Privacy Statement

1. Sources of Personal Data

As used in this Privacy Statement, "personal data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identifiable individual. Personal data includes "personal information" and "personally identifiable information" as that term is defined in privacy laws.

Personal data does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified or anonymized; or aggregate information.

We may create aggregated, de-identified, or anonymous information from data by removing certain data components that make the data identifiable, or through aggregation, obfuscation, or other means. Subject to applicable law, our use and disclosure of aggregated, de-identified, or anonymized information is not personal data and is not subject to this Privacy Statement.

We may collect personal data about you from the following sources:

• Directly from you. We collect personal data you provide to us directly, such as when you contact us, sign up for an account, use chat features on the App, or otherwise interact with us.
• Data collected automatically and through tracking technologies. The App may use cookies and other tracking technologies such as web beacons, embedded scripts, and tags (collectively, "Cookies").
• Service providers. We collect personal data from our service providers, including those providing hosting, payment processing, advertising, analytics, artificial intelligence, customer and technical support, email services, and other services.
• AI Features. Sona utilizes artificial intelligence, machine learning, or similar technologies (collectively, "AI") and that collect personal data. Additionally, the App includes features in which you interact with AI directly ("AI Features"). We collect personal data if you use a chat feature on the App which is provided by our third-party service providers, Amazon Web Services and ElevenLabs, on our behalf. See Section 5 for more information.
• Coaches, healthcare providers, and payors. Pursuant to your privacy settings, we may collect personal data from coaches, healthcare providers, medical professionals, health plans, pharmacy benefits manager, employer group plan, or other payors, when information is necessary to provide the App, determine program eligibility, or to comply with legal and regulatory obligations.
• Corporate affiliates. We may collect personal data from our corporate affiliates, including parent entities, subsidiaries, business units, and other companies that share common ownership.
• Other third parties. We may collect personal data from third-party data providers and business and marketing partners.

We may combine the personal data we receive from third parties with personal data we otherwise collect about you through your use of the App.

2. Personal Data We Collect

We offer chat services and thus may collect any personal data that you input into your chats. It is ultimately your choice what personal data you choose to share with the App. In addition to information collected through our chat services, we may collect the following types of personal data:

• Identifiers, such as your name, email address, physical address, telephone number, and account log-in information.
• Demographic information, such as date of birth, sex assigned at birth, racial or ethnic origin, and information concerning your sex life or sexual orientation.
• Commercial information, such as information related to your transactions; products or services purchased, obtained, or considered; or other purchasing histories or tendencies.
• Browser and device data, such as IP address; geolocation information; device identifier, device type; operating system and Internet browser type; screen resolution; operating system name and version; device manufacturer and model; plug-ins; add-ons; and the language version of the App.
• Usage data, such as time spent on the App; pages visited; searches conducted; links clicked; patterns of use; and the pages that led or referred you to the App; diagnostic data; mouse clicks; mouse movements; keystrokes; and page scrolling.
• Audio, electronic, visual, or other sensory information, such as chat, call, or video recordings and transcripts and summaries.
• Records about you, such as signatures; the content, timing, and method of communications you have with us, such as via email; and information you share with or upload to the App.
• Professional information, including information relating to your role as a representative or agent of a company or business, such as your work title and business contact information.
• Health data, including:
  • Individual health condition, treatment, disease, or diagnosis information.
  • Social, psychological, behavioral, and medical intervention information.
  • Health-related surgery or procedure information.
  • Use or purchase of prescribed medication information.
  • Reproductive or sexual health information.
  • Gender affirming care information.
  • Data that identifies an individual seeking health services.
  • Vital signs, symptoms, or measurement of health information.
  • Diagnosis or diagnostic testing, treatment, or medication information.
  • Information about access to healthcare, including precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies.
• Other information you provide to us, such as information in response to surveys, forms, questionnaires, email, features on our website and software applications, engaging with customer service, or while using the App.
• Inferences drawn from any of the information we collect to create a profile about you reflecting your preferences or behavior, including to assess the level of interest in the App.

Note that some of this information may be considered "consumer health data," as further described in our Sona Consumer Health Data Privacy Notice for Connecticut, Nevada, and Washington residents.

We may combine the personal data we receive from third parties with personal data we otherwise collect about you through your use of the App.

3. Use of Personal Data

We may use the personal data we collect for the following purposes:

• To fulfill the purposes for which the information was provided (e.g., to provide a service or perform on a contract).
• To provide, operate, maintain, improve, personalize, and expand the App.
• To communicate with you, including to provide customer service, enable you to sign up for the App, and provide you with updates about the App.
• To develop the App, including for training purposes related to our own artificial intelligence technology.
• To perform internal analytics, research, and development.
• For marketing and promotional purposes.
• For internal business purposes, including general business administration.
• For systems and data security, including to prevent unauthorized, improper, or illegal activities on the App.
• To comply with our legal obligations, including responding to subpoenas, court orders, or legal process; and to establish or exercise our legal rights or defenses against legal claims.
• To enforce the legal or contractual terms that govern the App.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.
• For purposes disclosed at the time you provide your information or as otherwise set forth in this Privacy Statement.
• Any other purpose consistent with your consent and expressed preferences.
• As otherwise required or permitted by law.

We may utilize products, features, or tools that utilize AI, including AI Features, for any of the above purposes. Note that before you use or activate an AI Feature, we will let you know that you will be interacting with AI.

4. Disclosure of Personal Data

We may disclose personal data to the following categories of third parties:

• Corporate affiliates. We disclose personal data to our corporate affiliates, including parent entities, subsidiaries, business units, and other companies that share common ownership.
• Service providers. We may disclose personal data to our service providers to provide services to us and/or on our behalf, such as those providing hosting, payment processing, advertising, analytics, artificial intelligence, customer and technical support, email services, and other services. For example, if you use a chat feature on the App, the information provided is recorded and stored by our third-party service providers, Amazon Web Services and ElevenLabs, on our behalf.
• Coaches, healthcare providers, and payors. We may disclose personal data to healthcare providers, medical professionals, health plans, pharmacy benefits manager, employer group plan, or other payors, when information is necessary to provide the App, determine program eligibility, or to comply with legal and regulatory obligations.
• Business transferees. If we or our affiliates are involved in a merger, acquisition, asset sale, or other corporate combination, your personal data may be transferred to the acquiring or surviving entity.
• Professional advisors. We may disclose personal data to our professional advisors, including attorneys, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us.
• Authorities for compliance and harm prevention. Under certain circumstances, we may be required to disclose your personal data if required to do so by law, in response to valid requests by public authorities, and/or in response to a threat of harm involving an individual's health and/or safety.
• Other parties with your consent. We may disclose personal data to other parties with your consent.

5. Our Use of AI Tools

Our AI tools and other AI Features collect personal data to the extent you provide it or it is otherwise automatically collected as a result of your use of the AI tools. We, and our third-party service providers such as Amazon Web Services and ElevenLabs acting on our behalf, may utilize this personal data to generate outputs as requested by you.

Further, depending on certain use cases and parameters, this personal data may be used to "train," finetune, or otherwise provide inferences and context to Pelago's AI tools by identifying general patterns in text in order to help create new and better outputs and to allow the accurate and safe operation of our own AI tools. In such cases, your personal data is typically not stored or retained; rather, the AI model learns the patterns and connections between words and/or content. Once the AI tools have been trained or properly finetuned, they do not have access to or pull from the original training data. In no case will your personal data be used by our third-party service providers or other third parties for those third parties' own AI tools, including training.

Note that we apply privacy enhancing measures to any data before using such data for training purposes.

6. Cookies and Other Tracking Technologies

We use Cookies that collect information to improve and analyze the App. Some Cookies are offered by third parties who collect your personal data so they can provide services to us and information about your online activity to others. You can modify your browser settings to decline or accept certain Cookies. However, if you decline certain Cookies, some of the App's features may not function as designed.

Cookies on the App generally fall into the following categories:

• Strictly Necessary. We may use Cookies that we consider to be strictly necessary to allow you to use and access the App, including Cookies required to prevent fraudulent activity and improve security.
• Functionality. We may use Cookies that are required to offer you enhanced functionality when accessing the App, including identifying you when you sign in to the App or keeping track of your specified preferences.
• Performance/Analytics. We may use Cookies to assess the performance of the App, including as part of our analytics practices. For example, we may use Amplitude to track user language, location, device and browser used, and user sign in and actions. You can learn more about Amplitude's practices at https://www.amplitude.com/privacy.

7. Children's Privacy

The App is not directed to or intended for children. We do not knowingly collect any personal data from anyone under the age of 18. If you think that your child provided information via the App, please email privacy@pelagohealth.com, and we will do our best to promptly delete such information.

8. Data Security and Retention

The security of your personal data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. We maintain appropriate technical, administrative, and physical safeguards to help protect the security of your personal data against unauthorized access, destruction, loss, alteration, disclosure or misuse, but we cannot guarantee its absolute security. We encourage you to secure your account with a strong password and to keep your password private. If you suspect unauthorized use of your account, please email privacy@pelagohealth.com.

We will retain personal data for as long as necessary for the purposes outlined in this Privacy Statement, including complying with any legal obligations or policies, resolving disputes, enforcing legal agreements, and for internal analytics purposes. Our determination of precise retention periods will be based on (a) the length of time we have an ongoing relationship with you; (b) whether there is a legal obligation to which we are subject; and (c) whether retention is advisable in light of our legal position, including with regard to applicable statutes of limitations, litigation, or regulatory investigations.

9. Transfers of Personal Data

Your personal data may be transferred and maintained outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. If you are located outside of the United States and choose to provide information to us, please note that we transfer personal data to the United States and process it there. For such transfers, we take the necessary measures to ensure that your personal data receives an adequate level of protection.

10. Privacy Choices

A. Opting out of promotional communications

We may use your personal data to send you email updates regarding the App, other announcements, and inquiries. If you no longer wish to receive promotional email communications from us, you may opt out via the unsubscribe link included in such emails or by emailing us at privacy@pelagohealth.com. We will comply with your request as soon as reasonably practicable. Please note that if you opt out of receiving promotional emails from us, we may still send you important administrative messages that are required to provide you with the App or for other reasons disclosed in this Privacy Statement.

Additionally, with your consent, we may send you SMS messages for promotional purposes, internal business purposes, internal user research, and to provide customer service, including troubleshooting. To cancel the SMS service at any time, text "STOP" to any text message you receive. After you send the SMS message "STOP" to us, we will send you an SMS message to confirm that you have unsubscribed. After this, you will no longer receive SMS messages from us. If you are experiencing issues with the messaging program you can text "HELP" for more assistance, or you can email us at privacy@pelagohealth.com.

B. Accessing, updating, and deleting your account information

If you have an account with us, you can access, correct, or update your account or other personal data by logging into your account and updating it in your account settings. You may also request that we delete your account by emailing us at privacy@pelagohealth.com. Please note that we may retain your personal data even after you have deleted your account if reasonably necessary to comply with our legal obligations, resolve disputes, maintain security, detect and prevent fraud and abuse, enforce our Terms of Use, or fulfill your request to "unsubscribe" from further messages from us. We may also retain aggregate, de-identified, or anonymized data about you.

11. Supplemental State Notices

We are providing the following disclosures and rights in the interest of transparency and in furtherance of our privacy commitment to you. Such disclosures and rights are not intended to waive any applicable exemptions under state and federal law.

A. Notice for California Residents

California residents have the right to request information regarding third parties to whom we have disclosed certain categories of personal data during the preceding year for the third parties' direct marketing purposes under California's "Shine the Light" law (Cal. Civ. Code §1798.83). We do not disclose personal data to third parties for such purposes. If you wish to request information regarding such practices, please email privacy@pelagohealth.com. You must include your full name, email address, and postal address in your request so that we can verify your residency and respond.

B. Notice for Connecticut, Nebraska, and Texas Residents

This notice contains additional information for residents of Connecticut, Nebraska, and Texas about our data practices and your rights with respect to personal data under applicable laws and regulations.

Your privacy rights: Connecticut, Nebraska, and Texas residents may have the following rights under applicable law in relation to your personal data, subject to certain exceptions:

• Right to know and access. You have the right to know what personal data we collect, use, disclose, and "sell" (as defined by applicable law). You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period.
• Right to delete and erase. You have the right to request under certain circumstances that we, as well as our service providers and contractors, delete the personal data that we collect about you.
• Right to correct. You have the right to request the correction of inaccurate personal data.
• Right to opt out. You have the right to opt-out of the processing of personal data for the purposes of targeted advertising, the sale of your personal data, and profiling. Please note that we do not process personal data for such profiling or targeted advertising and do not sell personal data.
• Rights concerning sensitive personal data. We cannot process sensitive data or use your personal data for certain purposes without your affirmative consent.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

You can exercise any of these rights by emailing us at privacy@pelagohealth.com, calling us at 877-349-7755, or writing to us at Digital Therapeutics, Inc. 1632 1st Ave. #20163 New York, NY 10028.

How to appeal decisions about your rights:

• Connecticut residents. If you want to appeal our decision regarding a request, please email privacy@pelagohealth.com. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken. If the appeal is denied, you may contact Connecticut's Office of the Attorney General by phone at (860) 808-5420 or by submitting a form here.
• Nebraska residents. If you want to appeal our decision, please email privacy@pelagohealth.com. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken. If the appeal is denied, you may contact Nebraska's Office of the Attorney General by phone at (402) 471-2683 or by submitting a form here.
• Texas residents. If you want to appeal our decision, please email privacy@pelagohealth.com. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken. If the appeal is denied, you may contact Texas' Office of the Attorney General by phone at (800) 621-0508 or by submitting a form here.

C. Notice for Nevada Residents

We do not "sell" personal data as that term is defined under Nevada law. Nevada residents have the right to opt out of any future sale of their personal data under Nevada SB 220. If you are a Nevada resident and would like to make such a request, please email us at privacy@pelagohealth.com. You must include your full name, email address, and postal address in your request so that we can verify your residency and respond.

12. Updates to this Privacy Statement

We may change this Privacy Statement from time to time to reflect changes in our data practices or applicable law. We will notify you of any changes consistent with applicable law, including by posting the new Privacy Statement on this page and updating the "Effective Date" at the top of this Privacy Statement. We recommend periodically reviewing this page for any changes. Changes to this Privacy Statement are effective when they are posted on this page.

13. Contact Us

If you have questions or concerns regarding this Privacy Statement, please contact us: