Effective date: November 1, 2020

Please note that Users in different regions may be subject to different data protection standards; this document has a section dedicated to Californian consumers and their privacy rights, as well asa section dedicated to European Union consumers and their privacy rights.

This document can be printed for reference by using the print command in the settings of any browser.

By using this website or mobile application(the “Site”), or the services provided by Mederva Medical Corporation, (“Company”, “we”, “our” or “us”), you are accepting the practices described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use the Site, the Company’s services, or the Company’s mobile applications.

What is the purpose of this Privacy Policy?

This Privacy Policy discloses Company’s personal information gathering and dissemination practices with respect to the Site, mobile applications, and our services. Please read this Privacy Policy carefully.

We have also created this Privacy Policy to demonstrate our commitment to privacy. We recognize that when you provide us with information about yourself that you trust us to act in a responsible manner with that information. We are committed to making sure we earn that trust.

What information do we collect from users and how is it used?

The following describes the types of personal and other information the Company may collect about you, and how the Company may use and maintain that information, including, but not limited to:

Eligibility and claims. If you are eligible for Company services through your employer (together, your “employer”), your employer may provide to us data required to verify your eligibility, to allow us to communicate with you, and to understand your health. This information may include your name, email address, phone number, medical history and claims, and information used to verify your identity (such as birthday, and/or employee ID number).

Registration. Before you can utilize certain services that we offer on the Site or otherwise, we may ask that you register with the Site and provide us with your email address, a password, your first and last name and other contact information and personal details. We request this information for identification purposes, to communicate with you regarding your account, and to facilitate the functioning of certain services. We may keep this information indefinitely.

Forms. To fully utilize the services we offer, you may be required to fill out forms that will contain personal information such as your name, address, telephone number, social security number, account information, employment, health status and other personal information relevant to your health insurance coverage, diagnosis and treatment.

Medical Records. In order for the medical professionals giving second-opinions regarding your health, you may be required to provide us with past and current medical records, description of symptoms, a medical history and life-style descriptions.

Correspondence. If you correspond with us via email, we may gather in a file specific to you the information that you submit. We may keep this information indefinitely.

URL and IP addresses. Like many other websites, Company collects information about users’ utilization and navigation of our Site. This information helps us to design our Site to better suit our users’ needs. For example, our Site will track the URL that you visited before you came to our Site, the URL to which you next go and your Internet Protocol (IP) address. We use your IP address to help diagnose problems with our server and to administer our Site. Your IP address also is used to help identify you and to gather broad demographic information.

Information Collected With Cookies. Like most major websites, Company uses cookies on certain pages of our Site. Cookies make using the Internet easier by, among other things, saving your preferences for you. For example, a cookie lets the Site remember that you’ve registered, which allows us to speed up your future activities at our Site, and which allows you to enter your registration information less frequently while visiting our Site. We may also use cookies to deliver content tailored to your interests. Our cookies may enable us to relate your use of our Site to personally identifying information that you previously submitted, such as calling you by name when you return to our Site. If your browser is set to reject cookies, or if your browser notifies you that you are about to receive a cookie and you reject it, then your use of the Site may not be as efficient or as enjoyable as it would be if the cookie were enabled. The information that we collect with cookies allows us to improve our marketing and promotional efforts, to statistically analyze Site usage, to improve our content and product offerings and to customize our Site’s content, layout and services. However, we only use information collected with cookies on an aggregated basis without the use of any information that personally identifies you. You may learn more about specific cookies later in this document.

To whom does Company disclose information about you that we collect?

We will not share, rent, sell or otherwise disclose any of the personally identifiable information that we collect about you, except when we have your permission or in any of the following situations

• If you have requested a Service, we may use information about you to fulfill such request (including providing that information to third parties). We may also at any time review your case, your medical records from prior to and after your interaction with the Site, and any records created as a result of services received. We may share information about you, your care, and your use of services to your healthcare payor, or as necessary to implement plan designs described to you in your applicable health plan documentation, or on your request. If your health plan provides incentives for utilization of services, we will share information required to implement such incentives. We may request courtesy notices from your treating physician(s) and/or request additional medical records from them, including records pertaining to care you received after receiving the services. We may review these records for, among other purposes, reviewing the quality of service you received, reviewing the quality of service provided by the physicians and medical professionals treating you (including the physicians and medical professionals to whom you may have received a referral), to better understand the course of treatment for your condition(s) including information regarding outcomes and costs, and to improve treatments and recommendations for people with similar or different conditions. We will take care to minimize personally identifying information in this process. We may also use anonymous information gathered, including information from your medical records, to generate conclusions about the healthcare process, particular conditions, and other matters. We and our affiliated physicians and researchers may publish this anonymous information in journals, websites and other locations. However, we will not publish your name or any identifying information about you; we will use only anonymous data for any public purpose.
• We may disclose information that we collect about you to our third-party contractors who perform services for Company in order to provide certain services or to complete or confirm a transaction that you conduct with us.
• We may use information we know about you to contact you to inform you about relevant services, including by telephone, text message, or direct mail.
• We may disclose the results of aggregated data about you for marketing or promotional purposes (for instance, that a certain percentage of our Site’s users are living in a particular location). In these situations, we do not disclose to these entities any information that could be used to personally identify you. Certain information, such as your password, is not disclosed to marketing advertisers at all, even in aggregate form.
• We may disclose information about you as part of a merger, acquisition or other sale or transfer of its assets or business. Company does not guarantee that any entity receiving such information in connection with one of these transactions will comply with all terms of this policy.
• We may disclose information about you for purposes such as to provide services available on the Site; to coordinate with insurance, reinsurance and excess or stop loss insurers; to enforce our members’ rights; to protect against actual or potential fraud; to resolve member inquiries or disputes; to receive payments; to carry out our business; to protect the confidentiality or security of our records; to administer preventive health and case management programs; to perform auditing and ratemaking functions; to enable our service providers to perform marketing services on our behalf and inform Members about our own products or services; to comply with federal or state laws and other applicable legal requirements.
• We may disclose your information, to the extent permitted by law, in court or in the stages leading to possible legal action arising from improper use of this website, application or services, or due to a dispute you initiate in connection with the related services.
• Moreover, we may be legally obligated to disclose information about you to the government or to third parties under certain circumstances, such as in connection with illegal activity on our Site or to respond to a subpoena, court order or other legal process. Company reserves the right to release information that we collect to law enforcement or other government officials, as we, in our sole and absolute discretion, deem necessary, appropriate or as required under law, such as your statement to hurt yourself or others.

If you use our Site or services outside of the United States, information that we collect about you will be transferred to servers inside the United States, which may involve the transfer of information out of countries located in the European Economic Area. By allowing Company to collect information about you, you consent to such transfer and processing of your data.

Your Rights Regarding Your Protected Health Information

You have certain rights regarding protected health information that we maintain about you.

• Right to Access Your Protected Health Information. You have the right to review or obtain copies of your protected health information records, with some limited exceptions. Usually the records include enrollment, billing, claims payment and case or medical management records. Your request to review and/or obtain a copy of your protected health information records must be made in writing. We may charge a fee for the costs of producing, copying and mailing your requested information, but we will tell you the cost in advance (waived as applicable by the GDPR and/or CCPA).
• Right to Amend Your Protected Health Information. If you feel that your information (including protected health information) maintained by us is incorrect or incomplete, you may request that we amend the information. Your request must be made in writing and must include the reason you are seeking a change. We may deny your request if, for example, you ask to amend a record that is already accurate and complete.

If we deny your request to amend, we will notify you in writing. You then have the right to submit to us a written statement of disagreement with our decision and we have the right to rebut that statement.

• Right to an Accounting of Disclosures. You have the right to request an accounting of disclosures we have made of your protected health information. The list will not include our disclosures related to your treatment, our payment or healthcare operations, or disclosures made to you or with your authorization (except for users covered by the GDPR regime, which may request such uses). The list may also exclude certain other disclosures, such as for national security purposes.

Your request for an accounting of disclosures must be made in writing and must state a time period for which you want an accounting. Your request should indicate in what form you want the list (for example, on paper or electronically). The first accounting that you request within a 12-month period will be free. For users outside the GDPR regime, we may charge for providing the accounting additional lists within the same time period, but we will tell you the cost in advance.

• Right to Request Restrictions on the Use and Disclosure of Your Protected Health Information.You have the right to request that we restrict or limit how we use or disclose your protected health information (or for users covered by the GDPR, all personal information) for treatment, payment or healthcare operations. We may not agree to your request. If we do agree, we will comply with your request unless the information is needed for an emergency. Your request for a restriction must be made in writing. In your request, you must tell us: (i) what information you want to limit; (ii) whether you want to limit how we use or disclose your information, or both; and (iii) to whom you want the restrictions to apply.
• Right to Receive Confidential Communications. You have the right to request that we use a certain method to communicate with you or that we send information about you to a certain location if the communication could endanger you. Your request to receive confidential communications must be made in writing. Your request must clearly state that all or part of the communication from us could endanger you. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.
• Right to a Paper Copy of This Privacy Policy. You have a right at any time to request a paper copy of this Privacy Policy, even if you had previously agreed to receive an electronic copy.
• Contact Information for Exercising Your Rights. You may exercise any of the rights described above by contacting our Privacy Office as follows:

Privacy Officer
Mederva Medical Corporation
415 Mission St, 37th floor
San Francisco, CA 94105
1-800-988-5534
privacy@medervahealth.com

What security measures does the Site employ?

To help protect the privacy of data you transmit through this Site, where personally identifiable information is requested, we also use technology designed to encrypt the information that you input before it is sent to us using Secure Sockets Layer (SSL) technology or similar encryption technology. In addition, Company takes steps to protect the user data we collect against unauthorized access. However, you should keep in mind that this Site and our services are run on software, hardware and networks, any component of which may, from time to time, require maintenance or experience problems or breaches of security beyond our control.

Please also be aware that despite our best intentions and the guidelines outlined in this Privacy Policy, no data transmission over the Internet or encryption method can be guaranteed to be 100% secure.

How can you correct or update information that we collect about you?

You may correct or update information collected about you by managing your account profile or by contacting Company at the email or mailing address noted below. We will use reasonable efforts to update our records. If necessary, we may retain original and updated information for reasons such as technical constraints, dispute resolution, troubleshooting and agreement enforcement.

What are the policies of linked Sites and other third parties?

This Privacy Policy only addresses the use and disclosure of information we collect from you. You should be aware that when you are on the Site, you can be directed to other websites that are beyond our control, and Company is not responsible for the privacy practices of third parties or the content of linked websites. We encourage you to read the posted privacy policy whenever interacting with any website.

How will I know about changes in the Privacy Policy?

Company reserves the right to update this Privacy Policy from time to time. Please visit this page periodically so that you will be apprised of any changes.

What is our policy on children users of our Site?

We do not knowingly collect or maintain personally identifiable information from persons under 18 years old, and no part of our Site is directed to persons under 18. IF YOU ARE UNDER 13 YEARS OFAGE, PLEASE DO NOT USE OR ACCESS OUR SITE AT ANY TIME OR IN ANY MANNER. If Company learns that personally identifiable information of persons less than 13 years old has been collected without verifiable parental consent, then Company will take the appropriate steps to delete this information. If you are a parent or guardian and discover that your child under the age of 18 has obtained a Company account, then you may alert Company at the address below and request that we delete that child’s personal information from our systems.

We do collect from employers information regarding members of all ages, so that we may know who is eligible to receive Services. A parent/guardian may request that we stop processing that information if eligible under CCPA or GDPR, as further described below, however you should contact your employer if you would like that information no longer provided to health carriers.

What law governs my use of the Site and Company’s services?

By choosing to visit this Site, use our services, or otherwise provide information to Company, you agree that any dispute over privacy or the terms contained in this Privacy Policy will be governed by the law of the State of California. You also agree to abide by any limitation on damages contained in our Terms of Service or other agreement that we have with you.

How to contact us / data controller? If you have any questions about this PrivacyPolicy, or need to reach the owner / data controller for any other reason, you may contact us by e-mail at privacy@medervahealth.com or by mail:

Mederva Medical Corporation
415 Mission St, 37th floor
San Francisco, CA 94105
1-800-988-5534

Additional Information About This Privacy Statement

The policies indicated in this Privacy Policy will remain effective, even if the Member’s coverage is terminated, to the extent we retain information about a member. We may change this Privacy Policy at any time and will inform you of any changes as required by law or regulation.

Information about Particular Services

Contacting the User

Contact form (this Website)

By filling in any contact form with their Data, the User authorizes thisWebsite to use these details to reply to requests for information, quotes or any other kind of request as indicated by the form’s header.
Personal Data collected: various types of Data.

System logs and maintenance

For operation and maintenance purposes, this Website and any third-partyservices may collect files that record interaction with this Website (Systemlogs) use other Personal Data (such as the IP Address) for this purpose.

Additional Information for EU / EEC Users

Data Is required to provide services

Unless otherwise specified, all data requested is mandatory and your choice to not provide data may make it impossible to provide services to you. In cases where we have made clear that some Data is not mandatory, you are free not to communicate this Data without any consequences on the availability or the functioning of the service. If you are uncertain about which Personal Data is mandatory then you are welcome to contact us at the address specified above.

Additional information about your PersonalData

In addition to the information contained in this privacy policy, upon your request we may you with additional and contextual information concerning particular services or the collection and processing of Personal Data.

Your GDPR rights

Solely to the extent applicable to the Company, if you are subject to the GDPR regime, then you have the right, at any time, to know whether your PersonalData has been stored. You and can consult the Company to learn about their contents and origin, to verify their accuracy or to ask for them to be supplemented, cancelled, updated or corrected, or for their transformation into anonymous format or to block any data held in violation of the law, as well as to oppose their treatment for any and all legitimate reasons. Requests should be sent to the Data Controller at the contact information set out above.

Additional information regarding methods of processing

The Owner takes security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data. The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Website (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. If applicable, this list may be requested and by a GDPR-coveredPerson from the Owner at any time.

Legal basis for processing

The Owner may process Personal Data relating to Users if one of the following applies:

• Users or their agents (including group sponsors and employers) have given their consent for one or more specific purposes. Note: Under some legislations the Owner may be allowed to process Personal Data until the User objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases;
• provision of Data is necessary for the performance of an agreement with the User or an authorized agent of the User (such as a group sponsor or employer) and/or for any pre contractual obligations thereof;
• processing is necessary for compliance with a legal obligation to which the Owner is subject;
• processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;
• processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.

In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Place of processing

The Data is processed at the Owner’s operating offices, in data centers located in the United States and in any other places where the parties involved in the processing are located. The United States has different (and often lesser)privacy protections than other jurisdictions. By providing data, using this website, using mobile applications provided by Company, or requesting services, you consent to the transfer of your data to the United States and the processing of such data in the United States.

Retention time

Personal Data shall be processed and stored for as long as required by the purpose they have been collected for.

Therefore:

• Personal Data collected for purposes related to the performance of services shall be retained until the longer of (a) such services are completed, (b) as specified in a relevant agreement (such as an agreement with a group sponsor), and (c) as required to maintain records of such services.
• Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes, including but not limited to retention of records of completed services as required by law, regulation and healthcare practice and for the other reasons described in this policy. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.

The Owner may be allowed to retain PersonalData for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation (including but not limited to retention of records of healthcare services performed or recommended) or upon order of an authority.

The right to access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after information has been deleted.

The purposes of processing

Data about you is collected to allow us to provide services to you, as well as for the following purposes: Analytics, Remarketing and behavioral targeting,Interaction with external social networks and platforms, Managing contacts and sending messages, User database management, Heat mapping session recording,Content commenting, Displaying content from external platforms, Content performance and features testing (A/B testing), Generation models of medical and clinical conditions, Generation models of physician and clinical performance, Infrastructure monitoring and Contacting the User.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Data Controller at any time. Please see the contact information at the beginning of this document.

Legal Basis

This privacy statement has been prepared based on provisions of multiple legislations, including the U.S. Health Insurance Portability andAccountability Act of 1996 (“HIPAA”), the U.S. Health Information Technology for Economic and Clinical Health Act (“HITECH”). and Art. 13/14 of Regulation(EU) 2016/679 (General Data Protection Regulation or “GDPR”).

Information for Californian consumers

This part of the document integrates with and supplements the information contained in the rest of the privacy policy and is provided by the business running this Website and, if the case may be, its parent, subsidiaries and affiliates (for the purposes of this section referred to collectively as “we”,“us”, “our”).

The provisions contained in this section apply to all Users who are consumers residing in the state of California, UnitedStates of America, according to “The California Consumer Privacy Act of 2018”(Users are referred to below, simply as “you”, “your”, “yours”), and, for such consumers, these provisions supersede any other possibly divergent or conflicting provisions contained in the privacy policy.

This part of the document uses the term“personal information“ as it is defined in The California Consumer Privacy Act of 2018 (“CCPA”).

Categories of personal information collected, disclosed or sold

Please refer to the list above under “What information do we collect from users and how is it used?”

We will not collect additional categories of personal information without updating this document.

How we use the information we collect: sharing and disclosing of your personal information with third parties for a business purpose

We may disclose the personal information we collect about you to a third party for business purposes. In this case, we enter a written agreement with such third party that requires the recipient to both keep the personal information confidential and not use it for any purpose(s) other than those necessary for the performance of the agreement.

We may also disclose your personal information to third parties when you explicitly ask or authorize us to do so, in order to provide you with our Service.

To find out more about the purposes of processing, please refer to the relevant section of this document.

Your right to opt out of the sale of personal information

We do not sell lists of members. We do not sell your personal health information to any party. We do not provide any information to pharmaceutical companies.

However, some actions such as remarketing or statistical analysis may be considered “sales” under some interpretations of the CCPA. Accordingly, we will make it possible to opt out of those activities.

You have the right to opt out of the sale of your personal information. This means that whenever you request us to stop selling your data, we will abide by your request.
Such requests can be made freely, at any time, without submitting any verifiable request, simply by following the instructions below.

Instructions to opt out of the sale of personal information

If you’d like to know more, or exercise your right to opt out in regard to all the sales carried out by this Website, both online and offline, you can contact us for further information using the contact details provided in this document.

What are the purposes for which we use your personal information?

We may use your personal information to allow us to render services to you and your employer (if applicable), the operational functioning of this Website and features thereof (all together, “business purposes”). In such cases, your personal information will be processed in a fashion necessary and proportionate to the business purpose for which it was collected, and strictly within the limits of compatible operational purposes.

We may also use your personal information for other reasons such as for commercial purposes as well as for complying with the law and defending our rights before the competent authorities where our rights and interests are threatened or we suffer an actual damage.

We will not use your personal information for different, unrelated, or incompatible purposes without notifying you.

Your California privacy rights and how to exercise them
The right to know and to portability

You have the right to request that we disclose to you:

• the categories and sources of the personal information that we collect about you, the purposes for which we use your information and with whom such information is shared;
• in case of sale of personal information or disclosure for a business purpose, two separate lists where we disclose:
• for sales, the personal information categories purchased by each category of recipient; and
• for disclosures for a business purpose, the personal information categories obtained by each category of recipient.
• The disclosure described above will be limited to the personal information collected or used over the past 12 months.

If we deliver our response electronically, the information enclosed will be “portable”, i.e. delivered in an easily usable format to enable you to transmit the information to another entity without hindrance – provided that this is technically feasible.

The right to request the deletion of your personal information
You have the right to request that we delete any of your personal information, subject to exceptions set forth by the law (such as, including but not limited to, where the information is used to identify and repair errors on thisWebsite, to detect security incidents and protect against fraudulent or illegal activities, to exercise certain rights etc.). For example, we cannot delete information that explains medical treatment decisions, as we are legally obligated to keep such information.

If no legal exception applies, as a result of exercising your right, we will delete your personal information and direct any of our service providers to do so.

How to exercise your rights

To exercise the rights described above, you need to submit your verifiable request to us by contacting us at privacy@medervahealth.com, by calling on your designated toll-free number (or our general toll-free number at 1-800-988-5534), or by submitting a message through the“chat” experience once logged-in.

For us to respond to your request, it’s necessary that we know who you are. Therefore, you can only exercise the above rights by making a verifiable request which must:

• provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative;
• describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We will not respond to any request if we are unable to verify your identity and therefore confirm the personal information in our possession actually relates to you.
If you cannot personally submit a verifiable request, you can authorize a person registered with the California Secretary of State to act on your behalf.

If you are an adult, you can make a verifiable request on behalf of a minor under your parental authority.

You can submit a maximum number of 2 requests over a period of 12 months.

How and when we are expected to handle your request

We will confirm receipt of your verifiable request within 10 days and provide information about how we will process your request.
We will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Our disclosure(s) will cover the preceding 12 month period.

Should we deny your request, we will explain you the reasons behind our denial.

We do not charge a fee to process or respond to your verifiable request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee, or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind it.