Apollo Neuro Privacy Policy

Effective Date: 1-27-2022

This Policy describes the collection, use and disclosure of personal information by Apollo Neuroscience, Inc. (“we,” “us,” “our”) when you access our Website or download, install or use our software, including the firmware on any of our devices, any Apollo applications (or apps), and all updates and upgrades thereto (our “Software”) or the Apollo Neuro wearable (our “Services”). A summary is provided below. You can learn more about each category by clicking on the links, or you can view the entire policy by clicking here: https://help.apolloneuro.com/hc/en-us/sections/360008390493-Policies-terms-and-warranty.

This Policy, together with the Terms of Use for our Website and the End User License Agreement (“EULA”) for the Software are an agreement between you and us (our “Agreement”). By accessing our Website or downloading, installing or using the Software or Services you agree to the Agreement.

Privacy Summary

Personal Information We Collect

Based on your agreement of this Policy, the Terms of use for our Website and the End User License Agreement (“EULA”) for the software, we collect:

• Personal contact information: name, address, IP address and email
• Information about the Services that you use
• Physiological data
• Your browsing history, search history, use history and other interaction with our Website,
• Software and Services
• Profile information you provide to us about you and your preferences and goals in using our Services

How We Collect Information about You

• Directly from you when you purchase our Services or email with us
• Indirectly by observing your actions on our Website, social media pages, how you interact with our Software and Apollo Neuro wearable and which of our emails you engage with
• From your interactions with our sites on social media such as Facebook
• From the Apple HealthKit and business partners

How We Use Your Information

• To provide the Services to you
• To communicate with you, unless you opt out
• To personalize your Website experience
• To further test, develop and improve the Services
• To respond to authorized law enforcement requests

How We Share Your Information

• We provide certain Personal Information to business partners that we engage to assist us in providing and marketing our Services. We do not use or share any personal physiological data for advertising purposes.

How We Protect Your Information

• Your Personal Information is transmitted and stored on our servers using industry standard security technologies

Your Rights; Privacy Tools and Controls

• We will delete your Personal Information at your request
• We will provide you with a copy of your Personal Information that we maintain at your request
• You can decide what information to provide to us to personalize your experience

Cookies and Tracking

• We use Google Analytics, pixel tracking and cookies to track your use of our Website; more information about these common technologies is given below
• We obtain information about your browsing history on social media sites where we have a presence

Third Party Sites

• You can access our Services through sites that we do not operate or control, including, but not necessarily limited to the Apple AppStore, Google Play, Facebook
• We also use third parties such as Amazon Web Services and DataDog to provide the Services.
• These third party sites have their own privacy policies, and we encourage you to consult their policies before using the Services or accessing or using the third party services

Privacy Policy Details

Personal Information We Collect

We collect information that can be identified with you either directly or indirectly (“Personal Information”) in a variety of ways, including the following:

While using our Services, we may ask you to provide us with certain Personal Information that we can use to contact or identify you. This information may include, but is not limited to, your name, your email address, telephone number and physical address. You of course are not obligated to provide any of this information, but many of our Services cannot be provided without it. If you choose to provide it to us while you are using the Services we will also collect certain demographic and physiological and biometric information such as your birth date or age range, gender, height and weight, other physical characteristics you wish to share with us, as well as your level of education and income range. An example of the biometric information we collect, if you choose to provide it to us, is accelerometry data based on your use of the wearable device.

When you open an account with us you will also be asked to create a username and password, which helps us secure your Personal Information and gives you unique access to your account. We use a third party to process your payment information. See below under “Third Parties” for information about their and other third parties’ privacy policies.

We collect information that your browser and our Software send whenever you use our Services. This may include information such as your mobile or other computer device’s brand, model number and operating system, your device’s Internet Protocol (“IP”) address, browser type, browser version, the pages of our Website that you visit, the time and date of your visit, the time spent on those pages and other statistics, the time and settings during which you are using your Apollo Neuro and feedback we receive either directly from you or from the Software. Some of this information is sent from Cookies, which are explained in more detail below.

How We Collect Your Information

We collect information about you, including your Personal Information, in a variety of ways, including, but not necessarily limited to the following.

We collect your information directly when you purchase the Apollo Neuro device, create an account, download the Software, engage with and use the Software or send us an email or other communication. For a better experience, while using our Service, we also give you the option to provide us with certain demographic and physiological information, such as your age, gender, height and weight.

We also collect information about you indirectly from business partners we engage to assist us in providing the Services to you and in communicating with you. If you access our Services through a third party site (such as Facebook) we will also receive information about you and your interactions with the site from that third party. Some of our current business partners are listed here: https://help.apolloneuro.com/hc/en-us/articles/4406213840663. This list will be updated from time to time; we encourage you to consult it on a regular basis. For further information about third party sites that we access and use, see below under the heading “Third Party Sites.”

We collect information from your browser, computer, or mobile device, which provide us with technical information when you access or use the Services. This technical information includes, for example, your device and network information, IP addresses, browser type, internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and number of clicks. information collected by cookies, pixel tracking, log files and Google Analytics. For more information about these technologies, see below under “Cookies and Tracking.”

How We Use Your Personal Information

To Provide the Services to You

We use your Personal Information to provide the Services to you and to fulfill or meet the reasons for which you provide the information to us. Using your Personal Information we can also personalize your experience with our Website and Software and deliver content and product and service offerings relevant to your interests and goals.

To Communicate with You

Your Personal Information allows us to process your requests, purchases, transactions, and payments. It also allows us to provide you with support, to respond to your inquiries, to investigate and address your concerns and to monitor and improve our responses to you. We also use your Personal Information to provide targeted offers and ads through our Website, third-party sites, social media, and via email or text message (with your consent, where required by law).

For Safety, Security and Integrity of the Services

Your Personal Information, including such elements as your username and password, enables us to secure your account with us and prevent transactional fraud. This includes maintaining the safety, security, and integrity of our Services, databases and other technology assets. We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.

For Research, Testing and Product Development

Information about your use of our Services, some of which is Personal Information, allows us to engage in testing, research, analysis, and product development, including to develop and improve our Website, Software, products, and Services.

To Comply with Our Legal Obligations

We use your Personal Information, as necessary, to comply with applicable laws and regulations. These may include, depending on where you reside or the information provided, the General Data Protection Regulations of the European Union and United Kingdom (“GDPR”), the California Consumer Privacy Act (“CCPA”)and FDA guidelines and regulatory requirements. We use your Personal Information consistently with those requirements and for the purpose of fulfilling them to the extent your Personal Information is necessary for their fulfillment.

We also use your Personal Information to respond to and comply with your requests and instructions regarding your Personal Information, including for example requests to delete or to correct your Personal Information. For more information about your rights please see below under the heading “Your Rights; Privacy Tools and Controls.”

We do not knowingly collect personally identifiable information from children under 13 and use the Personal Information you provide to verify that you are 13 years of age or older. If we discover that a child under 13 has provided us with personal information, we will immediately delete this from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we will be able to delete it.

We also use information, including as required your Personal Information, to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
How We Share your Personal Information

We permit our business partners to store the information we provide them or what they collect directly from you in order to deliver or support our services and communication to you. As examples, we have business partners who process your payments, others who provide customer service and others who facilitate our communications with you.

We also provide certain Personal Information to business partners that we engage to assist us in
marketing our Services. Providing Personal Information to these business partners may be
considered a sale of Personal Information for purposes of California law. If you wish to opt out
of sales of your Personal Information see below under the heading of “Exercising your Rights to Opt-Out, Know or Delete”.

How we Protect your Personal Information

Our information about you is stored initially on our servers, and longer term on “cloud” facilities provided by our business partners. Our services are located in the United States and designed to comply with industry standard guidelines for security. Those of our cloud service providers may be located in the United States or elsewhere. The laws of the United States or of other jurisdictions from which our business partners provide their services may not be as protective of your Personal Information as those of your jurisdiction. Our software development, testing, and review processes have also been established to meet FDA and other regulatory requirements, as applicable.

Our business partners may also store the information we provide them, or that they collect directly from you. We only engage business partners who agree to take reasonable steps to protect your information, but we cannot directly control their processes and procedures. For information about the steps they take we encourage you to consult their individual privacy policies, which you can find on the websites listed at https://help.apolloneuro.com/hc/en-us/articles/4406213840663.

Although we exercise commercially reasonable steps to protect your Personal information, our Services rely on public networks including the Internet and third-party service providers who operate those networks. These networks and services involve inherent security risks which are common to most Internet-based applications, but out of our control to prevent. You should consider these risks before using our Services.

Your Rights; Privacy Tools and Controls

Under the laws of many countries and jurisdictions, including California, the United Kingdom and the European Union, you have a variety of rights regarding your Personal Information (referred to as “Personal Data” under the laws of the UK and EU). Although the application of these laws is usually limited to Personal Information about residents of those jurisdictions, as a matter of policy and out of respect for your privacy, we offer you many of the rights available to residents of California, the UK and the EU, regardless of the jurisdiction in which you live. We reserve, however, the right to object to the application of any law beyond its particular jurisdiction. Also, the rights described below do not apply to information that has been anonymized, de-identified or aggregated consistently with the relevant laws. You may have additional rights depending on the place of your residence, and we will endeavor to comply with them to the extent required by the relevant law. We will not discriminate against you because of your exercise of these rights, but you should understand that our ability to provide Services to you may be compromised or rendered impossible by reason of your exercise of these rights.

Subject to these limitations we offer you the following rights with respect to your Personal Data:

Right to Opt-Out

You have the right to opt out of the sale of your Personal Information to those business partners we engage for marketing purposes and to whom we have provided your Personal Information. To exercise this right, see below under the heading of “Exercising your Rights to Opt-Out, Know or Delete”,

Right to Know

You have the right to ask us to inform you about our collection and use of your Personal Information (your "Right to Know"). Once we receive your request and confirm your identity (see below under the heading of “Exercising your Rights to Opt-out, Know or Delete”), we will disclose to you the following information, with respect to the twelve months preceding your request:

• The categories of Personal Information we collected about you.
• The types of sources for the Personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we share that personal information.
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
  
  • sales, identifying the personal information categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained
• The specific pieces of personal information we collected about you (also called a data portability request).

Deletion

You have the right to request that we delete any of your Personal Information, subject to certain exceptions. Once we receive your request and confirm your identity (see below under the heading of “Exercising your Rights to Know or Delete”), we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete the transaction for which we collected the personal information, provide a Service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with relevant law, including the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or de-identify Personal Information not subject to one of these exceptions from our records and will direct our service providers to take similar action. Please note that it may take up to 45 days to delete your Personal Information

Exercising your Rights to Opt-Out, Know or Delete

To exercise your rights to opt-out, know, or delete described above, please submit a request by either:

• Calling us at 1 (844) 218 - 2896.
• Emailing us at support@apolloneuro.com
• Visiting https://help.apolloneuro.com/hc/en-us/requests/new

Only you, or someone legally authorized to act on your behalf, may make a request to opt-out, know or delete related to your personal information. To designate an authorized agent, you should follow the procedures required by the agent; we will then verify whether they are sufficient to meet our obligations under law.

You may only submit a request to know twice within a 12-month period. Your request to opt-out, know or delete must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact Apollo Neuro Customer Service at 1 (844) 218 - 2896 or support@apolloneuro.com.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Our Legal Bases

Under the laws of various jurisdictions, including the European Union, we are required to have a legal basis for our collection and processing of your Personal Information. We rely on a number of legal bases to collect, use, share, and otherwise process your Personal Information for the purposes described in this Privacy Policy, including:

• as necessary to provide the Services and fulfill our obligations to you;
  where you have consented to the processing;
• where necessary to comply with a legal obligation, a court order, or to exercise and defend legal claims;
• to protect your vital interests, or those of others, such as in the case of emergencies; and
• where necessary for the purposes of our or a third party’s legitimate interests, such as our interests in protecting our members, our partners’ interests in collaborating with our members, and our commercial interests in ensuring the sustainability of the Services.

Transfers

The Services are operated from the United States. If you are located outside of the United States and choose to use the Services or provide information to us, you acknowledge and understand that your information will be transferred, processed and stored in the United States, since the transfer is necessary to provide the Services. United States privacy laws may not be as protective as those in your jurisdiction.

Retention of Information

We retain information as long as it is necessary to provide the Services to you and others, subject to any legal obligations to further retain such information. Information associated with your account will generally be kept until it is no longer necessary to provide the Services or until your account is deleted. In addition, you can delete some items of information (e.g., profile information) without deleting your account. Additionally, we may retain information to comply with the law, prevent fraud, collect fees, resolve disputes, troubleshoot problems, assist with investigations, enforce our agreement with you and take other actions permitted by law. The information we retain will be handled in accordance with this Privacy Policy.

Information connected to you that is no longer necessary and relevant to provide our Services may be de-identified or aggregated with other non-personal data to provide insights which are commercially valuable to Apollo, such as statistics of the use of the Services.

Cookies and Tracking

Cookies, pixel tags, and similar technologies are typically small data files that record information when you access or use our Services. The data helps us perform a variety of functions. These functions include operating the Services, measuring and improving the performance of the Services, tracking your preferences, and delivering content to you, depending on your needs and interests. The data files are stored in various places. Some are placed directly onto your computer or device by your web browser. Others might be embedded in a website, webpage or email that you access.

Cookies are small text files placed on your computer or device that store information about you and that can be accessed by the Services. We may use both “session” cookies and “persistent” cookies. Session cookies expire at the end of your browser session. Persistent cookies are stored in between browser sessions so we can remember your preferences or actions. You should be able to control how and whether cookies will be accepted by your web browser.

Pixel tags (also called scripts, web beacons, web bugs or clear GIFs) are typically invisible tags placed on certain pages of the Services but not on your computer or device. When you access those pages, pixel tags generate a generic notice of your visit. Pixel tags usually work in conjunction with cookies, registering when a particular computer or device visits a particular page. This can help us personalize the presentation of the Services for you. If you turn off cookies, the pixel tag will simply detect an anonymous visit.

Log files are electronic files that record events, transactions, actions or messages that have occurred, such as requests you make to our web server. We can analyze these records to get an idea of where visitors are coming from, how often they are returning and how they are navigating through and using our Services. We may also use other technologies that collect and store information about your use of the Services. Like the technologies described above, these other technologies might store information on your computer or device or on our website or web server. The specific names and features may change as technology advances.

localStorage is a mechanism for storing small pieces of data on a user’s device in a similar manner to cookies, and is used for similar purposes such as keeping a user logged into the service.

We use Google Analytics, and may use other third-party analytics tools, to help us measure traffic and usage trends for our website and to understand more about the demographics of our users. Google Analytics uses cookies and similar technologies to collect and analyze information about the use of our website and report on activities and trends. That service also may collect information regarding your use of other websites, apps and online resources. You can learn more about Google’s practices at http://www.google.com/policies/privacy/partners, and view its currently available opt-out options at https://tools.google.com/dlpage/gaoptout.

Some of the cookies and tracking technologies on our Services are managed by us (first-party cookies), while others are managed by third parties that we do not control (third-party cookies). For more information about data collected by third parties, please see below under the heading “Third Party Sites.”

Most browsers and mobile devices offer instructions on how to disable cookies (typically in “Preferences” or “Settings”). If you disable our cookies, some functions and conveniences of our Services may not work properly or at all. We will attempt to honor your privacy preferences, but we may not be able to honor all of them, including, for example, Do Not Track signals sent by your browser.

Third Party Sites

We allow you to sign up and log in to the Services using accounts you create with third-party products and services (collectively, “Third Parties”), such as Facebook and the Apple AppStore, some of whom are also our business partners. If you access the Services with through a Third Party we will collect information that you have agreed to make available such as your name, email address, profile information and preferences. This information is collected by the Third-Party Account provider and is provided to us under their privacy policies. These services also collect various kinds of information from you when you use them, as described in their privacy policies. They may also serve you advertisements as part of their content or service.

Our Website and Services may also contain links to additional Third Party websites and services.

These Third Party websites, services, applications and resources are not under our control, and we are not responsible for the collection and use of your information by them or for their content. We encourage you to be aware when you are viewing or using a third-party website, application or resource, and to review the privacy policies and terms of use of each website, application and resource you visit or use. You can generally control the information that we receive from these sources using the privacy controls in your Third-Party Account.

Changes to Our Privacy Policy

We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated notice on the Website and update the notice's effective date. Your continued use of our Website and/or Services following the posting of changes constitutes your acceptance of such changes.

Communicating With Us

If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights, you can contact us at:

• Phone: +1 (844) 218 - 2896
• Website: apolloneuro.com
• Email: Support@apolloneuro.com
• Postal Address:
  Apollo Neurosciences
  Attn: Customer Service
  1942 5th Avenue Pittsburgh
  Pittsburgh, PA

If you need to access this Policy in an alternative format due to having a disability, please contact Support@apolloneuro.com and +1 (844) 218 - 2896.