Privacy Policy

Privacy Policy

Last Updated: July 1, 2023

Privacy

CareValidate, Inc. (“CareValidate”,“we”, “us” or “our”) values the privacy of your data, and we are committed tousing our best efforts to protect it. This privacy policy (“Privacy Policy”) explainswhat information we collect about you and why, what we do with your informationand how we handle your information. This Policy covers information collectedthrough our website, Care360 platform, solutions and underlying componentswithin those platforms, any mobile applications, and any emails, text messages,direct messages or other communications we may have with you about CareValidate(collectively the “Platform”).

Terms not defined in this Privacy Policy have the meanings ascribed them in our Terms of Service. By providing us any information or accessing any part of the Platform, individuals agree to the following terms and conditions as final and binding.

Changes to This Privacy Policy

This Policy may change from time to time.  We will post a notice on our platform if any material changes are made to this Policy, along with the effective date, in an easy-to-find area of the Platform. Note that your continued use of the Platform after any change means that you agree with, and consent to be bound by, the new policy. We reserve the right to modify the Privacy Policy at any time. Please review it frequently.

Types of Data We Collect

We collect the following information about you:

Personal Data

“Personal Data” means information that directly or indirectly identifies you, such as your name, email address, or other identifying information about you, or that would, when combined with other information you provide or that is broadly available, be likely to identify you.

You may interact with CareValidate in ways that require us to gather Personal Data. The amount and type of information that we gather depends on the nature of the interaction. For example, if you order a test kit, we will require your name and contact information to deliver the test. In each case, we collect such information only in so far as is legal and appropriate. If you do not wish for us to collect any information about you through the Platform, you can simply not utilize the Platform or otherwise supply Personal Data. Your choice not to provide information may, however, prevent you from using certain features of the Platform. Note that we may still process information about you on behalf of your employer or the organizer of the event you are attending, as applicable. Please contact your employer or the organizer of the event you are attending, as applicable, if you have any questions about this information.

Other Data

Like most website and application operators, CareValidate also collects information of the sort that web browsers, applications and servers typically make available to operators, like the browser type, language preference, referring site, and the date and time of each visitor request. In this Privacy Policy, we refer to this type of data as “Other Data.” CareValidate may use this information for a number of purposes including, for example, to better understand how CareValidate’s visitors use the Platform. The purposes for collecting and using this data may change from time to time at CareValidate’s discretion, and CareValidate may release Other Data in the aggregate. By utilizing the Platform, you agree to such use.

How CareValidate Collects Personal Data

Personal Data you provide to us.

We will collect Personal Data when you interact with us via the Platform.  We also will collect Personal Data when you subscribe to receive CareValidate marketing materials.

Personal Data provided by our Clients.

We receive Personal Data from our clients, such as employers or event organizers, who are using our services to verify vaccination status or provide free testing (collectively, our “Clients”). We receive that information by various means, including information that Clients input into the Platform.

Personal Data collected from testing kits purchased on the Platform.

We may collect the results of any testing kit you or our Client purchase from us, which may include Personal Data.

Information automatically collected by the Platform.

We may collect information about the Platform that you use and how you use it. This information includes:

• Computer, tablet, or mobile telephone information. We may collect device-specific information(such as your hardware model, operating system version, unique device identifiers, device sensors and mobile network information including phone number) and device sensors and related information. CareValidate may associate your device identifiers or phone number with your account. We will comply with the usage/license restrictions and requirements applicable to the device from which the information comes.

• Log information. When you usethe Platform or view content provided by us, we may automatically collect andstore certain information in server logs. This may include, for example:

o details of how you used the Platform.

o Internet protocol address.

o device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request and referral URL.

• Location information. When you use the Platform, we may collect and process information about your actual location, like GPS signals sent by a mobile device. We also may use various technologies to determine location, such as sensor data from your device that may, for example, provide information on nearby Wi-Fi access points and cell towers.

• Unique application numbers. The Platform may include a unique application number. This number and information about your installation (for example, the operating system type and application version number) may be sent to CareValidate when you install or uninstall an application or utilize the Platform or when the Platform periodically contacts our servers, such as for automatic updates.

• Local storage. We may collect and store information (including Personal Data) locally on your device using mechanisms such as browser web storage (including HTML 5) and application data caches.

• Cookies and anonymous identifiers. We use various technologies to collect and store information when you visit the Platform as described below, and this may include sending one or more cookies or anonymous identifiers to your device.

Cookies

The Platform may utilize “cookies” to improve the functionality of the Platform. Cookies are text files that are sent by servers to web browsers and stored on your computer. They tell us which parts of the Platform you’ve visited so CareValidate can alert you to software compatibility issues and save your preferences for future visits to the Platform. Some cookies and other technologies may serve to recall Personal Data previously provided by a user.

We use information collected from cookies and other technologies to improve your user experience and the overall quality of our services. We use cookies to help us identify and track visitors, their usage of the Platform, and their access preferences. We may use your Personal Data to see which web pages you visit at our websites, which website you visited before coming to our website, and where you go after you leave our website. We can then develop statistics that help us understand how our visitors use our websites and how to improve them. Visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using the Platform; provided, however, that CareValidate disclaims, and you hereby waive, any claim or liability that may arise due to your partial or incomplete access to the content of any of the Platform as a result thereof. Visitors also can utilize the Global Privacy Control (“GPC”) add-on or browser preference, which signals that you do not want personal information collected by websites you visit. Our Sites are designed to respond to GPC signals.

For more information about how CareValidate utilizes cookies, you can visit our Cookie Policy here .

How CareValidate Uses Personal Data

We primarily use your Personal Data in order to provide our vaccine and testing information records management services to our Clients. Please contact your employer or the organizer of the event you are attending, as applicable, to learn more about how they use your Personal Data.

Separately, we may use some of your Personal Data, such as information derived from cookies, electronic identifiers, and log information, in the following ways:

• To operate, maintain, and improve ourservices, including the Platform.

• To create your account, identify you as a user, and customize the Platform for your use.

• To operate, evaluate and improve our business and the products and services we offer.

• If you submit a resume to work at CareValidate, we may use it for hiring decisions and retain the resume or information in it for our own records or in order to contact you later.

• To send you administrative communications about your use of the Platform, which may include administrative emails, confirmations, technical notices, updates, and security alerts.

• To provide you with user support and to respond to your comments and questions.

• To analyze trends and statistics regarding the use of the Platform including any mobile applications and social media assets.

• To improve our customer service.

• To protect, investigate, and discourage fraudulent, unauthorized, or illegal activity.

• To comply with legal obligations and to cooperate with public and government authorities, courts or regulators in accordance with applicable laws to the extent doing so requires the processing of Personal Data.

Data Retention

Your Personal Data will not be kept for longer than is necessary to fulfill the specific purposes outlined in this Privacy Policy and to allow us to comply with our legal requirements. If we collect your Personal Data on behalf of our Clients, we may be required to keep your Personal Data for as long as our Clients direct us. We also may retain information that is not Personal Data (e.g., information that is de-identified and aggregated with other data and Other Data) for longer periods for internal and operational purposes.

How CareValidate Shares Personal Data

We may share your Personal Data with third parties such as vendors. These include:

• Third parties designated by you. We may share your Personal Data with third parties where you have provided your consent to do so.

• With our Clients. We mayprovide your Personal Data to our Clients who have directed you to use ourPlatform.

• Our third-party service providers. We may share your Personal Data with our third-party service providers who provide us services including hosting, delivering, and improving our services. We also use third-party service providers for specific services and functions, including email communication, customer support services, and data analysis. These third-party service providers may only use your Personal Data following CareValidate's instructions and to perform their duties for us.

• Business Transfers. We mays hare your Personal Data in connection with a merger, acquisition, bankruptcy, reorganization, sale of some or all of our assets, or steps in consideration of such activities. In the event that (i) we engage one more asset sales or purchases; (ii) we are acquired; (iii) we in one or more business combinations, mergers or acquisitions; (iv) substantially all of our assets are acquired; or(v) we subject to an event of bankruptcy, you acknowledge and agree that user information comprises an asset of CareValidate and that it may be assigned, transferred, or acquired by a third party. Accordingly, and not withstanding anything to the contrary in this Privacy Policy, you acknowledge and agree that such transfers may occur, and that any acquirer of CareValidate may continue to subsequently use your Personal Data, and that such subsequent use may not be consistent with this Privacy Policy.

• Other disclosures. If CareValidate determines that the access, preservation, or disclosure of your Personal Data is required by law to protect the rights, property, or personal safety of CareValidate and users of the Platform, or to respond to lawful requests by public authorities, including national security or law enforcement requests then CareValidate will share or disclose your Personal Data. Additionally, if CareValidate believes it is necessary to investigate potential violations of the Terms of Service, to enforce the Terms of Service, or where we believe it is necessary to investigate, prevent, or act regarding illegal activities, suspected fraud, or potential threats against persons, property, or the systems on which we operate our Platform, then CareValidate may share or disclose your Personal Data.

CareValidate does not

• Share your Personal Data with third parties for the purpose of enabling them to deliver advertisements to you.

• Sell or rent your Personal Data in exchange for monetary consideration.

How We Protect YourInformation

CareValidate discloses Personal Data to those of its employees, contractors, agents and affiliated organizations that need to know that information in order to process it on CareValidate’s behalf or to provide services. Some of those employees, contractors, agents and affiliated organizations may be located outside of your state, province or country. By using the Resources or providing us information, you consent to the transfer of such information to them.

If you are a registered user of one or more Resources or have supplied your email address, you agree that in addition to any Resources you may have solicited or requested, CareValidate may further send you emails to provide you with information, , to solicit your feedback, or to keep you up to date on CareValidate. If you send us a request (for example via a support email or via one of our feedback mechanisms), we reserve the right to publish it in order to help us clarify or respond to your request or to help us support other users.

We aim to maintain our services in a manner that protects information from accidental or malicious destruction. Because of this, we may not immediately delete residual copies of Personal Data that is on our active servers and may not remove information from our backup or archive systems.

As noted, we primarily collect and store your Personal Data on behalf of our Clients. If you believe that Personal Data we maintain about you is inaccurate, please contact your employer or the organizer of the event you are attending, as applicable.

In some cases, we cannot control, and are not responsible for, information that is shared about you. For example:

• Information You Share. The Platform may let you share information with others. Remember that when youshare information publicly, it may be indexable by search engines or otherwise further disclosed.

• Social Media Accounts. CareValidate maintains various social network accounts such as Facebook, Twitter, Instagram or LinkedIn. Please note that comments and information that you leave in such settings are likely to be broadly visible and may not be controlled by us. We are therefore not responsible for any information or messages you leave in such settings or for how such information may be used by others. Please review the terms of use and privacy policies of any social network platforms you use, as they will control your rights and responsibilities, and your use of those platforms is not covered by this Privacy Policy.

• Accessing and Updating Personal Data. If you provide us with information or create an account in order to access or receive services on the Platform, we may or may not be able to provide you with access to your Personal Data. If information that we control about you is incorrect, we strive to give you ways to update it quickly or to delete it (unless we have to keep that information for legitimate business or legal purposes). When updating your Personal Data, we may ask you to verify your identity before we can act on your request.

State Specific Privacy Rights

Some state consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, provide individuals with certain rights regarding their Personal Data. These laws do not apply to all organizations that collect personal data, and at this time CareValidate does not meet the applicability thresholds of any of those laws.

Notice to California Residents

A California resident who has provided Personal Data to a business with whom he/she has established a business relationship for personal, family, or household purposes may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes. As noted above, we do not disclose personal information to third parties for such purposes.

International Users

If you are visiting from the European Union or other regions with laws governing data collection and use that may differ from U.S. law, please note that you are transferring information about you, including Personal Data, to a country and jurisdiction that may not have the same data protection laws as your country of residence. By providing us with Personal Data, you consent to the transfer of information about you, including your Personal Data, to the U.S. and the use and disclosure of information about you, including your Personal Data, as described in this Privacy Policy.

In some cases, we may transfer Personal Data provided to us by Clients in one country, to entities within our organization located outside of that country. If we transfer Personal Data internationally, we may rely on a legal framework that provides appropriate safeguards, which could include the standard contractual clauses, binding corporate rules, or another framework deemed adequate by the appropriate governing body (such as the Standard Contractual Clauses approved by the European Commission).

Identity of the Data Controller

A “data controller” is a person or entity that determines the purpose and means for which Personal Data is processed. The “data processor” is a person or entity that processes Personal Data on behalf of the data controller.

CareValidate acts as a data processor on behalf of Clients when it processes Personal Data for the purposes of providing our services to those Clients, such as managing vaccination status records or offering testing kits to employees. The identity of the controller of your Personal Data is your employer or the organizer of the event you are attending, as applicable. Please Contact Us for more information about the controller of your Personal Data.

Advertisements

Advertisements appearing on the Platform may be delivered to users by advertising partners, who may set cookies. These cookies allow the ad server to recognize your computer each time they send you an online advertisement to compile information about you or others who use your computer. This information allows ad networks to, among other things, deliver targeted advertisements that they believe will be of most interest to you. This Privacy Policy and our Cookie Policy[WR2]  cover the use of cookies by CareValidate and do not cover the use of cookies by any advertisers.

Comments

You acknowledge and agree that CareValidate has no duty or obligation to respond to or save user comments, but we may further use and disclose your comments as otherwise described in this Privacy Policy.

Third Party Links

The Platform may contain links to webpages or tools operated by parties other than CareValidate. We do not control such websites or tools and are not responsible for their contents or the privacy policies or other practices of such websites or service providers. Our inclusion of links to an outside website or tool does not imply any endorsement of the material on such websites or tools or any association with their operators. Further, it is up to you to take precautions to ensure that whatever links you select or software you download (whether from an electronic platform (such as an app) or other websites) is free of such items as viruses, worms, trojan horses, defects and other items of a destructive nature. These websites and services may have their own privacy policies, which you will be subject to upon accessing the third party’s website. We strongly recommend you review the third party’s terms and policies.

Children

CareValidate does not knowingly collect information from children under the age of 16. If a parent or guardian becomes aware that their child has provided us with information without the consent of the parent or guardian, then the parent or guardian should immediately contact CareValidate via e-mail or through other written communications. We will delete such information as soon as reasonably possible. We strongly encourage parents and guardians to monitor their children's internet usage and to advise their children to never provide Personal Data through this Platform without their permission.

Do Not Track

Some browsers have a “Do Not Track” feature that lets you tell websites and online services that you do not want to have your online activities tracked. Such browser features and industry standards are not uniform, so our websites and online services do not respond to those signals.

Contact Information

Our Contact Information

If you have any questions about this Privacy Policy, you may contact us at:

CareValidate, Inc.

4575 Webb Bridge Road

Alpharetta, GA 30005

info@CareValidate.com

Data Protection Officer Contact Information

You may contact our Data Protection Officer, Johan Westin, at:

Per Hörbergs Väg 3

164 50 Bromma

Sweden

p. +46 705085085

Email: johanwestin00@gmail.com

35766804.1