Privacy Policy – Catalia Health Pharmaceutical Platform

This Privacy Policy is between you and Catalia Health and applies to patients taking a specific medication who are being offered the Mabu Wellness Companion Robot and its related hosting and data services in the Catalia Health Secure Cloud (the “Mabu WCR”), and our mobile short message service (SMS) text messaging application (the “SMS Application”) by their specialty pharmacy. The Mabu WCR and the SMS Application are referred to together as the “Platform”. If you do not agree to the terms of this Privacy Policy, including with respect to the collection, processing, and limited sharing of Health Information, as defined below, please do not use and set up or use the Mabu WCR.

We have the highest regard for your privacy and personal information and realize that the success of our service depends on the trust that users have in the way we handle their personal information. This policy sets out our commitments and explains the rights that you have with respect to your personal information.

Information Collection and Use

Use of the Platform requires registration. If you choose to register with us, you will be asked to provide Personal Information (as defined below) and may also be asked to input Personal Health Information. It is your voluntary decision whether to provide us with any such Personal Information or Health Information, but if you refuse to provide such information we may not be able to register you to use the Platform or your use of the Platform may be limited.

I.              Collecting and Using Your Information

Collecting and Using Your Personal Information and Health Information (Actively Provided Information)

Whenever you submit information via our Platform, or otherwise in connection with your use of the Platform, including, but not limited to, by telephone or email with customer service, you consent to the collection and processing of your Health Information in accordance with this Privacy Policy.

“Personal Information” means information that can be directly associated with a specific person (and can include Health Information that is directly associated with a specific person). When you register or update your information on our Platforms, we collect Personal Information including, but not limited to:

• first and last name;
• e-mail address;
• year of birth;
• gender;
• geographic location, including your zip code;
• phone number;
• data used to recognize your face (for facial recognition, not a photo or video);
• disease state and disease progression;
• medication type;
• medication usage and adherence;
• symptoms;
• side effects;
• self-reported wellness information, including weight, exercise, and nutrition;
• stress or anxiety levels;
• other self-reported information relevant to your health, wellness, and disease management;
• other self-reported information asked during the course of a conversation, for purposes of providing a more engaging and personalized conversation.

De-identified information may include Health Information and other information about you that cannot be associated with you.

During registration or subsequently, you may choose to use certain features of the Platform that will allow you to input Personal Information with respect to your health, such as the medications you take, the date of your prescription, the date you received your diagnosis, the number of refills you have made, how often you take your medication, the frequency you would like us to send you reminders to take your medication, whether you take your medication, and other information related to your treatment or your illness (“Health Information”). We will tailor our Platform to improve Mabu’s conversations with you and to improve our system for helping with your care management using this information.

Your use of the Platform may be in connection with a program offered by a specialty pharmacy (the “Specialty Pharmacy Partner”) and a pharmaceutical company (the “Pharmaceutical Partner”) in conjunction with medication you have been prescribed prior to enrolling in this Program. It may also be in connection with a We are a business associate of the Specialty Pharmacy Partner. We supplement care management services offered by the Specialty Pharmacy Partner. The Specialty Pharmacy Partner will provide us Personal Information about you, such as your medication list, address, phone number, and other Personal Information. This is in order to send Mabu Wellness Companion Robot to the correct address and to ensure it provides you with information about your prescription so that we can personalize our service to you. We will also provide the Specialty Pharmacy Partner with your Personal Information in order to help coordinate your care management and help manage your health.

We do not provide the Pharmaceutical Partner with Personal Information; any and all data sent to the Pharmaceutical Partner from the Platform or from the Specialty Pharmacy Partner will not be identified with you. We provide this de-identified information to the Pharmaceutical Partner in order for them to monitor this care management program and to understand more about how patients like you manage your care while taking a specific medication.

We may also use the Personal Information (1) to identify your account for purposes of providing you with customer services and to respond to your requests, (2) to provide you the specific services related to your care management, (3) to help diagnose problems with our servers, to make the Platform more useful, for other internal purposes or to customize the Platform and personalize its content for you; and (4) to send you texts, emails, or other communications regarding general adherence information, Platform maintenance, updates, or changes to this Privacy Policy or any other relevant agreements.

Ensuring the accuracy and completeness of the Personal Information and any other information that you provide in connection with your use of the Platform is important. Inaccurate or incomplete information will affect the functioning of the Platform, as well as the information you receive from us and our ability to contact you.

II.            Automatic Data Collection

The Platform may automatically collect certain information about you when you utilize the Platform, such as what time(s) you use the Platform, data related to the cellular or WiFi connection you use to connect to the Platform, and when the Mabu Wellness Companion Robot is turned off or turned on.

Data collected automatically on the Platform may be used, for example, to help diagnose problems with our infrastructure, to make the Catalia Health Platform more useful, and to customize the Platform and personalize its content for you.

Sharing of Your Personal Information with Third Parties and Service Providers

We may share your Personal Information and Health Information with the Specialty Pharmacy Partner. Personal Information and Health Information is provided to them to improve the Platform, improve the efficacy of your treatment program, improve their marketing to persons with similar treatment issues, and to more be able to treat people with similar issues.

You have been provided specific information from the Specialty Pharmacy Partner about who will receive your Personal Information. Contact your Specialty Pharmacy Partner, the company that opted you in to the Mabu WCR, to get further information about who receives your Personal Information from them and for what purpose.

We will not publish your Personal Information without your explicit consent.

We may ask for your consent to share your Personal Information with third parties, such as research institutes, healthcare systems or doctors, for research purposes and so that they can cross-check such information with other information that they have about you, for research purposes and for improvement of our services. We will first obtain your consent for the same.

Sometimes we may provide limited access to your Personal Information to the extent necessary to our contractors and consultants, who are bound by an obligation of confidentiality, including vendors and suppliers that provide us with development services, technology, services, or content for the operation, development and maintenance of our Platform or data and analysis on Platform use. Such access is limited to the information reasonably necessary for the contractor or consultant to perform its services to us. We also require that such contractors and consultants agree to protect the privacy of your Personal Information and agree not to use or disclose Personal Information for any purpose other than providing us with products and services and as required by law. We mitigate access to Personal Information by requiring specific access to systems that can be used to tie your de-identified information with information that identify you.

In addition, we may share your Personal Information with third parties, such as law enforcement authorities, courts and tribunals, to respond to law enforcement requests or other legal requests or pursuant to a requirement imposed by law, order, judgment or decree, as required by law.

We may also share your Personal Information with legal advisors, consultants, or courts in order to protect and defend our rights and property or those of Platform users. We may also transfer your Personal Information in the event of a merger, acquisition, or sale of all or a portion of our assets.

III.          Use of Aggregated Data

We may analyze all information we receive and/or combine your Personal Information, including Health Information and information regarding your use of the Platform, with information from other users to create aggregated data that may be disclosed to and utilized by us, our affiliates and by third parties without restriction, on commercial terms that we can determine in our sole discretion for purposes of content marketing, for research purposes, in order to understand behavior patterns and in order to increase adherence to medication regimens, to lessen or reduce side-effects, and symptoms, and to improve disease management. Such aggregated data will not contain any information that could be used to contact or identify you.

IV.         SMS Texting

Personal Information and/or Health Information (“PHI”) may be sent to you via SMS text from or on behalf of Catalia Health or the Specialty Pharmacy Partner if you provide your consent to such texts. While the SMS texts we send are encrypted according to industry standards during transmission through our Platform, you should contact your cellular provider if you have questions about encryption through your cellular network.

You should be aware that PHI sent to your phone through SMS texts could be seen by other people who have access to your mobile phone or access to SMS texts to that number through other devices you may have set up.

If you change your telephone number, you agree to notify Catalia Health, the Specialty Pharmacy Partner, and other applicable parties promptly by calling your specialty pharmacy or the technical support number provided to you in one page setup insert provided with the Mabu WCR.

V.           Emailing

Personal Information and/or Health Information may be sent to you via email message if you authorize such usage. While the email message we send is encrypted according to industry standards during its transmission through our Platform, you should contact your email host if you have questions about its encryption through your email service.

Disabling the Service, Access, Corrections, and Deletion

At any time, you can stop the collection of your information by unplugging the Mabu WCR and refraining from using the Platform. You may also request that your Personal Information be deleted from our active databases. A separate request will have to be made with each Specialty Pharmacy Partners which are providing our Platform to you. We cannot restore information that we have deleted. We may retain any data in de-identified form, subject to applicable law.

You may contact us as specified below under “How to Contact Us” to access information that we keep about you or update or correct such information or ask for its deletion. We will retain your information for as long as you continue to use our Platform and for a reasonable period of time afterwards.

Links to Other Websites or Apps

The Mabu WCR may link to or refer to websites or mobile device applications that we do not control. Any Personal Information you provide on the linked pages or external mobile applications is provided directly to this third party and is subject to this third party’s provider’s privacy policy. This Privacy Policy does not apply to such other websites or applications, and we are not responsible for the privacy practices or content of any website or application not controlled by us. If you have any concerns, we urge you to review the terms of those other websites or applications for more information about their applicable policies.

Security

We take reasonable steps to protect Personal Information as you transmit it to us and to protect such information from loss, misuse and unauthorized access, disclosure, alteration or destruction. However, you should keep in mind that no Internet transmission is ever completely secure.

Children

Our Platform is intended for use by persons 18 years of age and older. Under no circumstances should the Platform be used by children under 14 years of age, and we will not knowingly collect Personal Information from any person we know to be in this age group. If you are using the Platform for the benefit of a child, please do not provide information relating to such child unless you have obtained the child’s parents’ or guardians’ consent, including their consent to this Privacy Policy. If you discover that your child has been using the Platform without your consent, or that someone has been using the Platform for or on behalf of your child without your consent, please contact us using the information below under “How to Contact Us,” and we will take reasonable steps to delete the child’s information from our active databases.

We may transfer our databases containing your Personal Information if we sell our business or part of it.

HIPAA

Your Health Information is protected and secured under HIPAA (the Health Insurance Portability and Accountability Act of 1996) guidelines and other applicable law. Some Personal Information you provide to us (that which is not Health Information) is not protected by HIPAA. HIPAA protects health information held by or on behalf of your health care provider or health plan.

How to Contact Us

If you have any questions, comments, requests, or concerns related to this Privacy Policy or the privacy practices for our Platform, please contact us at:

Catalia Health

ATTN: Catalia Health Privacy Questions

1223 Masonic Ave., Berkeley, CA 94706

info@cataliahealth.com

Changes to the Privacy Policy

From time to time we may need to change this Privacy Policy. You will be informed of such change in advance, and you will always have the possibility to stop using the service as explained above.

This Privacy Policy was last updated in September, 2023