Consumer Health Data Privacy Policy

What this policy covers

"Consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present or future physical or mental health status, including information about health conditions, treatments, diseases or diagnoses; health-related surgeries or procedures; use or purchase of medication; bodily functions and vital signs; efforts to seek health care services; precise location information that could reasonably indicate a consumer's attempt to receive health care services; and any information that is derived or extrapolated from information that is not consumer health data, such as inferences drawn from proxy or other non-health information.

This policy does not cover information we process as a business associate on behalf of a covered entity under the Health Insurance Portability and Accountability Act ("HIPAA"). That information, including protected health information, is governed by HIPAA and by our agreements with the covered entity, and is exempt from the My Health My Data Act. It also does not cover the practices of companies we do not own or control, including the sponsors, physician practices and telehealth partners described below, each of which maintains its own privacy practices.

Categories of consumer health data we collect, and why

We collect the following categories of consumer health data. For each category, we collect it in order to provide, customize and improve our Services, to correspond with you, and to meet the purposes described in the "How and why we use consumer health data" section below.

• Health data, such as medical conditions, symptoms, weight, health or exercise activity monitoring, and any other information concerning your health, including information about a mental or physical health condition or diagnosis.
• Information about your efforts to seek health care services, such as the specialty of care you are looking for, appointments you request or book through our Services, and your responses to screening or intake questions.
• Biometric and sensory data, such as voice recordings, including recordings of calls between you and a Presso care coordinator.
• Geolocation data, such as IP-address-based location information, and location information you provide so that we can identify health care providers near you.
• Profile or contact data, such as your first and last name, email address, phone number and unique identifiers, where it is linked to the information above.
• Consumer demographic data, such as age or date of birth, zip code or gender, where it is linked to the information above.
• Inferences drawn from the data above, including inferences about which health care specialists may be appropriate for your needs.

Categories of sources from which we collect consumer health data

• You. When you provide information directly to us, including through our interactive tools and Services, through free-form text boxes, in response to screening or intake questions, during a call with a Presso care coordinator, or when you contact us by email.
• You, collected automatically. When you use the Services and information is collected automatically, including through cookies and similar technologies, and through location-enabled browsers or devices.

How and why we use consumer health data

• To provide, customize and improve the Services, including identifying and recommending health care specialists relevant to your needs, requesting or booking appointments on your behalf, and supporting you before an appointment.
• To correspond with you, including responding to you, contacting you when necessary or requested, and sending communications according to your preferences.
• To provide support and assistance, and to conduct testing, research, internal analytics and product development.
• For fraud protection, security and debugging.
• To meet legal requirements and enforce legal terms, including complying with applicable law, regulation, court order or other legal process, protecting the rights, property or safety of you, Presso or another party, enforcing our agreements, and resolving disputes.

Categories of consumer health data we share, and with whom

We share each of the categories of consumer health data described above with the following categories of third parties and affiliates, and only as needed for the purposes described in this policy:

• Service providers that help us provide the Services or perform business functions on our behalf, including hosting, technology and communication providers; analytics providers; security and fraud prevention consultants; and support and customer service vendors. These parties are bound by contract to process consumer health data only on our instructions and for the purposes we specify.
• Physician practices and their schedulers, so that an appointment can be requested or booked for you.
• Telehealth partners that you elect to be routed to.
• The sponsor whose program you accessed our Services through, and that sponsor's care-coordination vendor.
• Parties you authorize, access or authenticate, where you direct us to share the data.
• Government authorities, including law enforcement, and other parties where necessary to meet the legal requirements described above.
• A third party that assumes control of our business, in whole or in part, in connection with a merger, acquisition, bankruptcy or similar transaction.

We do not have affiliates with whom we share consumer health data. If that changes, we will identify those affiliates by name in this policy before sharing consumer health data with them.

We do not sell consumer health data

We do not sell consumer health data, and we have not done so. Under the My Health My Data Act, selling consumer health data requires your signed valid authorization; we do not seek such authorizations, because we do not sell consumer health data. We also do not share consumer health data for cross-context behavioral advertising or targeted advertising, and we do not use it for those purposes.

How we process consumer health data

We process consumer health data electronically, using systems operated by us and by the service providers described above. Access is limited to personnel and service providers who need it to perform the purposes described in this policy, and is protected using physical, technical, organizational and administrative security measures appropriate to the sensitivity of the data.

Some processing is automated. We use your responses, together with geographic and demographic information, to rank health care specialists according to your needs and to provide matches. That processing informs our recommendation of particular specialists to you. You may opt out of this profiling as described below.

We retain consumer health data for as long as necessary to provide the Services and to fulfill the purposes described in this policy. Where we collect consumer health data in connection with a sponsor or covered entity, we retain it for the period required by our agreement with that party, including any applicable business associate agreement, after which it is deleted or de-identified. We may retain information in aggregated, de-identified or anonymized form that does not identify you.

Your rights, and how to exercise them

If you are a Washington or Nevada resident, you have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data, and access that data, including a list of all third parties and affiliates with whom we have shared or sold it.
• Withdraw your consent to our collection and sharing of your consumer health data.
• Have your consumer health data deleted, including from our archived and backup systems, and to have us notify the service providers, third parties and affiliates that received it of your deletion request.
• Not be discriminated against for exercising any of these rights.

You may exercise these rights, including reviewing your consumer health data and requesting that we correct or change it, by either of the following methods:

• Complete the online form at https://pressohealth.com/privacy-request, which covers all privacy requests, including access, deletion, correction and withdrawal of consent.
• Email us at contact@pressohealth.com.

You may also opt out of the automated profiling described above using either method. We will respond within the time period required by applicable law. We may ask you for information sufficient to verify that you are the person about whom we collected consumer health data, and we will use that information only to verify your identity and complete your request. You do not need an account to make a request.

You may authorize an agent to exercise these rights on your behalf. You must provide your authorized agent with written permission to do so, and we may ask your agent for a copy of that permission.

If we decline to act on your request, we will tell you why, and you may appeal that decision by submitting the form at https://pressohealth.com/appeal or by emailing contact@pressohealth.com with "[STATE OF RESIDENCE] Appeal" in the subject line. If we deny your appeal, we will provide you with a method to contact your state Attorney General.

Tracking across websites and services

We use cookies and similar technologies on our own website and within the Services, as described in the "Tracking Tools and Opt-Out" section of our Privacy Policy. Third parties may collect consumer health data over time and across different websites or online services when you use our Services, to the extent they place their own cookies or similar technologies. You can review and change your cookie choices at any time by clicking "Cookie Settings" at the bottom left of our website, and we honor the Global Privacy Control signal.

Changes to this policy

We will not collect, use or share additional categories of consumer health data, or collect, use or share consumer health data for additional purposes, without first disclosing those categories or purposes here and obtaining your affirmative consent. If we make material changes to this policy, we will alert you by placing a notice on the Presso website, by sending you an email, or by another means, and we will update the effective date above.

Contact us

If you have questions or comments about this policy or about how we handle consumer health data, contact us at:

• https://www.pressohealth.com
• contact@pressohealth.com
• Presso, Inc., 418 Broadway #11789, Albany, NY 12207