Privacy Policy

This Privacy Notice for Health Care Originals, Inc. ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://healthcareoriginals.com ("Website") or any website of ours that links to this Privacy Notice
• Use our cardiopulmonary and neuro-rehabilitation programs, devices, and services for chronic respiratory and neurological conditions
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@healthcareoriginals.com.

• What personal information do we process? Only what you choose to give us, such as your name and email address when you contact us, plus limited technical information needed to deliver and measure the Website.
• Do we process sensitive personal information? Not through our Website. Please do not include health information in Website forms.
• Do we sell or share your information? No. We do not sell your information or share it with third parties for their own use, and we do not use advertising networks, retargeting, or cross-site tracking. Inquiries are routed internally to the relevant Health Care Originals subsidiary so the right team can reply.
• How long do we keep it?Information from our "Ready to get started" form and email addresses used to access investor materials are kept for 2 years.
• Do we use cookies? Only one strictly necessary session cookie, and only if you choose to access our gated investor materials. See our Cookie Policy.
• What are your rights? Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information.
• How do you exercise your rights? Email us at info@healthcareoriginals.com or use our contact page.

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us. When you use a form on our Website, this may include:

• Name
• Email address
• Phone number, if you choose to provide it
• Organization and role (for example, health plan, employer, or value-based organization)
• Area of interest and the message you write to us

Investor materials access. If you choose to view our gated investor materials, we ask for your email address and send a one-time passcode to it so we can verify your access. We keep a record of the email address and when access was granted. We do not use this email address to contact you.

Sensitive information. We do not request or intend to collect sensitive information, including health information, through our Website. Please do not include medical or health details in Website forms. Health information collected as part of enrolled clinical programs is handled under separate program agreements and notices.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In short: Limited technical information, such as your IP address and browser type, is processed automatically when you visit our Website.

When you visit our Website, our hosting provider processes standard request data, including your IP address, browser and device type, operating system, referring URL, and the date and time of your request. This is needed to deliver pages and protect the Website against abuse.

Information collected from other sources

We may receive business contact information, such as name, job title, and work email address, from public sources or partners when you or your organization engage with us about our Services. We do not purchase data for targeted advertising.

In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

• To respond to your inquiries.We use the information you submit through our "Ready to get started" form only to contact you about the area of interest you selected. We do not use it for any other purpose, such as unrelated marketing. If you later submit the form again with a different area of interest, we will contact you about that area as well.
• To provide access to investor materials. We use the email address you enter on our investor access page only to send your one-time passcode, verify your access, and keep a record of who has accessed those materials. We never use it to contact you or add you to any mailing list.
• To protect our Services. We process request data to keep the Website secure and prevent abuse.
• To comply with legal obligations. We may process information where required by law.
• To save or protect an individual's vital interest. We may process information when necessary to prevent harm.

We may also process your information for other purposes only with your prior explicit consent.

In short: We only process your personal information when we have a valid legal reason to do so under applicable law.

If you are located in the EU or UK

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases we rely on:

• Consent. We may process your information if you have given us permission to use it for a specific purpose. You can withdraw your consent at any time.
• Legitimate interests. We may process your information when it is reasonably necessary to respond to your inquiry and secure our Website, provided those interests do not outweigh your rights.
• Legal obligations. We may process your information where necessary to comply with our legal obligations, such as cooperating with a law enforcement body or regulatory agency, or exercising or defending our legal rights.
• Vital interests. We may process your information where necessary to protect your vital interests or those of a third party.

If you are located in Canada

We may process your information if you have given us express consent, or where your consent can be inferred (implied consent). You can withdraw your consent at any time. In some exceptional cases, we may be legally permitted to process your information without consent, including:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse
• If it is reasonable to expect that collection with consent would compromise the availability or accuracy of the information and the collection is reasonable for investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which it was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

In short: We share information only with service providers who help us run our Services, and in the specific situations below. We do not sell your information.

Service providers. We may share your data with vendors who perform services for us and need access to that information to do the work. Our contracts require them to use your information only on our instructions, keep it confidential, protect it, and retain it only as long as we direct. The categories of service providers we use are:

• Website hosting service providers
• Data storage service providers
• Communication and collaboration tools, such as email

We may also share your personal information in the following situations:

• Business transfers. In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business.
• Our subsidiaries. Health Care Originals is a parent company. Based on the area of interest you select, we pass your inquiry to the relevant lead within the applicable Health Care Originals subsidiary so they can contact you. Neurological inquiries are handled by HCO Neuro, which operates as Imago Rehab. Respiratory inquiries are handled by our respiratory division, which is also branded as Nightingale (ndh.health) in some campaigns. Our subsidiaries use your information only for the purpose described above and are required to honor this Privacy Notice. This internal routing is not a sale or sharing of your information with third parties.
• Legal requirements. Where required by law, subpoena, or other legal process, or to protect the rights, property, or safety of us or others.

In short: Only one strictly necessary session cookie, and only if you choose to access our gated investor materials. We do not use advertising or cross-site tracking.

If you choose to access our gated investor materials, we set one first-party session cookie after you enter a correct passcode. It holds a random session identifier, not your email address, and it is deleted when you close your browser. If you do not want this cookie, simply do not continue with the investor access step. No other part of our Website sets cookies.

We do not use advertising cookies, tracking pixels, web beacons, Google Analytics, retargeting, or social media tracking on our Website. Our fonts are served from our own servers. Links to YouTube, LinkedIn, X, and other sites are plain links; nothing from those services loads on our pages unless you click through.

Details are in our Cookie Policy. If we ever add cookies that are not strictly necessary, we will update this notice and our Cookie Policy and ask for your consent where required.

In short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Specifically:

• "Ready to get started" form. The information you submit is kept for 2 years from the date of your submission.
• Investor materials access. The email address you use to access our gated investor materials is kept for 2 years from the date of access.

Separate relationships. Your investor access email is kept separately and is never used to contact you. You may also give us the same email address through another lawful channel you have consented to, such as contacting us directly, submitting our form, or an existing business relationship. In that case we may contact you under that separate consent. Contact through that channel does not mean we used your investor access record, and a matching email address alone does not show that this notice has been breached.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because it has been stored in backup archives), we will securely store it and isolate it from any further processing until deletion is possible.

In short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process, including encrypted (HTTPS) connections to our Website. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorized third parties will not be able to defeat our security. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In short: We do not knowingly collect data from or market to children under 18 years of age through our Website.

Our Website is intended for adults. We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. Where a minor participates in one of our clinical programs, a parent or legal guardian enrolls them and provides any required consent. If we learn that personal information from a child has been collected through our Website, we will take reasonable measures to promptly delete it. If you become aware of any such data, please contact us at info@healthcareoriginals.com.

In short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that give you greater access to and control over your personal information.

In some regions (like the EEA, UK, Switzerland, and Canada), you may have the right (i) to request access to and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request using the contact details in section 14 below. We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the UK

If you are unhappy with how we have handled your personal information, you can complain directly to us. This is in addition to your rights under the UK GDPR and the Data Protection Act 2018.

• Online: healthcareoriginals.com/contact
• Email: info@healthcareoriginals.com
• Post: see section 14 below

We will acknowledge your complaint within 30 days of receiving it, investigate without unjustifiable or excessive delay, keep you informed of progress, and explain the outcome. If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office (ICO), the UK supervisory authority: website ico.org.uk/make-a-complaint, helpline 0303 123 1113, or post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us. This will not affect the lawfulness of processing before its withdrawal, nor processing conducted in reliance on lawful grounds other than consent.

Opting out of marketing communications

You can unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in our emails, replying "STOP" or "UNSUBSCRIBE" to our SMS messages, or contacting us. We may still send you service-related messages that are necessary to respond to your requests or administer the Services.

Cookies

Our Website does not set cookies, so blocking or deleting cookies in your browser will not affect how it works. See our Cookie Policy for details.

Most web browsers include a Do-Not-Track ("DNT") setting. No uniform technology standard for recognizing DNT signals has been finalized, so we do not respond to DNT signals specifically. Because we do not track you across websites or use advertising trackers, there is no cross-site tracking for DNT to switch off. If a standard for online tracking is adopted that we must follow, we will describe that practice in a revised version of this Privacy Notice.

Global Privacy Control. We recognize and honor Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of your personal information for targeted advertising under applicable state privacy laws, including the California Consumer Privacy Act (CCPA). We do not sell or share personal information for targeted advertising, but if we ever begin to, we will automatically apply your GPC opt-out. Learn more at globalprivacycontrol.org.

In short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and details about the personal information we maintain about you, correct inaccuracies, get a copy of, or delete it. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve months.

We may also collect other personal information when you interact with us in person, online, by phone, or by mail in the context of receiving support, taking part in customer surveys, or when we deliver our Services and respond to your inquiries. We retain Category A, B, and I information for as long as needed to respond to you and maintain our business relationship. Category F and G information is processed in aggregate and is not linked to you.

Sources, use, and sharing

Learn about the sources of personal information in section 1, how we use it in section 2, and who we disclose it to in section 4. We disclose personal information only to service providers under written contracts. We may use your personal information for our own business purposes, such as internal research for technological development and demonstration; this is not a "sale."

We have not sold or shared personal information with third parties for targeted advertising in the preceding twelve months.

Your rights

You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases we may decline your request as permitted by law. They include the right to:

• Know whether or not we are processing your personal data
• Access your personal data
• Correct inaccuracies in your personal data
• Request the deletion of your personal data
• Obtain a copy of the personal data you previously shared with us
• Non-discrimination for exercising your rights
• Opt out of the processing of your personal data if it is used for targeted advertising (or "sharing" as defined under California law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

Depending on the state where you live, you may also have the right to:

• Access the categories of personal data being processed (for example, in Minnesota)
• Obtain a list of the categories of third parties to which we have disclosed personal data (for example, in California, Delaware, and Maryland)
• Obtain a list of specific third parties to which we have disclosed personal data (for example, in Minnesota and Oregon)
• Obtain a list of third parties to which we have sold personal data (for example, in Connecticut)
• Review, understand, question, and correct how personal data has been profiled (for example, in Connecticut and Minnesota)
• Limit use and disclosure of sensitive personal data (for example, in California)
• Opt out of the collection of sensitive data and personal data collected through a voice or facial recognition feature (for example, in Florida)

How to exercise your rights

Email us at info@healthcareoriginals.com, visit our contact page, or use the contact details in section 14. We will honor your opt-out preferences if you enable the Global Privacy Control signal in your browser. You can designate an authorized agent to make a request on your behalf; we may deny a request from an agent who does not submit proof of valid authorization.

Request verification

When we receive your request, we will need to verify your identity. We will only use personal information provided in your request to verify your identity or authority to make it. If we cannot verify your identity from the information we already hold, we may ask for additional information for verification and fraud prevention. If you submit a request through an authorized agent, the agent will need to provide your written and signed permission.

Appeals

If we decline to take action on your request, you may appeal by emailing us at info@healthcareoriginals.com. We will inform you in writing of any action taken or not taken in response, with a written explanation. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine the Light" law

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year, and the names and addresses of those third parties. To make such a request, write to us using the details in section 14.

Mobile/phone number. We may collect your mobile or other telephone number when you enroll in a program, complete a form, request information, schedule services, or otherwise communicate with us. We use it to contact you about your account or requested services, provide support, deliver appointment or service-related communications, and send SMS messages where you have given the necessary consent.

Advertising and marketing. Your mobile phone number, telephone number, SMS consent, SMS opt-in status, and SMS messaging data are not shared, sold, rented, or disclosed to third parties or affiliates for advertising, marketing, or promotional purposes. They are used solely to provide the communications and services you have requested, except where disclosure is required by law or is necessary for service providers acting on our behalf to deliver the requested messaging.

Types of SMS messages. If you choose to receive text messages from us, you may receive appointment reminders, scheduling confirmations or changes, care coordination communications, service updates, account notifications, verification or security codes, responses to your inquiries, and other information necessary to provide our services. We will only send marketing SMS messages where permitted by law and where you have provided any required consent.

Message frequency. Message frequency varies depending on your interactions with us and the services you receive.

Message and data rates. Standard message and data rates may apply. Charges, if any, are determined by your mobile carrier and are your responsibility.

Opt-out. Reply STOP to any message to stop receiving SMS messages from us. After we process your request, you will no longer receive SMS messages except to confirm your opt-out or where otherwise permitted by law.

Help. Reply HELP to any message, or contact us using the details in section 14.

Consent is not required. Consenting to SMS messages is voluntary. Choosing not to receive them will not affect your ability to receive healthcare services or take part in our programs. Other ways to communicate are available on request.

Privacy of SMS information. Mobile phone numbers, SMS opt-in information, and SMS messaging data are expressly excluded from any advertising- or marketing-related sharing. We may disclose them only as required by law or to service providers acting on our behalf to deliver SMS communications under appropriate contractual and confidentiality obligations.

In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by the "Last updated" date at the top of this page. If we make material changes, we may notify you by prominently posting a notice of the changes or by sending you a notification directly. We encourage you to review this Privacy Notice frequently.

If you have questions or comments about this notice, you may contact our Data Protection Officer (DPO) by email, by phone, or by post:

Based on the laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete it. You may also have the right to withdraw your consent to our processing. To make a request, email info@healthcareoriginals.com with the subject line "Data request."