CARDAMOM HEALTH, INC. – WEBSITE PRIVACY POLICY

Effective Date: 31 August 2023

Note: This privacy policy applies to our collection, use, and disclosure of data received or created by Cardamom Health, Inc., (referred to here as “Cardamom,” “we,” “us,” or “our”) when you access, use, or enter information into our website at https://cardamom.health (the “Site”) and if you use the services we offer. The Site, data and professional services are referred to collectively as the “Services.”

Your Consent
By accessing or using the Services, you consent to us processing the information described in this Privacy Policy. “Processing,” means using or touching information in any way, including, but not limited to, collecting, storing, deleting, using, combining, and disclosing information. Information processed by the Services will be transferred, processed, and stored in accordance with United States federal and state law.

What information is collected by the Services and how is it used?
We collect personal information (such as your name, mailing address, email address and phone number) when you use submit information into the Site (“User Information”) to provide the Services.

We may collect some information automatically, such as the type of device or mobile device you use, your device or mobile device’s unique device ID, the IP address of your device or mobile device, your device or mobile device operating system, the type of internet browsers you use, and information about your use of the (“Usage Data”). Usage Data will be used to enhance and improve Services.

We may use information that you submit to contact you or send you information, for example, to answer your inquiry to our Site, send you our newsletters, marketing or promotional materials, and other information that we think may be of interest to you. You may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or the instructions provided in any email we send.

Do third parties see and/or have access to information obtained by the Services?
User Information and Usage Data may be shared with the third-party service providers who host and support the Site on Cardamom’s behalf. These service providers do not have any right to independently use any personal information that we share with them.

What are my opt-out rights?
We only collect the User Information and Usage Data necessary to provide Services or for marketing purposes. Because of this, the only way to opt out of information collection is to stop using the Site or Services. If you do not wish to receive marketing emails from us, you can opt out of marketing emails by following the instructions provided in the marketing emails. Opting out of marketing emails will not affect our administrative emails to you (e.g., emails about your transactions or policy changes).

Data retention policy
We retain personal information that you submit to improve and market our Services. We use and retain Usage Data indefinitely to improve the Site.

Statement regarding the California Consumer Privacy Act of 2018 (“CCPA”)
For compliance with the California Consumer Privacy Act of 2018, as amended, and its associated regulations (“CCPA”), We may collect “Personal Information” from the following categories:
(A) Identifiers (ex. real name, alias, postal address, unique identifiers, online identifiers, internet protocol (“IP”) address, email address, account name, social security number, driver’s license number, passport
number, or other similar identifiers.
(B) Categories of personal information described in subdivision (e) of Section 1798.80 (Identifiable information contained in Customer Records).
(C) Characteristics of protected classifications under California or federal law.
(D) Commercial information, including products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E) Biometric information.
(F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.
(G) Geolocation data.
(H) Audio, electronic, visual, thermal, olfactory, or similar information.
(I) Professional or employment-related information.
(J) Education information, defined as information that is not publicly available personally identifiable information in the Family Educational Rights and Privacy Act (“FERPA”).
(K) Inferences drawn from any of the information identified in this subdivision to create a profile about a reflection of the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Your Personal Information Rights
You may make certain requests regarding our use of your personal information by emailing us at [email protected]. If you are a resident of the State of California, some requests may be governed by CCPA. If you are not a California resident, or a response to any given request is not required by CCPA or other applicable law, we are under no obligation to provide a specific response to any such request, however, we will make commercially reasonable efforts to respond to any request we receive, subject to applicable laws. For your protection, we may need to verify your identity before acting on your request.

• You may request to review and obtain a copy of your personal information. We will provide a copy or a summary of your information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
• You may request to amend your personal information. You can ask us to correct personal information about you that you think is incorrect or incomplete. In your request, please make clear what personal information you would like to have changed. We may say “no” to your request, but we’ll tell you why in writing within 60 days.
• You may request to restrict use or disclosure of Personal Information in certain circumstances. Although we do not sell personal information about our users, you do have the right to explicitly ask us not to sell your personal information to third-parties. This opt-out right does not apply to personal information that we share with third-party service providers involved in the operation of the Site.
• You may ask for a list of those with whom we’ve shared personal information with, and why. We will usually deliver the list within 30 days of your request.
• You may request confidential communications. Within reason, we will act upon requests to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
• You may request a copy of this Privacy Policy. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Age Requirements
The Site is not designed or intended to appeal to minors, and we do not knowingly collect User Data from children under the age of 18 without parental consent.

If a parent or guardian becomes aware that a child has provided us with information without consent, the parent or guardian should contact us at [email protected] so we can promptly delete such information.


Security
We use physical, electronic, and procedural safeguards to protect the information that we collect, process, and maintain. Although we strive to keep the information that we collect, process, and maintain secure, no security system can prevent all potential security breaches.
In addition to the security safeguards we provide, we urge you to take precautionary measures to maintain the integrity of your data. Please make sure that no one can see or access your account or log-in/password information, or your mobile device.

Links to other sites and services
The Site may contain links to other sites or services that are not operated by us. If you click an outside link, you will be directed to that outside site or service. We strongly advise you to review the privacy policy of every site you visit. We are not responsible for the privacy practices or the content of any outside sites or services.

Changes
We reserve the right to modify this Privacy Policy at any time in our sole discretion by including such alteration and/or modification in this Privacy Policy, along with a notice of the effective date of such modified Privacy Policy. If you continue to use the Site or Service after a modified Privacy Policy is posted, you consent to the modified Privacy Policy. Accordingly, if at any time you do not agree to be subject to any modified Privacy Policy, you may no longer use the Site.