Platform Privacy Policy

5. How We Share Your Information

We do not sell your personal information. We may share your information only in the limited circumstances described below, and always with appropriate safeguards in place.

5.1 Service Providers and Sub-Processors

We engage trusted third-party service providers who perform services on our behalf and require access to your personal information to do so. These service providers are contractually bound to use your information only for the purposes we specify, to maintain its confidentiality, and to implement appropriate security measures. Our service providers include:

Third-Party Platform Infrastructure Provider. Our Platform is built on infrastructure provided by a third-party platform infrastructure provider that hosts and powers core Platform functionality, including CRM features, workflow automation, and communication tools.

Payment Processors. We use third-party payment processors to handle subscription billing and payment transactions. These processors receive your payment card information directly and are PCI DSS compliant.

Email and SMS Delivery Providers. We use third-party services to deliver transactional and service-related email and SMS communications on our behalf.

Cloud Hosting and Storage. Your information is stored on servers provided by cloud hosting providers that maintain industry-standard security certifications.

Analytics Providers. We use analytics services to understand how our Platform and website are used, to improve performance, and to identify issues.

Customer Support Tools. We use third-party tools to manage support tickets, live chat, and help documentation.

5.2 Professional Advisors

We may share your personal information with our professional advisors, including legal counsel, accountants, auditors, and insurance providers, where necessary to obtain their services. These disclosures are protected by professional privilege or contractual confidentiality obligations.

5.3 Legal and Regulatory Disclosures

We may disclose your personal information to law enforcement agencies, regulators, courts, or other governmental authorities when we believe in good faith that disclosure is:

• Required by applicable law, regulation, or legal process (such as a subpoena, court order, or search warrant);

• Necessary to respond to valid legal process served on us;

• Necessary to protect our rights, property, or safety, or the rights, property, or safety of our Subscribers, their patients, or the public; or

• Necessary to detect, prevent, or address fraud, security issues, or technical problems.

Where legally permitted, we will make reasonable efforts to notify you before disclosing your information in response to legal process.

5.4 Business Transfers

If [My Sancta] is involved in a merger, acquisition, reorganization, asset sale, bankruptcy, or similar corporate transaction, your personal information may be transferred as part of that transaction. In such an event, we will provide notice to you (for example, via email to the address associated with your account or a prominent notice on our website) before your personal information is transferred and becomes subject to a different privacy policy. Any successor entity will be required to honor the commitments we have made in this Privacy Policy.

5.5 With Your Consent

We may share your personal information with third parties when you have given us your explicit consent or directed us to do so. For example, if you authorize an integration between your Platform account and a third-party service, we will share the information necessary to facilitate that integration.

5.6 We Do Not Sell or Share for Cross-Context Behavioral Advertising

We do not sell your personal information as the term "sell" is defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). We do not share your personal information for purposes of cross-context behavioral advertising as defined under the CCPA/CPRA.

For clarity, under the CCPA, a "sale" means sharing personal information with a third party for monetary or other valuable consideration. "Sharing" means making personal information available to a third party for cross-context behavioral advertising purposes, whether or not for monetary consideration. We do not engage in either of these practices with respect to your personal information.

Note: We use Google Analytics and may deploy advertising pixels (such as Meta Pixel, Google Ads conversion tracking, or LinkedIn Insight Tag) on our marketing website. To the extent that these tools disclose personal information to third-party advertising platforms in a manner that constitutes “sharing” under the CCPA, we will provide appropriate opt-out mechanisms, including honoring Global Privacy Control signals as described in Section 6.4. We do not use advertising or analytics tools within the authenticated Platform environment where Subscriber account data is processed.

6. Cookies and Tracking Technologies

We and our service providers use cookies, pixels, web beacons, and similar tracking technologies to collect information about your interactions with our website and Platform. This section explains what these technologies are, how we use them, and your choices regarding them.

Cookies are small text files that are stored on your device when you visit a website. They serve a variety of functions, such as remembering your preferences, enabling certain features, and helping us understand how our services are used.

6.1 Types of Cookies We Use

Essential/Strictly Necessary Cookies

These cookies are necessary for the website and Platform to function and cannot be switched off in our systems. They are typically set in response to actions you take that amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms. These cookies include:

• Authentication cookies that verify your identity when you log into your account;

• Security cookies that help detect and prevent fraudulent activity and protect against unauthorized access;

• Session management cookies that maintain your session state as you navigate between pages; and

• Load-balancing cookies that distribute traffic across servers to ensure Platform stability.

You can configure your browser to block or alert you about these cookies, but some parts of the website and Platform will not function properly without them.

Functional Cookies

These cookies enable enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. These include cookies that:

• Remember your preferences, such as language selection, region, or display settings;

• Store your saved settings and configurations; and

• Enable features like live chat support tools.

If you do not allow these cookies, some or all of these features may not function properly.

Analytics and Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our website and Platform. They help us understand which pages are the most and least popular, how visitors move around the site, and how to improve the user experience. Information collected includes:

• Usage patterns and page views;

• Page load times and performance metrics;

• Error tracking and diagnostic information; and

• Referring URLs and navigation paths.

Information collected through these cookies may be aggregated and used to improve how our website and Platform work.

Google Analytics collects usage data, including page views, session duration, traffic sources, user demographics (if enabled), and device/browser information.

We use Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to help analyze how users interact with our website and Platform. The information generated by the cookie about your use of the website (including your IP address) is transmitted to and stored by Google on servers in the United States. Google uses this information to evaluate your use of the website, compile reports on website activity, and provide other services relating to website activity and internet usage. Google may also transfer this information to third parties where required by law, or where such third parties process the information on Google’s behalf. For more information about Google Analytics and how to opt out, visit https://tools.google.com/dlpage/gaoptout.

Marketing and Advertising Cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant advertisements on other sites. They work by uniquely identifying your browser and device.

We may deploy tracking pixels and similar technologies from the following advertising platforms on our marketing website: Meta (Facebook/Instagram), Google Ads, YouTube, and LinkedIn. These technologies allow us to measure the effectiveness of our advertising campaigns, build custom audiences, and deliver targeted advertisements on those platforms. These cookies work by uniquely identifying your browser and device and may constitute “sharing” of personal information under the CCPA. You may opt out of these cookies through our cookie consent tool, by adjusting your browser settings, or by enabling a Global Privacy Control signal as described in Section 6.4.

6.2 Managing Your Cookie Preferences

You have several options for managing cookies and tracking technologies:

Browser Settings. Most web browsers allow you to control cookies through their settings. You can typically set your browser to refuse all cookies, accept all cookies, or notify you when a cookie is being set so that you can decide whether to accept it. The method for managing cookies varies by browser; please consult your browser's help documentation for instructions.

Cookie Consent Tool. When you first visit our website, you may be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You can change your preferences at any time by accessing the cookie settings link in our website footer.

6.3 Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is no universally accepted standard for how to interpret and respond to DNT signals, our website does not currently respond to browser DNT signals. This position is consistent with the majority of websites and platforms, as no uniform technology standard for recognizing and implementing DNT signals has been finalized.

This does not affect your ability to exercise your privacy rights through other mechanisms described in this Privacy Policy or through Global Privacy Control signals as described below.

6.4 Opt-Out Preference Signals (Global Privacy Control)

We honor Global Privacy Control (GPC) signals as valid opt-out of sale/sharing requests where required by applicable law, including under the California Consumer Privacy Act. If our systems detect a GPC signal from your browser, we will treat that signal as a valid request to opt out of the sale or sharing of your personal information associated with that browser. You can learn more about Global Privacy Control and how to enable it at globalprivacycontrol.org.

7. Data Retention

We retain your personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, and to comply with our legal obligations. The retention period depends on the nature of the information and the purposes for which it is processed.

7.1 Active Accounts

We retain your personal information for as long as your Subscriber account remains active and for a reasonable period thereafter to provide you with continued access to our services, to maintain business records, and to fulfill any contractual obligations.

7.2 Post-Termination Retention

Upon termination or expiration of your Subscription Agreement, we will retain your account data in accordance with the terms of your SaaS Subscription Agreement. Specifically:

• Retrieval Period: You will have thirty (30) days following termination to retrieve or export your data from the Platform.

• Primary Deletion: After the 30-day retrieval period, your account data will be permanently deleted from our primary production systems.

• Backup Deletion: Copies of your data that may exist in encrypted backup systems will be permanently deleted within an additional sixty (60) days following primary deletion.

7.3 Extended Retention Where Required by Law

Notwithstanding the foregoing, we may retain certain information for longer periods where required or permitted by applicable law, including:

• Tax and Financial Records: Billing records, invoices, and related financial information may be retained for up to seven (7) years to comply with tax reporting and audit requirements.

• Legal Holds: Information subject to pending or reasonably anticipated litigation, government investigation, or other legal proceedings will be preserved for the duration of the hold.

• Regulatory Compliance: Information required to be maintained under applicable healthcare regulations, state licensing requirements, or other regulatory mandates will be retained for the period specified by those requirements.

7.4 Usage and Log Data

Usage data and system logs are retained in de-identified and aggregated form for analytics, security, and service improvement purposes. Once de-identified, this information is no longer considered personal information and may be retained indefinitely.

7.5 Payment Records

Payment card information is not stored on our systems. Payment transaction records (which do not include full card numbers) are retained in accordance with PCI DSS requirements and applicable tax record-keeping obligations.

8. Data Security

We take the security of your personal information seriously and implement a combination of administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, disclosure, alteration, or destruction.

8.1 Administrative Safeguards

Our administrative security measures include:

• Access Controls: We enforce role-based access controls that limit access to personal information to those employees and contractors who need it to perform their job functions.

• Employee Training: All personnel with access to personal information receive training on data protection, security awareness, and privacy best practices.

• Security Policies: We maintain comprehensive written information security policies and procedures that govern the handling of personal information.

• Designated Security Officer: We have designated a security officer responsible for overseeing and coordinating our information security program.

8.2 Technical Safeguards

Our technical security measures include:

• Encryption at Rest: Personal information stored in our systems is encrypted using AES-256 encryption.

• Encryption in Transit: All data transmitted between your device and our Platform is protected using Transport Layer Security (TLS) 1.2 or higher.

• Multi-Factor Authentication: Administrative access to our systems requires multi-factor authentication (MFA).

• Vulnerability Scanning: We conduct regular vulnerability scans of our systems to identify and remediate potential security weaknesses.

• Intrusion Detection: We employ intrusion detection and prevention systems to monitor for and respond to unauthorized access attempts.

• Secure Development Practices: We follow secure software development practices, including code review and security testing.

8.3 Physical Safeguards

Your information is hosted in data centers maintained by our third-party infrastructure provider. Our third-party platform infrastructure provider maintains SOC 2 Type II and ISO/IEC 27001:2022 certifications. The provider’s cloud infrastructure (Amazon Web Services) also maintains SOC 2 Type II and ISO 27001 certifications. These data centers implement physical security measures including:

• Controlled physical access with multi-layered authentication;

• 24/7 security monitoring and surveillance;

• Environmental controls (fire suppression, climate control, redundant power); and

• Visitor access logging and escort requirements.

8.4 Security Assessments and Testing

We conduct regular security assessments, including periodic penetration testing, to evaluate the effectiveness of our security controls and identify areas for improvement. Findings from these assessments are remediated according to their severity level.

8.5 Incident Response

We maintain an incident response plan that establishes procedures for detecting, responding to, and recovering from security incidents. In the event of a security breach that affects your personal information, we will notify you in accordance with applicable law and the terms of your Subscription Agreement.

8.6 Limitations

While we implement robust security measures, no method of transmission over the Internet and no method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal information. We continuously work to improve our security posture, but we cannot ensure or warrant the security of any information you transmit to us, and you do so at your own risk.

8.7 Your Security Responsibilities

As a Subscriber, you also play an important role in maintaining the security of your account and the information within it. Your responsibilities include:

• Maintaining the confidentiality of your login credentials and not sharing them with unauthorized individuals;

• Using strong, unique passwords for your Platform account and enabling multi-factor authentication where available;

• Properly configuring access controls and user permissions within your account to limit access to authorized personnel only;

• Promptly reporting any suspected unauthorized access to your account or any other security concern to us at the contact information provided in this Privacy Policy; and

• Keeping your systems and software up to date with the latest security patches.

9. Your Privacy Rights (Multi-State)

We respect your privacy rights under applicable federal and state laws. Depending on your state of residence, you may have specific rights regarding your personal information. This Section describes those rights and how to exercise them.

9.1 All Consumers (Baseline Rights)

Regardless of where you reside in the United States, we provide the following baseline privacy rights to all consumers who interact with our Platform:

Right to Know. You have the right to know what categories and specific pieces of personal information we collect about you, the sources from which it is collected, the purposes for which it is used, and the categories of third parties with whom it is shared.

Right to Access. You have the right to request access to the personal information we have collected and maintained about you.

Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law (for example, where we are required to retain information to comply with legal obligations, complete a transaction, detect security incidents, or exercise or defend legal claims).

Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature of the personal information and the purposes of the processing.

Right to Data Portability. You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit that information to another entity without hindrance, where technically feasible.

Right to Opt Out of Sale or Sharing. If applicable, you have the right to opt out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes.

Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge different prices or rates, provide a different level or quality of goods or services, or suggest that you will receive a different price or rate or different level or quality of goods or services as a result of exercising your rights.

9.2 California Residents (CCPA/CPRA Supplemental)

If you are a California resident, you have additional rights under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"). The following supplements the baseline rights described above.

Right to Know (12-Month Lookback)

You may request that we disclose the following for the 12-month period preceding your request:

• The categories of personal information we collected about you.

• The categories of sources from which personal information was collected.

• The business or commercial purpose for collecting, selling, or sharing personal information.

• The categories of third parties to whom we disclosed personal information.

• The specific pieces of personal information we collected about you.

• The categories of personal information sold or shared, and the categories of third parties to whom it was sold or shared, by category of personal information for each category of third parties.

• The categories of personal information disclosed for a business purpose, and the categories of recipients.

You may submit a verifiable request to know up to twice in a 12-month period.

Right to Limit Use and Disclosure of Sensitive Personal Information

If we collect sensitive personal information (as defined under CCPA) and use it for purposes beyond what is necessary to perform the services or provide the goods you request, you have the right to limit our use and disclosure of such sensitive personal information. At this time, we do not use sensitive personal information for purposes beyond those permitted under the CCPA, and therefore a limitation request is not required.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. To do so, you must provide the agent with written permission signed by you, or provide a valid power of attorney under California Probate Code sections 4000 to 4465. We may still require you to verify your identity directly with us and confirm that you authorized the agent to act on your behalf.

Financial Incentives

We do not offer financial incentives, price differences, or service differences in exchange for the retention, sale, or sharing of your personal information. If we offer any such program in the future, we will provide a separate notice describing the material terms, your right to opt in, and how you may withdraw.

Automated Decision-Making Technology (ADMT)

We do not currently use automated decision-making technology to make decisions that produce legal or similarly significant effects concerning you. If we adopt such technology in the future, we will update this Policy and provide the required disclosures, including the right to opt out of such processing and the right to access information about the logic involved.

Shine the Light (Cal. Civ. Code § 1798.83)

Under California's "Shine the Light" law, California residents who provide personal information in obtaining products or services for personal, family, or household use may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. If our practices change, we will update this disclosure and provide you with the ability to opt out.

Minors Under 16

We do not knowingly sell or share the personal information of consumers under the age of 16. If we have actual knowledge that a consumer is between 13 and 16 years of age, we will not sell or share their personal information unless the consumer has affirmatively authorized (opted in to) the sale or sharing. If we have actual knowledge that a consumer is under 13 years of age, we will not sell or share their personal information unless the consumer's parent or guardian has affirmatively authorized the sale or sharing.

9.3 Texas Residents (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act ("TDPSA"), effective July 1, 2024.

Your Rights Under the TDPSA

As a Texas resident, you have the right to:

• Access the personal data a controller has collected about you.

• Correct inaccuracies in your personal data.

• Delete personal data you provided or that the controller obtained about you.

• Obtain a copy of your personal data in a portable and readily usable format (data portability).

• Opt out of the processing of your personal data for purposes of targeted advertising.

• Opt out of the sale of your personal data.

• Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Right to Appeal

If we decline to take action on your request, we will inform you of our reasons and provide instructions for how to appeal. You may submit an appeal using the contact methods described in Section 9.6 below. We will respond to your appeal within sixty (60) days of receipt. If your appeal is denied, we will inform you in writing of the reasons for the denial and your right to contact the Texas Attorney General to submit a complaint.

Data Protection Assessments

As required by the TDPSA, we conduct and document data protection assessments for processing activities that present a heightened risk of harm to consumers, including processing for purposes of targeted advertising, the sale of personal data, certain profiling activities, and the processing of sensitive data.

9.4 Florida Residents (Florida Digital Bill of Rights)

If you are a Florida resident, the Florida Digital Bill of Rights ("FDBR"), effective July 1, 2024, may provide you with additional privacy rights.

Your Rights Under the FDBR (If Applicable)

If we meet the FDBR thresholds, Florida residents have the right to:

• Access personal data collected about you.

• Correct inaccuracies in your personal data.

• Delete personal data provided by you or obtained by the controller.

• Opt out of the processing of personal data for purposes of sale.

• Opt out of the processing of personal data for purposes of sharing for targeted advertising.

• Opt out of the collection of sensitive personal data and precise geolocation data.

If we do not currently meet the FDBR thresholds, we nonetheless honor access, correction, and deletion requests from Florida residents as a matter of best practice, consistent with our baseline rights described in Section 9.1.

9.5 Other State Residents

Residents of other states with comprehensive consumer privacy laws may have similar rights. The following is a non-exhaustive summary:

Colorado (Colorado Privacy Act, effective July 1, 2023)

Colorado residents have the right to access, correct, and delete personal data; obtain a copy in a portable format; and opt out of processing for purposes of targeted advertising, sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects.

Connecticut (Connecticut Data Privacy Act, effective July 1, 2023)

Connecticut residents have rights substantially similar to those provided to Colorado residents, including access, correction, deletion, portability, and the right to opt out of sale, targeted advertising, and profiling.

Virginia (Virginia Consumer Data Protection Act, effective January 1, 2023)

Virginia residents have the right to access, correct, and delete personal data; obtain a copy in a portable format; and opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, and profiling in furtherance of solely automated decisions producing legal or similarly significant effects.

Additional States

Additional state privacy laws that may provide comparable rights include, but are not limited to:

• Oregon Consumer Privacy Act (OCPA)

• Delaware Personal Data Privacy Act (DPDPA)

• Montana Consumer Data Privacy Act (MCDPA)

• Iowa Consumer Data Protection Act (ICDPA)

• New Hampshire Privacy Act

• New Jersey Data Privacy Act

• Tennessee Information Protection Act

• Nebraska Data Privacy Act

• Minnesota Consumer Data Privacy Act

As additional state privacy laws take effect, we will update our practices and this Policy accordingly. If you are a resident of any state with a comprehensive privacy law and wish to exercise your rights or request information about rights specific to your state, please contact us using the methods described in Section 9.6 below.

9.6 How to Exercise Your Rights

Submission Methods

You may submit a request to exercise your privacy rights through any of the following methods:

• Email: [email protected]

• Web Form: [Compliance group]

• Toll-Free Telephone Number: 1- 866-773-1733

Verification Process

When you submit a request, we must verify your identity to protect your privacy and security. Our verification process works as follows:

• We will attempt to verify your identity using information we already have on file (for example, matching information you provide in your request against account information in our records).

• If we cannot verify your identity using existing information, we may request additional information from you solely for the purpose of verifying your identity. Any additional information collected for verification will be used only for that purpose and will be deleted promptly after verification.

• If we are unable to verify your identity after reasonable efforts, we will inform you and will not fulfill the request. We will explain the basis for our inability to verify and any steps you may take.

Response Timeframes

We will process your request in accordance with the following timeframes:

• Acknowledgment: We will acknowledge receipt of your request within ten (10) business days of receipt.

• Substantive Response: We will provide a substantive response to your request within forty-five (45) calendar days of receipt.

• Extension: If reasonably necessary due to the complexity or volume of requests, we may extend the response period by an additional forty-five (45) calendar days, provided we notify you of the extension and the reason within the initial 45-day period.

Authorized Agent Process

If you wish to use an authorized agent to submit a request on your behalf:

• The agent must submit proof of your written authorization (signed by you) or a valid, registered power of attorney.

• Even when using an authorized agent, we may require you to verify your identity directly with us to protect against fraudulent requests.

• We may deny requests from agents who do not submit proper proof of authorization.

Appeal Process

If we deny your request in whole or in part, you have the right to appeal our decision:

• To submit an appeal, contact us at [email protected] or through https://mysancta.io/submit-privacy-concern with the subject line "Privacy Rights Appeal."

• We will respond to your appeal within the timeframe required by your state's applicable law (for example, 60 days under the TDPSA, 45 days under the CCPA).

• If your appeal is denied, we will inform you in writing of the reasons for the denial and provide you with information about how to contact your state attorney general or other appropriate regulatory authority to file a complaint.

10. CHILDREN'S PRIVACY

The Platform is designed for licensed healthcare professionals, including Nurse Practitioners (NPs) and Advanced Practice Registered Nurses (APRNs), all of whom are adults. The Platform is not directed to children under the age of eighteen (18).

We do not knowingly collect personal information from children under the age of sixteen (16), which is the threshold established by the California Consumer Privacy Act (CCPA), or from children under the age of thirteen (13), which is the threshold established by the Children's Online Privacy Protection Act (COPPA).

If we become aware that we have inadvertently collected personal information from a child under the applicable age threshold, we will take prompt steps to delete such information from our systems and, if applicable, terminate any account associated with that child.

If you believe that a child has provided us with personal information in connection with the Platform, please contact us immediately at [email protected] so that we can take appropriate action.

11. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, applications, or services that are not owned or controlled by Provider. These third-party services have their own privacy policies governing the collection, use, and disclosure of your personal information.

We are not responsible for the privacy practices, content, or security of any third-party websites, applications, or services. The inclusion of a link to a third-party service does not imply endorsement by Provider.

Third-party integrations activated by Subscriber (including but not limited to payment processors, scheduling tools, telehealth video providers, electronic health record systems, and marketing tools) are subject to the respective third party's own terms of service and privacy policy. Subscribers are responsible for reviewing and accepting such third-party terms before activating any integration.

We encourage you to review the privacy policies of any third-party services before providing them with your personal information or enabling them to access data processed through the Platform.

The Platform relies on third-party infrastructure and service providers who process data on our behalf. These sub-processors are bound by contractual restrictions that limit their use and disclosure of personal information to what is necessary to provide services to us and that require them to maintain appropriate security safeguards.

12. INTERNATIONAL DATA TRANSFERS

Personal information collected through the Platform is processed and stored in the United States. Our servers, our third-party platform infrastructure provider's servers, and our sub-processors' facilities are located in the United States.

By accessing or using the Platform, you acknowledge and consent to the transfer of your personal information to the United States for processing and storage. You understand that the United States may not provide the same level of data protection as your home jurisdiction.

European Economic Area (EEA), United Kingdom, and Switzerland

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional provisions apply to international transfers of your personal information:

We rely on appropriate transfer mechanisms as required by applicable data protection law, including the European Commission's Standard Contractual Clauses (SCCs) and any applicable adequacy decisions issued by relevant authorities.

Our third-party platform infrastructure provider participates in the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, as set forth by the U.S. Department of Commerce. This provides an additional legal basis for cross-border data transfers to that provider.

You may request a copy of the applicable transfer mechanisms or additional information about international data transfers by contacting us using the information provided in Section 15 below.

13. HIPAA AND HEALTH INFORMATION

This Privacy Policy does NOT govern Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (collectively, "HIPAA"). The handling of PHI is addressed exclusively in the Business Associate Agreement ("BAA") between Provider and Subscriber.

Provider's Role as Business Associate

Where Provider processes PHI on behalf of a Subscriber, Provider acts as a Business Associate (as defined under HIPAA) to the Subscriber, who is the Covered Entity or Business Associate in the chain of custody for such PHI.

Provider's obligations with respect to PHI are set forth exclusively in the BAA and include, without limitation:

• Permitted uses and disclosures of PHI, limited to those necessary to perform services on behalf of Subscriber or as otherwise required by law;

• Implementation and maintenance of administrative, physical, and technical safeguards for PHI;

• Breach notification obligations, including timely notification to Subscriber in the event of a Breach of Unsecured PHI;

• Return or destruction of PHI upon termination of the BAA or the underlying SaaS Subscription Agreement; and

• Cooperation with Subscriber in responding to individual rights requests related to PHI.

Prohibited Uses of PHI

Provider does not use or disclose PHI for any of the following purposes:

• Marketing purposes (as defined under HIPAA);

• Platform analytics, benchmarking, or product improvement;

• Artificial intelligence or machine learning model training;

• Sale to third parties (Provider does not sell PHI under any circumstances); or

• Any purpose not expressly authorized in the BAA.

Conflict Between This Policy and the BAA

To the extent any personal information collected under this Privacy Policy also constitutes PHI (as determined under HIPAA), the terms of the BAA shall control in the event of any conflict between this Privacy Policy and the BAA.

Subscriber Responsibilities

Subscribers are solely responsible for determining what information constitutes PHI within their use of the Platform and for ensuring that appropriate safeguards are in place. This includes, without limitation, executing a BAA with Provider prior to processing any PHI through the Platform. Subscribers who have not executed a BAA with Provider must not transmit, store, or process PHI through the Platform.

We direct Subscribers to review the BAA for comprehensive information regarding PHI-specific protections, obligations, and rights.

De-Identified Data

Data that has been de-identified in accordance with the HIPAA Safe Harbor method (45 C.F.R. § 164.514(b)) or the Expert Determination method (45 C.F.R. § 164.514(a)) does not constitute PHI. Such de-identified data may be used by Provider in accordance with the terms of this Privacy Policy, including for analytics and Platform improvement, provided that Provider does not attempt to re-identify such data.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, regulatory guidance, or other factors. We will not reduce your rights under this Privacy Policy without your explicit consent.

Material Changes

For material changes to this Privacy Policy (including changes that affect the categories of personal information collected, the purposes for processing, or your rights), we will notify you by:

• Sending an email to the address associated with your account; and/or

• Posting a prominent notice on the Platform (such as a banner or pop-up notification).

Such notice will be provided at least thirty (30) days prior to the effective date of the material change, giving you sufficient time to review the updated terms and exercise your rights.

Non-Material Changes

Non-material changes (such as formatting updates, grammatical corrections, or clarifications that do not substantively alter your rights or our practices) will be posted to the Platform and are effective upon posting.

Your Acceptance

Your continued use of the Platform after the effective date of any change to this Privacy Policy constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated Privacy Policy, you must stop using the Platform and may terminate your subscription in accordance with the SaaS Subscription Agreement.

Prior Versions

Prior versions of this Privacy Policy are available upon request. Please contact us using the information in Section 15 below to obtain a copy of any previous version.

The "Last Updated" date at the top of this Privacy Policy will be revised each time this Privacy Policy is updated.

15. CONTACT INFORMATION

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the following information:

Company: Sancta, LLC

Doing Business As: My Sancta

Mailing Address: 2240 W. Woolbright Road, Suite 304, Boynton Beach, FL 33426

Email for Privacy Inquiries: [email protected]

Email for General Support: [email protected]

Toll-Free Number: 1- 866-773-1733

Website: www.mysancta.io

Exercising Your Privacy Rights

To exercise your privacy rights (including rights of access, deletion, correction, opt-out of sale/sharing, or data portability), you may submit a request through any of the following methods:

• Online:

• Email: [email protected]

• Toll-Free Telephone: 1-866-773-1733

We will respond to verifiable requests within the timeframes required by applicable law (generally within forty-five (45) days for CCPA requests, with extensions as permitted by law).

Accessibility

This Privacy Policy is available in alternative formats upon request. If you require an accessible version of this Privacy Policy (such as large print, audio, or screen-reader-compatible format), please contact us using the information above and we will provide a version that meets your accessibility needs.