We process your IP address to determine your rough location so that we can personalize the platform for you.

We also utilize your rough location to improve your user experience when using our platform. For example, we auto-populate your state (if applicable) and country when you are completing our onboarding questionnaire.

We do not request or process exact location information such as information provided by your phone via GPS.

We process your address information when you provide it as part of your emergency contact information when you start consultations on the Platform. Your contact information is required to comply with medical regulations and ethical codes. It can be used, for example, in case your Doctor believes you are in immediate danger. When you are filing out this field, we may process your rough location to provide autocomplete suggestions for your convenience.

Rough location using your IP address is also processed by the ReCAPTCHA security API tool we use. ReCAPTCHA is a Service Provider we use to identify potentially malicious actors trying to access our site

We use Artificial Intelligence (AI) and Natural Language Understanding (NLU) algorithms to support and develop features to provide you with services and improve the quality of the services. Our processing of data may include some automated and some human (or manual) methods of processing. The automated processing typically includes features aimed at completing manual, repetitive tasks more efficiently. We expect these improvements to ultimately improve our services and experiences for Users and Doctors. To help ensure these tools remain fair and accurate, as well as protect the privacy of our Users and Doctors, we either thoroughly review a model or build it internally and, unless you agree otherwise, do not use any Medical Data, such as sessions data, journal entries, messages, worksheets, or any other type of private communication you have with your Doctor in a session to train an AI or NLU model.

Here's some more information about the purposes for which we share your data: Your data may be shared to comply with applicable laws. For example, a court might subpoena information from us where we would be required to share certain information requested in the subpoena. This is not unique to AskADoc and is applicable to in-person consultations as well. Keep in mind that, as a general rule, we defer to your Doctor to decide to produce (or not produce) any consultation notes or messages you have had with them. Many jurisdictions have strict rules governing Doctor/client relationships and the confidentiality requirements associated with that. We encourage you to discuss with your Doctor early on if you have concerns about their disclosure obligations
Occasionally, your data may be handled by a select number of employees who are part of our company for support services. These employees are under strict duties of confidentiality. We may share certain data with Service Providers that provide limited services that help us operate the Platform. Examples include:

• Data hosting and storage providers,
• Technology Service Providers: For example, we sometimes integrate tools into our Platform, which give our Platform more functionality, like technology that helps us provide live audio, video and group meetings.
• Customer Service Providers: For example, we use a tool that helps keep track of requests and questions from our Users, visitors and Doctors in a secure way. Email management and communication Service Providers.
• Email management and communication Service Providers: For example, we may use a tool that makes reaching out to you easier for us and more convenient for you.
• Marketing and advertising Service Providers: For example, we may partner with an agency to run a marketing campaign or to help us better understand how to run our own campaigns to reach more people who may be interested in using our platform.

Remember that Service Providers can only legally use data at our direction - no other person or company can authorize how they use it and they cannot disclose data that is individually identifiable to any other person or company, other than to us or the Service Providers' own subcontractors provided that they're bound to data Processing terms that are no less restrictive than the Service Provider's terms.

• Billing and payment processing Service Providers
• Reporting and analytics Service Providers: For example, we might use a service to help us keep track of which pages and features are most used on our site.
• Advisors and lawyers: To assist with business matters.

We may share some of your data with Service Providers to ensure the safety and security of the Platform and that of our users.

If you're a Doctor on our Platform or being recruited to join us, in addition to the above, we may share certain data with Doctor recruiters in order to facilitate, monitor, and track the recruitment process. If you are a Doctor on our Platform, we may also share certain data such as information you volunteer in or through the Platform, including, but not limited to, your name, photograph, information about your credentials, experience, specialities and qualifications. We may also share this information with vendors that accredit/certify our doctor credentialing processes and otherwise help us streamline the credentialing process.

We may share some of your data in connection with an asset sale, merger or bankruptcy.

Note that if you make any information publicly available on the Platform, such as with a public post, anyone may see and use such information.

If you opt in to "Performance cookies", we may use analytics cookies and other tracking technologies to share your data with trusted Service Providers that assist us in processing data for activities, including but not limited to analysing traffic sources, visits, and site interactions. This analysis helps us to improve our products and services.

If you opt in to "Targeting cookies", information regarding your activity on our websites, excluding activity when you're logged in and have started consultation, may be shared for advertising purposes. For more information about your specific settings, see here. To learn more, see section: "Are you using my data for advertising?"

How do you use my data to comply with the law? When required by law, we cooperate with government agencies. This is not unique to AskADoc and is applicable to in-person consultations as well. For example, a court might subpoena information from us where we would be required to share certain information requested in the subpoena. Keep in mind that, as a general rule, we defer to your chosen Doctor to decide to produce (or not produce) any consultation notes or messages you have had with them. Many jurisdictions have strict rules governing Doctor/client relationships and the confidentiality requirements associated with that. We encourage you to discuss with your Doctors early on if you have concerns about their disclosure obligations.

You should also be aware that Doctors may be obliged to disclose information to authorities to meet professional and legal responsibilities. Specifically, some laws require healthcare professionals to disclose information and/or take action for: (a) reported or suspected abuse; (b) serious suicidal potential; (c) threatened harm; and (d) court-ordered treatment. You should speak with your Doctor if you have concerns about this.

We aren't paid by anyone for any data. However, in California, the laws define "sale" broadly to include the sharing of personal information in exchange for anything of value. If you opt in to our use of Advertising cookies and web beacons, this use may be considered a "sale" of personal information under that specific California law. For specific information on your data rights as a resident of California, see the additional notice for California residents

In order to reach people who may be looking for healthcare services, we advertise on some third-party web properties, such as third-party websites and apps. In order to minimise advertising costs related to this process and downstream costs to you, we strive to deliver ads that are relevant, interesting, and personal.

Therefore, if you opt in to Advertising cookies and web beacons, some Visitor Data, excluding activity when you're logged in and have started consultation, may be shared for advertising purposes. As a result, you may see ads for our services on some third-party websites.

To be clear, we don't share any data or information you share with your Doctors with any third-party advertisers. Even if you opt in to Advertising cookies and web beacons, we still don't share information with third-party advertisers like User names, phone numbers, clinician diagnosis, questionnaire answers, sessions data, journal entries, messages, worksheets, or any other type of private communication you have with your Doctors on the Platform.

As described further above at Data Sharing, we may also partner with some Service Providers to assist in marketing campaigns. Remember that in addition to needing a series of rigorous security standards (as further detailed here), Service Providers can only legally use data at our direction - no other person or company can authorize how they use it and they cannot disclose data that is individually identifiable to any other person or company, other than to us or the Service Providers' subcontractors provided that they're bound to data Processing terms that are no less restrictive than the Service Provider's terms.

AskADoc is committed to ensuring that all applicable User data is retained only for the amount of time required to provide relevant products and services and in accordance with relevant legal requirements.

Certain categories of data are retained for a period of time after you cancel your Membership or your Membership becomes inactive. These categories of data are retained to allow for a seamless reactivation in the event you begin using our services again, and allow Doctors to reference historical information. Retaining this data is also needed to ensure our products and services function.

In addition to the data retention schedule outlined below, AskADoc maintains a process for all Users (regardless of where they live) to receive and process, without undue delay, requests to erase or access their data.

The following sections describe both how long a User can expect their data to be retained with respect to specific account information, as well as how to request data erasure and access. In this Policy, data erasure is defined as the permanent removal or obfuscation of identifiable data (See "What is this Privacy Policy") so that it is no longer accessible by anyone.

AskADoc’s data retention policies are based upon what data is being processed, whether or not the User has participated in consultations, and if the User proactively requested data erasure or if the erasure is triggered due to Platform inactivity

As stated, you have certain rights under data protection laws, including the right to request that we erase personal data we hold about you, and the right to request a copy of it. The following sections describe how you can exercise those rights.

To request data erasure, please log in to your account and go to Menu > My Account (or Account Settings) > My Personal Information, where you will see a link to request complete erasure of your account. Click that and follow the instructions to begin the data erasure process.

If you do not have access to your account or are having trouble with this method, you can directly contact support@askadoc.org, and they will assist you with the process. Additionally, if, under applicable data protection laws, you have the right to request that data we hold about you be edited or rectified, you may make this request by contacting User Success. You can expect to receive an email confirming receipt of your request within 24 hours.

Additionally, you can visit our opt-out instructions page to request erasure or to opt out of previous settings you have opted into. You may reach out to us at support@askadoc.org if you need additional help. We will only comply with a request for the erasure of your data if we can verify your identity. There is usually no charge. In exceptional circumstances, we may charge a reasonable fee after discussing the fee with you.

If you reach out to support@askadoc.com, we have specific requirements that must be met in order for us to process your data erasure request.

Requirements:

• Only you or your authorized representative may make a request on your behalf. You may also make a request on behalf of your minor child, depending on the applicable laws.
• You must provide sufficient information that allows us to reasonably verify your identity or status as an authorized representative.
• You must provide details that allow us to understand, evaluate, and respond to your request.

In some circumstances, legal or regulatory requirements limit our ability to honor erasure requests. As such, we may decline requests for erasure if the information is:

• Subject to a litigation hold or legal request to preserve it.
• Necessary to comply with laws and regulations and to maintain business integrity.
• Clinical Health Record (described above) falls under this exemption.

Additionally, compliance obligations require us to retain records documenting certain interactions you have with us related to your Membership. As such, we cannot honor erasure requests for information contained in records of:

• Communications about complaints and erasure or access requests.
• Disclosures of personal data to Third Parties.

If we don't intend to comply with a request, then we will tell you why this is the case, and outline how we weighed your rights and freedoms against our legal obligations. In such instances, any information retained will only be used for purposes contemplated under the legally recognized exemption.

To receive a summary copy of your data, please log in to your account and go to Menu > My Account (or Account settings) > My Personal information, where you will see an option to request a copy of your data. The data you will receive as part of this request includes the contact information that you input on the site, questionnaire answers, worksheet entries, emergency contact information, messages you sent to your Doctor, journal entries that you created, and other personal information.

Additional data which we maintain includes email interactions with our help desk, which is stored on your email system. You may also request this information by writing to support@askadoc.org. As with data erasure, we are not always able to respect your request for data access. For more information on why this may be and how the situation will be handled, please reference the previous section.

We apply industry standards and strive to apply best practices to prevent any unauthorized access and disclosure. Internet-based services carry inherent security risks, but our systems infrastructure, encryption technology, operation and processes are all designed, built, and maintained with your security and privacy in mind.

For your own security, keep the following in mind:

• Phishing: This is a type of online identity theft or account hacking. We will never request your login information or credit card information in any non-secure or unsolicited communication. You should always be diligent when you are asked to provide your account information and make sure it is in our secure system.
• External links: Our Platform may contain links to an external website or service. We do not control external websites, and do not have control over their privacy policies and terms of use. The fact that we link to a website is not an endorsement, authorization, or representation of our affiliation with that external party or of their privacy and security policies or practices.

You and your Doctor are able to see the messages you send. We may review correspondence with your Doctor for quality assurance purposes. For example, if you raise a concern about your Doctor, or if we have concerns about a specific Doctor's clinical care.

In addition, our internal Trust and Safety or Legal teams may review correspondence for specific accounts if we have a reason to believe that there is a security, legal, or fraud issue occurring with that specific account.

Messages with your Doctor are not shared with any Third Party, and your live sessions are not recorded, unless you expressly consent. We also do not share when you send a message, or have a session with your Doctor, with any Third Party.

We don't knowingly collect or solicit any data or information from anyone under the age of thirteen (13) or knowingly allow such persons to become our users. The Platform is not directed at and not intended to be used by children under the age of thirteen (13). If you're aware that we have collected personal information from a child under age thirteen (13), please let us know by contacting us, and we'll delete that information.

A "cookie" is a small data file that is accessible within a folder on a computer, and it is used for record-keeping purposes. Cookies are used to enhance the performance of the Platform, personalize your experience and can be used for Third Party tracking (as described above). For example, cookies may be used to help you quickly log into certain platforms and websites without having to enter your credentials every time.

A "web beacon" or "pixel" is a tiny and sometimes invisible image or embedded code, placed on a web page or email that can report your visit or use to a Third Party (as described above). In general, these tools can be used to monitor the activity of users for the purpose of web analytics, advertising optimization, or page tagging.

We use our own cookies and web beacons to deliver a faster and safer experience, to monitor and analyze usage, to comply with laws, and for advertising purposes.

Please visit our opt-out instructions page to opt out of tracking via cookies or web beacons, or for instructions on how to remove previously set cookies.

You can always opt out of receiving marketing emails. In order to opt out, you can select the unsubscribe link located at the bottom of the relevant email communication.

This Privacy Notice for California Residents supplements the Privacy Policy to comply with the California Consumer Privacy Act of 2018 ("CCPA") and the California Privacy Rights Act ("CPRA") of 2020.

The CCPA and the CPRA are California laws that provide its residents with certain rights over information about them, including notice about the categories of personal information we have collected from them in the preceding twelve (12) months and the purposes for which the information is used or disclosed, and correction of personal information.

The following Sections outline the data that is processed by us, as well as the purpose for collection, and the categories of sources of such information:

• What specific data are you processing?
• Do you process location data?
• Why do you collect and process my data?
• What are you using cookies and web beacons for?

The data referenced at those links may fall in certain defined categories under the CCPA and CPRA.

Accordingly, we may have collected:

• Identifiers;
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e));
• Protected classification characteristics under California or federal law;
• Commercial information;
• Biometric information;
• Internet or other similar network activity;
• Geolocation data;
• Sensory data;
• Sensitive Personal Information;
• Professional or employment-related information; and
• Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

The information that we have disclosed in the past 12 months and the recipients of the information are described above, in the section titled "What are the purposes for sharing my data?" The information that we may have shared in the past 12 months falls into the following personal information categories under the CCPA and CPRA:

• Identifiers;
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e));
• Protected classification characteristics under California or federal law;
• Commercial information;
• Internet or other similar network activity;
• Geolocation data;
• Sensory data;
• Sensitive Personal Information;
• Professional or employment-related information; and
• Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

The information that we have disclosed in the past 12 months and the recipients of the information are described above, in the section titled "What are the purposes for sharing my data?" The information that we may have shared in the past 12 months falls into the following personal information categories under the CCPA and CPRA:

• Identifiers;
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e));
• Protected classification characteristics under California or federal law;
• Commercial information;
• Internet or other similar network activity;
• Geolocation data;
• Sensory data;
• Sensitive Personal Information;
• Professional or employment-related information; and
• Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

As noted in the Section titled "Do you sell my data?", our "sale" of information (including sale of information about consumers under the age of 16) consists of the disclosure of your information for targeted advertising purposes, and we aren't paid by any external or Third Party for any data. The information that we may have “sold” (for purposes of the CCPA and CPRA) in the past 12 months falls into the following personal information categories under the CCPA and CPRA:

• Identifiers;
• Commercial information; and
• Internet or other similar network activity;

Yes, as a California resident, you can request certain information about what we have processed over the past 12 months. Once we receive and verify your consumer request, we can provide:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of Third Parties with whom we shared that personal information.
• The specific pieces of personal information we collected about you.
• Whether we disclosed your personal information for a business purpose and the personal information categories that each category of recipient obtained.

You also have the right to request that we correct personal information about you if it is found to be inaccurate. To make such a request, please send an email to support@askadoc.org

Yes, you can request that we delete your data as described in the section of this Policy called: "How long do you retain my data and how do I request data erasure?" Once your request is received and verified by matching the information you provide with information that we maintain about you or via biometrics, we'll move forward with the Process of deleting your information in line with our legal requirements and Retention Policy. We cannot fulfill a deletion request and need to retain your information if the data is necessary to:

• Provide you services, take actions reasonably anticipated within the context of our ongoing business relationship, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with applicable laws, including but not limited to, the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.) and information covered by the California Confidentiality of Medical Information Act.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

As noted above, you do not need to opt in to the “sale” of personal information about you by withdrawing your consent to accept cookies used for advertising here. Our websites are also designed to implement a do-not-sell privacy preference.

California's “Shine the Light” law (Civil Code Section § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to Third Parties for direct marketing purposes. To make such a request, please send an email to support@askadoc.org

General Data Protection Regulation (GDPR) and UK General Data Protection Regulation Notice. This section provides additional information about our Policy relevant to you if you are from the European Economic Area (the EEA), the United Kingdom, and Switzerland (together “European Area Countries”). It supplements and should be read in conjunction with the rest of the Policy. Under the European Area Countries' privacy laws, we are the Controller with respect to your data.

European Area Country residents have specific rights regarding their data. This section describes your rights if you are resident in the European Area Countries and explains how to exercise those rights.

• Right to rectification: If the data we hold about you is inaccurate, you may request rectification. The data will be checked, and, where appropriate, inaccuracies will be rectified. Exercise this right by emailing support@askadoc.org and they will assist you with the process.
• Right to erasure: In certain circumstances, you may be entitled to ask us to erase your data.
• Right to data portability: In certain circumstances, you may wish to move, copy, or transfer the electronic data that we hold about you to another organization
• Right to object: You may object to your data being used for direct marketing. You may object to the continued use of your data in any circumstances where we rely upon consent as the legal basis for processing it. Where we rely upon legitimate interests as the legal basis for processing your data, you may object to us continuing to process your data, but you must give us specific reasons for objecting. We will consider the reasons you provide, but if we consider that there are compelling legitimate grounds for us to continue to process your data, we may continue to do so. In that event, we will let you know the reasons for our decision. In some instances, objecting to certain Processing may impact our ability to provide you with services.
• Rights related to automated decision-making, including profiling: We use limited data to operate the Platform and to carry out certain profiling activities to support and grow our business. When doing so, we rely upon our legitimate interests as the lawful basis for processing your data, and you may exercise the above rights if you do not wish us to process your data in this way.

To exercise the rights in relation to your data set out in this section, please contact us at support@askadoc.org

We transfer data from the EU to the U.S because our servers are located in the US. This transfer is conducted on a legal basis to ensure the protection of your data and compliance with applicable data protection laws. The legal basis for this transfer is the EU-U.S. Data Privacy Framework (DPF), which has been recognized by the European Commission as providing adequate protection for personal data transferred to participating US companies. Our company is certified under this framework, ensuring that your personal data is subject to rigorous protection standards when transferred to and processed in the US.

Additionally, we may transfer your data to organizations based in countries that have not been granted an adequacy decision under the General Data Protection Regulation. Where data is transferred to such countries, we shall ensure that appropriate safeguards are used to do that (such as by using standard contractual clauses with those vendors) or specific derogations have been established (for example where the data transfer is necessary in order to fulfill a contract between us and yourself, where we have received your specific consent after having made you aware of any risks involved, etc).

You can contact our Data Protection Officer with questions about this Policy, or about your data by writing to: support@askadoc.org

While we'll always work with you to resolve any concerns you have about the use of your data, under GDPR you have the right to lodge a complaint with the supervisory authority in your country of residence if you have any concerns about our use of your personal information.

As a part of our standard business practices, data is transferred outside of many visitors' countries of residence and predominantly used, accessed and processed within the U.S. Fortunately, given the robust and rigorous nature of privacy laws in the US, UK, and EU with which we comply, AskADoc considers that this has the effect of protecting user information in a way that, overall, is at least substantially similar or in many ways exceeds non-US data privacy legal requirements. AskADoc is certified under the EU-U.S. Data Privacy Framework (DPF), which has been recognized by the European Commission as providing adequate protection for personal data transferred to participating US companies. To the extent we contract with vendors who are outside of the U.S, we ensure that specific safeguards have been established to protect that data.

Please note that under certain circumstances, we may be required to disclose your Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.