WELLFRAME INC.

LAYERED CONSENT

Welcome to Wellframe! Wellframe is a mobile application that can help you learn about your health, track your health status, and conveniently message with a clinician or staff member. Please review our Privacy Policy carefully and click "Accept & Continue" to acknowledge that you understand the ways in which Wellframe may process your personal data, including your contact details and any other personally identifiable information or health information you provide via our mobile application (collectively, "Personal Information"). You may be asked additional questions to ensure we have your consent to collect and use your Personal Information for specific purposes. For your convenience, we are summarizing some highlights of our Privacy Policy below, but you should still review the entire Privacy Policy in detail. Wellframe may process your Personal Data for the following purposes:

• collecting, storing and using your Personal Information to provide you with the service accessed through this mobile application. We may use third parties to provide this service to you on our behalf and may share your Personal Information with them for this purpose, including our cloud host provider. These third parties will not use your Personal Information for their own purposes;
• disclosing your Personal Information to your health care professionals and providers;
• transferring your Personal Information to and hosting your Personal Information in data servers in the United States of America or the European Union;
• de-identifying your Personal Information (so it no longer identifies you) and providing it in aggregated or non-aggregated form to selected third parties, including our health care partners and/or any of their affiliates; and
• disclosing your Personal Information to the extent required by law.

If you do not agree to your Personal Information being processed for these purposes, or with any other terms of our Privacy Policy (see below) please do not use our mobile application.

WELLFRAME inc.

PRIVACY POLICY

This Privacy Policy is designed to inform users of the Wellframe Inc. ("Wellframe") websites, mobile application and services (collectively, the "Service") about how we gather and use personal information collected by us in connection with your use of the Service. You may have been invited to use, download or install the Service from a third party as part of a research or clinical care initiative, or you may have subscribed or downloaded and installed the Service for your personal use. This Privacy Policy covers how Wellframe treats your Personally Identifiable Information ("PII") and Protected Health Information ("PHI") (PII and PHI, collectively hereafter "Personal Information") that Wellframe collects, receives, maintains, stores or transmits, including information you transmit or submit to our Service. Your Personal Information includes information that individually identifies you or is information about you that can be traced back to you, your IP address, or your location. It may include, but is not limited to your name, address, employer, email address, phone number, and information about your health.

Wellframe complies with the EU-US Privacy Shield framework set forth by the US Department of Commerce, regarding the collection, use and retention of Personal Information from European Union member countries. Wellframe has certified that it adheres to the Privacy Shield principles of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access and recourse, enforcement and liability. If there is any conflict between the policies in Wellframe's Privacy Policy, and the Privacy Shield principles, the Privacy Shield principles shall govern. To learn more about the Privacy Shield program, and to review our certification page, please visit https://www.privacyshield.gov.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time by posting a new version online. You should check this page occasionally to review any changes. If we make any material changes affecting you as determined by Wellframe we will notify you by posting the revised Privacy Policy on our websites and, if you are an enrolled user of our platform, by providing notice through the Wellframe app. This helps you to always be aware of what information we collect, how we use it and under what circumstances, if any, it is disclosed. Your continued use of the Service, and/or continued provision of Personal Information to us will be subject to the terms of the then-current Privacy Policy.

Information Collection and Use

Wellframe collects Personal Information when you register with Wellframe or when you use Wellframe's Service. When registering with Wellframe, we will ask you to provide us with your name, address, e-mail address, phone number, sponsoring provider and monitored health data for which you are registering and other related information that Wellframe may ask of you from time to time, and you may submit additional information and comments through the Service. We may use your contact information to send you information about our Service or our other services we may provide to you, or information relating to your health, or to help prevent spam, fraud or abuse. It is always your choice whether or not to provide us with such information. If you choose not to provide the requested information you may not be able to use certain features or functions of our websites, mobile application or services. Whenever you visit our websites, Wellframe also receives and records information on our server logs from your browser, including your IP address, Wellframe's cookie information, and the pages you request. For more information on what is collected via our website, please see our Cookie Policy. Your information will be stored in our cloud hosting provider's data centers within the United States or the European Union depending on your country of residence or by how you were given access to the Services such as through your health care provider, your sponsor, or through the program or study you enrolled in. You may unenroll from the Service at any time by emailing us at [email protected].

Below is a list of the Personal Information Wellframe collects and how we use it with your consent. You may be asked additional questions regarding items on this list to ensure we have your consent to collect and use your Personal Information for specific purposes.

1. Registration — When you register for the Service, we collect your Personal Information as part of the registration process, including but not limited to your name, address, location, sponsoring provider and program preferences.
2. Self-Reported Health-Related Information — We collect the information that you enter during the course of using the Service, such as information regarding your health and/or medical condition and related behaviors.
3. Provider-Reported Health-Related Information — We collect the information about you that is submitted with your permission by your health care provider during the course of using the Service, such as information regarding your health and/or medical condition, including information that is protected under the HIPAA privacy and security regulations.
4. Communications With a Health Professional — We collect communications that take place through the Service between you and your healthcare provider, health manager or health coach.
5. Social Information — We collect information that you provide to us through the Services, pertaining to the people with whom you consent to share your Personal Information (such as a family member, another patient or doctor), as well as communications within the Services between you and such individuals.
6. Demographic Information — We may also collect demographic information, such as age, gender and geographic location, as part of your profile in the Service.
7. Automatically Tracked Health-Related Information — We may use automated methods to track data from fitness wearables and other biometric monitoring devices for use in the app that you have allowed to communicate with the app.
8. Product Improvement — Wellframe may utilize your demographic and health information, information about your device, and data derived through your utilization of our service to help improve the Wellframe product. We may also send this information to your healthcare provider or sponsor to help them improve their products or services.
9. Surveys and User Research — From time to time, we may send you survey questions or contact you with questions related to your experience to provide us with feedback on our Service. We collect any responses that you provide. Participation in surveys or research tasks is elective and does not necessarily impact your access to the Service. We may provide this information to your healthcare provider or sponsor to help them improve their products or services.
10. Marketing Communication — We occasionally may contact you via email about new product and features. You may remove your name from our mailing lists to stop receiving these emails.
11. Mobile Devices — If you are accessing the Service through a program whereby you receive a sponsored Wellframe-enabled mobile device, we will collect and manage your data and other telephonic information as part of the device provision and maintenance.

De-identified information

In addition to the uses of Personal Information above, we may remove the identifiable parts of your information to create de-identified forms (“De-identified Information”). De-identified Information may be compiled with other data in aggregated forms. We use this aggregated or non-aggregated data in the following ways:

1. Disclosure for Business Purposes — We may also license, sell or otherwise share De-identified Information with institutional clients, partners, investors and contractors for any purposes related to our business practices.
2. Product Improvement — We may use De-identified Information for product improvement including the Service as well as third-parties to evaluate their products or services.
3. Research — We may use De-identified Information for research whether scientific, marketing, or business in nature. This research may be made public through publication such as within a scientific journal.

Privacy Shield

Wellframe is committed to adhering to the Privacy Shield principles. Wellframe will not process your information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by you. To the extent necessary for those purposes, Wellframe will take reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and current. Wellframe will adhere to the Privacy Shield principles for as long as it retains any information transmitted while a member of the Privacy Shield.

Independent Recourse Mechanism

In compliance with the Privacy Shield principles, Wellframe commits to resolve complaints about your privacy and our collection or use of your Personal Information. Wellframe will respond to the inquiry or complaint within forty-five (45) days. European Union individuals with inquiries or complaints regarding our Privacy Shield policy should first contact Wellframe at: [email protected].

Wellframe has further committed to refer unresolved privacy complaints under the EU-US Privacy Shield principles to the JAMS EU-US Privacy Shield program, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint, or your complaint is not satisfactorily addressed by Wellframe, please visit the JAMS website at: https://www.jamsadr.com/eu-us-privacy-shield for more information or to file complaint. The services of JAMS are provided at no cost to you. Please note that if your complaint is not resolved through these channels, as a last resort and under limited circumstances, a binding arbitration option may be available before a Privacy Shield panel.

The Federal Trade Commission (“FTC”) has jurisdiction over Wellframe’s compliance with the Privacy Shield. Wellframe is subject to the investigatory and enforcement powers of the FTC.

Information Sharing and Disclosure

Wellframe does not rent, sell, or share your Personal Information with other people or non-affiliated companies, except to provide products or services you have requested, when we have your authorization to share such information, or when we provide the information to companies or consultants working on our behalf under confidentiality agreements. These companies and consultants do not have any independent right to share your Personal Information.

If Wellframe ever transfers your Personal Information to a third-party, Wellframe is responsible for the processing of Personal Information it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. Wellframe will remain liable under the Privacy Shield principles if its agent processes your Personal Information in a manner inconsistent with the Privacy Shield principles, unless the third-party organization can prove that it is not responsible for the event giving rise to the damage.

We may also be required to disclose your Personal Information in response to a legal process, for example, in response to a court order or a subpoena to comply with its applicable legal and regulatory reporting requirements. We also may disclose your Personal Information in response to a law enforcement agency's request, or where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our End User License Agreement, or to verify or enforce compliance with the policies governing our products and services and with applicable laws, or as otherwise required or permitted by law or consistent with legal requirements. In addition, we may transfer your Personal Information to an entity or individual that acquires, buys, or merges with Wellframe, or our other business units.

Confidentiality and Security

We have taken reasonable and necessary steps to ensure that all Personal Information collected will remain secure. We have put in place appropriate physical, electronic, and administrative procedures in an effort to safeguard and help prevent unauthorized access, maintain data security, and correctly use the Personal Information that we collect.

Wellframe is not responsible for and will not be a party to any transactions between you and a third party provider of products, information or services. Wellframe does not monitor such interactions to ensure the confidentiality of your Personal Information, including credit card information. Any separate charges, data records or obligations you incur in your dealings with third parties linked to or in conjunction with Wellframe's Service are solely your responsibility.

Accessing, Changing, and Deleting Your Information

You may request access, changes, or deletions to your Personal Information and request information about our collection, use and disclosure of such information by contacting us at [email protected]. We use best efforts to keep our records as accurate and complete as possible. You can help us maintain the accuracy of your information by notifying us of any changes to your Personal Information as soon as possible. Your rights to access, change, or delete your Personal Information are not absolute. We may deny you such rights when required by law or if the request would likely reveal Personal Information about a third party.

General Information

1. Links — The Wellframe Service may contain links or deep links to other websites, open search results, public feeds, or curated channels. Wellframe generally reviews the content of health news articles or publications linked through third party websites, but is not responsible for such content, the privacy practices, or any advertisements on third party websites. Users should be aware of this when they leave our Service and are encouraged to review the privacy statements of each third party website. Moreover, Wellframe is not responsible for any disclosures to third parties to whom you may disclose your Personal Information directly, including family members and/or friends. This Privacy Policy applies solely to information collected by Wellframe in relation to the Service.
2. Termination — Wellframe reserves the right to decide, at its sole discretion, to no longer offer you the Service. If Wellframe decides to terminate your account, Wellframe will either return or permanently destroy any copies it maintains of your Personal Information in accordance with its obligations under applicable law.
3. Children — Wellframe does not knowingly collect Personal Information from children under the age of 13, and our Service is not directed at users under the age of 13. If we find that Personal Information has inadvertently been collected for an individual under the age of 13, we will immediately delete it.

Questions and Suggestions

If you have questions or suggestions, or wish to correct your Personal Information, please email Wellframe at [email protected] or write to us at:

This Privacy Policy was last updated on May 22, 2018.