Transcarent Privacy Policy

At Transcarent, Inc. (“Transcarent,” “we,” “our” and/or “us”), our goal is to connect consumers with the right information, resources, and tools to help them make the best medical and financial decisions for themselves and their families in a simplified, seamless experience.We understand that your health is a personal matter, and we appreciate the concerns you may have in regard to privacy and security of your personal information. Your privacy is important to us, and we are strongly committed to protecting your personal information, as explained in more detail in this Privacy Policy.This privacy policy (“Privacy Policy”) explains how we collect, use, and share information from users of our live health guides, mobile applications, digital tools, other platform services, and related web- sites (including our website at www.transcarent.ai (the “Site”)) (collectively, the “Services”) (“Users,” “you” or “your”). Your use of our Services is also subject to our Terms of Service (available at https:// transcarent.ai/terms-and-conditions).

A Note about Protected Health Information.

Many of our customers are sponsors and administrators of group health and welfare plans, often employers, unions and third-party administrators. If you use the Services because they are offered to you as a participant in a group health or welfare plan sponsored or administrated by a Transcarent customer, we may collect protected health information governed by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) about you, either directly from your health plan, or on behalf of your health plan from you or the health care providers that provide health care services to you. For example, we may collect your protected health information to help coordinate care you receive at centers of excellence and other health care providers that we help you access.The types of protected health information we may collect from or on behalf of your health plan include:

• your medical history, conditions, treatments, medications, lab results, and care team;

• your medical claims, health plan account number and insurance information;

• your weight, activity logs, other health statistics collected from medical devices and smartphones;

• information you provide in response to surveys we may send you from time to time regarding your health and care experiences;

• information provided by your family members relating to your health and;

• demographic information (such as your age and gender).;

The HIPAA Notice of Privacy Practices of the health plan sponsored by your employer governs our collection and use of such protected health information, not this Privacy Policy. If you have questions about the treatment of your protected health information, you should review the HIPAA Notice of Pri- vacy Practices of the health plan sponsored by your employer or contact your health plan.

Information We Collect.

When you use the Services, we may collect a variety of information from or about you or your devices as described below.You may limit the information you provide or make available to us; however, that may limit your ability to access or use certain Services functions. It may also limit your ability to request, or for us to provide further details about, certain services, or information.Information You Provide to Us.Public Inquiries.If you choose to submit information to us using the “Contact Us” link on the Site, or if you send us an inquiry using another method, or otherwise choose to sign up for notifications or updates from us, we may ask you for your first and last name, email address, phone number, zip code, the name of your company, and the reasons you are interested in Transcarent, among other information.Eligibility Information. The plan that provides you with access to the Services will provide Transcarent with information normally found on your plan’s eligibility report in order for Transcarent to verify your eligibility to access the Services.Secure Account Set Up and Sign In. To register a secure account with Transcarent, you will be prompted to provide an email address of your choice and a password that only you know. Do not share your password with anyone else, including us. No one at Transcarent will ask you for your pass- word via phone call, email, or text at any time. When registering for your secure account with Tran- scarent, we may ask you for additional information, including your legal first and last names, date of birth, zip code, and potentially other information to validate your eligibility. After you have completed your account set up, you may be required to provide additional information to sign in to your account, including your mobile telephone number, and you may have an opportunity to update your password in connection with your account.Member Communications. If you are a registered member and contact us directly, we may receive additional information about you. For example, when you contact our customer support team, we may receive your name, email address, phone number, the contents of a message or attachments that you may send to us, and other information you choose to provide. If you subscribe to our newsletters and other updates, then we will collect certain information from you, such as your email address. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services.Unsubscribe. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive adminis- trative messages from us.Information We Collect When You Use Our Services.Device and Geo-location Information.We receive information about the device and software you use to access our Services, including IP address, web browser type, operating system version, and device identifiers. Additionally, if you choose to use certain features in the Services where your geo- location information is directly relevant, such as locating a nearby health provider, and you choose to provide such information, we may receive your primary physical address or another physical address you provide in connection with performing a search. Usage Information. To help us understand how you use our Services and to help us improve them, we may automatically receive information about your interactions with our Services, like the pages or other content you view and the dates and times of your visits.Site Visit Information.In general, you can visit the Site without telling us who you are or providing us with your business information. However, we collect the IP (Internet protocol) addresses of all visi- tors to our websites and other related information such as page requests, browser type, operating system, and average time spent on our websites. We use this information to monitor and improve our websites.Information from Cookies and Similar Technologies. We and third-party partners collect informa- tion using cookies, pixel tags, or similar technologies. Our third-party partners, such as analytics and advertising partners, may use these technologies to collect information about your online activities over time and across different services.

• Cookies are small text files containing a string of alphanumeric characters. We may use both ses- sion cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services.;

• Pixel tags, also known as “clear GIFs”, “tracer tags”, or “web beacons”, are technologies that al- low us and our third-party partners to understand which pages or content you view. These pixel tags are used to help us optimize and tailor our Site for you and other web visitors.;

• Please review your web browser’s “Help” file to learn the proper way to modify your cookie set- tings. Please note that if you delete or choose not to accept cookies from the Service, you may not be able to utilize the features of the Service to their fullest potential.;

Analytics Information.We may use analytics services such as Google Analytics and MixPanel to collect and process certain analytics data. These services may also collect information about your use of other websites, apps, and online resources. To help us understand how you use our Services and to help us improve them, we automatically receive information about your interactions with our Services, like the pages or other content you view, the searches you conduct, purchases you make, your comments, any content you post, and the dates and times of your visits. You can learn about Google’s practices by going to https://www.google.com/policies/privacy/partners/ and opt out of them by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.How We Respond to Do Not Track (DNT) Settings. Some web browsers incorporate a “Do Not Track” (“DNT”) or similar feature. At the present time, we do not respond to DNT signals.

How We Use the Information We Collect.

We use the information we collect:

• To provide, maintain, improve, and enhance our Services and your health and care experience;

• To authenticate you on any portion of our Services and with vendors acting on our behalf;

• To protect someone’s health, safety, or welfare;

• To personalize your experience on our Services such as by providing tailored content and recommendations;

• To understand and analyze how you use our Services and develop new products, services, features, and functionality;

• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;

• To find and prevent fraud, and respond to trust and safety issues that may arise;

• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or govern- mental agency and;

• For other purposes for which we provide specific notice at the time the information is collected.

How We Share the Information We Collect.

Vendors and Service Providers. We may share any information we receive with vendors and ser- vice providers retained in connection with the provision of our Services to the extent necessary to perform their respective functions, including our analytics partners described in the section above titled “Analytics Information.”Marketing. We do not rent, sell, or share information about you with nonaffiliated companies for their direct marketing purposes, unless we have your permission.Corporate Affiliates. To support us in providing, integrating, promoting, and improving the Services, we may share personal information within our corporate family of companies that are related by common ownership or control.As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with an- other company, or we sell, liquidate, or transfer all or a portion of our assets.Consent. We may also disclose your information with your permission.

Third Parties.

Our Services may contain links to other websites, products, or services that we do not own or operate. These links are provided solely as a convenience to you and not as an endorsement by us of the content of such third parties. Links to third-party websites are not a referral or endorsement of any other entity, item, or service. The content provided on such third-party websites is developed and provided by or on behalf of that third party. We are not responsible for the content of any linked third-party website and do not make any representations regarding the content or accuracy of any materials on such third-party website. You should take precautions when downloading files from all websites to protect your computer from viruses and other destructive programs. If you decide to access any third- party websites, you do so at your own risk. We are not responsible for the privacy practices of these third parties and this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them and to contact the site administrator or webmaster of the third-party website if you have any concerns regarding such links or content.

Security.

We make reasonable efforts to protect your personal information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, as no electron- ic transmission or storage of information can be entirely secure, no one can guarantee the absolute security or privacy of your information.

California Residents.

If you are a California resident, your information may be covered by the California Consumer Privacy Act (“CCPA”). The below disclosures apply to the extent the CCPA applies to your data, subject to any applicable exemptions. Please note that certain information, such as protected health information governed by HIPAA and medical information (as defined under the Confidentiality of Medical Information Act (“CMIA”)) may be exempted from the CCPA. This means that we and certain service provid- ers or other recipients may not be required to honor the rights described in this section and instead we comply with our obligations under other laws, such as HIPAA and CMIA.Personal Information We Collect. The categories of “personal information,” as defined in the CCPA, that we collect include:

• Identifiers

• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))

• Characteristics of protected classifications under California or federal law

• Commercial information

• Internet or other electronic network activity information

• Professional or employment-related information

• Inferences drawn from other personal information

We may obtain, use, and share these data categories as detailed in the “Information We Collect,” “How We Use the Information We Collect,” and “How We Share the Information We Collect” sections of this Privacy Policy, above.Sales of Personal Information. We do not “sell” your personal information as that term is defined in the CCPA.Your California Privacy Rights. You may have the following rights with respect to your personal information under the CCPA:Right to Know About Personal Information Collected, Disclosed, or Sold. You may have the right to request that we provide certain information to you about our collection and use of your personal infor- mation over the past twelve (12) months. Specifically, you may have the right to request disclosure of:

• The specific pieces of personal information we collected about you;

• The categories of personal information we collected about you;

• The categories of sources from which personal information was collected;

• Our business or commercial purpose for collecting or disclosing personal information and;

• The categories of third parties with whom we shared personal information.

Right to Request Deletion of Personal Information. You may also have the right to request that we delete any of your personal information that we collected or maintain about you, subject to certain exceptions.Right to Non- Discrimination for the Exercise of a Consumer’s Privacy Rights. We will not unlawfully discriminate against you for exercising any of your applicable privacy rights.Exercising Your California Privacy Rights. To request to exercise your CCPA rights described above, please submit a verifiable consumer request to us by using the information in the “Contact Us” section below. Only you or your “authorized agent,” as defined in the CCPA, may make a verifiable consumer request related to your personal information.Your verifiable consumer request must (i) provide sufficient information that allows us to reasonably verify that you are the person about whom we collected personal information or an authorized rep- resentative; and (ii) describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with personal informa- tion if we cannot verify your identity or authority to make the request and confirm the personal infor- mation relates to you. We will use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Making a verifiable consumer request does not require you to create an account with us.Response Timing and Format. We will make our best effort to respond to a verifiable consumer request no later than forty-five (45) days after receipt. If we require more time (up to ninety (90) days), we will inform you of the reason and extension period in writing. No later than ten (10) days of receiv- ing the request, we will confirm receipt and provide information about its verification and processing of the request. We will maintain records of consumer requests made pursuant to the CCPA as well as our response to said requests for a period of at least twenty-four (24) months.Shine the Light. California residents may also request information from us once per calendar year about any personal information shared with third parties for their own direct marketing purposes, in- cluding the categories of information and the names and addresses of those businesses with which we have shared such information. To request this information, please contact us as directed in the “Contact Information” section below. Your inquiry must specify “California Privacy Rights Request” in the subject line of the email, and you must include your name, street address, city, state, and ZIP code.

California Minors Under 18.

If you are a California resident under the age of 18 and are a registered user of our Services, you may request that we remove from our Services any content you post to our Services that can be ac- cessed by any other user (whether registered or not). Please note that any content that is removed from visibility on our Services may still remain on our servers and in our systems. To request removal of content under this provision, please write or e-mail us at the postal or e-mail address found in the “Contact Information” section below. When you write us, provide us with a description of the content and the location of the content on our Services, and any other information we may require in order to consider your request. Please note that removal of content under this provision does not ensure complete or comprehensive removal of the content or information posted on the Services by you.

Children’s Privacy.

We do not knowingly collect, maintain, or use personal information from children under 13 years of age, and although certain health care services for children provided by independent health care practitioners may be accessed using our Services, no part of our Services is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Policy, then please alert us at inquiry@transcarent.ai.

International Visitors.

Our Services are hosted in the United States and intended for users located within the United States. If you choose to use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are trans- ferring your personal information outside of those regions to the United States for storage and pro- cessing. Also, if you choose to use the Services outside the United States, we may transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. By providing any information, including personal informa- tion, on or to the Services, you consent to such transfer, storage, and processing.

Update Your Information or Pose a Question.

You can update your account and profile information or close your account through your profile set- tings. If you have questions about your privacy on the Services or this privacy policy, please contact us at inquiry@transcarent.ai.

Changes to Our Privacy Policy.

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effec- tive when it is posted. If we materially change the ways in which we use or share personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication. If you object to any modification, your sole recourse is to stop using the Ser- vices and providing us with your personal information.

Contact Information.

If you have any questions, comments, or concerns about our processing activities, please email us at inquiry@transcarent.ai or write to us at Transcarent, Inc., 2 South Park Street, San Francisco, California 94107, Attention: Privacy Inquiries.

Last Updated: July 15, 2021