Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Leapcure, Inc. ("we", "us") collects, uses, shares, and protects "consumer health data" as defined under applicable U.S. state laws, and the privacy rights and choices you have with respect to such data, in connection with our service offerings and other products or services (collectively, the "Services").

This Consumer Health Data Privacy Policy supplements our Privacy Policy.

Categories of Consumer Health Data We Collect

We collect the following categories of consumer health data:

• Information about your health conditions, treatment, diseases, or diagnoses, such as information about your health history, hereditary or chronic symptoms or disease, including treatment, prescribed medications or other health-related information that you provide.
• Social, psychological, behavioral, and medical interventions, including exercise routines, goals, health management activities, or other habit metrics you provide.
• Information about your bodily functions, vital signs, symptoms or measurements of information, such as information about your weight and height, vital signs and physiological measurements.
• Diagnoses or diagnostic testing, treatment or medication, such as when you share results of diagnostic tests with us.
• Health information that is derived or inferred from non-health data, such as derived health insights we generate from your inputs to the Services, including potential eligibility for clinical trials.

Categories of Sources of Consumer Health Data We Collect

We collect consumer health data from you when you complete and initial screening with our Services, provide such information to us in connection with your use of the Services, including when you fill out our forms, surveys, questionnaires, or upload results of health assessments, or ask questions or provide feedback to us, including in connection with our support services.

Our Purposes for Collecting and Using Consumer Health Data

We collect and use consumer health data for the following purposes:

To provide our Services to you, including to assess your potential eligibility for clinical trials; provide support and assistance relating to the Services; create and manage your account; and process orders or other transactions.

For research and development. We may use your consumer health data for research and development purposes, including to analyze and improve our Services and our business. As part of these activities, we may create aggregated, de-identified, or other anonymized data from personal information we collect. We may use this data and disclose it to third parties for our lawful business purposes, including to analyze and improve our Services and promote our business.

Compliance and protection. We may use consumer health data to comply with legal obligations, and to defend our company against legal claims or disputes, including to:

• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;
• Protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims);
• Audit our internal processes for compliance with legal and contractual requirements and internal policies;
• Enforce the terms and conditions that govern our Websites and Services; and
• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

How We Disclose Your Consumer Health Data

We may disclose the categories of consumer health data described above to:

Sponsors. Your consumer health data may also be shared with the sponsor of the clinical trial (and/or representatives working on the sponsor's behalf, such as data processors) in pseudonymised form for the purpose of sharing updates on clinical trial patient recruitment efforts and asking questions about specific considerations for patients on the clinical trial. Pseudonymised form means that the consumer health data that identifies you is replaced with a data subject identification number, which is a number specific to you, to protect your identity.

Service providers. Companies and individuals that provide services on our behalf or help us operate our Services or our business (such as hosting and cloud services, information technology, customer support, email delivery, Website analytics services and consultants).

Business clients. We share your consumer health data with business clients to help better assist you in finding a clinical trial.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, us or our affiliates (including, in connection with a bankruptcy or similar proceedings).

Other third parties at your direction or with your authorization.

Your Rights Regarding Your Consumer Health Data

Depending on your location and the nature of your interaction with the Services, you may request the following:

• Confirm whether we collect, share or sell your consumer health data
• Access your consumer health data
• Delete your consumer health data
• Withdraw your consent from our collection or sharing of your consumer health data

Please note that in some circumstances, your choices may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. In those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include personal information if necessary to verify your identity and the nature of your request.

Submitting a request. To submit a request regarding any of the rights described above, please send us an email at privacy@leapcure.com.

We will not discriminate against you for exercising your rights described above.

How to appeal. If your request to exercise any of the rights described above is denied, you may appeal this decision by emailing us at privacy@leapcure.com. We will inform you within 45 days of receiving your appeal which will include an explanation of the reasons for our decision. If your appeal is denied, you may issue a complaint with appropriate regulatory enforcement authorities.

Changes to this Consumer Health Data Privacy Policy

We reserve the right to make changes to this Consumer Health Data Privacy Policy at any time. If we do so, we will notify you by updating the date of this Consumer Health Data Privacy Policy and posting it on our website and online services. If required by law to provide notification of changes in another way, such as by sending you an email, and/or by some other means, we will do so. If you use the Services after any changes to the Consumer Health Data Privacy Policy have been posted, you acknowledge all of the changes. Any modifications to this Consumer Health Data Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting).