2.0 Personal Information We Collect

2.1 Information You Choose to Provide to Us

WHEN

We may ask you to provide personal information when:

• You use the Website to download articles, data sheets, or similar informational content.
• You use the HCW App as an HCW Study Partcipant per the terms of the Consent Form as provided by your Study Coordinator
• You request a free trial or demo.
• You refer a friend to us.
• You connect with us directly via phone calls or video conferencing platforms.
• We or Client Account Administrators grant you access to the Application.
• You or Client Account Administrators upload or enter personal information into the Application.
• You participate in a marketing/sales promotion.
• You attend trade events and other industry networking events.
• You register or attend a webinar or other event.
• You participate in programs we may offer from time to time.
• You participate in chats.
• You pay for our services.

WHAT

As an End User of the Application, we may collect your name, email address, phone number, and any other data you might provide in the Application.

As an HCW Study Partcipant using the HCW App, we may collect study-related information per the terms of the Consent Form as provided by your Study Coordinator. Cobalt Innovations, Inc. does not receive any personally identifying information about you from the Study Coordinator.

In addition, we may collect data uploaded by you, your Employer or other End Users of the Application or HCW Study Partcipant using the HCW App that may be required to use Cobalt Innovations, Inc. services. We expect all End Users to follow their organization's privacy policy and any applicable regulatory requirements when uploading, accessing and using personal information into our Application. The data may include personal information like:

• Employee names, email addresses, and other contact information
• Customer names, email addresses, and other contact information used to provide services within Cobalt Innovations, Inc.'s platform

2.2 Information We Collect Automatically

WHEN

We collect information about your visits to the Website and the Application when you land on any of our web pages through cookies and similar tracking technology. The Cobalt Website and Application are designed specifically for Clients and End Users in the USA.

As an HCW Study Partcipant using the HCW App, we collect information about when you open and close the app on your device. We collect explicitly-provided information per the terms of the study including audio/video recordings and answers for healthcare assessments. We may also collect passive information per the terms of the study which can include but is not limited to location data, accelerometer data, SMS message frequency and content (phone numbers are anonymized), phone call frequency and duration (phone numbers are anonymized), and step tracking.

WHAT

The information collected includes but is not limited to:

• Access times
• The pages and content you view
• The links you click on
• The search terms you enter
• Actions you take in connection with any of the visited pages
• Your device information such as IP address, location, browser type and language
• The Uniform Resource Locator (URL) of the website that referred you to our Website
• The URL you browse away from on if you click on an external link

We may also collect information when you open email messages from us or click on links within those email messages.

2.3 Information We May Collect From Third Parties

WHEN

We may combine the information we collect from your direct interactions with us with information obtained through other third-party sources, such as EHR (Electronic Health Record) or EMR (Electronic Medical Record) systems. We may also obtain and/or purchase lists from third parties about individuals and companies interested in our products.

WHAT

The personal information collected may include your name, email address, telephone number, appointment bookings, appointment availability, and other information agreed upon by Clients for their End Users to access services within Cobalt Innovations, Inc.'s platform.

4.0 How We Share Personal Information

Our Application and Services

If you are an End User of our Application, some of your personal information may be viewed by other End Users with access to the Application with appropriate levels of access and contextual need. For example, if you are an End User who books a Telehealth appointment with a 1:1 support provider, that provider will have access to the email address you have provided, answers to any appointment screening questions you have answered, and potentially other information that may be needed to effectively conduct the appointment.

Our HCW App

If you are an HCW Study Partcipant using the HCW App, active and passive data collected per the terms of the HCW Study will be provided to researchers for analysis.

Service Providers

We use third parties to help us provide our services. They will have access to your information as collected by the Website or the Application, as reasonably necessary to perform the contracted tasks on our behalf. We sign contractual agreements which obligate them to protect the personal information, only use it to deliver the contracted services to us, prohibit them from selling it, and not disclose it without our knowledge and permission.

Legal Disclosures

It is possible that we may need to disclose personal information when required by law, subpoena or other legal processes as identified in the applicable legislation.

We attempt to notify our Clients about legal demands for their personal data when appropriate in our judgment unless prohibited by law or court order or when the request is an emergency.

Change in Control

We can also share your personal data as part of a sale, merger, change in control or in preparation for any of these events.

Any other entity which buys us or part of our business will have the right to continue to use your data, but only in the manner set out in this Privacy Policy unless you agree otherwise.

6.0 Your Rights

We offer the same suite of services to all of our Clients and End Users, with each Client negotiating with Us to offer all or a subset of our services to their End Users.

We offer the following rights to all individuals regardless of their location or applicable privacy regulations.

For personal information we have about you, you can:

• Access your personal information or request a copy.

You have the right to obtain information about what personal information we process about you or to obtain a copy of your personal information.

If you have provided personal information to us, you may contact us to obtain an outline of what information we have about you or a copy of the information.

• You have the right to be notified of what personal information we collect about you and how we use it, disclose it and protect it.

This Privacy Policy describes what personal information we collect and our privacy practices. We may also have additional privacy notices and statements available to you at the point of providing information to us directly.

• Change or correct your personal information.

You have the right to update/correct your personal information or ask us to do it on your behalf.

You can ask us to change or correct it by contacting us at support@cobaltinnovations.org.

• Delete or erase your personal information.

You have the right to request the deletion of your personal information at any time. We will communicate back to you within reasonable timelines the result of your request. We may not be able to delete or erase your personal information, but we will inform you of these reasons and any further actions available to you.

• Object to the processing of your personal information.

You have the right to object to our processing of your personal information for direct marketing purposes. This means that we will stop using your personal information for these purposes.

• Ask us to restrict the processing of your personal information.

You may have the right to ask us to limit the way that we use your personal information.

• Export your personal data.

You have the right to request that we export to you in a machine-readable format all of the personal information we have about you.

We do not process personal information through the use of automated means.

If you would like to exercise any of the rights described above, please contact us at support@cobaltinnovations.org.

You also have the right to lodge a complaint with the local organizations in charge of enforcing the privacy legislation applicable in your territory.

8.0 Other Important Information

We process data in the USA. If it becomes required to transfer data across borders, we will rely on legally-provided mechanisms to lawfully do so, such as contracts incorporating data protection and sharing obligations.

We will only collect and process your personal data where we have a lawful reason for its collection.

When you visit our Website or Application or HCW App and provide us with your personal information, we collect and use it with your consent or the consent of the Client under whom you are an End User.

As an Application End User, you consent to our collection of your personal information when you log in for the first time. However, your Client has control of the account and may upload and share additional personal information. Your Client's responsibility is to ensure that collecting, using and sharing the personal information uploaded to the Application complies with all applicable legislation.

As an HCW Study Partcipant, you will have already provided consent to our collection of your personal information to your Study Coordinator prior to receiving an anonymized HCW App username and password. However, your Client has control of the account and may upload and share additional personal information. Your Client's responsibility is to ensure that collecting, using and sharing the personal information uploaded to the Application complies with all applicable legislation.

Where we rely on your consent to process personal data, you have the right to withdraw or decline your consent at any time. If you have any questions about the lawful bases upon which we collect and use your personal data, please contact us at support@cobaltinnovations.org.

Appendix

A.1 For Individuals Based in California

This section provides additional specific information for consumers based in California as required by the California Consumer Privacy Act of 2018 (“CCPA”).

A.1.1 Collection and Use of Personal Information

In the last 12 months, we may have collected the following categories of personal information:

• Identifiers, such as your name, email address, telephone number or other similar identifiers
• California Customer Records (Cal. Civ. Code § 1798.80(e)), such as username and password, company name, job title, business email address and department
• Internet/network information, such as your browsing history, log and analytics data, information about the device(s) used to access the services and information regarding your interaction with our Website or Application or services and other usage data
• Geolocation data, such as information about your location (at country and city level) collected from your IP address
• Sensory Information, the content, audio and video recordings of conference calls between you and us that we record where permitted by you and/or the law
• Other personal information, such as personal information you provide to us in relation to a survey, comment, question, request, content download or inquiry and any other information you upload to our Application

We collect personal information directly from you, from your browser or device when you visit our Website or Application, from third parties that you permit to share your information or from third parties that share public information about you, as stated above.

See the section above, “How We Use Personal Information,” to understand how we use the personal information collected from California consumers.

A.1.2 Recipients of Personal Information

We may share personal information with third parties for business purposes. The categories of third parties to whom we disclose your personal information may include: (i) our service providers and advisors, (ii) marketing and strategic partners; (iii) ad networks and advertising partners; and (iv) analytics providers.

Please see the “How We Share Information” section of the Privacy Policy above for more information.

A.1.3 California Privacy Rights

As a California resident, you may be able to exercise the following rights in relation to the personal information about you that we have collected (subject to certain limitations at law):

• The right to know any or all of the following information relating to your personal information that we have collected and disclosed in the last 12 months (upon verification of your identity):
  • The specific pieces of personal information we have collected about you
  • The categories of personal information we have collected about you
  • The categories of sources of the personal information
  • The categories of personal information that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed
  • The categories of personal information we have sold and the categories of third parties to whom the information was sold, and
  • The business or commercial purposes for collecting or selling the personal information.
• The right to request deletion of personal information we have collected from you, subject to certain exceptions.
• The right to opt-out of personal information sales to third parties now or in the future. However, we do not sell your personal information.

You also have the right to be free of discrimination for exercising these rights.

Please note that if exercising these rights limits our ability to process personal information (such as a deletion request), we may no longer be able to provide you with our products and services or engage with you in the same manner.

A.1.4 How to Exercise Your California Consumer Rights

To exercise your right to know and/or your right to deletion, please submit a request by contacting us at support@cobaltinnovations.org.

We will need to verify your identity before processing your request.

In order to verify your identity, we will generally require sufficient information from you so that we can match it to the information we maintain about you in our systems. Sometimes we may need additional personal information from you to be able to identify you. We will notify you.

We may decline a request to exercise the right to know and/or right to deletion, particularly where we cannot verify your identity or locate your information in our systems or as permitted by law.

You may choose to designate an authorized agent to make a request under the CCPA on your behalf. No information will be disclosed until the authorized agent's authority has been reviewed and verified. Once an authorized agent has submitted a request, we may require additional information (i.e., written authorization from you) to confirm the authorized agent's authority.

If you are an employee/former employee of a Cobalt Innovations, Inc. Client that uses our Application and services, please direct your requests and/or questions directly to your Employer/former Employer.

If you are a third party (auditor, business associate, etc.), who was given access to the Cobalt Innovations, Inc. Application by a Cobalt Innovations, Inc. Client, please direct your requests and/or questions directly to the Cobalt Innovations, Inc. Client that gave you access.

Minors Under Age 16

Our Application and services are intended for business/professional use by adults, and we do not currently expect them to be of interest to minors. We do not intentionally collect any personal information of consumers below the age of 16. We do not sell the personal information of California consumers.