Any individual, subscriber, or patient using SonarMD's websites, applications, and related technologies is a user ("User", "you", or "your") for purposes of this Privacy Policy.

SonarMD, Inc., a Delaware corporation, and its affiliated companies under common control ("SonarMD", "we", "us", or "our") take the privacy of your personal data very seriously. This Privacy Policy describes how we collect, use, and disclose your personal data, and how you may access and correct the personal data that you have provided. This Privacy Policy applies solely to personal data collected, used, and disclosed by us in connection with the Products and Services.

SonarMD provides access to websites, applications, and related technologies, including videoconferencing, text messaging and other means of communication, (the "Products and Services") that assist individuals to obtain information about their health, coordinate their clinical care, and improve their health and wellbeing. We also provide access to Products and Services that assist health plans, healthcare providers, and other healthcare-related companies (the "Clients") improve their delivery of healthcare and related services, coordinate clinical care, and improve the health and wellbeing of their subscribers or patients. Your personal data is needed in connection with one or more of these Products and Services.

1. User Eligibility; Children Under Thirteen

The Products and Services are designed for use by adult residents of the States of California, Illinois, Minnesota or North Carolina while physically located within the United States. You must be a legal resident of one of these states to use the Products and Services and physically located within the United States while using the Products and Services. If you are not a legal resident of one of these states or are not physically located within the United States, do not use any of the Products and Services. Specifically, our mobile application ("mobile app") is intended for wider use than the our other Products and Services; the mobile app is designed for use exclusively by United States residents who are physically located within the United States at the time of use.

You must be at least thirteen years of age to use the Products and Services. If you are not at least thirteen years of age, do not use any of the Products and Services.

If you are between thirteen and eighteen years of age, you may use the Products and Services only with the permission of your parent or legal guardian.

We do not knowingly collect or solicit personal data from children under thirteen years of age. If we become aware that we have received any personal data from a child under thirteen years of age, we will use such child's personal data only to correspond with the parent or legal guardian (or the child directly in the event we do not have a means of contacting the parent or legal guardian) to inform them that the child cannot use the Products and Services. We will then permanently delete that child's personal data. If you believe or know that a child under thirteen years of age has provided us with personal data, please email SonarMD at: info@sonarmd.com to report it.

2. Personal Data

You will be required to share personal data to use the Products and Services. Personal data may include your name, username, password, IP address, e-mail address, physical address, location data, device information, telephone number, age, gender, health information, and health or related conditions. You can review, edit, or delete your personal data at any time. Should you need help reviewing, editing, or deleting your personal data, please email SonarMD at: info@sonarmd.com to request assistance. We may decline or delay deletion if retaining the personal data is necessary to complete a transaction related to a Product or Service you requested, detect or prevent security incidents or fraud, comply with a legal obligation, maintain required business or financial records, or support internal operations that are reasonably aligned with our relationship with you. When deletion is feasible, we will delete, de-identify, or anonymize your personal data as appropriate and ensure that any remaining copies are removed through our routine backup and retention cycles. Although personal data stored in our system cannot always be immediately deleted due to technical constraints, such data will be permanently removed as backups are overwritten or otherwise retired according to our retention practices.

3. Collection, Use, and Disclosure of Personal Data

SonarMD does not collect, use, or disclose your personal data unless you voluntarily provide it to us, provide it to Clients who are authorized to provide it to us, or you otherwise voluntarily consent to Clients providing it to us. SonarMD does not sell, rent, or lease your personal data without your consent.

We collect, use, and disclose personal data as appropriate or necessary in connection with the Product and Services. This may include exchanging personal data with you or with Clients. We use industry-standard technology, including firewalls and encryption, to protect personal data from unauthorized access, alteration, theft, or misuse. To enable us to provide a secure environment, we may use personal data internally to diagnose problems or to contact you if appropriate or necessary.

We may collect, use, and disclose personal data to personalize or improve our existing, or to develop new, websites, applications, and related technologies.

We also may collect, use, and disclose personal data to generate aggregated information as well as anonymized or de-identified information, which will not be identifiable to you, consistent with applicable law.

SonarMD may use and disclose your personal data, without notice, if required to do so by applicable law or in the good faith belief that such action is necessary to (a) conform to applicable law, (b) comply with legal process served on SonarMD, (c) protect or defend the rights or property of SonarMD, or (c) act under exigent circumstances to protect the security or safety of SonarMD, Clients, or any individual.

4. Artificial Intelligence

SonarMD utilizes third-party, and may utilize its own, artificial intelligence, generative artificial intelligence, and machine learning technologies, and agentic AI systems, including third-party platforms and tools (collectively, "AI Tools"), to power, support, facilitate, or automate certain features of the Products and Services. By using the Products and Services, you acknowledge and consent to SonarMD's use of AI Tools to process your personal data as described in this Privacy Policy and our Terms of Use.

Certain categories of personal data, which may include your name, contact information, health information, health or related conditions, communications, and User Content, may be transmitted to, processed by, or otherwise accessible through AI Tools, including third-party AI Tool providers, in connection with the operation of AI-enabled features of the Products and Services. The specific categories of personal data processed depend on the features you use and the information you provide or that Clients provide on your behalf.

Personal data may be processed through AI Tools for purposes including, but not limited to, care coordination, targeted care management, patient navigation and support, health and wellness education, communication facilitation, generating summaries and recommendations, research and outreach activities, and improving the Products and Services.

SonarMD may use AI Tools provided by third parties. In connection with providing AI-enabled features, personal data may be shared with or accessible to such third-party AI Tool providers. These third-party providers may process personal data in accordance with their own terms, conditions, and privacy policies, which may differ from this Privacy Policy. SonarMD requires its third-party AI Tool providers to implement appropriate safeguards for the protection of personal data, but SonarMD does not control and is not responsible for the data practices of such third-party providers.

Personal data processed through AI Tools is retained in accordance with our data retention practices described in Section 8 (Data Retention) of this Privacy Policy.

SonarMD implements commercially reasonable administrative, technical, and physical safeguards designed to protect personal data processed through AI Tools, including encryption, access controls, and contractual obligations imposed on third-party AI Tool providers. However, no method of transmission over the internet or electronic storage is completely secure, and SonarMD cannot guarantee the absolute security of personal data processed through AI Tools.

5. Other Offering, Related Service, or Future Research; Opt-Out

SonarMD may, from time to time, collect, use, and disclose personal data to contact you about a general or personalized offering, related service, and future research. In those cases, SonarMD will request that you sign an authorization for such purposes prior to SonarMD contacting you, as may be required by applicable law. To opt-out of such offerings, related service, and research, please email SonarMD at: info@sonarmd.com.

6. External Data Storage Sites

SonarMD may store personal data on servers provided by third party hosting vendors with whom SonarMD has contracted.

7. Accessing and Correcting Your Personal Data

You may access personal data that you have provided through the Products and Services. You also may correct your personal data through the same Products and Services that were used to provide such data.

8. Data Retention

Personal data is retained based on several guiding principles. We retain personal data only for the business and commercial purposes for which it was collected, including, but not limited to, providing care coordination and target care management services, mobile application functionality, customer support, or legal compliance. We follow the principle of data minimization, collecting and retaining only the personal data necessary to achieve these purposes. In determining retention periods, we consider the sensitivity of the personal data, the potential harm that could result from unauthorized access or disclosure, and the impact of retention on User privacy. Retention periods are also influenced by applicable laws and regulations, including HIPAA, to ensure that personal data is stored in compliance with our legal obligations. In some cases, we retain personal data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees, provide our Products and Services, or is otherwise permitted or required by applicable law or regulation. We may further retain personal data in a de-identified and/or aggregated form where personal data would not identify you personally.

9. Opt-Out of Disclosure by SonarMD

In connection with any personal data SonarMD may disclose, you have the right to know the categories of personal information that we disclosed about you in connection with the Products and Services.

You have the right under applicable law to opt-out of the disclosure of your personal data. If you exercise your right to opt-out, we will refrain from disclosing your personal data, unless you subsequently provide express authorization for the disclosure of your personal data to us. To opt-out of the disclosure of your personal data, please email SonarMD at: info@sonarmd.com.

10. For Android Users – Required Google Play Disclosures for Certain Health Apps

Google requires our mobile app to comply with their Health Apps requirements. As a result, we are required to provide this information so we can make our mobile app available to you in the Google Play store. Our mobile app interacts with your microphone only when you use it to navigate the mobile app. Our mobile app interacts with your camera only when you choose to upload a profile image. Our mobile app accesses, collects, uses, and shares your information (including video, audio, images, files, and phone data). Your healthcare provider or organization may allow you to use our mobile app to conduct telehealth appointments with your providers. Our app functions only as a technical mechanism to facilitate these appointments. It does not access or interact with any health information exchanged during a telehealth session.

11. Reporting Complaints or Potential Vulnerability or Security Concerns

If you would like to report a concern about the collection, use, or disclosure of your personal data or if you would like to report a potential vulnerability or security concern, please email SonarMD at: info@sonarmd.com.

Please provide your name and contact information with your report. As reports may include protected health information or other confidential data, all reports should be encrypted. Our PGP public key for encryption purposes can be found here. So that we may effectively review and respond to your report, please provide details of the concern or potential vulnerability or security concern. With respect to reports about a potential vulnerability or security concern, please make sure to include steps necessary to reproduce the issue, including any relevant logs and files (e.g., screenshots). Do not destroy or modify data or attempt to interrupt or degrade the Products and Services. Your report will be reviewed by SonarMD, and we will contact you if we need more information.

12. Changes to this Privacy Policy

SonarMD reserves the right at any time to change this Privacy Policy. Accordingly, you are advised to review this Privacy Policy from time to time. Using any of the Products and Services after any change to this Privacy Policy constitutes your understanding and agreement with the change to this Privacy Policy. If you object to any change to this Privacy Policy, do not use any of the Products and Services.

BE.16699921.3/SON058-275469