1. Acceptance of Terms

These Terms of Use (“Terms”) govern access to and use of Equipo Health's websites, cloud-based software platforms, web and mobile applications, patient and provider portals, application programming interfaces (APIs), artificial intelligence (AI) services, integrations, browser extensions, and connected devices that reference these Terms (collectively, the “Services”), provided by Equipo Health, Inc. (“Equipo Health,” “we,” “us,” or “our”).

These Terms apply to two categories of users, as further described in Section 3: (a) healthcare provider organizations, health plans, and other payer entities that access the Services under an executed order form, subscription agreement, or statement of work (each, a “Customer”); and (b) individuals who access the Services directly, including through a mobile application, browser extension, or portal, whether as personnel of a Customer or as a patient, caregiver, or other authorized individual (each, an “End User,” and together with Customer, “you” or “your”).

By accessing or using the Services—including by accessing or downloading a mobile application, installing a browser extension, creating an account, clicking “I Accept” where presented, or otherwise accessing or using the Services—you agree to be bound by these Terms.

If you are accessing or using the Services on behalf of an organization, you represent and warrant that you have the authority to bind that organization to these Terms. If you do not agree to these Terms, you may not access or use the Services.

These Terms incorporate by reference the Equipo Health Privacy Policy and, where applicable, any Order Form, Business Associate Agreement (“BAA”), and Data Processing Addendum (“DPA”) executed between Equipo Health and a Customer. In the event of a conflict, the order of precedence is: (i) the BAA, as to Protected Health Information; (ii) the Order Form; (iii) these Terms; and (iv) the Privacy Policy. These Terms and the Privacy Policy are each published in full and are accessible directly from the website, application, and extension listing without requiring sign-in or redirection elsewhere.

2. The Equipo Health Services

Equipo Health provides an integrated healthcare technology platform that supports care coordination, chronic care management, patient engagement, population health management, referral management, healthcare operations, analytics, and interoperability, accessible through web application and native mobile application (iOS and Android) interfaces. The Services include:

• Compass - Care Coordination Platform.
• Contigo Patient Portal and Mobile Application
• Pulse - Provider Portal.
• Care Connect - Referral and Care Network Platform.
• Prism - Population Health and Analytics Platform.
• Foresight – Equipo Health's AI ecosystem, including intelligent automation, predictive analytics, AI assistants, clinical decision support, documentation assistance, and workflow optimization.
• CareLink, CareAssist, CareEdge, CareLens, and other Equipo Health applications.
• Equipo Health browser extensions and plugins that integrate with EHR systems, web portals, or other third-party web applications.
• Wearable devices, remote patient monitoring devices, and other connected health technologies that transmit data to the Services, where enabled by a healthcare organization or authorized user.
• Electronic Health Record (EHR) integrations, APIs, and interoperability services.

These Terms apply regardless of whether the Services are accessed through a web browser, a downloaded mobile application, a browser extension, a wearable or connected device, or any other current or future access channel. Equipo Health may introduce, modify, or retire features or products from time to time; material reductions in functionality for a currently subscribed product will be communicated to affected Customers.

3. Who These Terms Apply To

3.1 Customers and Authorized Users

Where Compass, Pulse, Care Connect, Prism, or Foresight are licensed to a healthcare organization under an Order Form, that organization is the “Customer,” and its clinicians, care coordinators, administrative staff, and other personnel granted credentials by the Customer are “Authorized Users.” Authorized Users access the Services on the Customer's behalf, subject to the Customer's Order Form, and do not have independent contractual rights against Equipo Health except as expressly stated in these Terms.

3.2 Individual End Users

Where an individual accesses the Services directly and not on behalf of a Customer — for example, a patient using the Contigo mobile application or patient portal, or an individual installing an Equipo Health browser extension — that individual accepts these Terms in their personal capacity as an End User. References to “Customer” regarding contractual matters (fees, Order Forms, BAAs) do not apply to Individual End Users; provisions regarding acceptable use, account responsibility, disclaimers, and liability apply equally to Customers, Authorized Users, and Individual End Users.

3.3 Minors

The Contigo mobile application and patient portal are not directed to children under thirteen (13) for independent, unsupervised use. Where a healthcare organization's pediatric care program authorizes use of the Services on behalf of a minor patient, access is provided to, and these Terms are accepted by, the minor's parent, guardian, or authorized representative, consistent with the Privacy Policy and applicable law.

4. Eligibility and Account Registration

Customer is responsible for determining which of its personnel and authorized third parties may access the Services as Authorized Users, for ensuring Authorized Users comply with these Terms and any role-based access restrictions, and for all activity occurring under Customer's accounts, except to the extent caused by Equipo Health's breach of these Terms.

Individual End Users registering directly for the Contigo mobile application, patient portal, or a browser extension are responsible for providing accurate registration information, maintaining the confidentiality of their login credentials (including any biometric or passkey-based login they enable on their device), and promptly notifying Equipo Health of any suspected unauthorized access to their account.

5. License Grant and Restrictions

5.1 Customer License

Subject to these Terms and the applicable Order Form, Equipo Health grants Customer a non-exclusive, non-transferable, non-sublicensable license during the subscription term to access and use the licensed products of the Services for Customer's internal healthcare operations.

5.2 Individual End User License

Subject to these Terms, Equipo Health grants each Individual End User a personal, non-exclusive, non-transferable, revocable license to download, install, and use the applicable mobile application, portal, or browser extension solely for its intended purpose, such as viewing personal health information, communicating with a care team, or supporting an authorized clinical or administrative workflow.

5.3 Restrictions

No Customer, Authorized User, or Individual End User will, or will permit any third party to:

• Reverse engineer, decompile, or otherwise attempt to derive the source code or underlying models of the Services, except to the extent such restriction is prohibited by law;
• Use the Services to build a competing product or service;
• Resell, sublicense, or provide access to the Services to any party not authorized under the applicable Order Form or these Terms;
• Remove or obscure any proprietary notices;
• Use the Services, including any AI-enabled outreach or communication feature, to contact individuals without any consent required by applicable law;
• Grant an Equipo Health browser extension broader access than the specific browser or host permissions disclosed at installation, or use the extension outside the domains and workflows for which it is designed.

6. Mobile Application and Browser Extension Terms

Because certain Services are distributed through app marketplaces (including the Apple App Store and Google Play Store) and browser extension marketplaces (including the Chrome Web Store), the following additional terms apply to those access channels:

• These Terms and the Privacy Policy are accessible directly from the application or extension listing and from within the application or extension itself, without requiring login, so they can be reviewed prior to installation.
• An Individual End User may delete their account and associated non-PHI account data directly through in-application account settings where available, or by contacting Equipo Health as described in Section 20; requests concerning PHI maintained on behalf of a healthcare organization are directed to that organization, consistent with the Privacy Policy.
• Device permissions requested by the mobile application (camera, photo library, push notifications, location, biometric login, and, where applicable, contacts) and browser or host permissions requested by a browser extension are each used solely for the disclosed, user-facing feature associated with that permission, are not used for advertising, and may be revoked at any time through device or browser settings without affecting core features that do not depend on that permission.
• Equipo Health does not sell End User data collected through the mobile application or browser extension, and does not use such data to train generalized AI or machine learning models except as described in the Privacy Policy.
• These terms for the mobile application and browser extension serve as the end-user license and acceptable-use terms required by the applicable marketplace and are not superseded by conflicting marketplace default terms, except where a marketplace's own policies require its terms to prevail.

7. Protected Health Information and Data Privacy

Where use of the Services involves the creation, receipt, maintenance, or transmission of Protected Health Information (“PHI”) as defined under HIPAA on behalf of a Customer, such use is governed by the BAA executed between Equipo Health and that Customer, which is incorporated into these Terms. In the event of any conflict between these Terms and a BAA regarding the treatment of PHI, the BAA controls. Equipo Health's collection, use, and disclosure of personal information more broadly — including for Individual End Users — is described in the Privacy Policy, which is incorporated into these Terms.

Equipo Health implements administrative, technical, and physical safeguards designed to protect data consistent with the BAA, the DPA, the Privacy Policy, and applicable law. Customers remain responsible for obtaining any consents or authorizations required from patients or members before using the Services, including outreach conducted through Foresight or other AI-enabled communication capabilities.

8. Use of AI-Enabled Features

Certain Services, including Foresight and AI-enabled capabilities within Compass, Pulse, and Care Connect, employ artificial intelligence, automation, and predictive analytics (“AI Features”). AI Features are advisory in nature and are not a substitute for independent professional judgment. With respect to AI Features, Customer and Authorized Users acknowledge and agree that:

• AI Features are designed to support, not replace, the clinical and operational judgment of qualified personnel; healthcare providers remain solely responsible for patient care and clinical decisions;
• Outputs, recommendations, risk flags, or drafted documentation generated by AI Features should be reviewed by appropriately qualified personnel before being relied upon for clinical, coverage, or coding decisions;
• Customer is responsible for configuring appropriate human-review checkpoints for AI-generated outputs used in regulated workflows;
• Equipo Health does not use PHI to train, fine-tune, or improve AI or machine learning models except as permitted under the Privacy Policy and applicable BAA.

9. Customer and User Responsibilities

Customer, Authorized Users, and Individual End Users agree to:

• Provide accurate, complete information reasonably necessary for Equipo Health to configure, support, or provide the Services;
• Use the Services in compliance with all applicable laws and regulations, including HIPAA, the HITECH Act, CMS Medicare Advantage regulations, and applicable state privacy and telephone-consumer-protection laws;
• Maintain any equipment, connectivity, and third-party systems required to access the Services;
• Promptly notify Equipo Health of any suspected security incident involving the Services.

10. Fees and Payment

Fees for Services licensed under an Order Form are set forth in that Order Form. Except as otherwise specified, fees are non-refundable and payable in accordance with the payment terms in the Order Form. Late payments may result in suspension of access following written notice and a reasonable cure period. The Contigo mobile application and Equipo Health browser extensions are made available to Individual End Users at no direct charge unless otherwise disclosed at download or installation.:

11. Intellectual Property

As between the parties, Equipo Health retains all right, title, and interest in and to the Services, including all underlying software, models, workflows, templates, and documentation, together with all improvements and derivative works thereof. The Customer retains all right, title, and interest in Customer Data, and Individual End Users retain their rights in their own personal information, subject to the license granted to Equipo Health to provide the Services as described in the Privacy Policy. Equipo Health may use de-identified, aggregated data derived from use of the Services to improve and develop its products, consistent with the Privacy Policy.

12. Confidentiality

Each party agrees to protect the other party's confidential information using at least the same degree of care it uses to protect its own confidential information of similar nature, and no less than reasonable care, and to use such information solely to perform its obligations under these Terms. This section does not limit either party's obligations under the BAA with respect to PHI.

13. Term, Suspension, and Termination

For Customers, these Terms remain in effect for as long as Customer maintains an active subscription to the Services under an Order Form. For Individual End Users, these Terms remain in effect until the End User's account is deleted or access is otherwise terminated as described in Section 6. Equipo Health may suspend access to the Services if use poses a security risk, violates applicable law, or is in material breach of these Terms, following notice where reasonably practicable. Upon termination, access to the Services will cease, and each party will return or destroy the other party's confidential information in accordance with the DPA and BAA, where applicable.

14. Warranties and Disclaimers

Equipo Health warrants that the Services will perform materially in accordance with applicable documentation. EXCEPT AS EXPRESSLY SET FORTH IN THESE TERMS OR AN APPLICABLE ORDER FORM, THE SERVICES ARE PROVIDED “AS IS,” AND EQUIPO HEALTH DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. EQUIPO HEALTH DOES NOT WARRANT THAT AI FEATURE OUTPUTS WILL BE ERROR-FREE OR THAT THE SERVICES WILL OPERATE UNINTERRUPTED. THE SERVICES DO NOT PROVIDE MEDICAL ADVICE, DIAGNOSIS, OR TREATMENT, AND ARE NOT A SUBSTITUTE FOR PROFESSIONAL MEDICAL JUDGMENT.

15. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATED TO THESE TERMS, REGARDLESS OF THE THEORY OF LIABILITY. FOR CUSTOMERS, EACH PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE AMOUNTS PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY. FOR INDIVIDUAL END USERS ACCESSING THE SERVICES AT NO CHARGE, EQUIPO HEALTH'S AGGREGATE LIABILITY WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (USD $100). THESE LIMITS DO NOT APPLY TO EACH PARTY'S CONFIDENTIALITY AND INDEMNIFICATION OBLIGATIONS, OR AS OTHERWISE LIMITED BY AN APPLICABLE BAA.

16. Indemnification

Equipo Health will defend Customer against third-party claims alleging that the Services infringe such third party's intellectual property rights, and will indemnify Customer against damages finally awarded, subject to the limitations and procedures set forth in the Order Form. Customer and Authorized Users will defend and indemnify Equipo Health against claims arising from their misuse of the Services or violation of applicable law, including failure to obtain required patient or member consents.

17. Compliance with Healthcare Regulations

The parties acknowledge that use of the Services may be subject to regulatory requirements applicable to Medicare Advantage organizations, healthcare providers, and health plans, including CMS marketing and communications rules, risk-adjustment documentation standards, and applicable state insurance regulations. Customer is solely responsible for ensuring that its use of the Services, including any AI-enabled outreach and risk-adjustment-related workflows, complies with such requirements.

18. Governing Law and Dispute Resolution

These Terms are governed by all applicable federal, state, and local laws and regulations of the United States. For Customers, the parties will first attempt to resolve any dispute through good-faith negotiations between designated representatives, escalating to executive-level discussion if unresolved within thirty (30) days, with any remaining dispute resolved in accordance with the dispute-resolution provisions of the applicable Order Form. For Individual End Users, disputes will be resolved in accordance with applicable law.

19. General Provisions

• Amendments: Equipo Health may update these Terms from time to time; material changes will be posted with a revised effective date and, where required by law, communicated via in-app or in-extension notice or email to registered users.
• Assignment: Neither party may assign these Terms without the other's consent, except in connection with a merger, acquisition, or sale of substantially all assets.
• Force Majeure: Neither party is liable for delays caused by events beyond its reasonable control.
• Entire Agreement: These Terms, together with the Privacy Policy and, where applicable, the Order Form, BAA, and DPA, constitute the entire agreement between the parties regarding the subject matter herein.
• Notices: Notices to Customer will be provided in accordance with the notice provisions of the applicable Order Form; notices to Individual End Users may be provided via in-app notification, in-extension notification, or email to the address associated with the End User's account.

20. Contact Us

Questions about these Terms may be directed to Equipo Health at info@equipohealth.com

Effective From: 2024

Equipo Health ("Equipo," "we," "our," or "us") respects the privacy of our customers, healthcare organizations, providers, patients, business partners, authorized users, and website and application visitors. This Privacy Policy explains how we collect, receive, access, use, store, disclose, protect, and otherwise process information.through our websites, cloud-based software platforms, web and mobile applications, patient and provider portals, application programming interfaces (APIs), artificial intelligence (AI) services, integrations, browser extensions, connected devices, and other products and services that reference this Privacy Policy (collectively, the "Services").

Equipo provides an integrated healthcare technology ecosystem that enables healthcare organizations to deliver coordinated, patient-centered care while supporting clinical, operational, and administrative workflows. The Services support care coordination, chronic care management, patient engagement, population health management, referral management, healthcare operations, analytics, interoperability, and other healthcare programs, and are accessible through both web application and native mobile application interfaces.

The Services include, but are not limited to:

• Compass - Care Coordination Platform
• Contigo - Patient Portal and Mobile Application
• Pulse - Provider Portal
• Care Connect – Referral and Care Network Platform
• Prism - Population Health and Analytics Platform
• Foresight - Equipo's AI ecosystem includes intelligent automation, predictive analytics, AI assistants, clinical decision support, documentation assistance, workflow optimization, operational insights, and future AI capabilities.
• CareLink, CareAssist, CareEdge, CareLens, and other Equipo applications
• Equipo browser extensions and plugins (including, where applicable, a browser extension) that integrate with EHR systems, web portals, or other third-party web applications
• Wearable devices, remote patient monitoring devices, and other connected health technologies that transmit data to the Services, where enabled by a healthcare organization or authorized user
• Electronic Health Record (EHR) integrations, APIs, interoperability services, mobile applications, customer support services, and any current or future products, features, channels, or services that incorporate or reference this Privacy Policy

This Privacy Policy applies whether you access the Services through a web browser, a downloaded mobile application (iOS or Android), a browser extension or plugin (including a browser extension), a wearable or connected health device, or any other current or future access channel Equipo may offer. Where a requirement or disclosure below applies only to one access channel, it is identified as such.

Equipo Health acts as a Business Associate, as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"), when it creates, receives, maintains, or transmits Protected Health Information ("PHI") on behalf of healthcare organization customers. Equipo is not a Covered Entity with respect to that PHI. The healthcare organization that engages Equipo remains responsible for its own Notice of Privacy Practices and for determining the permissible uses and disclosures of its patients' PHI. Nothing in this Privacy Policy is intended to expand, limit, or otherwise alter Equipo's obligations under any Business Associate Agreement ("BAA") in place with a customer.

By accessing or using the Services, you acknowledge that you have read and understand this Privacy Policy. By voluntarily submitting information to Equipo through our website, web application, mobile application, registering for events or webinars, communicating with us, or otherwise interacting with Equipo, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy, to the extent permitted by applicable law.

1. Scope of This Privacy Policy

This Privacy Policy applies to information collected through our Services, including information provided by healthcare organizations, providers, patients, authorized users, business partners, and visitors to our website, web application, or mobile application.

As used in this Privacy Policy: "Authorized User" means an individual granted credentials to access the Services by a healthcare organization customer or by Equipo, including but not limited to clinicians, care coordinators, administrative staff, and patients. "Business Partner" means an entity with which Equipo has a contractual relationship to provide, support, or integrate with the Services, including vendors, subcontractors, referral partners, and technology integration partners.

When Equipo provides technology services to healthcare organizations, hospitals, physician practices, Accountable Care Organizations (ACOs), Federally Qualified Health Centers (FQHCs), Managed Service Organizations (MSOs), payers, or other healthcare entities, Equipo may process PHI on behalf of those organizations in accordance with applicable BAAs and federal law.

2. Information We Collecty

Depending on how you access or use our Services — through our website, web application, or mobile application — Equipo may collect, receive, access, or otherwise process the following categories of information:

2.1 Personal and Professional Information

Name, mailing address, email address, telephone number, organization, job title, professional credentials, National Provider Identifier (NPI), user account information, authentication credentials, and other information necessary to establish, administer, and support your access to the Services.

2.2 Protected Health Information (PHI)

When providing Services to healthcare organizations, Equipo may receive, create, maintain, transmit, or process PHI on behalf of our customers in accordance with applicable BAAs and law. Such information may include patient identifiers (including Medical Record Number (MRN)), demographic information, insurance and eligibility information, appointments, diagnoses, problem lists, medications, allergies, immunizations, laboratory and diagnostic information, vital signs, care plans, assessments, referrals, clinical documentation, care coordination records, patient communications, billing-related information, and other health information necessary to provide the Services.

2.3 Technical and Usage Information (Web, Mobile, and Browser Extension)

We may automatically collect technical and usage information related to your interaction with the Services, including:

• IP address, browser type, and operating system
• Device identifiers, device type, and mobile carrier information (mobile application)
• Authentication records, session tokens, and browser local storage or similar client-side storage used to maintain your session
• Access times, application performance data, crash logs, and diagnostic data
• Audit trails and security logs, including login and access history
• Cookies and similar tracking technologies (web application and marketing website)
• Mobile application analytics and crash-reporting data collected through third-party software development kits (SDKs) embedded in the application
• Device permissions you grant to the mobile application (for example, camera, photo library, push notifications, or location, where applicable to a specific feature), and only the data associated with the permission you grant
• Approximate or precise geolocation, only where a specific feature requests it (for example, locating a nearby provider) and only with your permission
• Push notification tokens and delivery data, where you have enabled push notifications on the mobile application
• Biometric authentication signals (for example, use of Face ID, Touch ID, fingerprint, or WebAuthn/passkey login), where you elect to enable biometric login; Equipo does not receive or store the underlying biometric template, which is retained by your device's operating system
• Browser extension activity, limited to the specific web pages, fields, or workflows the extension is designed to read from or write to (for example, an EHR or provider portal page), as further described in Section 4.4
• Data transmitted from wearable devices or remote patient monitoring devices connected to the Services with authorization from a healthcare organization or authorized user, as further described in Section 17.2

2.4 Business and Communication Information

Information you voluntarily provide through our website, web application, customer support requests, product demonstrations, live chat, webinars, conferences, networking events, surveys, newsletters, marketing communications, event registrations, and other interactions with Equipo.

2.5 Information from Third-Party Sources

Where authorized by our customers or permitted by applicable law, we may receive information from healthcare organizations, EHR systems, health information exchanges, APIs, authorized third-party integrations, referral partners, customer administrators, or other authorized sources to facilitate the delivery of our Services.

Equipo collects, accesses, uses, and processes only the information reasonably necessary to provide, operate, maintain, secure, support, improve, and comply with our contractual, legal, regulatory, and operational obligations in connection with the Services.

3. How Information Is Collected

Information may be collected directly from users, healthcare organizations, EHR systems, authorized integrations, APIs, patient portals, provider portals, our web application, our mobile application, customer administrators, referral partners, healthcare staff, customer support interactions, uploaded documents, authorized third-party systems, and publicly available sources where permitted by law.

Certain technical information may be collected automatically through cookies, browser local storage, mobile SDKs, log files, analytics tools, and other technologies used to improve the functionality, performance, reliability, and security of our Services.

4. Cookies, Mobile SDKs, Browser Extensions, and Similar Technologies

4.1 Categories of Tracking Technologies

Our website and web application may use the following categories of cookies and similar technologies:

• Strictly necessary / session cookies — required for login, authentication, and core functionality; cannot be disabled without affecting your ability to use the Services
• Functional cookies — remember user preferences and settings
• Analytics cookies — help us understand usage patterns and improve the Services
• Security cookies — support fraud prevention, device recognition, and account security, including browser and device fingerprinting used to detect anomalous login activity

4.2 Mobile Application SDKs

Our mobile applications may incorporate third-party SDKs for functions such as crash reporting, performance monitoring, push notification delivery, and analytics. These SDKs may collect device identifiers, usage data, and diagnostic information as described in Section 2.3. Equipo requires that any such SDK provider process data only as necessary to provide its function and is consistent with this Privacy Policy and applicable law.

4.3 Advertising Technologies, Targeted Advertising, and Opt-Out Rights

Equipo does not sell Protected Health Information or personal information for monetary consideration. Where Equipo engages third-party service providers for analytics, communications, service delivery, or operational purposes, information is shared only as necessary to support the provision, maintenance, security, improvement, or lawful operation of the Services and subject to appropriate contractual and confidentiality obligations. Where applicable, Equipo will provide users with any required choices, preferences, or opt-out mechanisms regarding such data practices in accordance with applicable law and this Privacy Policy.

4.4 Browser Extensions and Plugins

Equipo offers one or more browser extensions or plugins (including, where applicable, a browser extension distributed through the Chrome Web Store) that allow authorized users to access Equipo functionality, such as care coordination prompts, documentation assistance, or data capture, directly within a third-party web application, EHR system, or web portal.

Consistent with Google's User Data Policy for Chrome Web Store items and comparable requirements of other browser stores, Equipo discloses the following regarding any such extension:

• The extension requests only the browser permissions and host permissions (that is, access to specific website domains) necessary to perform its disclosed function, such as reading or writing specific fields on an authorized EHR or portal page
• The extension may access page content, form field data, or clipboard content only where necessary to the feature you invoke, and only on the specific domains disclosed at installation or in the extension's Chrome Web Store listing
• Where the extension accesses PHI displayed within a third-party system (for example, an EHR), that PHI is handled subject to the same safeguards, BAA obligations, and use restrictions described elsewhere in this Privacy Policy
• If the extension accesses Google Workspace or other Google user data, Equipo's use of that data adheres to Google's Limited Use requirements: such data is used only to provide or improve the disclosed, user-facing features of the extension, is not used for advertising, and is not transferred to third parties except as necessary to provide the feature, to comply with law, or as part of a merger or acquisition as described in Section 9
• Equipo does not sell data collected through the extension and does not use it to train generalized (non-user-facing) AI or machine learning models except as permitted under Section 8.1

You may review and revoke the extension's permissions, or remove the extension entirely, at any time through your browser's extension management settings.

4.5 Your Choices and Opt-Out Rights

You may modify your browser settings to limit or disable certain cookies; doing so may affect the availability or functionality of portions of the web application. You may also disable specific device permissions (such as camera, location, or push notifications) for the mobile application at any time through your device's operating system settings, without affecting your ability to use core, non-permission-dependent features.

Where required by applicable law, Equipo will honor recognized opt-out preference signals, including the Global Privacy Control (GPC), with respect to the sale or sharing of personal information as those terms are defined under applicable state law.

5. How We Use Information

Equipo uses information to:

• Provide and maintain our Services across web and mobile access points
• Support patient engagement and care coordination
• Facilitate clinical, operational, and administrative workflows
• Enable chronic care management, population health management, referral management, and related healthcare programs
• Authenticate users and manage user accounts, including biometric or passkey-based login where enabled
• Respond to customer inquiries and provide technical support
• Improve system performance, functionality, usability, and security across web and mobile platforms
• Generate reports, analytics, and operational insights
• Detect, investigate, and prevent fraud, misuse, unauthorized access, or security incidents
• Deliver push notifications, in-app messages, email, or SMS communications you have consented to receive
• Communicate product updates, service notifications, educational materials, and marketing communications where permitted by law
• Train, validate, and improve artificial intelligence and machine learning features, subject to Section 8 below
• Comply with contractual obligations, legal requirements, court orders, regulatory requests, and applicable federal and state laws

Equipo does not sell personal information or PHI to third parties in exchange for monetary payment. Where applicable state law defines "sale" or "share" more broadly than a monetary exchange (for example, to include certain disclosures to advertising or analytics partners), Equipo will identify any such practices and provide the opt-out mechanisms described in Section 4.3.

6. Protected Health Information

Where applicable, Equipo processes PHI as a Business Associate on behalf of healthcare organizations and only as authorized by applicable BAAs, customer instructions, contractual obligations, and applicable law.

Equipo does not independently determine clinical treatment decisions and does not use PHI for purposes inconsistent with applicable agreements or legal requirements.

Patients seeking information regarding the use or disclosure of their medical information should contact their healthcare provider or healthcare organization directly.

7. Consumer Health Data (Non-HIPAA)

Certain state laws — including but not limited to Washington's My Health My Data Act and comparable laws in other states — regulate "consumer health data" collected outside the traditional HIPAA framework, such as wellness information, health-related search or usage activity, or location data collected through our website or web application from individuals not otherwise covered by a BAA (for example, prospective customers or website visitors researching health topics).

Where such laws apply, Equipo will not use precise geolocation to identify a consumer's attempt to access health care services, will not use geofencing around healthcare facilities for advertising purposes, and will obtain any consent required before collecting or sharing consumer health data outside the scope of a BAA.

8. Artificial Intelligence and Analytics

Certain Services, including those offered through Foresight, may include artificial intelligence, predictive analytics, automation, clinical decision support, workflow recommendations, population health analytics, risk stratification, documentation assistance, or similar capabilities, accessible through both the web application and mobile application.

These tools are intended solely to assist authorized users in clinical or operational decision-making. AI-generated information is advisory in nature and should not be considered medical advice, a diagnosis, treatment recommendation, or a substitute for independent professional judgment. Healthcare providers remain solely responsible for patient care, clinical decisions, and compliance with applicable laws and professional standards.

8.1 Use of Data for AI Model Training

Equipo does not use PHI to train, fine-tune, or improve artificial intelligence or machine learning models except where such use is (a) expressly authorized by the applicable customer's BAA or written agreement, (b) limited to de-identified or aggregated data consistent with the HIPAA de-identification standard, or (c) otherwise required or permitted by law. Customers may contact Equipo to determine whether and how their data is used in connection with AI model development.

9. Disclosure of Information

Equipo may disclose information:

• To healthcare organizations and authorized users utilizing our Services
• To service providers, contractors, and vendors performing services on our behalf under appropriate contractual obligations, including Business Associate Agreements where PHI is involved
• To third-party integrations authorized by our customers or users
• To governmental authorities or regulators when required by applicable law
• To comply with legal process, court orders, subpoenas, or regulatory requirements
• To protect the rights, safety, security, property, or operations of Equipo, our customers, users, or others
• In connection with a merger, acquisition, financing, reorganization, or sale of assets; any successor entity will remain bound by applicable BAAs and this Privacy Policy with respect to previously collected PHI and personal information, subject to applicable legal obligations

Equipo does not disclose personal information except as described in this Privacy Policy, authorized by our customers, required by law, or otherwise permitted under applicable federal and state law.

10. Security

Equipo maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, misuse, or destruction. These safeguards may include encryption in transit and at rest, access controls, multi-factor and biometric authentication options, audit logging, monitoring, backups, secure development practices, employee training, and vendor oversight.

Access to information is limited to authorized personnel and authorized users with a legitimate business or operational need.

Although Equipo maintains reasonable safeguards consistent with industry practices, no method of electronic transmission, storage, or information security can be guaranteed to be completely secure. Accordingly, Equipo does not warrant or guarantee that unauthorized access, cyber incidents, or security breaches will never occur.

11. Security Incident and Breach Notification

In the event Equipo discovers a breach of unsecured PHI, Equipo will notify affected customers without unreasonable delay and in accordance with the timelines and requirements of the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400-414) and the terms of the applicable Business Associate Agreement. Equipo's customers, as Covered Entities, remain responsible for any required notification to affected individuals and regulators unless otherwise agreed in writing.

For security incidents affecting personal information outside the scope of PHI (for example, web application or mobile application account credentials), Equipo will provide notification to affected individuals and, where required, state regulators, in accordance with applicable state breach notification laws.

12. Data Retention

Equipo retains information for as long as necessary to provide our Services, fulfill contractual obligations, comply with applicable laws, resolve disputes, enforce agreements, maintain security, or satisfy regulatory and record retention requirements.

Upon expiration of applicable retention periods, information may be securely deleted, archived, de-identified, or anonymized in accordance with legal, contractual, and operational requirements.

13. Third-Party Services

Our Services may contain links to, integrate with, or interoperate with third-party websites, applications, platforms, EHR systems, communication services, cloud providers, analytics providers, or other technologies that are not owned or controlled by Equipo.

Equipo is not responsible for the privacy, security, availability, content, or practices of third-party services. Users should review the applicable privacy policies and terms of those third parties before providing information or using their services.

14. Children's Privacy

Our public website and marketing materials are not directed toward children under the age of thirteen (13), and Equipo does not knowingly collect personal information directly from children through our public website.

Where the Services are used within a healthcare organization's pediatric care programs, information regarding minors may be collected, used, and disclosed by Equipo solely on behalf of, and as authorized by, the healthcare organization and the minor's parent, guardian, or authorized representative, consistent with HIPAA, applicable state minor-consent laws, and the organization's own policies. Parents or guardians with questions about a minor's information collected through the Services should contact the applicable healthcare organization directly.

15. Your Choices and Privacy Rights

15.1 Marketing Communications

You may discontinue marketing communications by using the unsubscribe instructions included in those communications or by contacting Equipo directly. Operational, security, contractual, administrative, product support, and legally required communications may continue to be sent as necessary to provide the Services or comply with applicable obligations.

15.2 Mobile Notifications

You may enable or disable push notifications for the mobile application at any time in your device settings or within the application's notification preferences.

15.3 State Privacy Law Rights

If you are a resident of a state with a comprehensive consumer privacy law (including, where applicable, California, Colorado, Connecticut, Virginia, Utah, and other states with similar laws), you may have the right, with respect to personal information not otherwise governed by HIPAA, to:

• Request access to the personal information Equipo has collected about you
• Request correction of inaccurate personal information
• Request deletion of your personal information
• Request a portable copy of your personal information
• Opt out of the sale or sharing of personal information, and of targeted advertising, where applicable
• Appeal a denial of a request through the process identified in Equipo's response

These rights generally do not apply to PHI processed by Equipo as a Business Associate, which is governed by HIPAA and the applicable BAA. To exercise a right described in this section, contact Equipo using the information in Section 20. Equipo will verify your identity before responding and will respond within the timeframe required by applicable law.

15.4 Account and Data Deletion (Web and Mobile Application)

Authorized users with a login account for the web application or mobile application may request deletion of their account and associated non-PHI account data by submitting a request through account settings, where available, or by contacting Equipo directly. Requests concerning PHI maintained on behalf of a healthcare organization should be directed to the applicable healthcare provider or organization, as Equipo may not unilaterally delete PHI it maintains as a Business Associate without customer authorization.

16. International Users and Cross-Border Data Transfers

The Services are designed primarily for use within the United States. If Equipo processes personal information of individuals located outside the United States, including the European Economic Area, United Kingdom, or Switzerland, Equipo will implement appropriate safeguards for cross-border data transfers, such as Standard Contractual Clauses, and will provide additional disclosures regarding legal basis for processing and applicable rights upon request. Organizations seeking to use the Services outside the United States should contact Equipo in advance to confirm availability and applicable data protection commitments.

17. Mobile Application Permissions and Connected Device Summary

17.1 Mobile Application Permissions

The table below summarizes categories of device permissions the mobile application may request, depending on which features you use. Equipo requests each permission only at the time a relevant feature is used and only collects the associated data with your consent through your device's permission dialog.

17.2 Wearable Devices and Remote Patient Monitoring

Where a healthcare organization or authorized user enables integration with a wearable device, remote patient monitoring device, or similar connected health technology, Equipo may receive data transmitted from that device, which may include biometric readings, vital signs, activity data, device identifiers, and timestam

Such data is received and processed by Equipo as a Business Associate on behalf of the applicable healthcare organization, subject to the same PHI safeguards, use restrictions, and BAA obligations described in Sections 6 and 10. Equipo does not independently control the data practices of the wearable device manufacturer or its companion application; you should review the privacy policy provided by the device manufacturer for information about how the device itself collects and transmits data before it reaches the Services.

You, or the healthcare organization managing your care, may disconnect a wearable or connected device from the Services at any time, which will stop future data transmission but will not delete data already received, subject to Section 12 (Data Retention).

18. Future Services, Channels, and Technologies

Equipo may, from time to time, introduce new products, features, access channels, or technologies not specifically enumerated in this Privacy Policy — including but not limited to new browser extensions, additional wearable or Internet of Things (IoT) device integrations, voice or conversational interfaces, kiosk or in-office check-in devices, SMS or messaging-based channels, or other emerging technologies (each, a "New Channel").

Any New Channel that references or incorporates this Privacy Policy will be governed by its terms to the extent applicable. Where a New Channel collects categories of information materially different from those described in this Privacy Policy, or introduces materially different data practices, Equipo will update this Privacy Policy prior to or concurrent with the launch of that New Channel and will provide notice consistent with Section 19 below. Equipo will not use PHI or personal information in connection with a New Channel in a manner inconsistent with the purposes and restrictions described in this Privacy Policy, applicable Business Associate Agreements, and applicable law.

19. Changes to This Privacy Policy

Equipo may revise this Privacy Policy from time to time to reflect changes in our Services, legal requirements, industry practices, or business operations. Updated versions will be posted on our website and within each applicable access channel, including the web application, mobile application, browser extension listing, and any wearable or connected device integration page, with a revised effective date. For material changes affecting how PHI or personal information is used, Equipo will provide additional notice as required by applicable law, which may include an in-app or in-extension notification, or email to registered users. Continued use of the Services after such updates constitutes acceptance of the revised Privacy Policy to the extent permitted by applicable law.

20. Contact Us

If you have questions regarding this Privacy Policy or our privacy practices, or wish to exercise a right described above, please contact:

Equipo Health

Email: info@equipohealth.com