Morley Medical Privacy Policy and PHI Disclaimer of Responsibility

Introduction

Morley Medical, Inc. ("Morley Medical," "Morley," "we," "us," or "our") values the privacy of its users. This Privacy Policy and PHI Disclaimer of Responsibility outlines our practices and policies regarding the information we collect from you, how we use and disclose your personal information and Protected Health Information ("PHI") as defined by the Health Insurance Portability and Accountability Act ("HIPAA"), when you use our website, purchase our remote healthcare monitoring devices, and use our monitoring services (collectively, the "Services").

Company Information

Important: HIPAA status and direct-to-consumer services

Critical Information for Direct-to-Consumer Customers: When you purchase monitoring devices and services directly from Morley Medical as an individual consumer (not through your healthcare provider), Morley Medical is NOT a covered entity under HIPAA, and traditional HIPAA protections do NOT apply to the health information you provide directly to us. However, we voluntarily implement HIPAA-equivalent security standards and privacy protections to safeguard your information.

If you are using our Services through a healthcare provider relationship where we serve as a Business Associate, different HIPAA protections apply, and we will have a separate Business Associate Agreement with that healthcare provider.

Information we collect

Personal Information

Morley Medical collects personal information from you when you visit our website, purchase monitoring devices, enroll in our Services, or interact with us. This information may include:

• Your name, date of birth, and gender
• Email address, phone number, and mailing address
• Emergency contact information
• Payment information (credit card details, billing address)
• Account credentials (username and password)
• Communications with customer support

Health Information and Protected Health Information (PHI)

For Direct-to-Consumer Customers: When you use our remote healthcare monitoring services, we collect health information including:

• Medical history, current health conditions, medications, and allergies provided in your intake form
• Information about your healthcare providers
• Monitoring data collected by your device(s), including vital signs such as heart rate, blood pressure, oxygen saturation, temperature, weight, glucose levels, respiratory rate, and activity levels
• Self-reported symptoms and health status updates
• AI-generated alerts and health insights based on your monitoring data
• Any health information you share with us through the Services

Important: Unlike our Business Associate relationships where we collect only de-identified PHI, when you use our Services as a direct-to-consumer customer, we collect identifiable health information about you. This is necessary to provide you with personalized monitoring services and AI-powered health insights.

Biometric Information

Depending on the monitoring device(s) you use, we may collect biometric information, which includes unique physiological patterns such as:

• Cardiac rhythms and heart rate patterns
• Respiratory patterns and breathing characteristics
• Blood glucose patterns
• Gait and movement patterns
• Sleep patterns and architecture

Special Notice for Illinois and Texas Residents

If you reside in Illinois or Texas, you have specific rights regarding biometric information under state law. Before we collect any biometric information from you:

• We notify you that we will collect biometric information through your monitoring device(s)
• The purpose for collection is to provide remote healthcare monitoring services and AI-powered health insights
• Your biometric information will be retained for up to three (3) years from your last use of our Services, or a shorter period if required by applicable law, after which it will be permanently destroyed
• We will never sell, lease, or trade your biometric information
• We will protect it using security measures equal to or greater than those used for other confidential information
• We will permanently destroy it when no longer needed or upon your request
• You must provide your informed written consent before we begin collecting biometric information

Technical and Usage Information

We automatically collect:

• Device information (device type, operating system, unique device identifiers)
• IP address and general geographic location
• Usage data (features used, time spent, interaction patterns)
• Log data (access times, pages viewed, errors)
• Monitoring device connectivity and performance data

Minors

The Services are intended only for individuals eighteen (18) years of age or older. We do not knowingly collect personally identifiable information from individuals under the age of eighteen (18), and individuals under eighteen (18) are not permitted to use the Services or submit any information to us. If we discover that we have collected information from an individual under 18, we will delete such information promptly.

How we use your information

Primary Service Purposes

Morley Medical uses your personal information and health information to:

• Provide remote healthcare monitoring services to you
• Operate and maintain your monitoring device(s)
• Process and analyze your monitoring data using our AI-powered clinical decision support software
• Generate automated alerts and notifications based on analysis of your health data
• Provide customer support and technical assistance
• Process payments and maintain billing records
• Communicate with you about your account, services, and alerts

Artificial Intelligence and Predictive Analytics

We use advanced artificial intelligence (AI) and machine learning algorithms to analyze your monitoring data. Our AI Technology:

• Identifies patterns and trends in your health data that may indicate potential health concerns
• Generates predictive insights about your health status and potential risks
• Creates automated alerts when data patterns suggest increased health risks
• Continuously learns and improves by analyzing de-identified data from our user base
• Provides early warning of potential adverse health events

Important Limitations: Our AI provides probabilistic predictions and insights, not medical diagnoses. AI-generated alerts may include false positives or false negatives. All AI insights should be reviewed by your healthcare provider before making medical decisions. You should never rely solely on AI-generated information without consulting a qualified healthcare professional.

Service Improvement and Research

• Improve our AI algorithms and predictive analytics using de-identified data
• Enhance device functionality and user experience
• Develop new features and monitoring capabilities
• Conduct research and data analysis to advance healthcare technology
• Train and validate machine learning models

Legal and Safety

• Comply with applicable laws and regulations
• Respond to legal requests and prevent fraud
• Protect the security and integrity of our website and Services
• Enforce our terms and policies
• Defend against legal claims

Marketing and Communications (With Your Consent)

With your opt-in consent, we may:

• Send promotional communications about new services or features
• Provide information about service upgrades or premium tiers
• Share health and wellness educational content

You may opt out of receiving marketing or promotional communications at any time by clicking "unsubscribe" in our emails, adjusting your account preferences, or contacting customer support using the contact information below. Opting out of marketing communications will not affect transactional or service-related communications that are necessary for your use of the Services.

By using our website and Services, you acknowledge and agree that any PHI transmitted or received through our website and Services will be used for the purposes described above, including providing you with healthcare information, AI-powered health insights, and for other uses permitted under HIPAA (where applicable).

How we protect your information

Morley Medical takes reasonable and appropriate measures, consistent with industry standards, to protect your personal information and health information from unauthorized access, disclosure, alteration, or misuse. Our security measures currently include, among other things:

Technical Security Measures

• Encryption: Data encrypted in transit using Transport Layer Security (TLS 1.2 or higher) and encrypted at rest using AES-256 encryption
• Secure Cloud Hosting: HIPAA-compliant cloud infrastructure with redundant backups
• Access Controls: Role-based access restrictions with multi-factor authentication for employees
• Network Security: Firewalls, intrusion detection systems, and 24/7 security monitoring
• Device Security: Encrypted data transmission from monitoring devices to our servers

Administrative Security Measures

• Regular security assessments and vulnerability testing
• Employee training on data security and privacy practices
• Background checks for employees with access to health information
• Incident response procedures and breach notification protocols
• Business Associate Agreements with all third-party service providers handling health data

Physical Security Measures

• Secure data centers with physical access controls
• Visitor logs and surveillance systems
• Secure disposal of physical records and devices

However, no security system is completely secure, and we cannot guarantee the absolute security of your information. Despite our reasonable security measures, unauthorized access, hacking, data loss, or other breaches may occur. You acknowledge that you provide your information at your own risk. You are responsible for maintaining the confidentiality of your account credentials and should notify us immediately if you suspect unauthorized access to your account.

Information sharing

We Do Not Sell Your Information

Morley Medical does not sell, rent, or lease your personal information, health information, or biometric information to third parties.

Service Providers

We may share your information with trusted third-party service providers who assist us in providing our Services, including:

• Cloud hosting and data storage providers
• Payment processing services
• Device manufacturers (for warranty and technical support)
• Customer support platform providers
• Analytics services (using de-identified data only)
• AI/ML development partners (using de-identified data only)

All service providers are contractually required to protect your information, use it only for specified purposes, and maintain security standards equivalent to ours. Service providers handling health information execute Business Associate Agreements as required.

Healthcare Providers (With Your Authorization)

If you authorize us, we may share your monitoring data, alerts, and AI-generated insights with your designated healthcare provider(s). You may grant or revoke this authorization at any time through your account settings or by contacting us. We will implement reasonable procedures to process your authorization and revocation requests in a timely manner.

You control these authorizations. You may grant or revoke authorization for any healthcare provider at any time through your account settings or by contacting us. Once information is shared with your healthcare provider, their use of that information is governed by their own privacy practices and applicable healthcare privacy laws.

Aggregated and De-Identified Information

We may in the future share aggregated and de-identified information that cannot reasonably identify you with third parties for healthcare research, analytics, or quality improvement purposes.

Legal Requirements and Protection of Rights

We may disclose your information when required by law or to protect our rights:

• In response to subpoenas, court orders, or legal process
• To comply with applicable laws, regulations, or regulatory requirements (FDA, FTC, etc.)
• To protect our rights, property, or safety, or the rights, property, or safety of others
• To investigate fraud, security issues, or violations of our terms
• To law enforcement authorities with proper legal authority
• In emergency situations to protect health or safety

Business Transfers

If Morley Medical is involved in a merger, acquisition, sale of assets, bankruptcy, or other business transaction, your information may be transferred to the successor entity as part of that transaction. We will notify you of any such transfer and provide you with choices regarding your information.

Cookies and tracking technologies

Morley Medical may use cookies and other tracking technologies to collect information about your usage of our website and Services. This information may include:

• Your browsing history and pages visited
• Time spent on pages and features used
• Click patterns and navigation paths
• Device and browser information
• Session and authentication information

How We Use Tracking Technologies

We use this information to:

• Provide essential website functionality and maintain your logged-in session
• Improve our website and Services
• Understand user behavior and preferences
• Provide you with a better user experience
• Conduct analytics to optimize performance

Types of Tracking Technologies

• Essential Cookies: Required for website functionality, security, and authentication
• Performance Cookies: Help us understand how visitors use our website
• Analytics: Third-party analytics tools (e.g., Google Analytics) to analyze usage patterns

Your Choices

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. However, if you disable essential cookies, some features of our Services may not function properly. You may also opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

Your rights

You have the following rights regarding your personal information and health information:

Right to Access

You have the right to access your personal information and health information that we have collected. You may access most of your information at any time through the customer portal. You may also request a copy (electronic or written) of your information by contacting us using the methods described below.

We will provide portable copies of your health information in a commonly used electronic format (such as PDF or other machine-readable format) unless you specifically request a different reasonable format.

Right to Correct

You have the right to request correction of inaccurate or incomplete personal information. You can update most information through your account settings or by contacting customer support.

Right to Delete

You have the right to request deletion of your personal information and health information, subject to:

• Legal retention requirements (we must retain certain records for specified periods)
• Legitimate business needs (such as resolving billing disputes)
• Ongoing legal claims or disputes

Right to Object and Restrict Processing

You have the right to object to certain processing of your personal information and to request restriction of processing activities.

Right to Withdraw Consent

You have the right to withdraw your consent for processing of your information at any time. However, withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Important Limitation Regarding De-Identified PHI: Once health information has been properly de-identified according to HIPAA standards and used for research or algorithm training, it can no longer be linked back to you and cannot be withdrawn, corrected, or deleted because it is no longer identifiable to any person.

Right to Data Portability

You have the right to receive a copy of your health information in a portable, commonly used electronic format that you can share with your healthcare providers or other services.

State-Specific Rights

California Residents (CCPA/CPRA)

California residents have additional rights including the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate information, the right to opt out of sale of personal information (we do not sell personal information), and the right to limit use of sensitive personal information. To exercise these rights, contact us at support@morleymed.com or 404-891-1750.

Illinois and Texas Residents (Biometric Privacy)

Residents of Illinois and Texas have specific rights regarding biometric information including the right to informed consent before collection, the right to know the purpose and retention period, the right to protection equivalent to other confidential information, and the right to deletion within specified timeframes. See the "Special Consent for Biometric Information" section above.

Other State Rights

Residents of certain U.S. states, including Virginia, Colorado, Connecticut, Utah, and Washington, may have additional privacy rights under applicable state laws, such as the right to confirm whether we process their personal data, the right to access and delete personal data, the right to correct inaccuracies, the right to opt out of certain uses of personal data, and the right to appeal our decisions regarding privacy requests. To learn more about your specific rights, please contact us.

How to Exercise Your Rights

To exercise any of these rights:

• Log into your account and adjust settings
• Email us at support@morleymed.com with "Privacy Rights Request" in the subject line
• Call us at 404-891-1750
• Mail written request to: Morley Medical, Inc., Attn: Privacy Officer, 4500 Mansell Road, Alpharetta, GA 30022

We will verify your identity before processing requests and respond within the time period required by applicable law (generally within 45 days, with the possibility of a reasonable extension where permitted).

Data retention

Morley Medical retains your information for as long as necessary to:

• Provide Services while your account is active
• Comply with legal, regulatory, and professional obligations
• Resolve disputes and enforce agreements
• Support legitimate business purposes

Specific Retention Periods

• Account Data: Retained while account is active plus seven (7) years after account closure
• Health Monitoring Data: Retained for seven (7) years from date of collection to comply with medical records retention requirements
• Biometric Information: Retained for up to three (3) years from your last use of the Services, or earlier upon your request or as required by applicable law (including for Illinois and Texas residents).
• Billing Records: Retained for seven (7) years per accounting requirements
• De-identified Data: May be retained indefinitely for research and algorithm improvement

You may request earlier deletion of your data subject to legal retention requirements.

PHI disclaimer of responsibility

The information provided on our website and through our Services is for general informational purposes only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website, Services, devices, or the information, products, services, or related content for any purpose. Any reliance you place on such information is therefore strictly at your own risk.

No Representation or Warranty

We make no representation or warranty, express or implied, regarding the accuracy, completeness, reliability, suitability, or availability of the products, services, monitoring devices, AI-generated insights, alerts, or information provided through our Services. We do not guarantee that our website, Services, or monitoring devices will meet your requirements, be uninterrupted, timely, secure, error-free, or that any defects will be corrected. We do not guarantee that our AI Technology will detect all health concerns or accurately predict adverse health events.

Limitation of Liability

IN NO EVENT WILL WE BE LIABLE FOR ANY LOSS OR DAMAGE INCLUDING WITHOUT LIMITATION, INDIRECT OR CONSEQUENTIAL LOSS OR DAMAGE, OR ANY LOSS OR DAMAGE WHATSOEVER ARISING FROM:

• Loss of data or profits
• Use of PHI transmitted through our website or stored on our servers or third-party servers
• Any injury, illness, disease, disability, medical emergency, hospitalization, or death
• Any failure to detect health conditions or predict adverse health events
• Any delayed, missed, or inaccurate alerts or notifications
• Any device malfunction or inaccuracy
• Any interruption or suspension of Services
• Any reliance on AI-generated insights without consulting healthcare professionals

Indemnification

You agree to indemnify and hold us harmless from and against any claims, actions, demands, liabilities, damages, costs, and expenses (including without limitation reasonable attorneys' fees) arising out of or related to:

• Your use of PHI transmitted through our website or Services
• Your use of monitoring devices or Services
• Your failure to seek appropriate medical care
• Any inaccurate information you provide
• Your breach of this Privacy Policy or our Service Agreement

No medical advice - critical disclaimer

As further described in our Service Agreement, the information provided through our website and Services (including any AI-generated insights or alerts) is for general informational purposes only and is not medical advice, diagnosis, or treatment. You must maintain a relationship with a licensed healthcare provider and should not rely on the Services for emergency or urgent care. In a medical emergency, call 911 or your local emergency services immediately.

Our Software is Clinical Decision Support, Not Medical Care

The Morley Medical clinical decision support software and AI Technology ("Software") is intended to:

• Aid in understanding your current condition and changes in health status over time
• Complement standard diagnostic practices
• Support the judgment of medical professionals
• Provide early warning of potential health concerns

The Software is NOT intended to:

• Diagnose any medical condition
• Provide treatment recommendations
• Replace professional medical care or advice
• Serve as the sole source of information for medical decision making
• Replace bedside vital signs, clinical alarms, or proactive care from clinicians
• Substitute for professional medical evaluation

Your Healthcare Provider Relationship

YOU MUST MAINTAIN A RELATIONSHIP WITH A LICENSED HEALTHCARE PROVIDER.

Morley Medical shall have no authority to participate in the actual provision of medical care, diagnosis, or treatment. Medical personnel shall be solely responsible for all medical care and treatment decisions.

Any medical care deemed necessary is solely the responsibility of you and your healthcare provider. We do not endorse any particular treatment or medication, and you should not rely on any information from our Services as a substitute for professional medical advice, diagnosis, or treatment.

Not an emergency service

MORLEY MEDICAL SERVICES AND SOFTWARE ARE NOT EMERGENCY SERVICES.

You, your representatives, and medical personnel should not assume that information and notifications provided by the Software are in real time or suitable for emergency response.

IN THE EVENT OF A MEDICAL EMERGENCY, IMMEDIATELY CALL 911 OR YOUR LOCAL EMERGENCY SERVICES, OR PROCEED TO THE NEAREST EMERGENCY ROOM. DO NOT CONTACT MORLEY MEDICAL OR WAIT FOR AN ALERT FROM OUR SERVICES.

Limitation of Liability for Medical Decisions

Morley shall not be liable to you or any third party if you:

• Disregard professional medical advice or delay seeking such advice as a result of your use of or reliance on the Software or Services
• Rely on information, notifications, or insights provided by the Software in making a diagnosis, determining whether to provide treatment, or determining the course of treatment
• Experience any adverse health outcome allegedly related to use of or reliance on our Services

RELIANCE ON ANY INFORMATION, NOTIFICATIONS, ALERTS, AI-GENERATED INSIGHTS, OR OTHER OUTPUT FROM THE SOFTWARE OR SERVICES IS SOLELY AT YOUR OWN RISK.

Morley is not responsible or liable to you or any third party for:

• Any advice, course of treatment, or diagnosis provided by a physician or other healthcare professional
• Any decision made by you or your healthcare provider based on monitoring data or AI insights
• Any delay in seeking medical care
• Any medical outcomes or health conditions

Morley neither recommends nor endorses any specific tests, products, procedures, opinions, or other information that may be recommended by any healthcare professional.

Age Restrictions

The Services and Software are not intended for use by those under 18 years of age without parental consent and supervision.

Links to third-party websites

Our website and Services may contain links to third-party websites or services that we do not own or control. Those third parties' practices are governed by their own terms and privacy policies, and we are not responsible for their content, privacy practices, or your use of their websites or services. See our Service Agreement for additional important disclaimers and limitations of liability.

Changes to our privacy policy

Morley Medical may update or modify this Privacy Policy and PHI Disclaimer of Responsibility from time to time without prior notice. Any changes will be posted on our website and will be effective immediately upon posting, or on such later date as may be specified in the updated policy.

For material changes affecting how we use health information or biometric data, we will provide advance notice via email to the address associated with your account.

You are advised to review this policy periodically for any changes. Your continued use of our Services after any changes constitutes your acceptance of the updated Privacy Policy.

We will update the "Last Updated" date at the top of this policy to reflect when changes were made.

Contact us

If you have any questions or concerns about this Privacy Policy and PHI Disclaimer of Responsibility, or if you wish to exercise your privacy rights, please contact us at:

For Privacy Rights Requests

Email: support@morleymed.com with "Privacy Rights Request" in subject line

For Biometric Information Inquiries (Illinois and Texas Residents)

Email: support@morleymed.com with "Biometric Information Inquiry" in subject line

For Security Incidents

Regulatory complaints

If you have concerns about our privacy practices, we encourage you to contact our Privacy Officer first using the contact information above. We are committed to working with you to resolve any privacy concerns.

If you are not satisfied with our response, you have the right to file a complaint with applicable regulatory authorities in your jurisdiction. We will not retaliate against you for filing a complaint with any regulatory authority.

California Residents: You may also contact the California Attorney General's Office regarding privacy complaints.

Acknowledgment

By using Morley Medical's website, purchasing our monitoring devices, and using our Services, you acknowledge that you have read, understood, and agree to this Privacy Policy and PHI Disclaimer of Responsibility.

FOR ILLINOIS AND TEXAS RESIDENTS: By using monitoring devices that collect biometric information, you specifically acknowledge and consent to the collection, storage, and use of your biometric information as described in this Privacy Policy.