COMPANY LOGO - VAULT HEALTH LOGIN PRIVACY POLICY Vault Health, Inc. Privacy Policy Last modified: July 22, 2021 1. Introduction This Privacy Policy describes how Vault Health, Inc. collects, uses Personal Data (defined below) about you through the use of our Website and through email, text, and other electronic communications between you and Vault Health, Inc. Vault Health, Inc. (“Vault Health,” or “we,” “our,” or “us”) respects your privacy and are committed to protecting it through our compliance with this policy. This Privacy Policy (our “Privacy Policy”) describes the types of information we may collect from you or that you may provide when you visit the following public websites that are owned and operated by Vault Health: www.vaulthealth.com, www.fssolutions.com (our “Website”), and our practices for collecting, using, maintaining, protecting, and disclosing that information. This Privacy Policy applies to information we collect: on our Website; in email, text, and other electronic messages between you and our Website; when you interact with our advertising and applications on third-party websites and services, if those applications or advertising include links to this policy. It does not apply to: information collected by us offline or through any other means, including on any other website operated by Vault Health or any third-party; information collected by any third party, including through any application or content (including advertising) that may link to or be accessible from or on the Website. the collection and use of certain employment-related information. the practices of companies we do not control. You understand that Vault Health, Inc. provides administrative services to Vault Medical Services, P.A., Vault Medical Services of New Jersey, P.C., Vault Medical Services of California, P.C., Omni Performance Practices, P.A., and Union Square Physician Services, P.C., (for purposes of this Privacy Policy only, the aforementioned entities shall be referred to collectively as "Vault Medical Services") each of which are independently owned by licensed physicians. Vault Health, Inc. does not own these medical practices, employ or in any way supervise or control the individuals providing care. The care provided by a Vault Medical Services practice is the sole responsibility of each independent entity and the individuals each Vault Medical Services practice employs or contracts with. I understand that care provided by a Vault Medical Services practice shall be completely separate and apart from any care I may be provided by another Vault Medical Services practice. Services and office practices may vary across Vault Medical Services practices and I should contact the specific entity for all questions related to the health care services I receive. This form has been reviewed and approved by the entities listed above. Vault Medical Services (or your own medical provider if you do not use a Vault Medical Services Provider) is responsible for providing you with a Notice of Privacy Practices describing its collection and use of your health information. If you do not agree to be bound by those terms, you are not authorized to access or use our Website, and you must promptly exit our Website. Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Website. By accessing or using our Website, you agree to this Privacy Policy. This Privacy Policy may change from time to time (see below Changes to Our Privacy Policy). Your continued use of our Website after we make changes is deemed to be acceptance of those changes, so please check this Privacy Policy periodically for updates. 2. Children Under the Age of 18 Our Website is not intended for children under the age of 18 and children under the age of 18 are not permitted to use our Website. We will remove any information about a child under the age of 18 if we become aware of it. Our Website is not intended for children under 18 years of age. No one under age 18 may provide any information to or through the Website. We will remove any information about a child under the age of 18 if we become aware of it. (For Covid-19 Testing services, individuals under the age of 18 may utilize our Website, but only with the participation of a parent or legal guardian.) Except as otherwise provided above, our Website is not intended for children under 18 years of age. No one under age 18 may provide any information to or through the Website. We do not knowingly collect Personal Data from children under 18. If you are under 18, do not use or provide any information on our Website or on or through any of their features, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received Personal Data from a child under 18, we will take reasonable steps to delete that information. If you believe we might have any information from a child under 18, please contact us at privacynotices@vaulthealth.com. 3. Information We Collect About You and How We Collect It We collect different types of information about you, including information that may directly identify you, information that is about you but individually does not personally identify you, and information that we combine with our other users. This includes information that we collect directly from you or through automated collection technologies. General We collect several types of information from and about users of our Website, specifically information: by which you may be personally identified, such as name, postal address, billing address, shipping address, e-mail address, telephone numbers (home, work, and mobile), driver’s license number and other government identification numbers, date of birth, credit or debit card number (for payment purposes only), photos of you, and other personal information (“Personal Data”); that is about you but individually does not identify you, such as traffic data, location data, logs, referring/exit pages, date and time of your visit to our Website, error information, clickstream data, and other communication data and the resources that you access and use on the Website; and/or about your internet connection, the equipment you use to access our Website and usage details. We collect this information: directly from you when you provide it to us; automatically as you navigate through the Website. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, geo-location services, and other tracking technologies; and from third parties, for example, our service vendors. Information You Provide to Us The information we collect on or through our Website: information that you provide by filling in forms on our Website. This includes information provided at the time of registering to use our Website, completing a questionnaire, or requesting further services. We may also ask you for information when you report a problem with our Website; records and copies of your correspondence (including email addresses), if you contact us; your responses to surveys that we might ask you to complete; details of transactions that may be tracked through our Website and of initiation of services. You may be required to provide financial information as part of initiation of services through our Website, which is processed by contracted vendors. Information We Collect From Vault Medical Services Some of the Personal Information received by Vault Health in connection with the Services may be provided by health care providers that are subject to laws and regulations, such as rules issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), that govern providers’ use and disclosure of certain individually identifiable health-related Personal Information (“Protected Health Information”). When we receive Protected Health Information, we may do so as a “business associate” of the health care provider under an agreement that, among other things, prohibits us from using or disclosing the Protected Health Information in ways that are not permissible by the health care provider itself, and requires us to implement certain measures to safeguard the confidentiality, integrity, and availability of the Protected Health Information. When we act as a Business Associate, we may be subject to certain laws and regulations, including certain HIPAA rules, that govern our use and disclosure of Protected Health Information and that may be more restrictive than otherwise provided in this Privacy Policy. For more information about our HIPAA-compliant activities, please contact privacynotices@vaulthealth.com] Practice Users: Vault Health makes its Website and its services available to Vault Medical Services practices for a variety of uses described in our Terms of Service. In order to provide the services to our Vault Medical Services practices (“Practice Users”), Vault Health collects certain Personal Information such as contact and registration information from the Practice User employee signing up on behalf of the Practice User. Vault Health collects and uses Practice User information the same way we collect and use Personal Data. Information We Collect Through Automatic Data Collection Technologies As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, specifically: details of your visits to our Website, such as traffic data, location data, logs, referring/exit pages, date and time of your visit to our Website, error information, clickstream data, and other communication data and the resources that you access and use on the Website; and Information about your computer, mobile device, and internet connection, specifically your IP address, operating system, and browser type. The information we collect automatically may include Personal Data or we may maintain it or associate it with Personal Data we collect in other ways or receive from third parties. It helps us to improve our Website and to deliver a better and more personalized service by enabling us to: estimate our audience size and usage patterns; verify your location to ensure we can provide you with our services; store information about your preferences, allowing us to customize our Website according to your individual interests; recognize you when you return to our Website. The technologies we use for this automatic data collection may include: Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer or mobile device. On your computer, you may refuse to accept browser cookies by activating the appropriate setting on your browser, and you may have similar capabilities on your mobile device in the preferences for your operating system or browser. However, if you select this setting you may be unable to access certain parts of our Website. Unless you have adjusted your browser or operating system setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Website. Web Beacons. Pages of our Website and our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Vault Health, for example, to count users who have visited those pages, used those screens, or opened an email and for other related Website statistics (for example, recording the level of engagement with certain Website content and verifying system and server integrity). Google Analytics. We use Google Analytics, a web analytics service provided by Google, Inc. (“Google”) to collect certain information relating to your use of the Website. Google Analytics uses “cookies”, which are text files placed on your computer, to help the Website analyze how users use the site. You can find out more about how Google uses data when you visit our Website by visiting “How Google uses data when you use our partners' sites or apps”, (located at www.google.com/policies/privacy/partners/). We may also use Google AdWords or other advertising networks to provide you with interest-based advertising based on your online activity. For more information regarding Google Analytics please visit Google's website, and pages that describe Google Analytics, such as www.google.com/analytics/learn/privacy.html. 4. How We Use Your Information We use your Personal Data for various purposes described below, including to: provide our Website to you; develop care coordination services for you; provide you with information you request from us; enforce our rights arising from contracts; notify you about changes; and provide you with notices about your account. We use information that we collect about you or that you provide to us, including any Personal Data: to present our Website and its contents to you; to provide you with information, products, or services that you request from us; to register and service your account; to track administration of care coordination transactions and initiation of services you request; to contact you in response to a request; to fulfill any other purpose for which you provide it; to carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for administration of care coordination transactions; to notify you about changes to our Website or any care coordination services; in any other way we may describe when you provide the information; and for any other purpose with your consent. We may also use your information to contact you about services that may be of interest to you, including through newsletters. If you wish to opt-out of receiving such communications, you may do so at any time by clicking unsubscribe at the bottom of these communications or by visiting your account profile page. For more information, see below Choices About How We Use and Disclose Your Information. We may use how you browse in order to show you ads that are more relevant to your interests. We may use cookies and other information to provide relevant interest-based advertising to you. Interest-based ads are ads presented to you based on your browsing behavior in order to provide you with ads more tailored to your interests. These interest-based ads may be presented to you while you are browsing our site or third party sites not owned by Vault Health. We will keep your Personal Data for as long as it remains necessary for the identified purpose or as required by law, which may extend beyond the termination of our relationship with you. We may retain certain data as necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, non-personally-identifiable data, account recovery, or if required by law. Unless otherwise set forth in the applicable Terms of Service or a separate agreement with you, if you cease using the Website, we may retain or destroy, at our discretion, all Personal Data and non-personally identifiable information we collect through your use of such Website. All retained information will remain subject to the terms of this Privacy Policy. 5. Disclosure of Your Information We do not share, sell, or otherwise disclose your Personal Data for purposes other than those outlined in this Privacy Policy. We disclose your Personal Data to: our third-party service providers that we use to support the operations of a Vault Medical Services practice; to a company we merge, acquire, or that buys us, or in the event of change in structure of our company of any form; to comply with our legal obligations; to enforce our rights; and with your consent. We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose Personal Data that we collect or you provide as described in this privacy policy: to contractors, service providers, and other third parties we contract with to support our business. The services provided by these organizations include but are not limited to providing IT and infrastructure support services, marketing, and payment processing services, if any Personal Data is considered Protected Health Information, it is only shared with contractors, service providers and third parties who are required to contractually comply with applicable state and federal privacy laws and regulations; to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Vault Health about our Website users are among the assets transferred; to fulfill the purpose for which you provide it. For example, we may disclose your Personal Data to a Vault Medical Services individual provider; for any other purpose disclosed by us when you provide the information; and with your consent. We may also disclose your Personal Data: to comply with any court order, law, or legal process, including to respond to any government or regulatory request; to enforce or apply our and other agreements, including for billing and collection purposes; and if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Vault Health, Vault Medical Services practices, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction. 6. Opting Out of Disclosure and Use of Your Information You can opt out of our use of tracking technology, disclosure of your Personal Data which we may use for internal communications to you about new services your Vault Medical Services practice may offer. In addition, we strive to let you determine the Personal Data you provide to us. We have created mechanisms to provide you with control over your Personal Data: Tracking Technologies and Advertising. You can set your browser or operating to refuse all or some cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of our Website may then be inaccessible or not function properly Promotional Offers from your Vault Medical Services practice (sent by Vault Health) (Please Note: This section does not apply to any clinical trial activities with which a Vault Medical Services practice may be involved -- no clinical trial participants shall be sent any promotional offers or other promotional communications). If you do not wish to have your email address used by Vault Health, on behalf of your Vault Medical Services practice, to promote new services offered by your Vault Medical Services practice and coordination services, you can opt-out at any time by clicking the unsubscribe link at the bottom of any email or other marketing communications you receive from us or logging onto your Account profile page. If you wish to opt-out of such communications, please change your preferences in your account page or email us privacynotices@vaulthealth.com. Targeted Advertising. (Please Note: This is NOT applicable to the COVID-19 sections of the website as it relates to any clinical trial activities with which a Vault Medical Services practice may be involved -- no clinical trial participants shall be intentionally sent any targeted advertising offers or other targeted advertising communications). We belong to ad networks that may use your browsing activity across participating websites to show you interest-based advertisements on those websites. To learn more about interest-based advertisements and your opt-out rights and options, visit the Digital Advertising Alliance and the Network Advertising Initiative websites (www.aboutads.info and www.networkadvertising.org). Please note that if you choose to opt out, you will continue to see ads, but they will not be based on your online activity. We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can also opt out of receiving targeted ads from members of the NAI on its website. 7. Your Rights Regarding Your Information and Accessing and Correcting Your Information You may review and change your personal information by logging into our Website and visiting your Account profile screen. You can review and change your Personal Data, except data that is entered into your medical record by your provider, by logging into our Website and visiting the account profile sections of our Website. You may also notify us through the Contact Information below of any changes or errors in any Personal Data we have about you to ensure that it is complete, accurate, and as current as possible or to delete your account. We cannot delete your personal information except by also deleting your account with us. We may also not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect. 8. Do Not Track Signals We may use automated data collection technologies to track you across websites. We currently do not honor do-not-track signals that may be sent by some browsers. We also may use automated data collection technologies to collect information about your online activities over time and across third party websites or other online services (behavioral tracking). Some web browsers permit you to broadcast a signal to websites and online services indicating a preference that they “do not track” your online activities. At this time, we do not honor such signals and we do not modify what information we collect or how we use that information based upon whether such signal is broadcast or received. 9. Data Security Information transmitted over the Internet is not completely secure, but we do our best to protect your Personal Data. You can help protect your Personal Data and other information by keeping your password to our Website confidential. We have implemented measures designed to secure your Personal Data from accidental loss and from unauthorized access, use, alteration, and disclosure. We use encryption technology for information sent and received by us. The safety and security of your information also depends on you. Where you have chosen a password for the use of our Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Data, we cannot guarantee the security of your Personal Data transmitted to our Website. Any transmission of Personal Data is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website or in your operating system. 10. Your California Privacy Rights Under some circumstances, California law may provide you with the right to obtain a list of third parties (if any) that we provide your Personal Data to for their own direct marketing purposes. California Civil Code Section 1798.83 (California’s “Shine the Light” law) permits users of our Website that are California residents and who provide Personal Data in obtaining products and services for personal, family, or household use to request certain information regarding our disclosure of Personal Data to third parties for their own direct marketing purposes. If applicable, this information would include the categories of Personal Data and the names and addresses of those businesses with which we shared your Personal Data with for the immediately prior calendar year (e.g., requests made in 2019 will receive information regarding such activities in 2018). You may request this information once per calendar year. To make such a request, please send an email to privacynotices@vaulthealth.com or by using the Contact Information below. 11. Changes to Our Privacy Policy We will post any changes to our Privacy Policy on our Website. If we make material changes to our Privacy Policy, we may notify you of such changes through your contact information and invite you to review (and accept, if necessary) the changes. We may change this Privacy Policy at any time. It is our policy to post any changes we make to our Privacy Policy on this page with a notice that the Privacy Policy has been updated on the Website’s home page. If we make material changes to how we treat our users’ Personal Data, we will notify you by email to the email address specified in your account and/or through a notice on the Website’s home page. The date this Privacy Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and reviewing this Privacy Policy to check for any changes. 12. Contact Information You may contact us through the contact information below. If you have any questions, concerns, complaints or suggestions regarding our Privacy Policy or otherwise need to contact us, you may contact us at the contact information below or through the “Contact” page on our Website. How to Contact Us: Vault Health, Inc. Attn: Patient Experience Team 255 Alhambra Circle, Suite 700 Coral Gables, FL 33134 Telephone: (212) 880-5494 Email: hello@vaulthealth.com CAREERS CONTACT MEDIA PATIENT LOGIN FAQ PRIVACY POLICY TERMS & CONDITIONS ACCESSIBILITY NOTICE OF PRIVACY PRACTICES The clinical information in your patient portal is provided on behalf of your health care provider to facilitate your care. If you have any questions about your care, please contact your health care provider. All content in your patient portal has been approved by the health care practice from which you receive care. Vault Health, Inc. provides administrative services to Vault Medical Services, P.A., Vault Medical Services of New Jersey, P.C., Union Square Physician Services, P.C., and Vault Medical Services of California, P.C., each of which are independently owned by licensed physicians. Vault Health, Inc. does not own these medical practices, employ or in any way supervise or control the health care providers rendering care. The care provided by each health care practice is the sole responsibility of such practice and the providers the practice employs or contracts with. Services and office practices may vary across entities and you should contact the specific entity for all questions related to the health care services you receive. Vault Health, Inc. does not provide pharmacy services. Medications that may be prescribed with a valid prescription by health care providers employed or contracted by the physician practices Vault Health provides administrative services to are fulfilled and shipped by independent third-party licensed pharmacies. COMPANY LOGO - VAULT HEALTH © VAULT HEALTH INC. 2021