Privacy Policy

I. Patient Privacy Policy

A. Acceptance of Terms

Medbridge Inc. ("Medbridge") is committed to protecting Your privacy when You visit the Medbridge website located at the URL www.medbridge.com, the Medbridge Mobile App, and other websites owned by Medbridge, including personalized white label websites (collectively, the "Medbridge Website", as defined below).

This Privacy Policy explains to You how Medbridge collects and uses Your Personal Information. This document should be read in conjunction with the Medbridge Patient Terms of Use.

Medbridge reserves the right to append or otherwise modify this privacy statement at any time.

B. Term Definitions

1. The term "Medbridge Website" or "Website" refers to the Medbridge website accessible through the URL www.medbridge.com, https://medbridgego.com, https://medbridgepathways.com the Medbridge Mobile App, and other websites owned by Medbridge, including personalized white label websites.

2. The term "Medbridge" refers to Medbridge, Inc.

3. The term "Medbridge Mobile App" or "Mobile Apps" refers to the Medbridge GO Mobile application (available as an iOS and Android application) and Medbridge's Pathways products (located at https://medbridgepathways.com) that provides User's access to their assigned courses, patient exercises, and treatment programs from their computer, smartphone, or tablet.

4. The term "User Profile" refers to a profile created by or assigned to a User on the Medbridge Website.

5. The terms "You", "Your" or "User" refer to any individuals and/or entities visiting and/or otherwise accessing the Medbridge Website for any reason.

6. The term "Content" refers to all information, data, text, software, music, sound, photographs, graphics, video, messages, tags, or other materials posted or otherwise displayed on, to, or at the Medbridge Website.

7. The term "Personal Information" includes, but is not limited to, any information that identifies or describes an individual, including his or her name, professional licensing information, social security number, physical description, age, gender, marital status, health status, financial status, home address, home telephone number, education, financial matters, and medical or employment history. Personal Information may also include statements made by, or attributed to, a User.

C. Collection of User Data

Medbridge collects user data, including Protected Health Information, during registration and use of the Medbridge Website and associated services as described below.

Collection and processing of user data occur with the notice to the User and ability of the User to modify, opt-in/out, and the ability to request cessation of collection and retention in accordance with all governing laws and regulations.

Medbridge uses collected data for the legitimate business purpose of providing, optimizing, and personalizing the services offered by Medbridge and its partners, improving patient programs, and for aggregated and deidentified analysis.

II. Your Personal Information

A. Information Collected by Medbridge

By voluntarily creating a User Profile on the Medbridge website, You agree to the Medbridge Terms of Use, this Privacy Policy, and consent to Medbridge's collection of Personal Information. To establish Your User Profile, Medbridge collects Your name, email address, phone number, and date of birth.

Medbridge collects additional Personal Information when You continue the use of the site and agree to its Terms of Use in order to receive Medbridge services, and access the Content on the Medbridge Website and Mobile Apps. When You assign or complete education courses, patient exercises, or treatment programs, on the Medbridge website, Medbridge collects data relating to the assignment and completion of courses, patient exercises, or treatment programs. System use is tracked through a combination of pixel tracking, cookies, and third-party services. Functional use of the Medbridge system requires essential tracking cookies and systems with remaining functionality being controlled by the User's preferences which can be modified within the settings page.

Within the last twelve months, Medbridge has collected the following categories of Personal Information from consumers:

Personal Information is provided at Your own risk. By providing Your Personal Information, You are communicating Your consent to Medbridge's collection, use and disclosure of such Personal Information for the purposes for which You provided the Personal Information to Medbridge and as described in this Privacy Policy.

B. Data Controller

For the majority of the Personal Information maintained, collected, or used by Medbridge, Medbridge is the data controller who is responsible for determining the purpose and means of processing personal data.

For some healthcare data, Your individual healthcare provider or their organization may be the data controller for whom Medbridge holds and processes data. Inquiries can be directed to [email protected].

C. Using Your Information

Personal Information is collected about You in order to establish and enhance our relationship with You. Medbridge's use of this Persona Information includes the following:

To personalize Your experience, so Medbridge is better able to respond to Your individual needs;

Improve its website through Your feedback;

More effectively responding to customer service requests and support needs and improve customer service;

Process transactions;

Contacting You;

Conducting research and compiling aggregate data for internal and external business purposes; and

Any other purpose disclosed to You at the time Medbridge collects Your information.

Much of the Personal Information collected by Medbridge is necessary for proper functioning of the Medbridge Website and Your use of the Medbridge products. For example, You may not be able to create a User account or reset Your password without provision of a valid email address. Further, Medbridge will store Your log-in credentials on Your device while using the Medbridge Mobile App, to provide a seamless experience. In these situations, if You choose to withhold any Personal Information requested by Medbridge, it may not be possible for You to gain access to certain parts of the Medbridge Website or Mobile Apps.

D. Updating and Deleting Your Information

On the Medbridge Website You can correct, update, review, or delete Personal Information You have submitted by going back to the specific tool and making the desired changes.

If You are unable to make the changes on the Medbridge Website, You can request Medbridge to change, correct, or delete Personal Information by contacting Medbridge at [email protected] or call (888) 824-9839.

You have the right to withdraw consent to Medbridge's use or processing of Your Personal Information at any time. If You refuse to consent to, opt out of, or withdraw Your consent, Medbridge may not be able to offer You certain services or benefits. Consent may be removed by emailing [email protected] or calling (888) 824-9839.

E. Retention of Information

Medbridge stores and retains Personal Information based on the level of sensitivity of this information for the period specified by the applicable legal and regulatory requirements. For some healthcare data, Your individual provider and/or their organization may require Medbridge to retain data based on their individual legal and contractual requirements.

F. Information Sharing and Disclosure

Medbridge may share Your Personal Information with trusted third parties who assist Medbridge in operating its website, conducting its business, or serving You, as long as those parties agree to keep this Personal Information confidential to the extent outlined under this Privacy Policy and consistent with all applicable laws and regulations. Medbridge may also release Your Personal Information when Medbridge believe it is needed to comply with the law, enforce its site policies, or protect ours or others' rights, property, or safety. Non-personally identifiable information may be provided to other parties for marketing, advertising, or other uses.

G. Sale of Personal Information

In the past twelve months, Medbridge has not sold any collected Personal Information to third parties.

H. Changes in Medbridge Inc.

If Medbridge is sold, merged, or otherwise transferred, Personal Information may be transferred along with it.

I. Information Use related to the Use of the Medbridge Mobile App

You may also opt into receiving Push Notifications from the Medbridge Mobile App. If You wish to stop receiving push notifications, You may turn off this feature in the settings on Your device or respond to any notification with the provided Stop code.

When You delete the Medbridge Mobile App, any Personal Information saved in Your device will be deleted, but any Personal Information collected and stored by Medbridge will remain in its server.

J. Additional Information Use

Medbridge may use Your email for transactional purposes, as well as for promotional purposes. Transactional purposes include confirmation and notification of changes to Your account. Promotional purposes include sending You newsletters about new features, special offers, promotional announcements, consumer surveys, and other items concerning our service. During registration at the Medbridge Website, You may be signed up to receive promotional email newsletters from Medbridge, unless disallowed by Your jurisdiction of residence. Email messages may contain code that enables Medbridge's database to track Your usage of the emails to determine whether the email was opened and what links, if any, were clicked. Should You prefer not to receive promotional emails from us, please edit the preferences in Your account menu or click Unsubscribe at the bottom of any promotional emails.

K. Access to Information

Users may have a right to request access to Your Personal Information collected or processed by Medbridge. You can request such access by contacting Medbridge at [email protected]. Upon verification of Your identity, Medbridge will make sure to provide You with a copy of the data Medbridge processes about You. In some circumstances Medbridge may need to work with Your healthcare provider in order to provide copies of sensitive information.

L. International Privacy Laws

If You are accessing the Medbridge Website and associated services from outside the United States, please be aware that You are sending Personal Information (including Personal Data) to the United States where Medbridge servers are located.

If You reside within the European Union, You may have the right to lodge a complaint regarding Medbridge's information collection and processing with Your local, national supervisory authority.

M. California Residents' Rights

This Section applies only to Users of the Medbridge Website who reside in the State of California.

Under the California Consumer Privacy Act of 2018 (CCPA) California consumers have the right to:

• Know the categories of Personal Information Medbridge collect and the categories of sources from which Medbridge obtained the information;

• Know the business or commercial purposes for which Medbridge collect and share Personal Information;

• Know the categories of third parties and other entities with whom Medbridge share Personal Information; and

• Access the specific pieces of Personal Information Medbridge have collected about You.

To obtain any additional information not found in this Privacy Policy, please send an email to [email protected] include Your name, email address, California postal address as well as the email associated with Your User Profile, if one exists ("Verification Information"). You may also exercise Your rights by calling (888) 824-9839.

Right to Deletion. In some circumstances You may ask Medbridge to delete Your Personal Information. To do so, please send an email Verification Information to [email protected]. You may also exercise Your right to delete Your Personal Information by calling (888) 824-9839.

Submission of Your Request. You may only submit a request to know twice within a 12-month period. Your request to know or delete must:

• Provide sufficient information that allows Medbridge to reasonably verify You are the person about whom Medbridge collected Personal Information or an authorized representative; and

• Describe Your request with sufficient detail that allows Medbridge to properly understand, evaluate, and respond to it.

Medbridge cannot respond to Your request, or provide You with Personal Information, if Medbridge cannot verify Your identity, Your authority to make the request, and confirm the Personal Information relates to You. You do not need to create an account with Medbridge to submit a request to know or delete Your Personal Information. Medbridge will use the Personal Information provided in Your request only to verify identity and authority.

Right to Opt Out of Sales. Medbridge does not share Your Personal Information with third parties in ways that may constitute a "sale" under CCPA. In line with this, Medbridge further does not sell Personal Information of consumers under 16 years of age. You may request that Medbridge do not "sell" Your Personal Information on a go forward basis. To do so, please email [email protected] and include Your Verification Information. You may also exercise Your right by calling (888) 824-9839. If You reengage with Medbridge after opting out of the "sale" of Your Personal Information, such as purchasing a new subscription, Your Personal Information will be collected and used in accordance with this Privacy Notice.

You have the right to not be discriminated against for exercising any of Your CCPA rights, and Medbridge will not do any of the following based on any exercise of Your rights:

• Deny You goods or services.

• Charge You different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

• Provide You a different level or quality of goods or services.

• Suggest that You may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, Medbridge may offer You certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive Medbridge offer will reasonably relate to Your Personal Information's value and contain written terms that describe the program's material aspects. Participation in a financial incentive program requires Your prior opt-in consent, which You may revoke at any time.

N. Text and SMS Messaging

In compliance with the Health Insurance Portability and Accountability Act (HIPAA) and guidelines provided by the Secretary of Health, Medbridge may request your consent to use SMS messaging for purposes including but not limited to program reminders, service notifications, Pathways messaging, and health-related communications. By opting into SMS communications, you authorize Medbridge to send you text messages to the mobile number you provided. You will be able to opt-out of receiving SMS messages at any time.

SMS messaging may not be secured or encrypted based on the technical limitations of the SMS system and your method of receiving that communication. Messaging rates and fees may apply and are controlled by Your specific plan.

III. Automatically Collected Information

As You use Medbridge, certain Personal Information may also be passively collected and stored on Medbridge's or its service providers' server logs, including Your Internet protocol address, browser type, and operating system. When You enter the Medbridge website, You are required to consent to Medbridge's use of Cookies in line with this Privacy Policy. Medbridge uses Cookies and navigational data like Uniform Resource Locators (URL) to gather information regarding the date and time of Your visit and the solutions and information for which You searched and viewed, or on which of the advertisements displayed on Medbridge You clicked. This type of Personal Information is collected to make Medbridge and solutions more useful to You and to tailor the experience to meet Your interests and needs.

Medbridge, or its service providers acting on Medbridge's behalf, use the following types of Cookies:

IV. Safety Measures

A. Payment Card Industry (PCI) Information

Medbridge use a variety of security measures to maintain the safety of Your Personal Information. Medbridge does not collect or process PCI Information from Users accessing the Medbridge Website or Mobile Apps as a patient. More information about Medbridge's PCI Compliance can be found at its General Privacy Policy.

B. Security Limitations Disclaimer

Medbridge cannot and does not guarantee that Personal Information You post on the Medbridge Website will not be accessed by unauthorized persons. Despite Medbridge's efforts to safeguard Your personal information, there is always a risk of security breach. Medbridge is not responsible for circumvention of any privacy settings or security measures of the Medbridge Website. You understand and acknowledge that, even after removal, copies of Personal Information on User Profiles may remain viewable in cached and archived pages or if other Users have copied or stored Your Personal Information.

The Medbridge Website might be linked to other websites, including but not limited to Facebook, LinkedIn, or Twitter, in order to better interact with its users and the public. Please be aware that Medbridge is not responsible for the privacy policies of those other websites. If users provide Personal Information directly to websites other than Medbridge, different terms, rules and privacy policies may apply for the use of personal information.

You are solely responsible for Your privacy settings. Medbridge is not and will not be responsible for Personal Information shared by You via a User Profile or the settings associated therewith.

C. Children's Privacy

Medbridge does not collect any Personal Information from anyone under 13 years of age. The Medbridge Website. Mobile Apps, and all Content posted on the Medbridge Website or Mobile Apps are directed at people who are older than 13 years. Minors below the age of 13 who need access to Medbridge programs or material should access all programs through an account controlled by their legal guardian.

Please direct additional Questions or Concerns to [email protected].

D. Changes to this Privacy Policy

Medbridge reserves the right to make changes to this privacy policy at any time by giving notice to its Users on this page. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom. If You object to any of the changes to the Policy, You must cease using the Medbridge Website and can request that Medbridge remove the Personal Information. Unless stated otherwise, the then-current privacy policy applies to all Personal Information Medbridge has about its Users.

Last Updated: 2/28/25