Consumer Health Data Privacy Policy

WLI Holdings LLC, doing business as ClearBox ("we"), provides the GetClear app. This policy explains how we handle consumer health data in GetClear. If you use GetClear through a clinic, your clinic also has its own privacy practices for the information it holds.

• Scan measurements: heart rate, heart rate variability, breathing rate, stress index, vascular age and the scores we calculate from them.
• Device data from wearables and home devices you connect, such as sleep, activity, heart rate, workouts, temperature, glucose and body composition.
• Lab orders and results.
• Bookings and purchases of health services, memberships and products.
• Information you enter, such as health goals and answers to questions.
• Inferences we derive from the above, such as trends and scores.

We also collect account information (name, email, phone, date of birth, state), payment confirmations from our payment processors, and technical data (device type, app version, IP address) needed to run and secure the app.

We do not use the face scan to identify you, unless you turn on an optional imaging feature (see Research programs and optional features). Disease-risk indices are switched off. We do not collect precise location.

You, your phone, devices and device accounts you connect, your clinic, the clinicians who order and review your labs, and the laboratories and lab partner that perform them.

To provide the features you ask for, show your trends, share data with your clinic as described below, arrange and display lab tests, schedule bookings, process payments, keep the app secure, develop and calibrate our models, meet legal obligations, and create and license de-identified data as described below. We do not sell consumer health data that identifies you, and we do not use consumer health data for advertising.

• Your clinic. For a clinic account, everything in the account, because we hold it on your clinic's behalf. For an account without a clinic, only what you choose to share.
• Clinicians who order and review your labs.
• Service providers that process data for us under contracts requiring them to protect it: cloud hosting (Amazon Web Services), our lab and device data partner, laboratories, scheduling, email and messaging, and payment processors.
• Authorities, when the law requires.

We do not place third-party advertising or analytics trackers in the app or on signed-in pages. Your identity and your health results are stored separately and linked by a code.

We may create de-identified data from the information we hold, including information derived from patient information. We de-identify health information using the expert determination method under the HIPAA Privacy Rule (45 CFR 164.514(b)(1)), and an independent expert certifies each dataset before it is shared. We use de-identified data to improve GetClear and train our models, and for research and publications. We may license de-identified data, and synthetic data and models derived from it, to research organizations, universities, health and life sciences companies, diagnostics companies and developers of AI models, or let them analyze it inside our secure environment. We commit to keep de-identified data in de-identified form and never to attempt to re-identify it, and every recipient must make the same commitment in writing and may not use the data for advertising or for decisions about individuals. Deleting your account does not delete de-identified data or models already trained on it. You can keep your data out of future licensed datasets in Settings.

Some programs need information that identifies you, such as research studies, outcome registries run with clinics, clinical trial matching, or optional imaging features. Each is optional. Before you join, we will describe who receives what, for what purpose and for how long, and ask for your separate permission. If a program pays you or gives you a discount in exchange for your information, we will give you a notice describing those terms first. Photos and facial measurements from imaging features are covered by our Biometric Policy, kept only as long as it says, and never sold, licensed or included in any dataset we share.

An independent expert reviews how we de-identify data and audits how we use it every year.

Accounts without a clinic. You can ask us to confirm whether we have your consumer health data, give you a copy, list the third parties and affiliates we have shared it with (with their contact details where the law requires), correct it, delete it (including from our service providers), or withdraw consent. Use Settings or email [privacy@clear-box.io]. We respond within 30 days and do not charge for requests. If we decline, you can appeal by replying to our decision, and we will answer within 45 days; if you remain unsatisfied you may contact your state attorney general. We honor these rights for every account without a clinic, whatever the person's state.

Clinic accounts. Your clinic controls this information. Send requests to see, correct, delete or restrict it to your clinic, which will answer under HIPAA or the state law that applies to it. If you send a request to us, we will forward it to your clinic within 5 business days and tell you we have done so. We cannot delete clinic-account information, or stop your clinic from seeing it, on your instruction alone.

For accounts without a clinic, we keep consumer health data while your account is open and delete it within 30 days after you delete your account, except encrypted backups, which expire within 35 days. For clinic accounts, we keep information for as long as your clinic directs and return or delete it under our agreement with your clinic. Imaging data follows the retention schedule in our Biometric Policy. Deletion does not reach de-identified data or models already trained on it.

We encrypt data in transit and at rest, limit and log access, and host data in the United States. If your data is involved in a breach, we will notify you and regulators as the law requires.

GetClear is for adults 18 and older. We do not knowingly collect data from anyone younger.

We will ask for your consent again before using consumer health data for a new purpose. Questions: privacy@clear-box.io, WLI Holdings LLC, 745 E Pikes Peak Ave, Colorado Springs, Colorado, 80903.