1. Information We Collect

Information you provide

• Account and contact information, such as your name, email address, age-confirmation information, account preferences, and authentication records.
• Health-related information you choose to enter, upload, or organize, which may include symptoms, goals, laboratory reports, collection context, medications, supplements, treatment context, questions, and follow-through notes.
• Communications you send to us, including support requests, feedback, pilot applications, and privacy requests.
• Information a participating clinic or other organization provides or makes available when you use CoreSignal through that relationship, subject to the applicable notice, authorization, or agreement.

Information collected through operation of the service

• Device, browser, IP-address, authentication, security, and diagnostic information needed to operate, protect, and troubleshoot the Platform.
• Essential storage used for sign-in, security, service continuity, and saving your privacy choices.
• Limited website usage information through optional analytics, but only after you allow optional analytics as described below.

Features and integrations may change during the pilot. We collect data from an integration only after that capability is available and you take the steps required to connect or use it.

2. How We Use Information

We use information to:

• Provide, maintain, secure, and support the Platform.
• Organize the information you submit and present it back to you or an authorized clinic user as part of the service you requested.
• Authenticate users, prevent abuse, investigate security events, and protect accounts and systems.
• Respond to support, pilot, clinic, legal, and privacy requests.
• Improve public website usability using optional analytics after consent. We do not use health records to build advertising audiences.
• Comply with applicable law, enforce our terms, and protect the rights, safety, and integrity of CoreSignal, our users, and others.

3. Optional Analytics, Cookies, and Similar Storage

Essential storage is used to operate the service and cannot be disabled through our analytics controls. Google Analytics and PostHog are optional. They remain off until you affirmatively allow optional analytics.

• Optional analytics are limited to public marketing and informational pages. They are not enabled on authenticated health-data workflows.
• PostHog session recording and automatic interaction capture are disabled in our consent-aware configuration.
• Analytics URLs are configured to exclude query strings and fragments, and event properties are filtered to reduce the risk of sensitive data being sent.
• We do not use optional analytics for cross-context behavioral advertising.

You can allow, decline, or later withdraw optional analytics through our Privacy Choices page. Compatible Global Privacy Control browser signals are honored and keep optional analytics off while the signal is active.

4. When We Disclose Information

We may disclose information only as reasonably necessary for the purposes described in this policy, including:

• To infrastructure, hosting, database, authentication, email, monitoring, security, support, and other service providers acting on our behalf and subject to appropriate contractual restrictions.
• To a clinic or other organization when you use CoreSignal through that relationship, request the disclosure, or otherwise authorize it.
• To comply with law, legal process, or a valid government request, or to protect rights, safety, security, and the integrity of the service.
• In connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable legal protections and notice requirements.

CoreSignal does not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not provide health information to employers, insurers, or data brokers for their own independent marketing or eligibility decisions.

5. Clinic and Regulated-Data Relationships

CoreSignal may be used independently or through a participating clinic. When a clinic relationship applies, the clinic's privacy notice, patient authorization, service agreement, or business-associate terms may govern particular information and uses. CoreSignal's legal role can differ by workflow and relationship; this policy does not represent that CoreSignal is a HIPAA covered entity or business associate in every context.

Contact the participating clinic for questions about its medical record, treatment, billing, or privacy practices. Contact CoreSignal for questions about the Platform and our handling of information.

6. Data Retention and Deletion

We retain information for as long as reasonably necessary to provide and secure the service, maintain required records, resolve disputes, enforce agreements, and meet legal or contractual obligations. Retention can vary by data type, account status, clinic relationship, security need, backup cycle, and applicable law.

You may request account or data deletion. Some information may be retained when required for security, fraud prevention, legal compliance, audit, dispute resolution, or a clinic's lawful recordkeeping obligations. Residual copies may remain in protected backups for a limited period before being overwritten through the normal backup cycle.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, and loss. Access is limited based on role and operational need. No online service or storage method can be guaranteed completely secure, so you should use a unique sign-in method and protect access to your email account and devices.

If a reportable incident occurs, we will investigate and provide notices as required by applicable law and contractual obligations.

8. Your Choices and Privacy Rights

Depending on your location and relationship with CoreSignal, you may have rights to request access, correction, deletion, or a portable copy of certain information; to withdraw consent; or to appeal a decision about a privacy request. We may need to verify your identity and authority before completing a request.

• Manage optional analytics and browser-based privacy signals on the Privacy Choices page.
• Request access, correction, deletion, or another privacy action by emailing privacy@coresignal.health.
• Revoke a connected service's permission through that service or your device settings when an integration is available.

We will not discriminate against you for exercising a privacy right available under applicable law.

9. Children's Privacy

CoreSignal is intended for adults age 18 and older. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information through the Platform.

10. United States Processing

CoreSignal is offered primarily in the United States. Information may be stored and processed in the United States and other locations where our service providers operate, subject to applicable safeguards.

11. Changes to This Policy

We may update this policy as the Platform, our practices, or legal requirements change. We will post the revised policy with a new effective date and provide additional notice when required by law or when a change materially affects how we handle information.