Privacy Policy

1. Scope of This Policy and Who We Are

This Privacy Policy describes how Noesis Inc., doing business as NoesisCare ("NoesisCare," "we," "us," or "our"), with its principal place of business in Houston, Texas, collects, uses, discloses, and protects information when you use the NoesisCare website, patient portal, and related applications (the "Platform"). It applies to patients and caregivers located in the United States and in Mexico.

Which privacy laws protect your information depends on how you access the Platform (see Section 5). This Policy should be read together with our Terms of Service and with whichever of the following applies to you: your treating provider's Notice of Privacy Practices, the informed consent form for a clinical trial, or, if you are in Mexico, our standalone Aviso de Privacidad published in Spanish, which is the legally operative privacy notice for patients in Mexico and which this Policy summarizes but does not replace.

2. Information We Collect

We collect the following categories of information, in each case only to the extent needed for the purposes described in Section 4: (a) account and contact information you provide, such as your name, email address, phone number, date of birth, and preferred language; (b) clinical and health information, described in Section 3; (c) information you provide directly to the Assistant, such as the questions you ask and the context you share; (d) your preferences, including how and when you choose to see your prognostic score; (e) technical information collected automatically, such as device type, browser, IP address, log data, and usage of Platform features; and (f) information from caregivers or legal representatives acting on your behalf.

Cookies and similar technologies. We use strictly necessary cookies to keep you signed in and to secure your session, and first-party analytics that measure how the Platform is used so we can improve it. We do not use third-party advertising cookies, pixels, software development kits, or similar tracking technologies on any page or screen where health information is present, and we do not use any tracking technology to share health information with advertisers or social-media platforms. You can manage cookies through your browser settings; disabling necessary cookies will prevent the Platform from working.

3. Health and Clinical Information

As a platform built around a patient's clinical picture, we collect and process health information including laboratory results, imaging and pathology data, treatment and medication history, vital signs, adverse events, and patient-reported, lived-experience data (such as symptoms, quality-of-life measures, and functional status) that you or your care team provide. This information is used to generate your fused prognostic score (the "Score") and to power the Assistant's responses to your questions about your own results. Where you participate in a clinical trial, we may also collect trial-specific data described in that trial's consent form.

4. How We Use Information

4.1 Primary purposes (necessary to provide the Platform)

• Generating, updating, and releasing your Score according to the display preferences you select.
• Operating the Assistant and responding to your questions about your own results.
• Sharing your Score and results with your treating clinicians, where you have chosen that.
• Maintaining the security and integrity of the Platform, including fraud and abuse prevention.
• Communicating with you about your account, and sending you the notices required by law.
• Complying with legal, regulatory, record-keeping, and safety-reporting obligations.

4.2 Secondary purposes (you may decline)

• Improving and validating our models, including the Score and the Assistant.
• Supporting medical research, including publication of aggregated findings.

Secondary purposes are not required to provide the Platform. You may decline them at enrollment, or at any time afterward in your account settings or by contacting us, without affecting your access to the Platform. For patients in Mexico, we will not process your data for secondary purposes unless you have agreed, as set out in the Aviso de Privacidad. Where NoesisCare acts as a business associate, we use data for these purposes only if, and to the extent that, the applicable Business Associate Agreement permits.

4.3 De-identification

Before using information for the secondary purposes above, we de-identify it in accordance with HIPAA, using either the safe-harbor method (removal of the 18 identifiers listed at 45 C.F.R. § 164.514(b)(2)) or the expert-determination method documented by a qualified statistician, and we contractually prohibit anyone who receives de-identified data from attempting to re-identify it. In Mexico, de-identified data is handled in accordance with the LFPDPPP's provisions on anonymization and dissociation.

We do not sell your health information, and we do not sell protected health information without your written authorization.

5. Legal Frameworks That Apply to Your Information

Whether HIPAA applies depends on the entity handling your information and on whose behalf, not on the type of data. The channel through which you access the Platform determines which framework governs.

5.1 Provider-deployed channel (HIPAA business associate)

Where your hospital, clinic, or physician (a HIPAA covered entity) offers you the Platform as part of your care, NoesisCare is that provider's business associate under HIPAA and a Business Associate Agreement. We use and disclose your protected health information ("PHI") only as the agreement and HIPAA permit, apply the safeguards required by the HIPAA Security Rule, and report security incidents and breaches to your provider. In this channel, your provider is responsible for your HIPAA rights (access, amendment, accounting of disclosures, restrictions, and confidential communications) and for its Notice of Privacy Practices; requests should be made to your provider, which may direct us to fulfill them. This Policy does not create rights against NoesisCare that would be inconsistent with that arrangement.

5.2 Clinical trial channel

Where you use the Platform as a research participant, the informed consent form and protocol approved by an institutional review board or research ethics committee govern, together with FDA regulations (including 21 C.F.R. Parts 50 and 56), ICH Good Clinical Practice, the HIPAA research provisions where the sponsor or site is a covered entity, and, in Mexico, the Reglamento de la Ley General de Salud en Materia de Investigación para la Salud and COFEPRIS requirements. Trial data is handled as the consent form describes.

5.3 Direct-to-consumer channel (non-HIPAA)

Where you create an account directly with NoesisCare, outside of a provider deployment or a trial, HIPAA generally does not apply. We nonetheless apply the same administrative, technical, and physical safeguards that HIPAA would require, and your information is protected by the following laws, among others:

• The Federal Trade Commission Act and the FTC's Health Breach Notification Rule (16 C.F.R. Part 318), which requires us to notify you, the FTC, and in some cases the media of a breach of unsecured identifiable health information.
• Washington's My Health My Data Act, Nevada's consumer health data law, and Connecticut's consumer health data provisions, which require your consent before we collect or share consumer health data for purposes beyond those necessary to provide the service you requested and prohibit its sale without your authorization. See Section 10.2.
• The California Consumer Privacy Act, as amended by the California Privacy Rights Act, and the California Confidentiality of Medical Information Act, for California residents. See Section 10.3.
• The Texas Medical Records Privacy Act (Tex. Health & Safety Code ch. 181), which applies to NoesisCare as a "covered entity" under Texas law even where HIPAA does not, and the Texas Data Privacy and Security Act, which requires your consent before we process sensitive data, including health data. See Section 10.4.
• Texas laws enacted in 2025 that require disclosure of the use of artificial intelligence in health care and impose requirements on the storage of electronic health records (see Section 12).

5.4 Patients in Mexico

For patients in Mexico, our legal basis for processing personal data, including sensitive health data, is your consent under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares published in March 2025 ("LFPDPPP") and its Regulations, subject to the exceptions that law provides (for example, where processing is necessary for medical care or emergency treatment). Because health data is sensitive personal data, we obtain your express written consent, by electronic signature or an equivalent verifiable mechanism, before processing it. That consent specifically covers the processing of your clinical and patient-reported data by the prognostic algorithm that generates the Score. Where the Platform produces an automated result that could significantly affect you, you have the right, as provided by the LFPDPPP, to object, to request human review by your clinician, and to receive a plain-language explanation of the logic used.

6. The AI Assistant and Third-Party Processors

The Assistant is powered by a large language model provided by third-party artificial-intelligence vendors. Where health information is sent to a vendor to generate a response, that vendor is bound by a Business Associate Agreement (where HIPAA applies) or an equivalent data-processing agreement that requires it to: use the information only to return a response to us; not use it to train or improve its own general-purpose models; retain no data after the response is returned (zero data retention), other than transient processing logs required for abuse monitoring that are deleted on a defined schedule; and maintain security controls appropriate to PHI. Assistant requests are processed in data centers located in the United States. Each response the Assistant gives you is identified as AI-generated.

We also use third-party vendors for cloud hosting, security monitoring, email and text-message delivery, and related infrastructure. Each is bound by contractual confidentiality and security obligations appropriate to the sensitivity of the data it processes, and, where it handles PHI on our behalf, by a Business Associate Agreement. Under Mexican law, disclosures to vendors that process data on our behalf and under our instructions are "remisiones" and do not require your separate consent. A current list of our vendor categories, and the countries in which they process data, is available at noesiscare.ai/vendors.

7. How We Share Information

We share information only as follows: with your treating physicians or care team, at your direction or as part of delivering the Platform through a provider deployment; with the service providers described in Section 6, under contracts that restrict their use of your information; with a clinical trial sponsor, site, or research collaborator, where you have separately consented to participate in that trial; with regulators, courts, or law enforcement where required by law, after reviewing the request for validity and scope; and in connection with a merger, acquisition, or similar transaction, subject to the acquiring party's commitment to honor this Policy and to any consent required by law.

We do not sell your personal information. We do not sell protected health information without your written authorization. We do not share your health information with advertisers, data brokers, or social-media platforms, and we do not use cookies, pixels, or similar technologies to share health information with any of them.

8. Data Security and Breach Notification

We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and at rest, multi-factor authentication for workforce access, role-based access controls limiting who within NoesisCare can view identifiable health information, audit logging, workforce training, and regular risk analysis and review of our security practices. No system is completely secure, and we encourage you to protect your own account credentials.

If a breach of your information occurs, we will notify you and the relevant authorities as the law requires:

• Where we act as a HIPAA business associate, we notify your provider without unreasonable delay and in no case later than 60 calendar days after discovery, so that your provider can notify you and the U.S. Department of Health and Human Services.
• Where HIPAA does not apply, we notify you under the FTC Health Breach Notification Rule without unreasonable delay and in no case later than 60 calendar days after discovery, and we notify the FTC and, where required, the media.
• We also comply with the breach-notification law of your state of residence, including the Texas Identity Theft Enforcement and Protection Act, which may require faster notice.
• For patients in Mexico, we notify you without delay, as required by the LFPDPPP, of any security breach that significantly affects your rights, so that you can take protective measures.

9. Data Retention

We retain your health information for as long as your account is active and as needed to provide the Platform to you. After your account is closed, we retain information only for as long as required by applicable law and the agreements that govern your channel:

• Medical-record retention periods are set by state law and by your provider's policies; where we hold records as a business associate, we retain or return them as the Business Associate Agreement directs.
• In Mexico, clinical records must be kept for at least five years from the last medical act, as required by NOM-004-SSA3-2012.
• Clinical trial records are retained for the period required by the protocol, FDA regulations, ICH Good Clinical Practice, and COFEPRIS research regulations.
• HIPAA separately requires us to retain compliance documentation (such as policies, authorizations, and Business Associate Agreements) for six years; this requirement applies to those documents, not to your medical records.

When information is no longer required, we securely delete it or de-identify it as described in Section 4.3.

10. Privacy Rights for U.S. Patients

10.1 Your rights

Depending on your channel and your state of residence, you have the right to: access and obtain a copy of your health information, including in electronic form; request correction or amendment of inaccurate or incomplete information; request an accounting of certain disclosures; request restrictions on certain uses or disclosures; request that we communicate with you by alternative means or at an alternative location (confidential communications); request deletion of information where the law provides that right; receive this Policy in writing; and file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights (www.hhs.gov/ocr/complaints) or your state attorney general. We will never retaliate against you for exercising your rights or filing a complaint.

Where NoesisCare is your provider's business associate, your provider handles these requests under HIPAA and its Notice of Privacy Practices; we will help you reach the right contact. Where HIPAA applies, access requests are answered within 30 days, with one 30-day extension if we tell you the reason in writing. Where Texas law applies to a request for an electronic health record, we respond within 15 business days. Where another state law sets a shorter deadline, we meet it. To exercise your rights, contact us using the information in Section 15; we may need to verify your identity before acting.

10.2 Consumer health data (Washington, Nevada, Connecticut)

If you are a resident of Washington, Nevada, or Connecticut, or your consumer health data is collected in one of those states, you have the right to: confirm whether we collect, share, or sell your consumer health data; access it, including a list of the third parties with which we have shared it; withdraw consent; and have it deleted. We collect and share consumer health data only with your consent or as necessary to provide the Platform at your request, and we do not sell it. Our Consumer Health Data Privacy Notice, required by Washington law, is available at noesiscare.ai/consumer-health-data. If we deny a request, you may appeal by contacting us at the address in Section 15, and if the appeal is denied you may contact your state attorney general.

10.3 California residents

If you are a California resident, you have the rights provided by the CCPA/CPRA to know what personal information we collect and how we use and share it, to delete it, to correct it, to limit the use of sensitive personal information, and not to be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioral advertising. Medical information we hold about California residents is also protected by the Confidentiality of Medical Information Act, and we do not disclose it without the authorization that Act requires. Information that is PHI handled under HIPAA, or is collected in a clinical trial, is exempt from the CCPA to the extent the law provides.

10.4 Texas residents

The Texas Medical Records Privacy Act applies to NoesisCare in every channel. Among other things, it prohibits us from re-identifying de-identified information, from selling your PHI, and from using your PHI for marketing without your consent, and it requires us to train our workforce on the protection of your information. Under the Texas Data Privacy and Security Act you may access, correct, delete, and obtain a copy of your personal data, and we process health data only with your consent. If we deny a request, you may appeal, and we will tell you how to contact the Texas Attorney General if you are not satisfied.

11. Privacy Rights for Patients in Mexico (ARCO Rights Under the LFPDPPP)

If you are located in Mexico, the LFPDPPP gives you ARCO rights: to Access the personal data we hold about you and the details of its processing; to Rectify it if it is inaccurate or incomplete; to Cancel it when it is no longer necessary for the purposes described in the Aviso de Privacidad or you withdraw your consent, subject to the retention periods in Section 9 and the exceptions the law provides; and to Oppose specific processing for legitimate reasons, including processing for secondary purposes and, as provided by law, automated decisions that significantly affect you. You may also revoke your consent at any time, and limit the use or disclosure of your data, which may limit our ability to continue providing the Platform to you.

To exercise these rights, submit a request to our data-protection contact (Departamento de Datos Personales) at privacy@noesiscare.ai or at the address in Section 15, including your name, a means of contact, a copy of an official identification (or proof of legal representation), a clear description of the data and the right you wish to exercise, and any information that helps us locate the data. We will acknowledge your request and respond within the periods set by the LFPDPPP, and we will tell you if we need more information. Our Aviso de Privacidad describes the procedure in full.

If you believe your rights under the LFPDPPP have been violated or are not satisfied with our response, you may file a complaint with the Secretaría Anticorrupción y Buen Gobierno, the authority responsible for personal data protection in Mexico.

12. Where Your Information Is Processed; International Data Transfers

NoesisCare is based in the United States, and the Platform is operated from data centers located in the United States. Information about patients in Mexico is therefore transferred to and processed in the United States. Our vendors (Section 6) may process limited categories of information in other countries under the contractual safeguards described in that Section.

Mexico. Under the LFPDPPP, a transfer of your personal data to a third party that will process it for its own purposes requires your consent, whether that third party is located in Mexico or abroad, except where the law provides otherwise (for example, a transfer necessary for your medical care or that is required by law). Our Aviso de Privacidad identifies each category of third-party transfer we make and whether your consent is required for it. Transfers to vendors that process data on our behalf and under our instructions (remisiones) are not third-party transfers and do not require your consent; we remain responsible for those vendors' handling of your data. Transfers abroad are made under written agreements that bind the recipient to the terms of the Aviso de Privacidad and the LFPDPPP.

Texas electronic health records. Where Texas law requires that electronic health records be physically maintained in the United States, we store those records in U.S. data centers and do not use offshore storage or processing for them.

13. Children's and Adolescents' Privacy

The Platform is not directed to anyone under 18 for self-directed use, and a person under 18 may not create their own account. A patient under 18 may use the Platform only through an account created and supervised by a parent or legal guardian, who is responsible for reviewing this Policy and consenting to the processing of the minor's health information, or through a deployment by the minor's treating provider that has obtained the consents required by law. Where state law gives an adolescent the right to confidential care for certain conditions, access by a parent or guardian to the related information may be limited as directed by the treating provider.

We do not knowingly collect personal information directly from a child under 13. If any feature of the Platform is designed in the future to be used directly by a child under 13, we will first obtain verifiable parental consent as required by the Children's Online Privacy Protection Act. If you believe a child has provided information to us directly, contact us and we will delete it.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on the Platform and update the "Last Updated" date shown at the top. Where a change materially affects how we collect, use, or share your health information, we will notify you at least 30 days in advance by email and within the Platform, we will obtain any new consent that applicable law requires before the change applies to your information, and for patients in Mexico we will publish an updated Aviso de Privacidad and notify you as the LFPDPPP requires. We will not apply a material change retroactively to information already collected without your consent.

15. Contact and Data Protection Inquiries

To exercise your privacy rights or ask questions about this Policy, contact NoesisCare:

• General inquiries: contact@noesiscare.ai
• Privacy and data-protection requests (including ARCO requests): privacy@noesiscare.ai, attention Privacy Officer / Departamento de Datos Personales
• Mail: Noesis Inc. (NoesisCare), Houston, Texas, United States

If you are in the United States and believe your HIPAA rights have been violated, you may complain to the U.S. Department of Health and Human Services, Office for Civil Rights. If you are in Mexico and are not satisfied with our response, you may contact the Secretaría Anticorrupción y Buen Gobierno. We will not retaliate against you for filing a complaint.