HealthBeacon Privacy Notice

This Privacy

This Privacy Notice is provided by HealthBeacon Limited (“HealthBeacon”) for participants and users of the HealthBeacon program, our electronic smart sharps bin (“HealthBeacon Unit”) and related services, and our website, web portal and mobile application (collectively, “Services”). This Privacy Notice covers the collection and use of your personal information in relation to your use of the Services. You should not use these Services if you do not agree to this Privacy Notice. We are firmly committed to protecting the confidentiality and security of your personal information. This Privacy Notice describes how we may use and disclose personal information, and your rights regarding your personal information. In the United States, HealthBeacon may use or disclose personal health information “PHI” to perform functions, activities and services for, provided that such disclosure would not violate the HIPAA Privacy and Security Rules if done by HealthBeacon.

For any medical questions, you must contact your HealthCare Provider.

METHODS OF PERSONAL INFORMATION COLLECTION

The personal information we collect and process depends on our relationship with you. We collect personal information directly from you, such as when you (i) input it into our programming forms; (ii) provide it to us over the phone and (iii) sign up to the HealthBeacon program. The information you disclose in connection with the Services is provided strictly on a voluntary basis. HealthBeacon is not responsible for the effects of any incorrect information provided.

We may also collect personal information from third parties. For example, we may collect personal information from service providers that help us to build and maintain our contact lists, that integrate their services into ours, or in other ways work with us for our mutual benefit. We may also collect personal information from you passively. For example, the Services use tracking tools like cookies, pixels, and web beacons to collect usage and browser information. For more information about the trackers that we use, please see the Collection of Cookies and Device Data section of this Notice. Additionally, if you enable location data on your device, this data will be collected based on the location settings on your device.

USES AND DISCLOSURE OF YOUR PERSONAL INFORMATION

We may collect personal information from or about you in order to provide, enhance, market, and offer the Services, and to otherwise communicate with you. This section describes the categories of personal information we may collect. You are not required to give us all the personal information identified in this Privacy Notice; however, if you do not provide requested personal information, we may not be able to provide you with some or all of the Services. The personal information collected as part of the Services may include:

• Name.
• Age and date of birth.
• Gender.
• Contact details (phone, address, e-mail, best time to contact).
• Contact details of parents, guardians, and authorized agents (name, phone number, email and relation to user).
• Healthcare professional, hospital / medical centre details, Details relating to medication being taken and how it is administered.
• Details of interactions with the Services, such as missed doses and any technical queries.
• Details of interactions with the Service team through the customer care support line and mobile app chat feature, such as individual SMS reminders, records, and email communications
• Details of interactions with HealthBeacon staff, including non-medical advice or training information. Information considered relevant by the HealthBeacon team you speak to, including adverse event notifications, complaints, information on clinical trial participation and service requests.
• Information related to your use of the Services (as described in the Collection of Cookies and Device Data).
• Data that is generated by or through use of the Services (including but not limited to diagnostic data), such as the time stamped image of the injection drop made, the time and date the injection drop was made, the location the injection drop was made, type of medication injection, and frequency and timing of the injections.
• Feedback on the Program. Users of the App cannot interact or exchange information with each other.

Users can only directly interact with the HealthBeacon support team through the App.

HOW WILL HEALTHBEACON USE YOUR INFORMATION

Your personal information will be used for:

• Program administration, correct use of your HealthBeacon Unit, delivery and collection of products and services;
• Reminding you when your medication is due, by SMS text, app notification, chat, phone or email as provided by you based on what was prescribed by your Health Care Professional;
• Tailoring the Services to you;
• Providing you with information relating to the Services;
• Providing you with educational materials and training sessions;
• Reviewing calls and mobile app chat content for quality control, service and product improvements and safety reporting purposes;
• Storing and managing your personal information on the our mobile application;
• Contacting you regarding any issues identified relating to the HealthBeacon services, to inform you of changes and to collect your feedback;
• We may disclose your personal information to relevant third parties such as auditors, lawyers, or other professional advisors;
• Protection against criminal activity, claims and other liabilities;
• Responding to reviews, comments, or other feedback provided to us;
• Protection of the security and integrity of the Services;
• Benchmarking, data analysis, audits, developing new products, enhancing the Services, facilitating product, software and applications development, improving the Services, conducting research, analysis, studies or surveys, identifying usage trends, as well as for other analytics purposes;
• Meeting our contractual requirements;
• Responding to inquiries related to employment opportunities; and
• Any other lawful purpose for which the personal information is collected

HealthBeacon will not use or disclose your personal information in a manner inconsistent with applicable law and this Privacy Notice.

In the United States, as permitted by HIPAA, we may disclose your PHI to: Public Health Authorities, The Food and Drug Administration, Health Oversight Agencies, Military Command Authorities, National Security and Intelligence Organization, Correctional Institutions, Organ and Tissue Donation Organizations, Coroners, Medical Examiners and Funeral Directors, Workers Compensation Agents.

Please be aware that we are required as stated in the Health Insurance Portability and Accountability Act (HIPAA) of 1996 to notify you in the event of a breach involving your PHI and will do so as required by law. You have the right to obtain a paper copy of this Privacy Policy by written request to the address below.

HOW WILL HEALTHBEACON SHARE YOUR INFORMATION

• Within HealthBeacon – We may share your personal information with our affiliates, subsidiaries, and employees.
• Service Providers – When we hire a service provider to help operate the Services or our business, we may allow access to personal information as necessary to perform the service for us. This may include service providers that operate the Services, collect payment, send our communications, or run our promotions.
• Business Partners – We may share personal information with our trusted business partners. For example, we may share your personal information with a company when we co-sponsor a promotion or service. These partners may use your personal information to, among other things, send you information or contact you about their services and products. Individual user location data is not shared however aggregated location data may be shared with HealthBeacon third parties, subject to any agreement HealthBeacon has entered into with that third party.
• Third Parties for Marketing Purposes – To the extent permitted by applicable law, we may share personal information with third parties for purposes of our marketing, advertising, promotions, contests, or other similar purposes. When necessary, we will only share such information in an aggregated and anonymized form.
• Legal Obligation or Protection from Harm – When we have a good faith belief that access, use, preservation or disclosure of the personal information is reasonably necessary to (a) satisfy or comply with any requirement of law, regulation, legal process, or enforceable governmental request, (b) enforce or investigate a potential violation of the Termsof Use, (c) detect, prevent, or otherwise respond to fraud, security or technical concerns, (d) support auditing and compliance functions, or (e) protect the rights, property, or safety of HealthBeacon, its users, or the public against harm.
• Mergers, Acquisitions, Divestitures – If we are involved in a merger, acquisition, or any form of transfer or sale of some or all of our business, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, personal information may be transferred along with the business. Where legally required we will give you prior notice and, if you have a legal right to do so, an opportunity to object to this transfer.
• Purposes Described to You – We may share your personal information for other purposes, as we describe to you and as permitted by applicable law. This may include sharing your name, date of birth, contact details (postal address, phone number and email address) and injection drop data with your healthcare professional, if you have consented to participation in a relevant program.

WHAT IS THE LEGAL JUSTIFICATION FOR OUR USE OF THE DATA?

We may be required to obtain personal information from you to comply with applicable legal requirements, and certain data may be needed to enable us to fulfil the terms of our contract with you, or in preparation of entering into a contract with you. If you do not provide the relevant data to us, we may not be able to provide our products and benefits to you. In the circumstances where we need your consent to collect and process your personal information, we will ask for such consent. We may need to collect, use and disclose personal information in connection with matters of important public interest, for instance when complying with our legal obligations.

COLLECTION OF COOKIES AND DEVICE DATA

Along with our third-party service providers we may collect user and device data in a variety of ways when you use HealthBeacon services including:

• internet browser and electronic device information
• app usage data
• data grouped together so that it is not possible to link the data to an individual, known as aggregated data.
• cookies and other tracking technologies including log files, pixel tags, web bugs, web beacons, clear GIFs, Local Storage Objects (LSOs) such as HTML5 and Flash or other similar technologies The below information may be aggregated and anonymized and used as described in this Privacy Notice.

Cookies are small files that download when you access certain websites. For more information about cookies visit: http://www.allaboutcookies.org/.

To assist us with analyzing our website traffic through cookies and similar technologies, we use analytics services such as Google Analytics. For more information on Google Analytics’ processing of your information, please see “How Google uses information from sites or apps that use our services.” You can opt out of Google Analytics by installing Google’s opt-out browser add-on.

These cookies may be placed by us (first-party) or by a third party. These cookies may also be Flash Cookies. To learn how to manage privacy and storage settings for Flash cookies click here. We may use cookies that are session-based or persistent. Session cookies expire when you close your browser or turn off your device. Persistent cookies remain on your device after you close your browser or turn off device.

We may use a variety of cookies:

Most internet browsers accept cookies by default. You can also accept, or block cookies by activating the setting on your browser that allows you to reject all or some cookies, or by changing your cookie preferences via the Services. The help and support area on your internet browser should have instructions on how to block or delete cookies. Some web browsers (including some mobile web browsers) provide settings that allow you to control or reject cookies or to alert you to when a cookie is placed on your computer, tablet or mobile device. Although you are not required to accept cookies, if you block or reject them, you may not have access to all of the features available through the Services.

• Cookie settings in Internet Explorer
• Cookie settings in Firefox
• Cookie settings in Chrome
• Cookie settings in Safari web and iOS.
• To find out more on how to manage and delete cookies, visit aboutcookies.org. For more details on your choices regarding use of your web browsing activity for interest-based advertising you may visit the following sites:
• networkadvertising.org
• optout.aboutads.info
• youradchoices.com
• youronlinechoices.eu On a mobile device, you may also adjust your settings to permit or limit ad tracking.

WHO IS RESPONSIBLE FOR THIRD PARTY SERVICES ACCESSED VIA HEALTHBEACON DIGITAL SERVICES?

We are not responsible for the privacy practices of any third parties, including any third party operating any site or service to which our Services link.

The inclusion of a link on our Services does not imply endorsement of the linked site or service by us or by our group companies. Please note that we are not responsible for the collection, usage and disclosure policies and practices (including the information security practices) of other organizations, such as Facebook®, Twitter®, Apple®, Google®, Microsoft®, RIM/Blackberry® or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or electronic device manufacturer, including any personal information you provide them.

CALL MONITORING AND COMMUNICATIONS

To ensure that we can meet the needs of our members we may record telephone calls to:

• Improve the standard of service that we provide by providing our team with feedback and training
• Address queries, concerns or complaints
• Prevent, detect and investigate crime, including fraud and money laundering, and analyse and manage other commercial risks
• Comply with our legal and regulatory obligations

We may also monitor electronic communications between us (for example, emails) to protect you, our business and IT infrastructure, and third parties. This monitoring may include identifying and dealing with inappropriate communications, looking for and removing any viruses, or other malware, and resolving any other information security issues.

CHILDREN UNDER THE AGE OF 13

The Services are meant for adults, and we will not knowingly collect personal information from any person under the age of 13 without permission from a parent or guardian. The Services is not designed to attract the attention of persons under the age of 13. No information should be submitted to us by any person under the age of 13. Individuals under the age of 18 should consult with their parent or guardian about the use of the Services for their benefit. If you are a parent or legal guardian and think your child has given us information, you can email us at support@healthbeacon.com. Please mark your inquiries “COPPA Inquiry.”

YOUR CHOICES

Depending on where you are located, you may have certain choices about how we use your personal information. To opt-out of marketing communications please email us at support@healthbeacon.com or by following the instructions included in the email or text correspondence. To exercise other rights with respect to your personal information, please contact us using the information in this Privacy Notice.

Please note that, even if you unsubscribe from certain correspondence, we may still need to contact you with important transactional or administrative information, as permitted by law. Additionally, if you withdraw your consent or object to processing, or if you choose not to provide certain personal information, we may be unable to provide some or all of the Services to you.

DURATION OF PROCESSING

HealthBeacon will use, process, and store personal information only for so long as you require us, or as legally required by set retention periods. As a company recording medical records, there are laws and regulations that apply to us which set minimum periods for retention of personal information.

For example: Where we hold personal information to comply with a legal or regulatory obligation, we will keep the information for at least as long as is required to comply with that obligation. Where we hold personal information in order to provide a product or service (such as a HealthBeacon), we will keep the information for at least as long as we provide the product or service. For further information about the period of time for which we retain your personal information, please contact us.

COMPELLED AND NECESSARY DISCLOSURES

In certain circumstances, we may be legally compelled to release your personal information in response to a court order, subpoena, search warrant, law or regulation

HOW YOU CAN CORRECT/ UPDATE YOUR PERSONAL INFORMATION

You can correct or update your personal information at any time by calling the HealthBeacon Customer Care Team using the phone number on the back of your HealthBeacon Unit.

RETENTION AND DESTRUCTION OF PERSONAL INFORMATION

Subject to any applicable business, legal, or regulatory requirements, we securely destroy personal information when it is no longer required to fulfil our services and commitments to you or to enforce our rights or meet our obligations.

WHERE DO WE PROCESS PERSONAL INFORMATION?

We process and store personal information both inside the United States and overseas. If you live outside of the United States, be advised that we may transfer your personal information to the United States and other countries, whose laws may not provide the same protections as the laws in your country. For information related to how we process, store, and transfer personal information of individuals in the European Union and United Kingdom, please review the “Information for Individuals in the EU and UK” section below.

HOW DO WE KEEP YOUR DATA SECURE?

Information security is extremely important to us. HealthBeacon uses appropriate technical, physical, legal and organisational measures, which comply with data protection laws to keep personal information secure. If, despite our efforts, you believe that personal information is no longer secure, please tell us so that we can resolve any security issue.

As most of the personal information we maintain is stored electronically, we have implemented appropriate IT security measures to ensure this personal information is kept secure. For example, we may use anti-virus protection systems, firewalls, and data encryption technologies. We have procedures in place at our premises to keep any hard copy records physically secure. Our HealthBeacon team receives regular training on data protection and information security.

When HealthBeacon engages a third party (including our service providers) to collect or otherwise process personal information on our behalf, the third party will be selected carefully and required to use appropriate security measures to protect the confidentiality and security of personal information.

Unfortunately, no data transmission over the Internet or electronic data storage system can be guaranteed to be 100% secure. If you believe that your interaction with us is no longer secure (for example, if you feel that the security of any personal information you might have sent to us has been compromised), please contact us immediately.

CALIFORNIA RESIDENTS

California enacted A.B. 370, amending the California Online Privacy Protection Act to require website operators like us to disclose how we respond to “Do Not Track Signals”; and whether third parties collect personally identifiable information about users when they visit us.

(1) We do not track users, who do not interact with its sharing functionality across the web, and therefore do not use “do not track” signals.

(2) We do not authorize the collection of personally identifiable information from our users for third party use through advertising technologies without separate member consent.

California Civil Code Section 1798.83 also permits our customers who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to quality@healthbeacon.com. Please note that we are only required to respond to one request per customer each year.

To the extent you are a California resident and your “Personal Information” is subject to the CCPA, this Section applies to our collection and use of Personal Information, as required by the California Consumer Privacy Act of 2018 and its implementing regulations (the “CCPA”). This Section describes (1) the categories of Personal Information, collected and disclosed by us, subject to CCPA, (2) your privacy rights under CCPA, and (3) how to exercise your rights.

When we use the term “Personal Information” in the context of the CCPA, we mean information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household.

If you would like to receive a copy of this Section in an alternate format (e.g., printable) or language, please contact us at support@healthbeacon.com.

A. Categories of Personal Information Collected, Used, and Shared

In accordance with California law, we may have collected and share the following categories of Personal Information within the past 12 months:

• Identifiers – A real name, Internet Protocol address, email address, and other types of online identifiers.
• Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) – e.g., a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some Personal Information included in this category may overlap with other categories.
• Internet or other similar network activity – Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.
• Geolocation data – Physical location or movements.
• Commercial information – Products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Protected classification characteristics under California or federal law – Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
• Professional or employment-related information – Current or past job history or performance evaluations.

We share each of these categories of Personal Information with our service providers to the extent necessary for them to facilitate our business purposes. We also share this Personal Information for the purposes set forth in this Privacy Notice.

B. Your California privacy rights

If you are a resident of California and your “Personal Information” is subject to the CCPA, you may have the following rights:

If you would like to exercise your rights listed above, please send (or have your authorized agent send) an email to support@healthbeacon.com or call us toll-free at: (857) 302-4872. Please note: you will not be discriminated against in any way by virtue of your exercise of the rights listed below, which means we will not deny goods or services to you, provide a different prices or rates for goods or services to you, or provide a different level or quality of goods or services to you. We must verify your identity before fulfilling your requests. If we cannot initially verify your identity, we may request additional information to complete the verification process. Any Personal Information you disclose to us for purposes of verifying your identitywill solely be used for the purpose of verification. If you are an authorized agent making a request on behalf of a California consumer, we will also need to verify your identity, which may require proof of your written authorization or evidence of a power of attorney.

We may deny certain requests, or only fulfil some in part, as permitted or required by law. For example, if you request to delete Personal Information, we may retain Personal Information that we need to retain for legal purposes (e.g., tax accounting). You have a right not to receive discriminatory treatment by any business when you exercise your California privacy rights.

INFORMATION FOR INDIVIDUALS IN THE EU AND UK

In accordance with European and UK law (collectively, the “GDPR”), individuals in the EU and UK may have additional rights relating to the collection and processing of personal information.

BASIS FOR PROCESSING

Our legal basis for processing the personal information described in this Notice will depend on the personal information concerned and the context in which we process it. We process personal information from you:

• where we need it to perform a contract with you;
• where the processing is in our legitimate interests (including the purposes described, above, in How We Use Personal Information);
• where the processing is necessary for us to meet our applicable legal obligations; or
• if we otherwise have your consent.

YOUR PRIVACY RIGHTS

Depending on applicable law, you may have the right to:

• Request access to your personal information.
• Request correction of your personal information.
• Request erasure of your personal information. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal information.
• Request restriction of processing of your personal information.
• Request the transfer of your personal information to you or to a third party.
• Withdraw consent at any time where we are relying on consent to process your personal information. If you wish to exercise any of these rights or would like further information, please contact us at support@healthbeacon.com or write to use using the address in the “Contacting HealthBeacon” section below. Depending on the nature of your request, we may need to verify your identity. Depending on where you are located, you may have a right to lodge a complaint with a supervisory authority or other regulatory agency if you believe that we have violated any of the rights concerning personal information. We encourage you to first reach out to us at support@healthbeacon.com or using the address in the “Contacting HealthBeacon” section below, so we have an opportunity to address your concerns directly before you do so.

RESPONSIBLE DISCLOSURE GUIDELINES

Security issues should be disclosed to quality@healthbeacon.com. We will investigate legitimate security reports and respond within 1-2 business days, and make every effort to quickly correct any issues, while following applicable laws and regulations. If you identify a security issue you should not modify or access data that does not belong to you.

WHEN WAS THE PRIVACY NOTICE LAST UPDATED?

This Privacy Notice was last updated in August 2022. We review this Privacy Notice regularly and reserve the right to make changes at any time to take account of changes in our business activities, legal requirements, and the way we process personal information. We will place updates on this website and where appropriate we will give reasonable notice of any changes.

CONTACTING HEALTHBEACON

If you have any questions about this Privacy Notice, or the privacy practices of HealthBeacon please email us at support@healthbeacon.com or write to us at:

HealthBeacon Limited, 423 West Broadway, Ste 301, South Boston, MA 02127

If you are in the European Union and UK, you may contact us at:

HealthBeacon Limited, Naas Road Business Park, 20 Muirfield Dr, Inchicore, Dublin, Ireland.

If you are contacting us to exercise your rights with respect to your personal information as detailed in this Privacy Notice, we ask you to please adhere to the following guidelines:

• Tell Us Which Right You Are Exercising: Specify which right you want to exercise and the personal information to which your request relates (if not to you). If you are acting on behalf of another consumer, please clearly indicate this fact and your authority to act on such consumer’s behalf;
• Help Us Verify Your Identity: Provide us enough information to verify your identity. For example, provide us (at a minimum) your full name, address, and phone number. Please note that if we cannot initially verify your identity, we may request additional information to complete the verification process. Any personal information you disclose to us for purposes of verifying your identity will solely be used for the purpose of verification.
• Direct Our Response Delivery: Inform us of the delivery mechanism with which you prefer to receive our response. You may specify, for example, email, mail, or through your account (if you have one with us).

Please note that you don’t need to create an account with us in order to make a request to exercise your rights hereunder.

Data Protection Officer

Siobhan Linden

Siobhan.linden@healthbeacon.com