Last Updated: October 3rd, 2022

About Your Privacy and This Privacy Policy

Your privacy is of upmost importance to us. This document is our “Privacy Policy” and it contains details on issues related to your privacy when using our services. This Privacy Policy applies to visitors of the website carebyclay.com and any affiliated mobile applications (collectively, the “Platform”) and describes the types of information (“Clay,” “us,” “we,” or “our”) may collect from you or your authorized representative (“you”). The Policy also describes our practices for collecting, using, maintaining, protecting, and disclosing information about you, and expresses our commitment to protecting your privacy in accordance with law.

The Privacy Policy does not apply to the collection and use of certain employment-related information or information received from contracted providers. If you are a current or former Clay job applicant, employee, owner, director, officer, or contractor, please contact us hello@carebyclay.com for the appropriate notice.

Agreement and Updates

Please read this policy carefully. If any term is unacceptable to you, please do not use the Platform or provide any personal information. If you do access or use the Platform, it will mean you expressly agree to the terms of this Privacy Policy.This Privacy Policy may change from time to time, and your use of the Platform after we make changes is deemed to be your acceptance of those changes, so please check the Platform periodically for updates.

General Description of the Site and Information Clay May Collect and Store

The Platform provides the technology that permits you to connect with a coach if you are located in a state where we operate, and to receive coaching, consisting of generalized advice based on publicized best practice guidelines. Clay does not practice medicine. Rather, Clay provides administrative and technological support for the coaches and other participants on the Platform. This includes collecting and securely maintaining health information from users and processing payment for services provided through the Platform.

When you use the Platform and communicate with us, we collect health information that individually identifies you, called Protected Health Information (“PHI”) and other private information. The Privacy Policy does not describe how we collect or use your PHI, which is covered by a separate Notice of HIPAA Privacy Practices (“NPP”). Please carefully review the NPP. The information it contains is important and is not repeated in this Privacy Policy.

The provisions in this Privacy Policy also apply to PHI but it focuses on the information collected by and through the Platform and on information we collect that is not healthcare information, such as:

• Technical information about how and when you use the Platform;

• Technical information about your mobile device or computer, including the operating system you use;

• Your general location when you use the Platform;

• Your internet protocol address and MAC address.

• Visitor data

• Onboarding data

• Transaction data

• Account registration data

• Counseling session data

Protecting this information is a top priority for us. Other than in the limited ways detailed in this Privacy Policy, we will never use or disclose any information unless you requested or approved us to do so. We also de-identify your data when sharing it internally to provide an extra layer of protection.

How We Use Your Personal Information

We may be use your personal information for one or more of the following business or marketing purposes:

• Delivery of Services : We may use your information to provide information or perform services that you request including, but not limited to: (a) create your account on our Platform and allow you to log-in to use the Platform; (b) manage your account and provide customer service; (c) bill and process transactions; (d) provide location-specific services; and (e) to provide, support, personalize and develop the Platform and our services.

• Communicating with you : We may use your information to communicate with you, including, but not limited to: (a) to provide you with information, alerts, and suggestions related to the Platform; (b) to verify your identity; (c) to assist you with completing an activity you request; and (d) to reach out to you, either through our coaches or ourselves, if we believe that you may be in danger or may be the cause or victim of a criminal act.

• Administration and Improvement of Services : We may use your information toadminister and improve our services including, but not limited to: (a) monitor, supervise, and administer the Platform; (b) inform research and development purposes to offer new content and features using aggregated data.

• Marketing and Customization: We may use your information to market our services and customize your experience when using our services and the Platform including, but not limited to: (a) personalize your Platform experience including promoting service offerings relevant to your interests including targeted advertisements through our websites, third-party sites, and via text messages and email and (b) keep you updated on our products and services through targeted marketing efforts.

• Account and Network Security: We may use your information to enhance your account security and our network security including, but not limited to: (a) using your information to combat malicious activities and combat malware; and (b) to monitor and verify your account access to ensure that unauthorized users are not using your credentials.

• Compliance with Law: We may use your information to ensure that we are complying with all applicable laws, including, but not limited to: (a) responding to law enforcement requests and as required by applicable law, court order, or governmental regulations; and (b) complying with applicable state and federal laws, including those laws related to protecting client and public health and safety.

• Other Purposes : We may also use your information for any other purpose with yourconsent.

Purposes for Which Information is Disclosed to Third PartiesInformation about you may be disclosed to third parties for one or more of the following purposes:

• Administer and Provide Services to You and Advertising : We may engage third-party service providers to work with us to administer and provide services to you and help us with our advertising efforts. These third-party service providers may have access to your information for the purpose of providing these services on your behalf and may not disclose your information for any other purposes.

• To Your Child’s School: We may share test results of students with the school with which we partner to provide services to students.

• With Your Consent : We may share your information if you request or direct us to do so. This includes your use of widgets on our Platform and sharing information with other applications with your consent and direction.

• With Our Affiliates : We may share your information with our subsidiaries or parent companies within our corporate organization.

• Compliance with Law: We may share your information with law enforcement personnel or pursuant to a government order or subpoena or any obligations thereunder.

• Transaction : We may share your information in the context of a business transaction such as an asset sale, merger, bankruptcy, corporate reorganization, or other business transaction.

• Other Business Reasons : We may share your information to enforce any applicable terms and conditions or terms of use and to ensure the safety and security of the Platform.

If you make any of your information publicly available on the Platform, then anyone can see it and use that information.

Opting Out of Marketing Communications

You may opt out of receiving our newsletter by unsubscribing using the unsubscribe link in the email communications. You may not opt-out of non-marketing communications including required notices related to your account and the Platform.

Data Security

It is our priority to protect and safeguard your information. To achieve that goal, we use physical, electronic, and administrative procedures to protect your information including, but not limited to two-factor authentication and a third-party security and compliance vendor. We do not transfer information about you to users that do not have a legal right to access it, and we use industry standard technologies, physical security, and administrative processes to help safeguard against unauthorized users gaining access. While we cannot guarantee that unauthorized access to, or loss, misuse, or alteration of data will not occur, we use various safeguards to avoid such occurrences.

Protecting your information is also your responsibility. We encourage you to take all

precautions to protect your information when using the Internet including, but not limited to changing your password on a regular basis, using a secure browser, and immediately contacting us if you believe an unauthorized user has accessed the Platform or your account.

Privacy of Children

We are committed to protecting the privacy of children when providing our services and making sure that we are in compliance with the Children’s Online Privacy Protection Act (“COPPA”).

Our services may be used to facilitate health care for a child. A parent or guardian may use our services on behalf of a dependent child. An individual under the age of 18 is not allowed to make or log into an online account. If you allow your child to use your account then we may collect information from that child. If you would not like your child to interact with our services, please do not provide your credentials to a child or use an automatic log-in on your device. Please note that we may be required by law to provide some health-related information directly to an individual under 18 years of age without a parent’s or guardian’s consent.

We will not sell or make public a child’s personal information. We may use a child’spersonal information for all of the purposes described in this Privacy Policy.

To provide our services, we may disclose a child’s personal information to service providers or clinicians if it is necessary for them to perform services. If we disclose a child’s information to a third-party, we will comply with all applicable laws including HIPAA.

At any time, you may revoke your consent for collection of your child’s information and may request to review the personal information we have collected about your child by contacting hello@carebyclay.com

Cookies and Web Beacons

Like many websites, we use “cookies” and “web beacons” to collect information. A “cookie” is a small data file that is transferred to your computer’s hard disk for record-keeping purposes. A “web beacon” is a tiny and sometimes invisible image or embedded code, placed on a Web page or email that can report your visit or use to a third party. Web beacons are typically used by third parties to monitor the activity of users at a website for the purpose of web analytics, advertising optimization, or page tagging.

You can change your browser’s settings so it will stop accepting cookies or to prompt you before accepting a cookie. However, if you do not accept cookies you may not be able to use the Platform.

Use of Cookies, Web Beacons, and Similar Technologies for Analytics

We may also use third party cookies for the purposes of web analytics, attribution, and error management. Our Platform may use Google Analytics and other vendor services that use cookies, web beacons (including web pixels), and similar technology to collect and store anonymous information about you, including when you pay for services, load a page, indicate that you heard about us on television, sign up for services, enter your payment information (but the payment details are not disclosed), start the intake questionnaire, and your response as to the referral source to the Platform. You can learn more about Google Analytics’ privacy policy and ways to opt out from Google Analytics tracking by visiting Google Analytics’ website.

Our Platform may also use analytics vendors to collect information (for example Visitor Data) about user actions on our websites for purposes of analytics and certain software to analyze certain Platform usage using the device identification for each user. The information used for analytics does not include any customer data, or communications data.

Link to Third-Party Sites

The Platform may contain links to other websites, services or offers which are owned, operated or maintained by third parties. If you click on a third party link, you will be directed to that third website or service. The fact that we link to a website or service is not an endorsement, authorization or representation of our affiliation with that third party, nor is it an endorsement of their privacy or information security policies or practices. We do not have control over third party websites and services and we do not have control over their privacy policies and terms of use.

Social Media PlatformsWe use several publicly-available tools and information exchange resources, such as (but not limited to) an Instagram page, a Linkedin account, a Facebook page, a Twitter account, and others (collectively “Social and General Information Tools”). Any information you provide or share while using Social and General Information Tools may be read, accessed, collected by that site and users of that site according to their Privacy Policy.

Phishing

Online identity theft and account hacking, including the practice currently known as “phishing”, are of great concern. You should always be diligent when you are being asked for your account information and you must always make sure you do that in our secure system. We will never request your login information or your credit card information in any non-secure or unsolicited communication (email, phone or otherwise).

Contacting Us

If you have any questions or concerns about this Privacy Policy or our privacy-related practices, please contact us by hello@carebyclay.com

This Privacy Notice for California Residents supplements and is expressly made part of the information contained in the Clay Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this Notice.

Information We Collect

Through your use of our Platform, we collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). In particular, our Platform has collected the following categories of personal information from its consumers within the last twelve (12) months. Additionally, we have disclosed the following categories of information for a business purpose in the past twelve (12) months: