Privacy Policy

Applicability

This Privacy Policy describes how Almanac Health, Inc. ("Almanac", "we", "our" or "us") collect, use, protect, and disclose information and data when you use our website, https://www.almanac.chat/ ("Site"), applications, and related services offered by us, and any other time you interact with Almanac (collectively, "Services"). This Privacy Policy also explains your choices for managing your information preferences, including opting out of certain uses of your Personal Information (defined below). This Privacy Policy applies to all users of the Site and Services.

By using the Services, or providing your personal information to us, you consent to the use of your information as described in this Privacy Policy. If you do not agree with any term in this Privacy Policy, you should not access or use the Services or provide your personal information to us.

This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings. Our use of that data is governed by our customer agreements covering access to and use of those offerings. For example, patient data is governed by Business Associate Agreements and any other applicable notices, consents, and/or authorizations that providers are responsible for presenting to patients.

1. Types of Personal Information We Collect

When you interact with the Services, we may collect your Personal Information. In this Privacy Policy, "Personal Information" means any information that can be used to identify, contact or locate you. We may collect the following categories and type of Personal Information:

Contact information: your first and last name, address, email address, and telephone number.

Financial Information: credit card, debit card and bank account information.

Other identifying information: IP address.

Internet or other electronic activity: your browsing and click history, including information about how you use and navigate within our Site and Services and which elements of our Site and Services you use the most.

We do not collect, use or disclose sensitive personal information, as defined by California law, for inferring characteristics or for purposes other than those permitted by law.

2. How We Collect Your Information

We collect information directly from you. We collect information if you make an account or contact us.

We collect information passively. We collect information about users over time and across different websites. We also work with third parties that collect personal information this way. We may use several common tracking tools to collect information. Tracking tools include browser cookies, web beacons, and pixels. To learn more about cookies visit the FTC's Online Tracking page. We may do this on our websites and in emails that we send to you. To learn more about these technologies and your choices, read more below.

We collect information about you from others. We may collect information about you from our business partners or other third party sources, such as social media sites, including Facebook and X (formerly Twitter).

3. How We Use Personal Information

We collect and use your Personal Information for the following purposes:

• To provide, analyze, and maintain our Services.
• To improve and develop our Services and conduct research.
• To communicate with you, including to send you information about our Services and events.
• To prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems and Services.
• To comply with legal obligations and to protect the rights, privacy, safety, or property of our users, Almanac, or third parties.
• For any other purposes disclosed to you at the time of collection.

3A. Google User Data

If you connect a Google account to Almanac, we access only the data needed for the features you enable:

• Sign in with Google: your name, email address, and profile picture, used to create your account and sign you in.
• Google Calendar (calendar.events, calendar.calendarlist.readonly, calendar.freebusy): your list of calendars, your free/busy availability, and read and write access to your events, used to show your schedule, find free time, and create, update, or respond to events at your request.
• Gmail (gmail.readonly, gmail.compose): read access to your messages and the ability to create drafts and send messages you approve, used to find, summarize, and draft email at your request.

Each Google connection also receives your email address (openid, email) so we can show which Google account is connected. We use this data solely to provide those user-facing features.

Almanac's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to develop, improve, or train generalized AI or machine learning models. Humans do not read Google user data except with your consent, for security purposes, or to comply with law. The research and service-improvement uses described in Section 3 do not apply to Google user data.

You can disconnect Google at any time in Almanac settings or at https://myaccount.google.com/permissions.

Prohibited uses. Almanac does not generate images of people and does not use Google APIs or Google user data to create, modify, or distribute sexually explicit or intimate imagery, including AI-generated non-consensual intimate imagery.

4. Cookies and Other Data Collection Technologies

When you access our Services, we (and third-party companies we work with) may collect and store certain information by using technologies such as server logs, cookies, web beacons, clear gifs, tags, e-tags, flash cookies, log files, code, Javascript packages, and similar technologies. These various technologies help us manage the operations of the Services, remember your preferences, and track usage behavior so that we can tailor information to make your visits more enjoyable and meaningful.

Our data collection technologies include:

• Cookies: A cookie is a text file that is placed on your hard disk by a webpage server. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you. You can find more information about cookies at www.allaboutcookies.org.
• Web beacons and GIFs: Certain pages on the Services contain web beacons (also known as web bugs, pixel tags and clear GIFs), which we use to monitor how users use the Services.
• Local Storage and Local Shared Objects: We use local shared objects and local storage to enhance user experience. Local storage is similar to browser cookies but can store data more complex than simple text. By itself, local storage cannot do anything to or with the data stored on your device. Like cookies, local storage can only access personal data that you have provided to the Services. Various browsers may offer their own management tools for removing HTML5.

You may have the ability to accept or decline cookies and manage your local storage through your web browser. Most web browsers automatically accept cookies, but you may be able to modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to experience certain features of the Services.

Some web browsers incorporate a "do-not-track" ("DNT") or similar feature that signals to websites that a visitor does not want to have his/her online activity tracked. If a website receives a DNT signal, the browser can block that website from collecting certain information about the browser's user. Not all browsers offer a DNT option and DNT signals are not yet uniform. For this reason, we (along with many other website operators) do not currently respond to DNT signals. For more information about DNT signals, visit www.allaboutdnt.com.

5. When We Share Personal Information

We may share and disclose your Personal Information in the following circumstances:

• Vendors and Service Providers: We may share your Personal Information with vendors and service providers, including providers of hosting services, cloud services, and other information technology providers, that we contract with to help us deliver the Services.
• Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider, your Personal Information may be shared in the diligence process with counterparties and others assisting with the transaction.
• Legal Requirements: We also may share your Personal Information that we collect, as needed, to enforce our rights, protect our property or protect the rights, property or safety of others, or as needed to support internal functions. We will disclose Personal Information as we deem necessary to respond to a subpoena, order, governmental request, or other legal or regulatory process. We also may share Personal Information as required to pursue available remedies or limit damages we may sustain.

6. Your Privacy Rights

Residents of California or jurisdictions with similar laws (e.g., Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) have certain additional data privacy rights under the applicable privacy laws in such states ("State Privacy Law(s)"). If you are a resident of a state that has a State Privacy Law, this section applies to you. Note that we allow all users of the Site and Services to exercise the rights set forth in this section in accordance with this Policy.

These data privacy rights are not absolute. In some situations we may not be able to process your request. This may include if a legal exception applies. These rights may be offered based on your location. We will let you know when or if a right does not apply to you. You will not be discriminated against for exercising a privacy right. If you disagree with our decision you can contact us as described at the end of this Policy. These data privacy rights are:

Confirmation and Access: You have the right to request confirmation of whether we are processing your Personal Information (also referred to as "personal data" under certain State Privacy Laws), and to access such information. This includes the right to obtain:

• The categories and specific pieces of Personal Information we have collected, used, disclosed, shared or sold about you;
• The categories of sources from which we collected your Personal Information;
• The purposes for which we collected, used, disclosed or sold your Personal Information;
• The categories of third parties to whom we have disclosed, shared or sold the Personal Information and (where required) the specific third parties to whom such disclosures or sales were made; and
• (Where applicable) information about any Profiling or automated decision-making processes that affect you.

Portability: You may request a copy of the Personal Information we have collected and maintain about you.

Deletion: to have us delete your Personal Information, which may include derived data, we have collected about you.

Correction: asking us to fix or update your Personal Information if it is inaccurate, incomplete, or outdated.

We will also maintain a record of your rights requests.

Please note that if we delete your Personal Information, some of our services will not work the same. For example, your previous opt out requests will not be saved and saved preferences and information will no longer be available.

Exercising your Rights

You can exercise some of these rights through your Almanac account. If you are unable to exercise your rights through your account, please submit a verifiable consumer request to us by either:

• Email to support@almanac.chat; or
• Mail to 1111B S Governors Ave, #26151, Dover, DE 19904.

Your verifiable consumer request must:

• Provide sufficient identifying information (including full name and email address) to allow us to reasonably verify you are the person about whom we collected and retained Personal Information, and/or your authority to make such request on behalf of the data subject, and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Note that we will only use Personal Information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request or to review and comply with the request.

You may authorize someone to act as your agent and submit a request on your behalf. Due to the sensitivity of such requests, you must verify the agent's authorization before we will act. Accordingly:

• You or your agent must supply proof that the agent is registered with the Secretary of State to act on your behalf; or
• You or your agent must supply other written permission for a specific agent to act on your behalf; and
• We will use your email address to connect directly with you to verify agent identity and authority.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm with a level of confidence appropriate to the sensitivity of the information that the Personal Information we have collected and retained in our systems and databases relates to you.

Making a verifiable consumer request does not require you to create an account with us, but if you have an account with us, we may require you to log-in to such account in order to verify your identity or authority or to provide or delete your information.

Right to Appeal

Residents of some jurisdictions (e.g., Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia) have a right to appeal our decision on a privacy rights request. If we were unable to fulfill your request, you may appeal our request by contacting us at support@almanac.chat within fourteen days of our decision, and provide a detailed reason for your appeal, as well as your state of residence.

7. Retention of Personal Information

We'll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data will depend on a number of factors, such as:

• Our purpose for processing the data;
• The amount, nature, and sensitivity of the information;
• The potential risk of harm from unauthorized use or disclosure;
• Any legal requirements that we are subject to.

8. Be Careful When You Share Information with Others

Please be aware that whenever you share information on any public area of the Site or Services, that information may be accessed by others. In addition, please remember that when you share information in any other communications with third parties, that information may be passed along or made public by others. This means that anyone with access to such information can potentially use it for any purpose, including sending unsolicited communications.

9. Security

We maintain commercially reasonable technical, administrative, and organizational measures designed to protect the confidentiality and security of information transmitted to us. However, no data transmission over the Internet or other network can be guaranteed to be 100% secure. Therefore, you should take special care in deciding what information you provide to the Services. While we strive to protect information transmitted on or through the Site or Services, we cannot and do not guarantee the security of any information you transmit on or through the Site or Services, and you do so at your own risk.

10. Processing in the United States

The Services are hosted in the United States and subject to U.S. law. If you are accessing the Services from outside the United States, please be advised that U.S. law may not offer the same privacy protections as the law of your jurisdiction. By accessing and using the Services, you consent to the transfer to and processing of your Personal Information in the United States.

11. Protection of Children's Privacy

The Services are not designed for, intended to attract, or directed toward children under the age of thirteen. Consistent with the requirement of the Children's Online Privacy and Protection Act, if we learn that we have received any information directly from a child under age 13 without first receiving his or her parent's verified consent, we will use that information only to respond directly to that child (or his or her parent or legal guardian) to inform the child that he or she cannot use the Services and subsequently, we will delete that information.

12. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. If we decide to change this Privacy Policy, we will inform you by posting the revised Privacy Policy on the Site. Those changes will go into effect on the "Effective" date shown in the revised Privacy Policy. We will notify you of any material changes to this Privacy Policy as required by law. By continuing to use the Site or Services, you are consenting to the revised Privacy Policy.

13. Contact Us

If you have any questions or concerns, you may contact us at support@almanac.chat.

Please print a copy of this Privacy Policy for your records and PLEASE check the Site frequently for any changes.

14. European Economic Area, Switzerland, and the United Kingdom Privacy Rights

This section applies to residents of the European Economic Area (EEA) or Switzerland.

Controller. The controller of your Personal Information is:

Almanac Health, Inc. 1111B S Governors Ave #26151 Dover, DE 19904 Email: support@almanac.chat

Data Protection Officer. Our Data Protection Officer is Cyril Zakka and may be contacted at cyril@almanac.chat.

Disclosure and Cross-Border Transfer. Personal information that is shared with affiliates and third parties as described in this Privacy Policy is done pursuant to contracts that include the requisite protections under applicable data protection laws. In accordance with these laws, transfers of Personal Information outside of the European Economic Area, Switzerland, and the United Kingdom are conducted in accordance with compliant arrangements such as data transfer agreements that contain standard contractual clauses adopted by the European Commission, Information Commissioner, and/or Federal Data Protection and Information Commissioner that provide safeguards for such transfers or legally recognized certifications and adequacy decisions. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Information.

Lawful Basis for Processing Personal Information. The lawful basis for our collection and use of your Personal Information described in this Privacy Policy is that the processing is (i) necessary for our legitimate interests in carrying out our business, provided those interests are not outweighed by your rights and interests; (ii) necessary to perform a contract with a third-party or with you; (iii) necessary to comply with a legal obligation; or (iv) based, when necessary and appropriate, on your consent.

Special Categories of Data. Unless we specifically authorize you to do so, do not send us any Special Categories of Data, which is defined under applicable data protection laws as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric characteristics, health, or sexual orientation.

Segmentation and Automated Decision Making. We do not currently engage in segmentation or automated decision-making without human intervention, including profiling.

Your Rights Over Your Personal Information. Subject to certain exceptions and limitations, you have the right to:

• Ask us to confirm whether we are processing your personal information.
• Ask us to provide you or a third party that you designate with certain of your personal information in a commonly used, machine readable format. Please note, however, that data portability rights apply only to personal information that we have obtained directly from you and only where our processing is based on consent or the performance of a contract.
• Request that we update or correct your personal information when it is inaccurate or incomplete.
• Request that we delete your personal information in certain circumstances.
• Request that we limit processing or stop processing your personal information in certain circumstances including for marketing activities and profiling for marketing activities and profiling for statistical purposes and, subject to certain exceptions, where such processing is based on our legitimate business interests.
• Withdraw or revoke consent previously granted to the extent permitted by law.

Exercising Your Rights. To exercise any of your rights, please follow the process described in "Exercising your Rights" in Section 6 above, or email us at support@almanac.chat. We will respond to all such requests within 30 days of our receipt of the request, unless there are extenuating circumstances, in which event we may take up to 60 days to respond. We will inform you if we expect our response to take longer than 30 days. Please note, however, that certain personal information may be exempt from such rights pursuant to applicable data protection laws. In addition, we will not respond to any request unless we are able to appropriately verify the requester's identity.

You also have the right to lodge a complaint with a data protection authority for your country or region or where an alleged infringement of applicable data protection laws occurs.

For the EEA, a list of the national data protection authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

For the UK, you have the right to lodge a complaint with the Information Commissioner's Office. The ICO's complaint procedures may be found at https://ico.org.uk/make-a-complaint/.