Limbic Access Privacy Policies

1. INTRODUCTION

1.1.       This privacy notice applies to you, a user of the LimbicAccess Intake and Assessment Assistant(the "Assistant") and a user or prospective user of the Assistant who are intended to be either patients or clinicians ("you"and "your").

1.2.       Please read this privacy notice carefully. Among otherthings, it explains:

1.2.1.         what personal data we may collect about you;

1.2.2.         why we collect and use your personal data and the legal bases we rely on for processing it;

1.2.3.         who we disclose your personal data to;

1.2.4.         where we store your personal data;

1.2.5.         how long we keep your personal data; and

1.2.6.         your rights regarding the personal data we hold about you and/or which you provide to us.

1.3.       This Privacy Policy applies to the personal information you provide us when you (i) visit any website we own, license or otherwise operate and that links to this Privacy Policy (each, a “Website”), (ii)purchase or receive products, goods, or services through the Website, or (iii)otherwise engage with us (e.g., via your provider’s website).  For purposes of this Privacy Policy, theWebsite and all products, goods and services furnished by Limbic through a Website shall be referred to collectively as the ”Services”.

1.4.       WHEN YOU ACCESS THE WEBSITE OR OUR SERVICES, OR OTHERWISE PROVIDE ANY INFORMATION TO US, YOU AGREE TO THE TERMS OF THIS PRIVACY POLICY, INCLUDING THE MANNER IN WHICH WE USE YOUR INFORMATION, WHETHER OR NOT YOU HAVE AN ACCOUNT WITH LIMBIC. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, OR TO ANY CHANGES WE SUBSEQUENTLY MAKE TO THIS PRIVACY POLICY, YOU MUST IMMEDIATELY STOP USING THE ASSISTANT, WEBSITE OR OTHERWISE PROVIDING ANY INFORMATION TO US.  YOU MAY BE ACCESSING LIMBIC’S SERVICES VIA YOUR PROVIDER’S WEBSITE, BUT PLEASE ACKNOWLEDGE THAT LIMBIC HAS NO CONTROL OVER AND IS NOT RESPONSIBLE FOR THE CONTENT OR PRIVACY PRACTICES OF YOUR PROVIDER’S WEBSITE.

2. WHO WE ARE

2.1.       We are Limbic Incorporated (“Limbic”), a Delaware corporation. We are a business that provides software for mental healthcare. .

2.2.       Data protection laws apply to our collection and use of personal data and Limbic is the processor of that personal data.

2.3.      If you have any questions regarding this privacy notice or the way in which we process your personal data, please contact us at: Email: data.enquiries@limbic.ai Address: FAO Data Protection Enquiries, Limbic Inc, 108 Lake Land Avenue, City of Dover, County of Kent, Delaware,19901   

3. YOUR RESPONSIBILITIES; CHANGES TO YOUR PERSONAL INFORMATION

‍It's important that the personal data we hold about you is accurate and current. You are permitted, and hereby agree, to only provide personal information to Limbic if such personal information is accurate, reliable, and relevant to our relationship and only to the extent such disclosure will not violate any applicable data protection law, statute, or regulation or infringe upon a person’s data privacy rights or privileges. IFYOU PROVIDE PERSONAL INFORMATION (INCLUDING PERSONAL INFORMATION CONCERNING ATHIRD PARTY) TO LIMBIC, YOU EXPRESSLY REPRESENT AND WARRANT TO LIMBIC THAT YOU HAVE THE FULL RIGHT AND AUTHORITY TO PROVIDE LIMBIC WITH SUCH PERSONAL INFORMATION (INCLUDING PERSONAL INFORMATION CONCERNING A THIRD PARTY) AND THAT LIMBIC’S USE AND PROCESSING OF SUCH PERSONAL INFORMATION AS SET FORTH HEREIN WILL NOT VIOLATE ANY PERSON’S RIGHTS OR PRIVILEGES, INCLUDING RIGHTS TOPRIVACY. YOU HEREBY AGREE TO FULLY AND COMPLETELY INDEMNIFY LIMBIC FOR ANY CLAIMS, HARM, OR DAMAGES THAT MAY ARISE FROM YOUR PROVISION OF PERSONAL INFORMATION (INCLUDING PERSONAL INFORMATION CONCERNING A THIRD PARTY) TO LIMBIC.  Please let us know if your personal data changes or if you become aware that any personal data that we hold about you is not accurate. To make changes to your personal data or to request a deletion of your personal data, you may contact us in accordance with section 13 below.

4.         WHAT PERSONAL DATA WE COLLECT

4.1.       The type of personal data we process may include (as applicable) the following depending on your use of the Assistant:
‍

4.2     Information about why weprocess the above personal data and the lawful basis we rely on is set out in sections 6 and 7 below.

‍4.3.       We only process personal data which is adequate, relevant and limited to what is necessary to fulfill the purposes set out in this notice. Where you are invited to input data into the Assistant, you should only provide data which is relevant and necessary.

‍4.4.       You acknowledge and agree that you will only provide us with your own personal data and that you must not provide us with the personal data of any third party or any data which may be considered unlawful.

‍4.5.       We do not process any information about children under theage of 13 and we do not process any information about criminal convictions and offences. You must not provide us with any such information on the Assistant. If you or any other person becomes aware that a child has accessed or may have accessed the Assistant and provided their personal data without parent consent, they must contact us by email at data.enquiries@limbic.ai.

5.         HOW WE COLLECT YOUR PERSONAL DATA

5.1.       We may collect information direct from you and use, disclose and store it when:

5.1.1.         you access, use or interact with the Limbic Assistant;

5.1.2.         you correspond/interact with usvia email, phone, social media or other channels;

5.1.3.         you make any inquiry or complaint;

5.1.4.         you purchase, request or subscribe for a product or service from us;

5.1.5.         you request technical support or other customer care support;

5.1.6.         you participate in surveys and questionnaires or provide us with a review or feedback; or

5.1.7.         you provide data for other legal and regulatory purposes.

‍5.2.       Where lawful, we may also obtain personal data from other third parties (including third party platforms) and we may process that information where such processing is necessary or permitted in order to provide our products and services to you, or where such processing is necessary or permitted for our internal administrative purposes or for marketing and business development purposes. We obtain this data through our partnerships with third-party platforms, with your consent or as otherwise permitted by law.

‍5.3.       Where we need to collect personal data by law, or underthe terms of an agreement we have with you, and you fail to provide that datawhen requested (or fail to consent to the processing of that data, ifnecessary), we may not be able to perform the agreement or arrangement we haveor are trying to enter into with you or such failure may limit or prevent you obtaining access to, or making full use of, the Assistant.

‍5.4.       For a lot of the personal data we process (see section 4), we only do so with your consent (see section 7), and by you actively in putting the information into the Assistant. You are of course free to 'opt out' of giving us any particular information by simply not providing it, and you can withdraw your consent at any time (see section 6.3), but again that may restrict our ability to provide you with our services.

‍6.         HOW WE USE YOUR PERSONAL DATA

‍6.1.      We use your personal data for a number of purposes but only where we're allowed to by law.  

‍6.2.       We may process your personal data where such processing is necessary or permitted:

6.2.1.         to authenticate and verify individual identities, including requests to exercise your rights under this privacy policy;

6.2.2.         to provide customized Services to you;

6.2.3.         in order to perform any agreement we have entered into with you or in anticipation of any agreement we may enter into with you (including our Terms of Use);

6.2.4.         to comply with any applicable law or regulation; and/or

6.2.5.         for the purposes of the legitimate interests pursued by us or a third party. These legitimate interests include the purposes identified in the table below in section 7 but may also include other commercial interests and our internal administrative purposes. Where we rely on legitimate interests as the lawful basis for processing your personal data, we'll put in place appropriate safeguards to protect your data and to ensure that your fundamental rights and freedoms are not overridden by those legitimate interests.

‍6.3.       We may also process your personal data where we have your consent. Where we rely on consent as the lawful basis for processing your personal data, we won't ever use that data for anything else except for the purpose for which we obtained consent at the time. You have the right to withdraw your consent at any time and if you wish to do so, you should contact us using the contact details set out in section 13 below. The withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal or the lawfulness of processing based on other lawful grounds.

‍6.4.       We may process special categories of personal data(including details about your race or ethnicity, sex life, sexual orientation, and information about your health and genetic and biometric data) where:

6.4.1.         we have your explicit consent;

6.4.2.         the processing is necessary forreasons of substantial public interest because of the law; and/or

6.4.3.         the processing is necessary forthe establishment, exercise, or defense of legal claims.

‍6.5.       As elements of your Health Data will constitute special categories of personal data, our lawful basis for processing your Health Data will usually be your explicit consent. Where you are asked to give such explicit consent, this consent refers to the processing of your Health Data for the specific purposes set out in clause 7 or such other purposes as may be communicated to you within the Assistant from time to time. You should not consent to such processing (including by accepting the terms of this notice) unless you wish to give us your express, freely given consent to process yourHealth Data in accordance with the terms of this notice. You are not required to provide any Health Data to us, but given the nature of our Assistant and ourservices, it is likely to prejudice our ability to deliver our services to you if you choose not to do so.

‍6.6.       We may anonymize your personal data and use it for our internal research and development purposes to improve and develop existing or new software and services, and for research papers which may be published. Such purposes may include, for example, to gain statistical insight into how our services are used and can be most helpful, as well as to develop and improve our algorithms, functionality and user interface, and to study data which might then be reported in the form of insights and research papers. We ensure that your personal data is irreversibly anonymized before using it for such purposes, meaning that it does not, and cannot be used to, identify you. You acknowledge and agree that any resulting intellectual property rights arising out of or in connection with your personal data and the research carried out using it are fully owned by us. Your data may also be used in a clinical trial, but Limbic will not do so without your express knowledge and written consent.

‍6.7.       We may process your personal data for more than one lawfulground depending on the specific purpose for which we're using your data.

‍6.8.       We may process your personal data ourselves or in conjunction with our third party service providers in accordance with section 8.

‍6.9.       We'll only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

‍6.10.    If we need to use your personal data for an unrelated purpose, we'll notify you (which may be by way of an update to this privacy notice) and we'll explain the legal basis which allows us to do so. In the event that the purpose of data collection changes where consent is the lawful basis for processing, we will notify you of such change and re-secure your consent for such processing.

‍6.11.    We may also need to use your personal data to manage and secure our operations, including for detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity; debugging to identify and repair errors with our Website; and auditing relating to interactions, transactions and other compliance activities.

6.12.    Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

‍7. OUR LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA

7.1.       We've set out below the legal bases on which we process your personal data. We've identified what our legitimate interests are, where appropriate.

‍

Purpose/Activity	Type of personal data processed	Lawful basis for processing
Provision of our products and services ● To provide our Assistant to you.	● Identity Data ● Contact Data ●Correspondence Data ● Health Data   ● Usage Data	● Your explicit consent (with regards to Health Data)    ● Performance of a contract ● Compliance with a legal obligation   ● Our legitimate interests to respond to enquiries, messages and requests, operate, develop and improve our business and to fulfil our legal and contractual obligations
Business Operation and Maintenance   ● To operate and protect the Assistant (including troubleshooting, incident management and data breach management, data analysis, product and system testing, system maintenance, support, reporting and hosting of data)	● Identity Data ● Contact Data ● Correspondence Data ● Health Data   ● Usage Data	● Your explicit consent (with regards to Health Data)   ● Performance of a contract ● Compliance with a legal obligation ● Our legitimate interests to operate and improve our business, fulfil our legal and contractual obligations and for the purposes of IT security
Customer Relationship Management   ● To manage our relationship with our customers which includes notifying you of any changes to our terms or this privacy notice or to our products/services, apps, to respond to enquiries, messages, and requests for technical support and customer care support	● Identity Data ● Contact Data ● Correspondence Data ● Health Data   ● Usage Data	● Your explicit consent (with regards to Health Data)    ● Performance of a contract ● Compliance with a legal obligation   ● Our legitimate interests to respond to enquiries, messages and requests, operate, develop and improve our business and to fulfill our legal and contractual obligations
Research and Business Development   ● To improve the Assistant, our apps, customer relationships and experiences ● To anonymize your data for the purposes set out in section 6.6	● Identity Data ● Contact Data ● Correspondence Data ● Health Data   ● Usage Data	● Our legitimate interests to define types of customers for our products and services, develop and improve our business and to inform our marketing strategy
Business Management   ● To manage our business including to keep financial and accounting records, carry out audits, testing, comply with our reporting requirements and other corporate governance requirements ● To exercise our rights set out in agreements including recovering debts owed to us	● Identity Data ● Contact Data ● Correspondence Data ● Usage Data	● Performance of a contract ● Compliance with a legal obligation ● Our legitimate interests to exercise our rights (including to recover debts), to operate our business (including internal administration and IT services, network security, to prevent fraud and in the context of a business reorganization, sale or group restructuring exercise) and to fulfil our legal and contractual obligations

8.   HOW WE SHARE YOUR PERSONAL DATA WITH OTHERS

8.1.       We won't share any of your personal data with third parties except as set out in this section or otherwise notified to you or agreed between you and us from time to time.

8.2.       We may share personal data with anyone we refer you to for treatment after engaging with our Assistant, including your clinician.

8.3.      We may also share personal data with any Limbic affiliate (including our subsidiaries, ultimate holding company and its subsidiaries) and partner companies for the purposes outlined in this Privacy Policy. We may also share personal data with third party service providers who we engage to provide services which facilitate our business, and we may also need to share personal data with other third parties in order to comply with our legal and regulatory obligations.These third parties may have limited and controlled access to personal data in connection with the services they provide, such as hosting. The use of personal data by service providers outside of agreed-upon service they provide is prohibited. Below is a list of specific third parties and other categories of third parties with whom we may share your personal data:

8.3.1.         Heroku Services, our data hosting provider;

8.3.2.         Amazon Web Services, the servers used by Heroku Services;

8.3.3.         Sentry, our application monitoring and error tracking software;

8.3.4.         Mix Panel, our application for monitoring performance and usage

8.3.5.         any third party buyer of our business or assets;

8.3.6.         law enforcement or a regulator;

8.3.7.         legal counsel and other professional advisers including accountants and auditors;

8.3.8.         any of our personnel who many need access to certain of your personal data in order to provide their services, which may include personnel who are engaged as consultants or workers, as well as our employees; and

8.3.9.         any similar or replacement third parties from time to time.

8.4.       We ensure that any third party engaged by us who processes your personal data in connection with the purposes listed above has policies and procedures in place to ensure compliance with data protection laws.

8.5.       We may share your personal data with third parties where we're required to do so by law or regulation (such as in connection with an investigation of fraud or other legal enquiry) or in connection with other legal proceedings (including where we believe that your actions violate applicable laws or any agreement with us, including our Terms of Use).

8.6.       In the event that our business or any part of it is sold or integrated with another business, your details may be disclosed to our advisers and those of any prospective purchaser and will be passed to the new owners of the business.

9.         HOW WE STORE AND RETAIN YOUR PERSONAL DATA

9.1.       By using the Assistant, you expressly consent to Limbic’s recording and retaining copies of all interactions, including but not limited to chat logs, communications, and inputs made by you during the use of theAssistant. This consent encompasses the collection, use, and storage of such data in accordance with the purposes outlined in this Privacy Policy, including but not limited to improving the functionality and user experience of theAssistant, providing personalized support, and maintaining accurate records of user interactions for legal, safety, and regulatory purposes. You acknowledge and agree that Limbic may retain these records for as long as is necessary to fulfill the purposes for which they were collected or as required by law, whichever is longer, and to exercise or defend any legal claims.

9.2.       For as long as we do store your data, we follow generally accepted industry standards and maintain reasonable safeguards that are designed to avoid accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data and to ensure the security, integrity, and privacy of the information you have provided. All information you provide to us is stored on our secure servers in the United States.

9.3.       While we take every measure to safeguard your personal data, no security measures are perfect, and no data storage or transmission is guaranteed to prevent unauthorized disclosure or misuse.  As a result, we cannot warrant the security of any personal data you provide to us, and – to the fullest extent permitted by law - we do not accept liability for unauthorized access, use, disclosure or loss of personal data.

9.4.       We'll notify you without undue delay in accordance with the requirements of data protection laws, if we have reason to believe that there has been a personal data breach by us which could adversely affect your rights and freedoms and we're required by law to notify you.

9.5.       We maintain and implement a data retention policy and will delete personal data in accordance with this. Other than in rare circumstances (for example, where we are required to retain data by law), your data will be deleted within 90 days once the purposes for which it was collected have been carried out, unless we are required or permitted by law to retain your data fora longer period.

10.       YOUR LEGALRIGHTS

‍10.1.    Subject to any conditions and requirements set out in data protection laws, you may have some, or all, of the following rights in relationto the personal data we hold about you:

10.1.1.       the right to request a copy of your personal data held by us;

10.1.2.       the right to correct any inaccurate or incomplete personal data held by us;

10.1.3.       the right to request that we erase personal data we hold about you;

10.1.4.       the right to request that we restrict the processing of your data;

10.1.5.       the right to have your personal data transferred to another organization;

10.1.6.       the right to object to certain types of processing of your personal data by us;

10.1.7.       the right to request that you are not subject to any decision which is based solely on automated processing,including profiling, where this produces legal effects or otherwise significantly affects you; and

10.1.8.       the right to complain (please see section 13 of this privacy notice).

10.2.    PLEASE NOTE that these rights are not absolute in all situations and may be subject to conditions and provisions set out in data protection laws.  We cannot, therefore, guarantee that we'll be able to honor any request from you in connection with the rights set out above. (For example, even if you request that we delete your personal data, we may be required by law to retain some personal data for accounting and record keeping purposes or in order that we comply with our legal and regulatory obligations).

10.3.    We will respond to a request to exercise your rights asset out in this section as soon as possible, but no later than two months from the date of the request.

10.4.    For further information, or to exercise any particular right, please see section 13 for details of how to contact us.

11.       LINKS TO THIRD PARTIES

11.1.    The Assistant may link or redirect to other websites, social media accounts or other content which is not under our control. Unless otherwise stated, such links or redirections are not endorsements of such websites or representation of our affiliation with them in any way and such third party websites are outside the scope of this privacy notice.

11.2.    If you choose to access such third party websites or platforms, we recommend reviewing their respective privacy policies before you provide them with any personal data. Limbic is not responsible for the activities, privacy policies or levels of privacy compliance of any website or platform operated by any third party.

12.       U.S. STATE-SPECIFIC RIGHTS.

12.1.    California Privacy Rights Data Privacy Rights. Pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”), California residents are entitled to certain data privacy rights:

12.1.1.       Right to Know (Specific Pieces of PersonalInformation). You have the right to know the specific pieces of your personal information that we have collected about you.

12.1.2.        Right toKnow (Categories of Personal Information). You have the right to know (i) the categories of personal information we have collected from you; (ii) the categories of sources from which the personal information is collected; (iii)the categories of your personal information we have sold or disclosed for a business purpose; (iv) the categories of third parties to whom your personal information was sold or disclosed for a business purpose; and (v) the business or commercial purpose for collecting or selling your personal information.

12.1.3.       Right to Delete. You have the right to request that we delete your personal information that we have collected and retain.

12.1.4.       Right to Correct. You have the right to request that we correct inaccurate personal information that we have collected and retain.

12.1.5       Nondiscrimination. You have the right not to be subject to discrimination for asserting your rights under the CCPA.

12.2.    Submit a Privacy Request. To submit a privacy request, you may contact us using any of the following means: (email) data.enquiries@limbic.ai or (mail)FAO Data Protection Enquiries, Limbic Inc, 108 Lake Land Avenue, City of Dover, County of Kent, Delaware, 19901. An authorized agent must be registered with the California Secretary of State to conduct business in California. PrivacyRequest Verification Process. If you (or your authorized agent) make any request related to your personal information, Limbic will ascertain your identity (and the identity of the authorized agent, to the extent applicable)to the degree of certainty required or permitted under the law before addressing your request. In particular, Limbic will, to the extent required or permitted by law, require you (or your authorized agent) to verify your request via email, request certain contact information or government identifiers, and we will match at least two pieces of such personal information with data that we have previously collected from you before granting you access to, erasing, or correcting, specific pieces or categories of personal information, or otherwise responding to your request. We may require written documentation that demonstrates a third party is authorized to serve as your agent for the purposes of submitting the requests set forth herein, unless you have provided the authorized agent with power of attorney pursuant to California Probate Code§§ 4121 to 4130. None of the CCPA’s rights are absolute, and such rights are subject to legal and regulatory exceptions and exemptions. For more information about the CCPA, please see: https://oag.ca.gov/privacy/ccpa.

12.3.    Opt-Out Rights / Do Not Sell My Personal Information. California residents have the right to opt out of the “sale” of their personal information. However, Limbic does not sell your personal information to third parties for profit or monetary or other valuable consideration, and therefore we do not provide opt-out request processes for the sale of personal information (because we do not undertake such activities). Opt-Out Rights / DoNot Share My Personal Information. California residents have the right to opt out of the “sharing” of their personal information. Limbic uses third-party analytical and targeted advertising features on our Site and similar web tools provided by our marketing partners, and such features, tools and marketing relationships involve the disclosure of your personal information to third parties and may constitute the “sharing” of your personal information for CCPA purposes. To opt out of this sharing of your personal information in these circumstances, please click on the cookie management tool to set your cookie preferences. You, or your authorized agent, may also contact us in accordance with the “Contact Us” section listed below. Limit Use of Sensitive PersonalInformation. Limbic does not use or disclose sensitive personal information for reasons other than those set forth in the CCPA, and therefore we do not provide individuals with the ability to limit how we use or disclose such sensitive personal information.

12.4.    Colorado Privacy Rights Data Privacy Rights.  

12.4.1.       Pursuant to the Colorado Privacy Act (CPA),Colorado residents are entitled to the following data privacy rights:

12.4.1.1.     To confirm whether or not we are processing your personal information and access such personal information, unless such confirmation or access would require us to reveal a trade secret.

12.4.1.2.     To correct inaccuracies in your personal information, taking into account the nature of the personal information and thepurposes of the processing of your personal information. 12.4.1.3.     To delete personal information provided by, orobtained about, you.

12.4.1.4.     To obtain a copy of your personal information processed by us, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

12.4.2.       Submit a Privacy Request. To submit a CPA privacy request, please contact us in accordance with the “Contact Us” section below. If you would prefer, you may designate an authorized agent to submit aCPA privacy request on your behalf. Privacy Request Verification Process. If you make any request related to your personal information, the Company will ascertain your identity (and the identity of the authorized agent, to the extent applicable) to the degree of certainty required or permitted under the law before addressing your request. In particular, before granting you access to, erasing, or correcting, specific pieces or categories of personal information or otherwise responding to your request, the Company will, to the extent required or permitted by law, (i) require you (or your authorized agent)to verify your request via email, (ii) request certain contact information or government identifiers, and (iii) match at least two pieces of such personal information with data that we have previously collected from you. None of your privacy rights are absolute, and such rights are subject to exceptions and exemptions. For more information about the Colorado Privacy Act, please see https://coag.gov/resources/colorado-privacy-act/.

12.4.3.       Privacy Requests Appeals Process. If you would like to appeal a decision the Company has made with respect to your privacy request, please email us in accordance with the “Contact Us” section listed below, with the subject line “ATTN: Privacy Appeals,” and describe the nature of your request, and the reason for requesting an appellate review. You may file privacy complaints with the Colorado Attorney General at: https://coag.gov/file-complaint/. Opt-Out Rights / The Sale of PersonalInformation. Colorado residents have the right to opt out of the “sale” of their personal information. However, the Company does not sell your personal information to third parties for monetary consideration or other valuable consideration, and therefore we do not provide opt-out request processes fo rthe sale of personal information (because we do not undertake such activities).

12.4.4.       Opt-Out Rights / Targeted Advertising. Colorado residents have the right to opt out of having their personal information used for targeted advertising purposes. The Company uses third-party analytical and targeted advertising features on our Website and similar web tools provided by our marketing partners. To opt out of this sharing of your personal information in these circumstances, please click on the cookie management tool on the footer of the Website to set your cookie preferences.

12.4.5.       Opt-Out Rights / Profiling. Colorado residents have the right to opt out of having their personal information used for profiling in furtherance of decisions that produce legal or similarly significant effects. However, the Company does not engage in such activities.

12.5.    Connecticut Privacy Rights Data Privacy Rights.

12.5.1.       Pursuant to the Connecticut Act ConcerningPersonal Data Privacy and Online Monitoring, also known as the Connecticut DataPrivacy Act (CDPA), Connecticut residents are entitled to the following data privacy rights:

12.5.1.1.     To confirm whether or not we are processingyour personal information and access such personal information, unless such confirmation or access would require us to reveal a trade secret.

12.5.1.2.     To correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of your personal information.

12.5.1.3.     To delete personal information provided by, or obtained about, you.

12.5.1.4.     To obtain a copy of your personal information processed by us, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided we shall not be required to reveal any trade secret.

12.5.2.       Submit a Privacy Request. To submit a CDPA privacy request, please contact us in accordance with the “Contact Us” section below. If you would prefer, you may designate an authorized agent to submit aCDPA privacy request on your behalf.

12.5.3.       Privacy Request Verification Process. If you make any request related to your personal information, Limbic will ascertain your identity (and the identity of the authorized agent, to the extent applicable) to the degree of certainty required or permitted under the law before addressing your request. In particular, before granting you access to, erasing, or correcting, specific pieces or categories of personal information or otherwise responding to your request, the Limbic will, to the extent required or permitted by law, (i) require you (or your authorized agent) to verify your request via email, (ii) request certain contact information or government identifiers, and (iii) match at least two pieces of such personal information with data that we have previously collected from you. None of your privacy rights are absolute, and such rights are subject to exceptions and exemptions. For more information about the Connecticut Data Privacy Act, please see https://portal.ct.gov/AG/Sections/Privacy/The-Connecticut-Data-Privacy-Act.

12.5.4.       Privacy Requests Appeals Process. If you would like to appeal a decision Limbic has made with respect to your privacy request, please email us in accordance with the “Contact Us” section listed below, with the subject line “ATTN: Privacy Appeals,” and describe the nature of yourrequest, and the reason for requesting an appellate review. You may file privacy complaints with the Connecticut Attorney General at: https://portal.ct.gov/DCP/Complaint-Center/Consumers---Complaint-Center.

12.5.5.       Opt-Out Rights / The Sale of PersonalInformation. Connecticut residents have the right to opt out of the “sale” of their personal information. However, Limbic does not sell your personal information to third parties for monetary consideration or other valuable consideration, and therefore we do not provide opt-out request processes for the sale of personal information (because we do not undertake such activities).

12.5.6.       Opt-Out Rights / Targeted Advertising.Connecticut residents have the right to opt out of having their personal information used for targeted advertising purposes. Limbic uses third-party analytical and targeted advertising features on our Website and similar web tools provided by our marketing partners. To opt out of this sharing of your personal information in these circumstances, please click on the cookie management tool on the footer of the Website to set your cookie preferences.

12.5.7.       Opt-Out Rights / Profiling. Connecticut residents have the right to opt out of having their personal information used for profiling in furtherance of decisions that produce legal or similarly significant effects. However, Limbic does not engage in such activities.

12.6.    Nevada Privacy Rights Limbic does not currently conduct “sales” of personal information for purposes of Nevada law. Notwithstanding the foregoing,Nevada residents may submit a request directing us to not sell personal information we maintain about them to third parties who will sell or licensetheir information to others. If you would like to exercise this right, please contact us in accordance with the “Contact Us” section listed below. 12.7.    Virginia Privacy Rights Data Privacy Rights.

12.7.1.       Pursuant to the Virginia Consumer DataProtection Act, Virginia residents are entitled to certain data privacy rights:

12.7.1.1.     The right to confirm whether or not Limbic isprocessing your personal information, and to access such personal information.

12.7.1.2.     The right to request Limbic correct inaccuracies in your personal information, taking into account the nature ofthe personal information and the purposes of the processing of the personal information.

12.7.1.3.     The right to request Limbic delete your personal information.

12.7.1.4.     The right to obtain a copy of the personal information that you previously provided Limbic in a portable and, to the extent technically feasible, readily usable format that allows it to be transmitted to another entity without hindrance, where the processing is carried out by automated means.

12.7.2.       Submit a Privacy Request. To submit a privacyrequest, you may contact us using any of the following means: (email)data.enquiries@limbic.ai  or (mail)  FAO Data Protection Enquiries, Limbic Inc,108 Lake Land Avenue, City of Dover, County of Kent, Delaware, 19901.

12.7.3.       Privacy Request Verification Process. If youmake any request related to your personal information, Limbic will ascertain your identity (and the identity of the authorized agent, to the extentapplicable) to the degree of certainty required or permitted under the law before addressing your request. In particular, Limbic will, to the extent required or permitted by law, require you (or your authorized agent) to verify your request via email, request certain contact information or government identifiers, and we will match at least two pieces of such personal information with data that we have previously collected from you before granting you access to, erasing, or correcting, specific pieces or categories of personal information, or otherwise responding to your request. None of Virginia’s privacy rights are absolute, and such rights are subject to legal and regulatory exceptions. For more information on the Virginia Consumer DataProtection Act, see: https://lis.virginia.gov/cgi-bin/legp604.exe?211+ful+SB1392ES1.

12.7.4.       Privacy Requests Appeals Process; Complaints.If you would like to appeal a decision Limbic has made with respect to yourdata privacy request, please email us at the following:data.enquiries@limbic.ai  with the subject line “PRIVACY REQUEST: APPEALS” and describe the nature of your request, andthe reason requesting an appellate review. Virginia residents may file privacy complaints with the Virginia Attorney General (https://www.oag.state.va.us/contact-us/contact-info).

12.7.5.       Opt-Out Rights / The Sale of Personal Information. Virginia residents have the right to opt out of the “sale” of their personal information. However, Limbic does not sell your personal information to third parties for or monetary consideration, and therefore we donot provide opt-out request processes for the sale of personal information (because we do not undertake such activities).

12.7.6.       Opt-Out Rights / Targeted Advertising. Virginia residents have the right to opt out of having their personal. information used for targeted advertising purposes. Limbic uses third-party analytical and targeted advertising features on our Website and similar webtools provided by our marketing partners. To opt out of this sharing of your personal information in these circumstances, please click on the cookie management tool to set your cookie preferences.

12.7.7.       Opt-Out Rights / Profiling. Virginia residentshave the right to opt out of having their personal information used forprofiling in furtherance of decisions that produce legal or similarlysignificant effects. However, Limbic does not engage in such activities.

13.       QUESTIONS AND COMPLAINTS

‍13.1.    Please contact us at: Email: data.enquiries@limbic.ai Address: FAO Data Protection Enquiries, Limbic Inc, 108 Lake Land Avenue, City of Dover, County of Kent, Delaware, 19901


DETAILS OF CHANGES TO THIS PRIVACY NOTICE

Version: 1.0
Date: 06/20/2024
Details: First version

1. INTRODUCTION

1.1.       This privacy notice applies to you, a user of the LimbicAccess Intake and Assessment Assistant(the "Assistant") and auser or prospective user of the Assistant who are intended to be eitherpatients or clinicians ("you"and "your").

1.2.       Please read this privacy notice carefully. Among otherthings, it explains:

1.2.1.         what personal data we may collectabout you;

1.2.2.         why we collect and use yourpersonal data and the legal bases we rely on for processing it;

1.2.3.         who we disclose your personal datato;

1.2.4.         where we store your personal data;

1.2.5.         how long we keep your personaldata; and

1.2.6.         your rights regarding the personaldata we hold about you and/or which you provide to us.
‍

2. WHO WE ARE

2.1.      We are Limbic. We are a business that provides software for mental healthcare. Limbic is acompany registered in England and Wales (company number: 11093861) with its registeredoffice at Kemp House 160 City Road, London, England, EC1V 2NX.

2.2.       Data protection laws apply to our collection and use of personal data and Limbic is theprocessor of that personal data (ICO registration number: ZA779212).
2.3.       If you have any queries regarding this privacy notice or the way in which we process yourpersonal data, please contact us at: Email: data.enquiries@limbic.ai, Address: FAO Data Protection Enquiries, CTO/Director, Kemp House, 160 City Road, London, England, EC1V 2NX.

‍3. CHANGES TO YOUR PERSONAL INFORMATION

It's important that the personal data we hold about you is accurate and current. Please let us know ifyour personal data changes or if you become aware that any personal data that we hold about you isnot accurate.

4.  WHAT PERSONAL DATA WE COLLECT

4.1.       The type of personal data we process may include (asapplicable) the following depending on your use of the Assistant:
‍

4.2     Information about why weprocess the above personal data and the lawful basis we rely on is set out in sections 6 and 7 below.

4.3.       We only process personal data which is adequate, relevant and limited to what is necessary to fulfill the purposes set out in this notice. Where you are invited to input data into the Assistant, you should only provide data which is relevant and necessary.

4.4.       You acknowledge and agree that you will only provide us with your own personal data and that you must not provide us with the personal data of any third party or any data which may be considered unlawful.

4.5.       We do not process any information about children under the age of 13 and we do not process any information about criminal convictions andoffences. You must not provide us with any such information on the Assistant.If you or any other person becomes aware that a child has accessed or may have accessed the Assistant and provided their personal data without parent consent, they must contact us by email at data.enquiries@limbic.ai.

5.         HOW WE COLLECT YOUR PERSONAL DATA

5.1.       We may collect information direct from you and use, disclose and store it when:

5.1.1.         you access, use or interact with the Limbic Assistant;

5.1.2.         you correspond/interact with us via email, phone, social media or other channels;

5.1.3.         you make any inquiry or complaint;

5.1.4.         you purchase, request or subscribe for a product or service from us;

5.1.5.         you request technical support or other customer care support;

5.1.6.         you participate in surveys and questionnaires or provide us with a review or feedback; or

5.1.7.         you provide data for other legal and regulatory purposes.

5.2.     Where lawful, we may also obtain personal data from other third parties (including third party platforms) and we may process that information where such processing is necessary or permitted in order to provide our products and services to you, or where such processing is necessary or permitted for our internal administrative purposes or for marketing and business development purposes.

5.3.       Where we need to collect personal data by law, or underthe terms of an agreement we have with you, and you fail to provide that data when requested (or fail to consent to the processing of that data, if necessary), we may not be able to perform the agreement or arrangement we have or are trying to enter into with you or such failure may limit or prevent you obtaining access to, or making full use of, the Assistant.

5.4.       For a lot of the personal data we process (see section 4), we only do so with your consent (see section 7), and by you actively in putting the information into the Assistant. You are of course free to 'opt out' ofgiving us any particular information by simply not providing it, and you can withdraw your consent at any time (see section 6.3), but again that may restrict our ability to provide you with our services.

6. HOW WE USE YOUR PERSONAL DATA

‍6.1.      We use your personal data for a number of purposes but only where we're allowed to by law.  

6.2.       We may process your personal data where such processing is necessary or permitted:

6.2.1.         to authenticate and verify individualid entities, including requests to exercise your rights under this privacy policy;

6.2.2         to comply with any applicable law or regulation; and/or

6.2.3.         for the purposes of the legitimate interests pursued by us or a third party. These legitimate interests include the purposes identified in the table below in section 7 but may also include other commercial interests and our internal administrative purposes. Where we rely on legitimate interests as the lawful basis for processing your personal data, we'll put in place appropriate safeguards to protect your data and to ensure that your fundamental rights and freedoms are not overridden by those legitimate interests.

6.3.       We may also process your personal data where we have your consent. Where we rely on consent as the lawful basis for processing your personal data, we won't ever use that data for anything else except for the purpose for which we obtained consent at the time. You have the right to withdraw your consent at any time and if you wish to do so, you should contact us using the contact details set out in section 13 below. The withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal or the lawfulness of processing based on other lawful grounds.

6.4.       We may process special categories of personal data(including details about your race or ethnicity, sex life, sexual orientation, and information about your health and genetic and biometric data) where:

6.4.1          we have your explicit consent;

6.4.2.         the processing is necessary for reasons of substantial public interest because of the law; and/or

6.4.3.         the processing is necessary for the establishment, exercise, or defense of legal claims.

6.5.        As elements of your Health Data will constitute special categories of personal data, our lawful basis for processing your Health Data will usually be your explicit consent. Where you are asked to give such explicit consent, this consent refers to the processing of your HealthData for the specific purposes set out in clause 7 or such other purposes as may be communicated to you within the Assistant from time to time. You should not consent to such processing (including by accepting the terms of this notice)unless you wish to give us your express, freely given consent to process your Health Data in accordance with the terms of this notice. You are not required to provide any Health Data to us, but given the nature of our Assistant and our services, it is likely to prejudice our ability to deliver our services to you if you choose not to do so.

6.6.        We may anonymise your personal data and use itfor our internal research and development purposes to improve and develop existing or new software and services, and for research papers which may be published. Such purposes may include, for example, to gain statistical insight into how our services are used and can be most helpful, as well as to develop and improve our algorithms, functionality and user interface, and to study datawhich might then be reported in the form of insights and research papers. We ensure that your personal data is irreversibly anonymised before using it for such purposes, meaning that it does not, and cannot be used to, identify you.You acknowledge and agree that any resulting intellectual property rights arising out of or in connection with your personal data and the research carried out using it are fully owned by us.

6.7.        We may process your personal data for more than one lawful ground depending on the specific purpose for which we're using your data.

6.8.        We may process your personal data ourselves or in conjunction with our third party service providers in accordance with section8.

6.9.  We'll only use your personal data for thepurposes for which we collected it, unless we reasonably consider that we needto use it for another reason and that reason is compatible with the original purpose.

6.10.  If we need to use your personal data for an unrelated purpose, we'll notify you (which may be by way of an update to this privacy notice) and we'll explain the legal basis which allows us to do so. Inthe event that the purpose of data collection changes where consent is the lawful basis for processing, we will notify you of such change and re-secure your consent for such processing.

6.11.  Please note that we may process your personal data without your knowledge or consent where this is required or permitted bylaw.

6.12.    Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

7.  OUR LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA

7.1.       We've set out below the legal bases on which we process your personal data. We've identified what our legitimate interests are, where appropriate.

‍

Purpose/Activity	Type of personal data processed	Lawful basis for processing
Provision of our products and services ● To provide our Assistant to you.	● Identity Data ● Contact Data ●Correspondence Data ● Health Data   ● Usage Data	● Your explicit consent (with regards to Health Data)    ● Performance of a contract ● Compliance with a legal obligation   ● Our legitimate interests to respond to enquiries, messages and requests, operate, develop and improve our business and to fulfil our legal and contractual obligations
Business Operation and Maintenance   ● To operate and protect the Assistant (including troubleshooting, incident management and data breach management, data analysis, product and system testing, system maintenance, support, reporting and hosting of data)	● Identity Data ● Contact Data ● Correspondence Data ● Health Data   ● Usage Data	● Your explicit consent (with regards to Health Data)   ● Performance of a contract ● Compliance with a legal obligation ● Our legitimate interests to operate and improve our business, fulfil our legal and contractual obligations and for the purposes of IT security
Customer Relationship Management   ● To manage our relationship with our customers which includes notifying you of any changes to our terms or this privacy notice or to our products/services, apps, to respond to enquiries, messages, and requests for technical support and customer care support	● Identity Data ● Contact Data ● Correspondence Data ● Health Data   ● Usage Data	● Your explicit consent (with regards to Health Data)    ● Performance of a contract ● Compliance with a legal obligation   ● Our legitimate interests to respond to enquiries, messages and requests, operate, develop and improve our business and to fulfill our legal and contractual obligations
Research and Business Development   ● To improve the Assistant, our apps, customer relationships and experiences ● To anonymize your data for the purposes set out in section 6.6	● Identity Data ● Contact Data ● Correspondence Data ● Health Data   ● Usage Data	● Our legitimate interests to define types of customers for our products and services, develop and improve our business and to inform our marketing strategy
Business Management   ● To manage our business including to keep financial and accounting records, carry out audits, testing, comply with our reporting requirements and other corporate governance requirements ● To exercise our rights set out in agreements including recovering debts owed to us	● Identity Data ● Contact Data ● Correspondence Data ● Usage Data	● Performance of a contract ● Compliance with a legal obligation ● Our legitimate interests to exercise our rights (including to recover debts), to operate our business (including internal administration and IT services, network security, to prevent fraud and in the context of a business reorganization, sale or group restructuring exercise) and to fulfil our legal and contractual obligations

8.   HOW WE SHARE YOUR PERSONAL DATA WITH OTHERS

8.1.       We won't share any of your personal data with third parties except as set out in this section or otherwise notified to you oragreed between you and us from time to time.

8.2.       We may share personal data with anyone we refer you to for treatment after engaging with our Assistant, including your clinician.

8.3.      We may also share personal data with our group companies (including our subsidiaries, ultimate holding company and its subsidiaries) and partnered companies for the purposes outlined in this privacy notice. We may also share personal data with third party service providers who we engage to provide services which facilitate our business and we may also need to share personal data with other third parties in order to comply with our legal and regulatory obligations.Below is a list of specific third parties and other categories of third parties with whom we may share your personal data:

8.3.1.         Heroku Services, our data hosting provider;

8.3.2.         Amazon Web Services, the servers used by Heroku Services;

8.3.3.         Sentry, our application monitoring and error tracking software;

8.3.4.         Mix Panel, our application for monitoring performance and usage

8.3.5.         any third party buyer of our business or assets;

8.3.6.         law enforcement or a regulator;

8.3.7.         legal counsel and other professional advisers including accountants and auditors;

8.3.8.         any of our personnel who many need access to certain of your personal data in order to provide their services, which may include personnel who are engaged as consultants or workers, as well as our employees; and

8.3.9.         any similar or replacement third parties from time to time.

8.4.      We ensure that any third party engaged by us who processes your personal data in connection with the purposes listed above has policies and procedures in place to ensure compliance with data protection laws.

8.5.      For any third parties that are based, or process data, outside of the EEA or the United Kingdom, we engage such third parties inaccordance with section 9 below.

8.6.      We may share your personal data with third parties where we're required to do so by law or regulation (such as inconnection with an investigation of fraud or other legal enquiry) or in connection with other legal proceedings (including where we believe that youractions violate applicable laws or any agreement with us, including our Terms of Use).

8.7.      In the event that our business or any part of it is sold or integrated with another business, your details may be disclosed to our advisers and those of any prospective purchaser and will be passed to th enew owners of the business.

9. INTERNATIONAL TRANSFERS OF YOUR PERSONAL DATA

9.1.      From time to time it may be necessary for us to transfer your information internationally. In particular, your information maybe transferred to and/or stored on the servers of third parties identified in section 8 which are based outside of the UK or the EEA.

9.2.      However, we won't transfer your personal dataoutside of the UK or the EEA unless:

9.2.1.        such transfer is to a country or jurisdiction which the EU Commission or the UK (as applicable) has approved as having an adequate level of protection;

9.2.2.        appropriate safeguards are in place in accordance with data protection laws. These safeguards include the use ofstandard contractual clauses or binding corporate rules; or

9.2.3.       the transfer is otherwise allowed under data protection laws (including where we have consent or the transfer is necessaryfor important reasons of public interest, is necessary for the establishment, exercise or defence of legal claims or is necessary for the performance of a contract with the data subject).

9.3.      We'll ensure that where your personal data is transferred outside of the UK or the EEA, it is afforded an essentially equivalent level of protection as would be afforded to it within the location from which it is transferred.

10. HOW WE STORE AND RETAIN YOUR PERSONAL DATA

10.1.      As a minimum, we need to store your personaldata for as long as is necessary to enable us to fulfill the purpose for whichit is processed, including to provide and operate our Assistant, fulfil our legal and regulatory obligations (e.g. relating to record keeping) and to exercise or defend any legal claims.

10.2.      For as long as we do store your data, we follow generally accepted industry standards and maintain reasonable safeguards toattempt to ensure the security, integrity, and privacy of the information you have provided. All information you provide to us is stored on our secure servers. We adhere to the NHS Data Protection Toolkit, have implemented DCB0129standards for safety/risk mitigation, are ISO 27001 certified and are CyberEssentials accredited.

10.3.      We'll notify you without undue delay in accordance with the requirements of data protection laws, if we have reason to believe that there has been a personal data breach by us which could adversely affect your rights and freedoms and we're required by law to notify you.

10.4.       We maintain and implement a data retention policy and will delete personal data in accordance with this. Other than in rare circumstances (for example, where we are required to retain data by law), your data will be deleted within 30 days once the purposes for which it was collected have been carried out.

11. YOUR LEGAL RIGHTS

11.1.      Subject to any conditions and requirements set out in data protection laws, you may have some, or all, of the following rights in relation to the personal data we hold about you:

11.1.1.        the right to request a copy of your personaldata held by us;

11.1.2.        the right to correct any inaccurate or incomplete personal data held by us;

11.1.3.        the right to request that we erase personal data we hold about you;

11.1.4.        the right to request that we restrict the processing of your data;

11.1.5.        the right to have your personal data transferred to another organisation;

11.1.6.        the right to object to certain types of processing of your personal data by us;  

11.1.7.        the right to request that you are not subject to any decision which is based solely on automated processing, including profiling, where this produces legal effects or otherwise significantly affects you; and

11.1.8.        the right to complain (please see section 13 of this privacy notice).

11.2.      PLEASE NOTE that these rights are not absolute in all situations and may be subject to conditions and provisions set out in data protection laws. We cannot, therefore, guarantee that we'll be able to honour any request from you in connection with the rights set out above. (For example, even if you request that we delete your personal data, we may be required by law to retain some personal data for accounting and record keeping purposes or in order that we comply with our legal and regulatory obligations).

11.3.      We will respond to a request to exercise your rights as set out in this section as we can, and in any event within two months.

11.4.      For further information, or to exercise any particular right, please see section 13 for details of how to contact us.

12. LINKS TO THIRD PARTIES

12.1.      The Assistant may link or redirect to other websites, social media accounts or other content which is not under our control. Unless otherwise stated, such links or redirections are not endorsements of such websites or representation of our affiliation with them inany way and such third party websites are outside the scope of this privacy notice.

12.2.      If you access such third party websites or platforms, please ensure that you're satisfied with their respective privacy policies before you provide them with any personal data. We cannot be held responsible for the activities, privacy policies or levels of privacy compliance of any website or platform operated by any third party.

13. QUESTIONS AND COMPLAINTS

13.1.      Please contact us at: Email: data.enquiries@limbic.ai, Address: FAO Data Protection Enquiries, CTO/Director, Kemp House, 160 CityRoad, London, England, EC1V 2NX.

13.2.      You have the right to make a complaint at anytime to the relevant supervisory authority for data protection issues, which in the UK is the Information Commissioner's Office (ICO) (www.ico.org.uk).


DETAILS OF CHANGES TO THIS PRIVACY NOTICE

Version: 1.0
Date: 01/07/2022
Details: First published

Version: 2.0
Date: 06/08/2023
Details: Update to section 8.3