Qare Privacy Policy

Lōkahi Therapeutics Inc. (“we”, “us”, “our”) is committed to protecting the privacy of information we collect from or about you that identifies or could reasonably be used to identify you, directly or indirectly (“Personal Data”). This Privacy Policy (“Policy”) describes how we collect, use, and disclose your Personal Data when you use the Qare mobile application (the “App”) or the Qare website (the “Website”), Qare-app.com (collectively, the “Services”).

Scope

This Policy applies to the Personal Data that we collect from you when you interact with us through the Services. This Policy does not apply to any other websites or online services that we operate but that do not include a link to this Policy. Those websites and online services may be subject to their own privacy notices. This Policy also does not apply to anonymous or de-identified data that is not associated with a particular individual or to clinical trial data collected or maintained by Lōkahi Therapeutics.

While we may collect and process your Personal Data through both the App and the Website, the Website is primarily intended for informational purposes and to allow you to submit general questions, requests, and feedback to us. Please do not submit health-related information to us through the Website.

In addition, while we may collect and process information related to your health through the App, please note that we are not a covered entity subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and that HIPAA's requirements do not apply to the health information we collect and process through the App. The App provides wellness-related insights only and is not intended to diagnose, treat, cure, or prevent any medical condition.

Personal Data We Collect and How We Collect It

The Personal Data we collect, and how we collect it, depends on how you interact with us. When you sign up for an account and access and use the Services, we may collect information both directly from you that you choose to provide, and automatically from your use of the Services.

Information You Provide Directly

We collect Personal Data you provide directly when you interact with us, such as the following:

• Account information, including Personal Data you provide when you create an account, such as your email address and password.
• Self-reported demographic information, including your gender, race, and age.
• Health and medication data, including your medications, dosages, dosing frequency, health history, baseline health metrics (such as energy levels, mood, and side effects), and outcome data you track over time (such as symptom relief, adherence, weight changes, or other health indicators).
• Any other information you submit through the Services, including information you provide through any free text field or contact forms within the Services.

We collect information that relates to a physical or mental health diagnosis, such as your health and medication data and information that may reveal your racial or ethnic origin. This information is categorized as sensitive data under applicable law.

Information We Collect Automatically

We may also collect certain device, usage, and other information automatically when you use the Services, such as the following:

• Device Information: When you visit the Services, we will collect certain information about your device automatically, such as information about your device and your browser. For example, we may receive device identifiers such as IP address and MAC address, and operating system type and version.
• Usage and Log Information: When you use the Services, we will collect certain information about how you use the Services, such as features visited and used, date of visit or usage, type of device, device or user ID, operating system version, clicks, text entered, time spent using the Services or particular features, errors, log files, including for query tracking, events, and errors, and other details of your actions on the Services.
• Information Collected in Connection with Analytics Technology: We may use various technologies to learn more about how visitors use the Services. We may also use other technologies to monitor your activities on our Services.

When you use the Services, our partners, service providers and other third parties with whom we work may use certain technologies to collect this information and other information about your online activities over time and across third-party websites or online services.

Purposes for Processing Personal Data

We may use, disclose, transmit, transfer, store, and otherwise process Personal Data for purposes including:

• Providing and maintaining the Services, including to monitor the usage of the Services.
• Communicating with you (e.g., responding to inquiries, fulfilling requests, and promoting the App and our products, services, and offerings).
• Operating, developing, and improving the Services.
• Enabling third-party integrations, services, features, and offerings.
• Creating aggregated and de-identified data, including for the purpose of developing anonymous cohort groups so that you can compare your experience with similar anonymous users in your cohort.
• Securing the Services, including protecting against and responding to fraud, illegal activity (such as hacking or misuse), and claims and other liabilities, including by enforcing our Terms of Service.
• Complying with legal or regulatory requirements, judicial process, and our policies (including due diligence and contracting activities).
• Evaluating or conducting a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our business, assets, or stock.
• Any other purpose you authorize or direct at the time we collect your information.

We may also use information that has been aggregated or de-identified such that it cannot reasonably be linked to an identified or identifiable individual or device for any purpose permitted by applicable law.

Qare does not collect, use, or sell Personal Data for the purpose of training large language models.

Parties to Whom We May Disclose Personal Data

To accomplish the purposes described in the “Purposes for Processing Personal Data” section above, we may disclose Personal Data to third parties, including:

• Our subsidiaries and affiliates.
• Contractors, service providers, and other third parties that support our organization, such as providers of cloud hosting, analytics, customer support, communications, and payment processing services.
• An actual or potential investor, buyer, successor, or other person or organization in connection with an actual or potential merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our business, assets, or stock (including in connection with bankruptcy, liquidation, or similar proceedings).
• Third parties when necessary to comply with any court order, law, or legal process; to respond to government or regulatory requests; and to enforce or apply our policies and other agreements.
• Any other parties disclosed by us at the time you provide the information or authorized or directed by you.

We may also disclose information that has been aggregated or de-identified such that it cannot reasonably be linked to an identified or identifiable individual or device for any purpose as permitted by applicable law.

Our Retention of Your Personal Data

We retain the information we collect for as long as is necessary to accomplish the purposes set out in this Privacy Policy, including as needed to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We determine the appropriate retention period for the information we collect on the basis of the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, whether we can achieve the purposes of the processing through other means, and on the basis of applicable legal requirements (such as applicable statutes of limitation).

Data Security

We take reasonable precautions, including administrative, technical, and physical measures, designed to safeguard Personal Data against loss, misuse, theft, and unauthorized access, disclosure, alteration, and destruction.

Your Choices

When you use the Services, you may choose not to provide requested Personal Data. However, if you do not provide requested information, your ability to use certain features may be limited.

Some Internet browsers have a “do-not-track” feature that lets you tell the Services that you do not want to have your online activities tracked. At this time, the Services do not respond to browser “do-not-track” signals, and other parties may collect personal information about your online activities over time and across different websites, applications, and other online products or services when you use the Services.

You may also edit or delete your account on the App at any time.

You may opt out of receiving our email alerts or other promotional email communications by using the opt-out link or unsubscribe instructions included in the emails we send, by contacting us through the details provided below, or (where available) through the Services.

Third-Party Links and Integrations

Our Services may include links to or options to integrate with third-party websites, applications, information, and services provided by third parties, including health and fitness platforms. If you choose to enable these integrations, the third-party service's privacy policy governs their collection and use of your data. We are not responsible for the privacy policies or practices of those third parties. We encourage you to review the applicable privacy policies of third parties if you choose to follow the links provided or integrate our Services with third-party applications and services.

De-identified Information

We will maintain and use de-identified information that does not constitute Personal Data in a de-identified form and will not attempt to re-identify such de-identified information except to the extent permitted under applicable law.

State-Specific Disclosures

If you are a resident of Washington or Nevada, please visit our Consumer Health Data Privacy Notice.

Additional privacy laws in certain states provide residents of those states with additional rights regarding our processing of Personal Data subject to those laws. We have described such privacy rights below, as applicable.

As the rights described below are provided by law, there may be limitations or exceptions that apply to your request in accordance with applicable legal requirements. We have described these rights generally, without noting all applicable or potentially applicable limitations or exceptions. When you make a request, we may provide more detailed information regarding any legal requirements applicable to your request and whether any exception or limitation applies.

Subject to these limitations and exceptions, residents of certain additional states may have rights to request that we:

• Access Personal Data we have collected about them.
• Delete Personal Data.
• Receive a copy of their Personal Data in a portable, and to the extent technically feasible, readily usable format.
• Correct inaccuracies in their Personal Data, taking into account the information's nature and purposes for processing.

Residents of these states may also have the right to not be retaliated against for exercising any of the above-listed rights.

To exercise any of these rights, please contact us using one of the methods described in the “Contact Us” section below, and identify the privacy right you wish to exercise as the reason for contacting us. To appeal a decision regarding a request to exercise these rights, please describe the issue and request an appeal by responding to our decision communication or otherwise contacting us as described in the “Contact Us” section below.

Changes to This Policy

We may update this Policy to reflect changes in our privacy practices at any time and without prior notice to you. When we do so, we will update the effective and last updated date above. We encourage you to periodically review this Policy for the latest information on our privacy practices.

Contact Us

If you have any questions about this Policy, concerns about the way we process your Personal Data, or require assistance in managing your privacy choices, please contact us at: