the services or providing the goods reasonably expected, (b) preventing, detecting, and investigating security incidents, (c) resisting malicious, deceptive, fraudulent, or illegal actions, (d) ensuring physical safety of natural persons, (e) for short-term transient use, (f) performing services on behalf of the business, (g) verifying or maintaining quality or safety of a product or service, and (h) collecting or processing sensitive personal data but not for the purpose of inferring characteristics, we do not offer a way for you to submit such a request.

13.6 We Will Not Discriminate Against You for Exercising Your Rights Under the CCPA

We will not discriminate against you for exercising your rights under the CCPA. We will not deny you our goods or services, charge you different prices or rates, or provide you with a lower quality of goods and services if you exercise your rights under the CCPA. However, we may offer different tiers of our Services as allowed by applicable data privacy laws (including the CCPA) with varying prices, rates or levels of quality of the goods or services you receive related to the value of personal data that we receive from you.

13.7 Additional California Resident Rights

Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to ask us to prevent disclosure of personal data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at privacy@verahealth.ai.

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services that you do not wish such operators to track certain of your online activities over time and across different websites. Our Services do not support Do Not Track requests at this time. To find out more about “Do Not Track,” you can visit www.allaboutdnt.com.

14. Contact Information

If you have any questions or comments about this Privacy Policy or your choices and rights, please contact us at:

• privacy@verahealth.ai, or
• Veracity-Health Inc. d/b/a Vera Health 2261 Market Street, Suite 22644 San Francisco, California 94114 USA

Our EU representative is Instant EU GDPR Representative Ltd —Adam Brogden, Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland · contact@gdprlocal.com

To contact our Data Protection Officer:

• Email: security@verahealth.ai
• Phone Number: +1 (516) 523-8438

We may need to verify your identity before fulfilling your request.

[END OF PRIVACY POLICY]