Aletha Health - App-privacy-policy-us

ALETHA INC.

NOTICE OF PRIVACY POLICY

Please read the following carefully to understand the views and practices of Aletha, Inc. regarding your Personal Data (defined below).

At Aletha Inc. (“Aletha,” “We,” “Us,” the “Company”), we value your privacy and are committed to keeping your personal data confidential. We use your data solely in the context of providing the Aletha application, software, web portal, and mobile application (collectively, the “Platform”) and all of its contents and functionality (all together, the “Services”) for use by qualified physicians and healthcare professionals, such as physical therapists (“Provider Users”) and mobile and web platform users (“Service Users”).

This Privacy Policy explains Aletha’s privacy practices with respect to our Platform and our Services. This Privacy Policy also provides you (“You”) with an overview of the types of information and data that Aletha collects through its Platform and the provision of its Services, how Aletha collects such information, how Aletha uses and discloses such information, and who will have access to such information, which includes any information that can be used on its own or with other information in combination to identify or contact one of our users (“Personal Data”). Personal Data, as used herein, do not include publicly available data or de-identified or de-anonymized data.

Please note that we occasionally update this Privacy Policy, and that it is Your responsibility to stay up to date with any amended or modified versions. If we amend or modify this Privacy Policy, we will post a link to the modified or amended terms on our website and/or notify you via the email address you have provided to us. You can store this Privacy Policy and/or any amended or modified versions digitally, print it, or save it in any other way. Any changes to this Privacy Policy will be effective immediately upon providing notice and shall apply to all Personal Data We maintain, use, and disclose. If You continue to use the Services following such notice, You are agreeing to any such amendments and/or modifications.

If You have any questions or concerns after reading this Privacy Policy, please do not hesitate to contact Us at privacy@alethahealth.com. We appreciate Your feedback.

Service Users:

1. 1. Some of the Personal Data We collect and transmit may be considered data related to:
    1. Your physical or mental health (“Health Data”);
    2. information that relates to Your past, present, or future physical or mental health or condition(s) (“Protected Health Information” or “PHI”);
    3. the provision of health care to You;
    4. the past, present, or future payment for the provision of health care to You; and/or
    5. medical records as defined by state law.
  2. Our privacy practices are intended to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and [California] law related to the use and disclosure of medical records, where applicable.
  3. For additional information related to how we use and disclose Your Health Data, PHI, and/or medical records data, please contact Us at privacy@alethahealth.com.
  4. By submitting Your Personal Data to or through the Platform, You acknowledge that You have read, understood, and agree to the terms of this Privacy Policy. If You do not agree, please do not submit any Personal Data to Us and immediately cease Your use of the Services.

Responsible Entity

1. The Company is the controller of Your Personal Data and may process this data in accordance with this Privacy Policy. If We are processing Personal Data on behalf of a third party that is not an agent or affiliate of the Company, the terms of this Privacy Policy do not apply; instead, the terms of that third party’s privacy policy will apply. You can contact Us with any questions about Our Privacy Policy at privacy@alethahealth.com.

Links to Other Sites

1. 1. Our Platform may contain links to websites and services that are owned or operated by third parties (each, a “Third Party Service”). Any information that You provide on or to a Third Party Service or that is collected by a Third Party Service is provided directly to the owner or operator of the Third Party Service and is subject to that respective Third Party Service owner’s or operator’s privacy policy. We are not responsible for the content, privacy, or security practices and policies of any Third Party Service. To protect Your information, We recommend that You carefully review the privacy policies of all Third Party Services that You access.

Personal Data We Collect

1. 1. The types of Personal Data We collect depend on your interaction with Our Platform and the choices You make, including your privacy settings and features You use, your location, and applicable law. We will only collect data about You that is necessary for one or more of our legitimate business purposes or is required by law. Examples of Personal Data We may collect include:
    1. Demographic Data. We may collect demographic information, including, but not limited to, Your name, birth year, sex, gender, height, weight, phone number, residential address, and email address, and if you are a Provider User, Your National Provider Identifier (“NPI”). Primarily, the collection of Your Personal Data assists Us in creating Your User Account, which You can use to securely to receive the Services.
    2. Payment Data. If You make payments via Our Platform, We may require that You provide to Us Your financial and billing information, such as billing name and address, credit card number or bank account information.
    3. Support Data. If You contact Us for support or to lodge a complaint, We may collect technical or other information from You through log files and other technologies, some of which may qualify as Personal Data, such as, but not limited to, IP Address. Such information will be used for the purposes of troubleshooting, customer support, software updates, and improvement of the Platform and related Services in accordance with this Privacy Policy. Calls with Aletha may be recorded or monitored for training, quality assurance, customer service, and reference purposes.
    4. Device, Telephone, and ISP Data. We use common information-gathering tools, such as log files, cookies, Web beacons, and similar technologies to automatically collect information, which may contain Personal Data, from Your computer or mobile device as You navigate our Platform interact with emails We have sent You. The information We collect may include Your IP address (or proxy server), device and application identification numbers, location, browser type, Internet service provider and/or mobile carrier, the pages and files You viewed, Your searches, Your operating system and system configuration information, and date/time stamps associated with Your usage. This information is used to analyze overall trends, to help Us provide and improve Our Services and to guarantee their security and continued proper functioning.
    5. For Service Users: Health and Device Data. In addition to demographic information, We may collect information regarding Your health conditions, including medical history, symptoms, physiologic data recorded by our devices, and communications between You and the Platform. We collect this information to provide You with the Services –

How We Use Your Personal Data

1. 1. We process Your Personal Data based on legitimate business interests, the fulfillment of Our Services to You, compliance with Our legal obligations, and/or Your consent. We only use or disclose Your Personal Data when it is legally mandated or where it is necessary to fulfill those purposes described herein. Where required by law, We will ask for Your prior consent before doing so.
  2. Specifically, We will process Your Personal Data for the following legitimate business purposes:
    1. To provide Our Services to You;
    2. To communicate with You about and manage Your User Account;
    3. To properly store and track Your data within Our system;
    4. To respond to lawful requests from public and government authorities, and to comply with applicable state/federal law, including cooperation with judicial proceedings or court orders;
    5. To protect Our rights, privacy, safety, or property, and/or that of You or others by providing proper notices, pursuing available legal remedies, and acting to limit Our damages;
    6. To handle technical support and other requests from You;
    7. To enforce and ensure Your compliance with Our Terms of Use or the terms of any other applicable services agreement We have with You;
    8. To manage and improve Our operations, Services, and the Platform, including the development of additional functionality;
    9. To manage payment processing;
    10. To evaluate the quality of service You receive, identify usage trends, and thereby improve Your user experience;
    11. To conduct research and analytics to understand, improve, evaluate, and develop Our Services and business processes and to develop other insights;
    12. To train, develop, and enhance a software program (the “Software Program”) that will provide improved, innovative, and personalized healthcare solutions for Our Service Users. We will take measures sufficient to de-identify or anonymize Your Personal Data, which may include, among other things, Your health data, medical data, PHI, personal information, images, videos from Your sessions, etc. All of Your Personal Data will be de-identified, obscured, and anonymized so that there is no reasonable basis to believe that the resulting information can be used to identify You. The measures taken by Aletha to de-identify or anonymize Your Personal Data, including Your PHI, will comply with the legal de-identification standards promulgated pursuant to HIPAA and other applicable health data laws and regulations. The data resulting from this de-identification process will create a new data set for each Service User of Aletha that will be referred to herein as the “Anonymized Data.” Only the Anonymized Data from Aletha’s Service Users will then be used to train, develop, and improve the Software Program developed and owned by Aletha. Your Personal Data will not be used to train, develop, and improve the Software Program. Ultimately, the Software Program will enable Aletha to deliver personalized healthcare solutions, track Service User progress, and improve treatment strategies for all of Aletha’s Service Users. Aletha will receive financial compensation and/or incentives from the sale or licensing of the Software Program to medical and/or healthcare providers.
    13. To tailor content, We may send or display on Our Services, including to offer location customization and personalized help and instructions, and to otherwise personalize Your experiences;
    14. To operate Our business, consider and implement mergers, acquisitions, reorganizations, bankruptcies, business collaborations, and other business transactions, and otherwise related to the administration and/or planning of Our general business, accounting, auditing, compliance, recordkeeping, and legal functions;
    15. To run the Company or its Services, We may combine Your Personal Data with many of Our Users to decide, for example, about additional services the Company should offer, decide the services not needed and whether certain new treatments are effective;
    16. To keep Our Platform safe and secure for You and for Us;
    17. To send You information about changes to Our terms, conditions, and policies;
    18. To allow Us to pursue available remedies or limit the damages that We may sustain; and
    19. If you are a Service User, to enable You to connect with (or share Personal Data with) the authorized Provider User or business associate to enable that individual to monitor Your progress and overall condition, as she/he deems appropriate.

Where is Your Personal Data Processed?

1. Personal Data We collect through the Platform and devices will be stored on secure servers. Personal Data may be transmitted to third parties, which parties may store or maintain the data on their secure servers.

Will We share Your Personal Data with Anyone Else?

1. 1. For Service Users.
    1. Yes, with the Provider User with whom You connect via the Services. We will share information you provide to Us via the Services with the Provider User with whom You connect via the Services. If, at any point, You want to deny access to one or more Provider Users, you can do so by emailing privacy@alethahealth.com .
    2. Yes, with third parties that help Us power Our Services. We have a limited number of service providers and other third parties (“Business Partners”) that help Us run various aspects of Our business. We have or will have written contracts in place with the Business Partners requiring the protection of the privacy and security of Your Personal Data and to use it only for the limited purpose(s) for which it is shared with Us. Business Partners’ use of Personal Data may include, but is not limited to, the provision of services such as data hosting, IT services, customer service, and payment processing.
    3. Yes, with third parties to recommend possible treatment options or alternatives that may be of interest to You or to teach health-related benefits or services that may be of interest to You.
    4. Yes, with third parties and the government when legal or enforcement issues arise. We may share Your Personal Data, if reasonable and necessary, to: (i) comply with legal processes or enforceable governmental requests, or as otherwise required by law; (ii) cooperate with third parties in investigating acts or omissions that violate this Privacy Policy or the Terms of Use; or (iii) bring legal action against someone who may be violating the Terms of Use or who may be causing intentional or unintentional injury or interference to the rights or property of Aletha or any third party, including other users of Our Services.
    5. Yes, with third parties that provide advisory services. We may share Your Personal Data with third parties that provide use services, including but not limited to, Our lawyers, auditors, accountants, or banks, when We have a legitimate business interest in doing so.
    6. Yes, with third parties in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of Aletha’s corporate entity, assets, or stock (including in connection with any bankruptcy or similar proceedings).
    7. Yes, with third-party business partners with whom We conduct joint business activities.
    8. Yes, with third parties to comply with Our general legal obligations.
    9. Yes, with third parties that process Your Personal Data at Your direction.
    10. Yes, with third parties in connection with the Company’s business transactions.
    11. If We share Your Personal Data with a third party other than as provided above, You will be notified at the time of data collection or transfer, and You will have the option of not permitting the transfer.

Situations Requiring Your Authorization

1. 1. For uses and disclosure not generally described above, We must obtain Your authorization. For example, the following uses and disclosures will be made only with Your authorization:
    1. Uses and disclosure that constitute a sale of Your Personal Data.
    2. Other uses and disclosures not described in this Privacy Policy.
  2. By agreeing to this Privacy Policy, You provide us authorization to use or disclose Personal Data as specified in this Privacy Policy, You may revoke this authorization in writing at any time. If You revoke Your authorization, We will no longer use or disclose Your Personal Data for the activities covered by the authorization, except if We have already acted in reliance on Your permission or consent. We are unable to take back any disclosures we have already made with Your authorization. If there is any data that We are unable to delete entirely from Our systems or from third parties with whom we have already disclosed your Personal Data, We will put in place and inform third parties to put in place appropriate measures to prevent any further processing of such data.

How Long Do We Retain Personal Data?

We will retain Your Personal Data for as long as You maintain a User Account and up to six (6) years after the account is closed. The exact period of retention will depend on the type of Personal Data, Our contractual obligation to You, and applicable law. We keep Your Personal Data for as long as necessary to fulfill the purpose for which it was collected, unless otherwise required or necessary pursuant to a legitimate business purpose outlined in this Privacy Policy. At the end of the applicable retention period, We will remove Your Personal Data from Our databases and will request that Our Business Partners remove Your Personal Data from their databases. If there is any data that We are unable, for technical reasons, to delete entirely from Our systems, We will put in place appropriate measures to prevent any further processing of such data.

We retain anonymized data indefinitely.

1. Once We disclose Your Personal Data to third parties, We may not be able to access that Personal Data any longer and cannot force the deletion or modification of any such information by the parties to whom We have made those disclosures. Written requests for deletion of Personal Data other than as described should be directed to privacy@alethahealth.com.

What is Our Cookie Policy?

1. Cookies are small files that a web server sends to Your computer or device when You visit a website that uses cookies to keep track of Your activity on that site. Cookies also exist within applications when a browser is needed to view certain content or display certain content within the application. Cookies hold a small amount of data specific to that website, which can later be used to help remember information You enter into the site (such as Your email or other contact info), preferences selected, and movement within the site. If You return to a previously visited website or application (and Your browser has cookies enabled), the web browser sends the small file to the web server, which tells it what activity You engaged in the last time You used the website or application, and the server can use the cookie to do things like expedite logging in and retrieving user data and keeping Your browser session secure.
2. We use cookies and other technologies to, among other things, better serve You with more tailored information, and to facilitate efficient and secure access to the Platform. We only use essential cookies. Essential cookies are those necessary for Us to provide services to You. We have provided, below, a full list of our cookies, categorized as described above. We have described the purpose of each, whether they are Aletha’s or Third-Party’s cookies, and how to withdraw consent to their use. We have also indicated which cookies last for as long as You keep Your browser open (“Session Cookies”) and which remain on Your hard drive until You delete them or they expire (“Persistent Cookies”).
3. We may also collect information using pixel tags, web beacons, clear GIFs, or other similar technologies. These may be used in connection with some web site or application pages and HTML formatted email messages to, among other things, track the actions of users and email recipients, and compile statistics about usage and response rates.
  1. Essential Cookies
    1. Strictly Necessary Cookies

These cookies are essential for the proper functioning of our website and cannot be disabled. They help with security, consent management, and user sessions.

Cookie Name	Provider	Duration	Purpose
AWSALBCORS	richpanel.com	7 days	Ensures load balancing functionality and maintains user session stickiness.
CookieScriptConsent	alethahealth.com	6 months	Stores user cookie consent preferences.
rpsid	alethahealth.com	6 hours	Stores session information for a seamless browsing experience.
__cf_bm	t.co	30 minutes	Distinguishes between humans and bots for security purposes.
VISITOR_PRIVACY_METADATA	youtube.com	6 months	Stores user privacy and consent preferences.

Performance Cookies

These cookies help us analyze website usage and improve performance by tracking user interactions, session states, and analytics.

Cookie Name	Provider	Duration	Purpose
_conv_v	alethahealth.com	6 months 2 days	Tracks user interactions for analytics and conversion tracking.
_ga	alethahealth.com	1 year 1 month	Google Analytics cookie used to distinguish unique users.
_gid	alethahealth.com	1 day	Google Analytics cookie used to track page views.
__kla_id	alethahealth.com	1 year 1 month	Tracks user clicks from Klaviyo emails.
rptkn	alethahealth.com	1 year 1 month	Used for internal reporting and analytics.

How Can You “Opt Out” of Cookies?

1. 1. If You prefer, You can usually choose to set Your browser to remove cookies and reject cookies. If You enable a do not track (“DNT”) signal or otherwise configure Your browser to prevent Aletha from collecting cookies, You will need to re-enter Your user name each time You visit the login page.

How Do We Protect Your Personal Data?

1. 1. Aletha is committed to protecting the security and confidentiality of Your Personal Data. We use a combination of reasonable physical, technical, and administrative security controls to maintain the security and integrity of Your Personal Data, to protect against any anticipated threats or hazards to the security or integrity of such information, and to protect against unauthorized access to or use of such information in Our possession or control that could result in substantial harm or inconvenience to You. However, Internet data transmissions, whether wired or wireless, cannot be guaranteed to be 100% secure. As a result, We cannot ensure the security of information You transmit to Us. By using the Platform, You are assuming this risk.
  2. Safeguards.
    1. The information collected by Aletha and stored on secure servers, is protected by a combination of technical, administrative, and physical security safeguards, such as authentication, encryption, backups, and access controls. If Aletha learns of a security concern, We may attempt to notify You and provide information on protective steps, if available, through the email address that You have provided to Us. Depending on where You live, You may have a legal right to receive such notices in writing.
    2. You are solely responsible for protecting information entered or generated via the Platform that is stored on Your device and/or removable device storage. Aletha has no access to or control over Your device’s security settings, and it is up to You to implement any device level security features and protections You feel are appropriate (e.g., password protection, encryption, remote wipe capability, etc.). We recommend that You take any and all appropriate steps to secure any device that You use to access Our Platform.
    3. NOTWITHSTANDING ANY OF THE STEPS TAKEN BY US, IT IS NOT POSSIBLE TO GUARANTEE THE SECURITY OR INTEGRITY OF DATA TRANSMITTED OVER THE INTERNET. THERE IS NO GUARANTEE THAT YOUR PERSONAL DATA WILL NOT BE ACCESSED, DISCLOSED, ALTERED, OR DESTROYED DESPITE THE IMPLEMENTATION OF OUR PHYSICAL, TECHNICAL, OR ADMINISTRATIVE SAFEGUARDS. THEREFORE, WE DO NOT AND CANNOT ENSURE OR WARRANT THE SECURITY OR INTEGRITY OF ANY PERSONAL DATA YOU TRANSMIT TO US AND YOU TRANSMIT SUCH PERSONAL DATA AT YOUR OWN RISK.
    4. In instances where You have authorized the Company to use and disclose Your Personal Data for certain purposes, You may withdraw Your authorization in the future. You may withdraw Your authorization by sending Your request in writing to: privacy@alethahealth.com or Aletha Inc., 2872 Ygnacio Valley Road #605, Walnut Creek CA 94598, Attn: Privacy Officer. Please note that Your withdrawal will not be effective until We receive Your request and will not apply to uses and disclosures that We have already made in reliance on Your authorization.

How Can You Protect Your Personal Data?

1. 1. In addition to securing Your device, as discussed above, We will never send You an email requesting confidential information such as account numbers, usernames, passwords, or social security numbers, and You should never respond to any email requesting such information. If You receive such an email that looks like it is from Us, do not respond to the email and do not click on any links and/or open any attachments in the email, and notify Aletha at privacy@alethahealth.com.
  2. You are responsible for taking reasonable precautions to protect Your user ID, password, and other User Account information from disclosure to third parties, and You are not permitted to circumvent the use of required encryption technologies. You should immediately notify Us at privacy@alethahealth.com if You know of or suspect any unauthorized use or disclosure of Your user ID, password, and/or other User Account information, or any other security concern.

Your Rights

1. 1. You have certain rights relating to Your Personal Data, subject to applicable data protection laws. These rights may include:
    1. to confirm, amend, modify, update, or access Your Personal Data held by Us;
    2. to inspect and obtain a paper or electronic copy of Your Personal Data that may be used to make decisions about Your care and treatment;
    3. to require that we communicate with You about Yourself in a certain way or at a certain location;
    4. to erase/delete Your Personal Data, to the extent permitted by applicable data protection laws;
    5. to receive communications related to the processing of Your Personal Data that are concise, transparent, intelligible, and easily accessible;
    6. to restrict the processing of Your Personal Data, to the extent permitted by law (while We verify or investigate Your concerns with this information, for example);
    7. to object to the further processing of Your Personal Data, including the right to object to marketing;
    8. to request that Your Personal Data be transferred to a third party, if possible;
    9. to receive Your Personal Data in a structured, commonly used, and machine-readable format;
    10. to lodge a complaint with a supervisory authority;
    11. to withdraw Your consent previously provided with respect to Our collection, use, and sharing of Your Personal Data;
    12. to request an “accounting of disclosures” describing how we have shared Your Personal Data with outside parties, including whether We are collecting, sharing, or selling Your Personal Data and access such Personal Data, including a list of all third parties and affiliates with whom We have shared or sold (if applicable) Your Personal Data and an active email address or other online mechanism that You may use to contact these third parties;
    13. to rectify inaccurate Personal Data and, taking into account the purpose of processing the Personal Data, ensure it is complete;
    14. to be notified of breaches affecting Your Personal Data; and,
    15. to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects (“Automated Decision-Making”).
  2. Where the processing of Your Personal Data by Us is based on consent, You have the right to withdraw that consent without detriment at any time or to exercise any of the rights listed above by emailing Us at privacy@alethahealth.com .

How Can You Update, Correct, or Delete Your Personal Data?

1. 1. You can change Your email address and other contact information by contacting us at privacy@alethahealth.com. If You need to make changes or corrections to other information, You may contact us at privacy@alethahealth.com. Please note that in order to comply with certain requests to limit use of Your Personal Data, We may need to terminate Your account and Your ability to access and use the Services, and You agree that We will not be liable to You for such termination or for any refunds of prepaid fees paid by You. You can deactivate Your account by request at privacy@alethahealth.com.
  2. Although We will make reasonable efforts to do so, You understand that it may not be technologically possible to remove from Our systems every record of Your Personal Data. The need to back up Our systems to protect information from inadvertent loss means a copy of Your Personal Data may exist in a non-erasable form that will be difficult or impossible for Us to locate or remove.

Can You “OPTOUT” of Receiving Communications from Us?

1. 1. We pledge not to market third party services to You without Your consent. We only send emails or SMS text messages to You regarding Your account unless We have Your express consent to do so. You can choose to filter these emails using Your email client settings, but We do not provide an option for You to opt out of these emails.

Special Provisions Pertaining to Minors

1. 1. We do not knowingly collect Personal Data from individuals under the age of 18. Our Services are not directed to individuals under the age of 18. We request that these individuals not provide Personal Data to Us. If We learn that Personal Data from users less than 18 years of age has been collected, We will deactivate the account and take reasonable measures to promptly delete such data from Our records. If You are aware of a user under the age of 18 using the Website, please contact Us at privacy@alethahealth.com.
  2. If You are a resident of California under the age of 18 and have registered for an account with Us, You may ask Us to remove content or information that You have posted to Our Platform.

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Montana, Nevada Oregon, Tennessee, Texas, Utah, and Virginia

1. California residents may request and obtain from Us, once a year, free of charge, a list of third parties, if any, to which We disclosed their Personal Data for direct marketing purposes during the preceding calendar year and the categories of Personal Data shared with those third parties. If You are a California resident and wish to obtain that information, please submit Your request by sending Us an email at privacy@alethahealth.com with “California Privacy Rights” in the subject line. You also have the following rights with respect to your Personal Data:

To opt out of Personal Data sales and sharing with service providers;
To limit Our use of Your Personal Data;
To correct inaccurate Personal Data about You;
To delete certain information We have about You;
To provide You with information about the financial incentives We offer to You, if any; and
To be free from discriminatory treatment for exercising these rights.

Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia provide (now or in the future) residents of their states with rights:

To confirm whether We process their Personal Data;
To access and delete certain Personal Data;
To correct inaccuracies in their Personal Data, taking into account the information’s processing purpose (excluding Iowa and Utah);
To data portability;
To opt out of Personal Data processing for targeted advertising (excluding Iowa), sales, or profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah);
To either limit (opt out of) or require consent to process sensitive Personal Data.

Nevada provides its residents with a limited right to opt out of certain Personal Data sales. Residents who seek to exercise such opt-out rights may submit an email request with the subject line “Nevada Privacy Right,” to the following email address: privacy@alethahealth.com. Please include Your account name and a detailed request so that We may respond properly.

Questions

1. 1. If at any point You no longer agree to the use and disclosure of Personal Data, as described in this Privacy Policy, You can delete Your account by [selecting “Delete” in the settings of our Platform] or by requesting deletion by emailing privacy @alethahealth.com with the subject line “REQUEST FOR PERSONAL DATA DELETION” and requesting account deletion.

Contact Us

1. If You have any questions about this Privacy Policy, please contact Us by email at privacy@alethahealth.com or write to Us at Aletha Inc., 2872 Ygnacio Valley Road #605, Walnut Creek CA 94598. Please note that email communications are not always secure; so please do not include sensitive information in Your emails to Us.

ACKNOWLEDGMENT OF NOTICE OF PRIVACY POLICY OF ALETHA INC.

AND CONSENT FORM

This Notice of Privacy Policy of Aletha Inc. constitutes a binding legal agreement between You and Aletha regarding Aletha’s use of Your Personal Data and Aletha’s use of Anonymized Data. To agree to the terms and conditions of this Acknowledgment, [click “AGREE” below.] If you do not agree to the terms and conditions of this Acknowledgment, [do not click “AGREE.”] By clicking “AGREE,”] You acknowledge and agree that You:

Have read and understood the terms and conditions stated above;
Consent to Our use, and disclosure of Your Personal Data as Anonymized Data for the development, publication, and business development of the Software Program;
Acknowledge that Anonymized Data may be used by Aletha for commercial purposes, including as part of selling and licensing of the Software Program; and
Retain all rights outlined in Our notices to You with the understanding that any changes will not be applied retroactively.

Service Users:

Some of the Personal Data We collect and transmit may be considered data related to:

Your physical or mental health (“Health Data”);

information that relates to Your past, present, or future physical or mental health or condition(s) (“Protected Health Information” or “PHI”);

the provision of health care to You;

the past, present, or future payment for the provision of health care to You; and/or

medical records as defined by state law.

Our privacy practices are intended to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and [California] law related to the use and disclosure of medical records, where applicable.

For additional information related to how we use and disclose Your Health Data, PHI, and/or medical records data, please contact Us at privacy@alethahealth.com.

By submitting Your Personal Data to or through the Platform, You acknowledge that You have read, understood, and agree to the terms of this Privacy Policy. If You do not agree, please do not submit any Personal Data to Us and immediately cease Your use of the Services.

Responsible Entity

Links to Other Sites

Personal Data We Collect

Payment Data. If You make payments via Our Platform, We may require that You provide to Us Your financial and billing information, such as billing name and address, credit card number or bank account information.

How We Use Your Personal Data

Specifically, We will process Your Personal Data for the following legitimate business purposes:

To provide Our Services to You;

To communicate with You about and manage Your User Account;

To properly store and track Your data within Our system;

To respond to lawful requests from public and government authorities, and to comply with applicable state/federal law, including cooperation with judicial proceedings or court orders;

To protect Our rights, privacy, safety, or property, and/or that of You or others by providing proper notices, pursuing available legal remedies, and acting to limit Our damages;

To handle technical support and other requests from You;

To enforce and ensure Your compliance with Our Terms of Use or the terms of any other applicable services agreement We have with You;

To manage and improve Our operations, Services, and the Platform, including the development of additional functionality;

To manage payment processing;

To evaluate the quality of service You receive, identify usage trends, and thereby improve Your user experience;

To conduct research and analytics to understand, improve, evaluate, and develop Our Services and business processes and to develop other insights;

To tailor content, We may send or display on Our Services, including to offer location customization and personalized help and instructions, and to otherwise personalize Your experiences;

To run the Company or its Services, We may combine Your Personal Data with many of Our Users to decide, for example, about additional services the Company should offer, decide the services not needed and whether certain new treatments are effective;

To keep Our Platform safe and secure for You and for Us;

To send You information about changes to Our terms, conditions, and policies;

To allow Us to pursue available remedies or limit the damages that We may sustain; and

If you are a Service User, to enable You to connect with (or share Personal Data with) the authorized Provider User or business associate to enable that individual to monitor Your progress and overall condition, as she/he deems appropriate.

Where is Your Personal Data Processed?

Personal Data We collect through the Platform and devices will be stored on secure servers. Personal Data may be transmitted to third parties, which parties may store or maintain the data on their secure servers.

Will We share Your Personal Data with Anyone Else?

For Service Users.

Yes, with third parties to recommend possible treatment options or alternatives that may be of interest to You or to teach health-related benefits or services that may be of interest to You.

Yes, with third parties that provide advisory services. We may share Your Personal Data with third parties that provide use services, including but not limited to, Our lawyers, auditors, accountants, or banks, when We have a legitimate business interest in doing so.

Yes, with third parties in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of Aletha’s corporate entity, assets, or stock (including in connection with any bankruptcy or similar proceedings).

Yes, with third-party business partners with whom We conduct joint business activities.

Yes, with third parties to comply with Our general legal obligations.

Yes, with third parties that process Your Personal Data at Your direction.

Yes, with third parties in connection with the Company’s business transactions.

If We share Your Personal Data with a third party other than as provided above, You will be notified at the time of data collection or transfer, and You will have the option of not permitting the transfer.

Situations Requiring Your Authorization

For uses and disclosure not generally described above, We must obtain Your authorization. For example, the following uses and disclosures will be made only with Your authorization:

Uses and disclosure that constitute a sale of Your Personal Data.

Other uses and disclosures not described in this Privacy Policy.

How Long Do We Retain Personal Data?

We retain anonymized data indefinitely.

What is Our Cookie Policy?

Essential Cookies

Strictly Necessary Cookies

Performance Cookies

How Can You “Opt Out” of Cookies?

If You prefer, You can usually choose to set Your browser to remove cookies and reject cookies. If You enable a do not track (“DNT”) signal or otherwise configure Your browser to prevent Aletha from collecting cookies, You will need to re-enter Your user name each time You visit the login page.

How Do We Protect Your Personal Data?

Safeguards.

How Can You Protect Your Personal Data?

Your Rights

You have certain rights relating to Your Personal Data, subject to applicable data protection laws. These rights may include:

to confirm, amend, modify, update, or access Your Personal Data held by Us;

to inspect and obtain a paper or electronic copy of Your Personal Data that may be used to make decisions about Your care and treatment;

to require that we communicate with You about Yourself in a certain way or at a certain location;

to erase/delete Your Personal Data, to the extent permitted by applicable data protection laws;

to receive communications related to the processing of Your Personal Data that are concise, transparent, intelligible, and easily accessible;

to restrict the processing of Your Personal Data, to the extent permitted by law (while We verify or investigate Your concerns with this information, for example);

to object to the further processing of Your Personal Data, including the right to object to marketing;

to request that Your Personal Data be transferred to a third party, if possible;

to receive Your Personal Data in a structured, commonly used, and machine-readable format;

to lodge a complaint with a supervisory authority;

to withdraw Your consent previously provided with respect to Our collection, use, and sharing of Your Personal Data;

to rectify inaccurate Personal Data and, taking into account the purpose of processing the Personal Data, ensure it is complete;

to be notified of breaches affecting Your Personal Data; and,

to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects (“Automated Decision-Making”).

Where the processing of Your Personal Data by Us is based on consent, You have the right to withdraw that consent without detriment at any time or to exercise any of the rights listed above by emailing Us at privacy@alethahealth.com .

How Can You Update, Correct, or Delete Your Personal Data?

Can You “OPTOUT” of Receiving Communications from Us?

Special Provisions Pertaining to Minors