Privacy Notice

CollectiveOS is a membership-based health platform that offers clinician-prescribed compounded therapies, integrated telehealth consultations, and digital pharmacy services to deliver health and wellness solutions to our members.

CollectiveOS is not a medical group or health care provider. We do not provide medical advice, diagnosis, or treatment. Instead, we serve as a technology platform that enables users to request, schedule, and conduct virtual consultations with independent medical groups and all members of the independent medical groups affiliated covered entity (collectively, the “Medical Group”). The Medical Group is an independent medical group with a network of United States-based health care providers (each, a “Provider”). These Providers are not employees, agents, or representatives of CollectiveOS. If you receive medical services from a Provider introduced through our Platform, that Provider (or its affiliated Medical Group) is solely responsible for your care. CollectiveOS does not control or manage any aspect of your clinical relationship with these independent Providers.

It is helpful to start by explaining some of our key terms and definitions used in this Privacy Notice.

• “Personal Information” — Any information relating to an identified or identifiable individual and any information listed here.
• “Platform” — Our Website and Services, as applicable.
• “Privacy Notice” — This privacy policy.
• “Services” — Any services provided through our Platform.
• “Terms of Use” — Our Terms of Use located here.
• “Website” — Our Website located at collectiveos.health and any other websites or platforms operated or powered by CollectiveOS that link to this Privacy Notice.

When does our Privacy Notice apply?

This Privacy Notice describes the types of information we may collect from you when you visit or use our Platform or the Services provided via our Platform, including when we communicate with you electronically, such as through our Platform, email, text message, and other electronic messages between CollectiveOS and you.

When does our Privacy Notice not apply?

This Privacy Notice does not apply to information (a) collected by any other websites or platforms operated by us, unless the website or platform links to this Privacy Notice; (b) collected by any third-party website that we may provide a link to or that is accessible from our Platform; or (c) covered in part or in whole by a separate privacy policy provided by us.

This Privacy Notice does not apply to Protected Health Information (“PHI”) collected in connection with the telehealth consultations and prescription fulfillment services facilitated through our Platform. PHI is governed by applicable federal and state health information privacy laws. CollectiveOS is required to follow your Provider's Notice of Privacy Practices when using and disclosing your PHI. The Provider's Notice of Privacy Practices can be located at https://enhance.md/privacy-policy.

Terms of Use

This Privacy Notice is incorporated into and governed by our Terms of Use, which is found here and incorporated herein by reference.

What is Personal Information?

Personal information is information from and about you that may be able to personally identify you. We treat any information that may identify you as personal information. For example, your name and e-mail address are personal information.

What types of Personal Information do we collect?

We may collect and use the following personal information (hereinafter, collectively referred to as “Personal Information”) when you use our Platform or interact with us:

• Personal Identifiers. A real name, postal address, email address, telephone number, IP address, driver's license number, and account login credentials.
• Characteristics of protected classifications under federal law. Age, medical information, if provided by you voluntarily in relation to our Services.
• Financial Information. Credit card number and debit card number.
• Health and Medical Information. Information related to your health conditions, symptoms, medical history, prescriptions, and treatment preferences, as collected through clinical questionnaires and telehealth consultations conducted through our Platform.
• Commercial Information and Inferences Drawn. Records of products or Services purchased, obtained, or considered, and profiles reflecting a person's behavior as it may relate to Services.
• Internet or other electronic network activity information. IP address, device model, device ID, operating system version, device language, operating system, browser type, browsing history, search history, and information regarding a consumer's interaction with an Internet website or advertisement.
• Geolocation Data. Physical location for registration, eligibility assessment, and consultation purposes.

How do we collect your Personal Information?

Information you provide to us.

We collect most of this Personal Information directly from you. For example, when you use our Platform, use our Services, create an account, complete a clinical questionnaire, or contact CollectiveOS directly.

When you make payments through the Platform.

When you make a payment through the Platform, we do not collect or store financial account information, though we may receive transaction identifiers and summary information that does not include credit card or bank account numbers. Our payment processor's privacy policy may be found at https://corepay.net/privacy-policy.

Information we collect automatically as you use our Platform.

As you navigate through and interact with our Platform, we also use automatic data collection technologies to collect certain Personal Information about your interaction with our Platform. The information we collect typically includes browsing history, search history, browser type, and operating system. We also collect information about the interaction of your browsers and devices with our Platform, such as IP address, device type, and the date, time, and referrer URL of your request.

The information we collect automatically may include Personal Information, or we may maintain it or associate it with Personal Information we collect in other ways or receive from third parties. It helps us to improve our Platform and to deliver a better and more personalized service by enabling us to: (i) estimate our audience size and usage patterns; (ii) store information about your preferences; (iii) customize our Website according to your individual interests; (iv) speed up your searches; and (v) recognize you when you return to our Platform.

The automatic data collection technologies that we use include:

Cookies (or browser cookies). We and our service providers may use cookies, web beacons, and other technologies to receive and store certain types of information whenever you interact with our Platform or Services through your computer or mobile device. A “cookie” is a small file or piece of data sent from a website and stored on the hard drive of your computer or mobile device. Some of the cookies we use are “session” cookies, meaning that they are automatically deleted from your hard drive after you close your browser at the end of your session. Session cookies are used to optimize the performance of the Website and to limit the amount of redundant data that is downloaded during a single session. We also may use “persistent” cookies, which remain on your computer or device unless deleted by you (or by your browser settings). We may use persistent cookies for various purposes, such as statistical analysis of performance to ensure the ongoing quality of our Platform and/or the Services. We and third parties may use session and persistent cookies for analytics and advertising purposes, as described herein. On your computer, you may refuse to accept browser cookies by activating the appropriate setting on your browser, and you may have similar capabilities on your mobile device in the preferences for your operating system or browser. However, if you select this setting, you may be unable to access or use certain parts of our Platform or the Services. Unless you have adjusted your browser or operating system setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Platform.

Google Analytics. We use Google Analytics, a web analytics service provided by Google, Inc., to collect certain information relating to your use of our Website. Google Analytics uses cookies to help us analyze how users use our Website. For more information regarding Google Analytics (including how Google uses data when you visit our Website), please visit Google's website and the pages that describe Google Analytics, such as: www.google.com/analytics/learn/privacy.html.

Other third-party tools. We use other third-party tools which allow us to track the performance of our Platform. These tools provide us with information about errors, app and website performance, and other technical details we may use to improve our Platform and/or the Services.

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. However, if you do not consent to our use of cookies or select this setting you may be unable to access certain parts of our Platform. You can find more information about cookies at http://www.allaboutcookies.org.

BY CONTINUING TO ALLOW COOKIES (SEE YOUR CHOICES FOR HOW WE COLLECT, USE AND SHARE YOUR PERSONAL INFORMATION), YOU HEREBY CONSENT TO OUR RECORDING AND DISCLOSURE TO THIRD-PARTY COOKIE PROVIDERS OF YOUR USE OF THE PLATFORM OR OTHER COMMUNICATIONS YOU MAY HAVE WITH OUR PLATFORM.

By providing your telephone number and opting in to receive text messages from CollectiveOS through a form on our Websites, by texting a designated keyword, or by otherwise expressly consenting to receive text messages, you consent to receive SMS and MMS messages from CollectiveOS related to the products, services, or inquiries you have requested or expressed interest in. Your consent to receive text messages is not a condition of purchasing any goods or services from CollectiveOS. Message frequency may vary. Message and Data Rates may apply. You can STOP messaging at any time by replying STOP to any message you receive from us, and you can get more help by replying HELP.

As described more fully below, we use information that we collect about you or that you provide to us, including any Personal Information for the following purposes:

• To operate, maintain, supervise, administer, and enhance our Platform or the Services, including monitoring and analyzing the effectiveness of content on the Platform, aggregate site usage data, and other usage of the Platform and/or the Services, such as assisting you in completing the registration process.
• To provide our products and Services to you in a custom and user-friendly way.
• To provide you with information, products, or Services that you request from us or that may be of interest to you.
• To promote and market our Platform and/or the Services to you. For example, we may use your Personal Information, such as your email address, to send you news and newsletters, special offers, and promotions, or to otherwise contact you about Services or information we think may interest you. We also may use the information that we learn about you to assist us in advertising our Services on third-party websites. You can opt out of receiving these emails at any time as described below.
• To personalize your Platform experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and advertisements through our Platform, third-party sites, and via email or text message (with your consent, where required by law).
• To provide you with support for our Platform and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To maintain, customize, and secure your account, including providing notices about subscriptions, expiration, and renewals.
• To process your requests, purchases, transactions, and payments and to prevent transactional fraud.
• For internal testing, research, analysis, and product development, including to develop and improve our Platform, and to develop, improve, or demonstrate our Services.
• To help maintain the safety, security, and integrity of our Platform.
• For detecting security incidents, responding to, and protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• To respond to law enforcement requests, court orders, and subpoenas and to carry out our legal and contractual obligations.
• To notify you about changes to our Platform.
• In any other way we may describe when you provide the information.
• To fulfill any other purpose for which you provide it.
• For any other purpose with your consent.

We may also use your information to contact you about our own goods and services that may be of interest to you, including by email, text message or SMS where you have provided your prior express consent. If you wish to change your choice, you may do so at any time by sending us an email stating your request, or, in the case of text messages, by replying STOP to any message you receive from us. For more information, see Choices About How We Use and Share Your Information.

We do not share, sell, or otherwise disclose your Personal Information for purposes other than those outlined in this Privacy Notice. However, we may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose Personal Information that we collect or you provide as described in this Privacy Notice:

Business Partners and Affiliates. We may share your Personal Information with our business partners, service providers, and affiliates who perform services on our behalf, including our pharmacy partners, telehealth partners, payment processors, shipping and logistics partners, data hosting and data storage partners, analytics providers, technology services and support, and data security advisors. We contractually require these third parties to keep Personal Information confidential and use it only for the purposes for which we disclose it to them.

Government Entities. We may share your Personal Information with government entities as required in connection with pharmacy fulfillment, regulatory compliance, and other legal obligations.

Compliance with Law. We may share your Personal Information to comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, subpoenas, and regulatory inquiries.

To Enforce our Rights. We may share your Personal Information to enforce our Terms of Use and any other agreement, terms and conditions relating to your use of our Platform. We also may share information as needed to ensure the safety and security of our Platform and our users, and to detect, prevent, or otherwise address fraud, security, or technical issues.

Protect Rights, Property and Safety. If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of CollectiveOS, our customers, or others. This may include exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

Business Transfers. We may share your Personal Information to a buyer, potential buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our users are among the assets transferred.

De-identified Information. We may also share de-identified information, so that it cannot be reasonably used to identify any individual, with third parties for marketing, advertising, research, or similar purposes.

To market our products and services. We may share your Personal Information to market our products and Services.

Knowledge and Consent. With your consent, pursuant to your instructions, to fulfill a purpose for which you provide the information to us, and for any other purpose disclosed by us when you provide the information.

We strive to provide you with choices regarding the personal information you provide to us. As a general rule, you cannot opt out of our collection, use and sharing of Personal Information to the extent it is necessary to provide our Platform or related basic services, features and functionality available on or through our Platform to you. We have created mechanisms to provide you with the following control over your information:

Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. You may also disable our use of any non-essential cookies (e.g., analytics cookies) through the cookie consent manager on our Platform. If you disable or refuse cookies, please note that some parts of our Websites may then be inaccessible or not function properly. You can find more information about cookies at http://www.allaboutcookies.org.

Direct Marketing/Promotional Offers from CollectiveOS. If you do not want us to use your contact information to promote our own Services and the products we offer, you can opt-out by sending email at the Contact Information below. If we have sent you a promotional email, you may click the unsubscribe link in the body of that email to be omitted from future email distributions.

Text Messages (SMS/MMS). If you have opted in to receive text messages from CollectiveOS and wish to opt out, you may do so at any time by replying STOP to any text message you receive from us. After you opt out, you will no longer receive text messages from CollectiveOS unless you subsequently re-enroll. For assistance, reply HELP to any text message you receive from us or contact us at the Contact Information below. Message and Data Rates may apply.

As noted above, we do not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can learn more about interest-based advertisements and your opt-out rights and options from members of the Network Advertising Initiative on its website (www.networkadvertising.org) and from members of the Digital Advertising Alliance on its websites by visiting www.aboutads.info (U.S. residents). Please note that you may continue to receive generic ads that are not based on your preferences.

Access, Corrections and Deletion. Please contact us by email at the Contact Information below to request access to, correct or delete any Personal Information that we have collected about you. Please promptly inform us of any changes or errors in any Personal Information we have about you to ensure that it is complete, accurate, and as current as possible. You may also have certain deletion rights in accordance with applicable law. We may not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect.

Copies and Retention of Personal Information. Please contact us by email at the Contact Information below if you have any questions about obtaining copies or the retention of your Personal Information.

Our Platform is not intended for children under 18 years of age. No one under age 18 may provide us with any Personal Information on or through our Platform. We do not knowingly collect Personal Information from children under 18. If you are under 18, do not use or provide any information on or through any of its features, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received Personal Information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information directly from a child under 18, please contact us using the Contact Information at the end of this Privacy Notice.

Some web browsers permit you to broadcast a signal to websites and online services indicating a preference that they “do not track” your online activities. At this time, we do not honor such signals and we do not modify what information we collect or how we use that information based upon whether such a signal is broadcast or received by us.

Some web browsers and browser extensions permit you to broadcast the Global Privacy Control signal (“GPC Signal”) as specified at https://www.globalprivacycontrol.org. Our Platform is designed to honor the GPC Signal and when we detect a valid GPC signal, we disable non-essential cookies for that browser session and refrain from targeted advertising associated with that browser.

For Texas Residents: If you are a resident of Texas, you have the additional rights described in the Texas Privacy Addendum below.

Texas Privacy Addendum

This Texas Privacy Addendum supplements our Privacy Notice and applies solely to residents of Texas. It is provided in accordance with the Texas Data Privacy and Security Act (“TDPSA”), Tex. Bus. & Com. Code § 541.001 et seq., effective July 1, 2024.

Your Rights Under the TDPSA

If you are a Texas resident, you have the following rights with respect to your personal data:

Right to Know. You have the right to confirm whether CollectiveOS is processing your personal data and to access that data.

Right to Correct. You have the right to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes for which it is processed.

Right to Delete. You have the right to request deletion of personal data provided by you or obtained about you.

Right to Data Portability. You have the right to obtain a copy of your personal data in a portable and readily usable format, to the extent technically feasible.

Right to Opt Out. You have the right to opt out of the processing of your personal data for purposes of (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

Right Against Discrimination. You have the right not to receive discriminatory treatment for exercising any of your rights under the TDPSA.

How to Submit a Request

To exercise any of the rights listed above, you may submit a request by:

• Emailing us at: questions@collectiveos.health
• Writing to us at: CollectiveOS, 13201 Northwest Freeway, Suite 800, Houston, TX 77040

We will respond to authenticated requests without undue delay and no later than 45 days after receipt. We may extend this period by an additional 45 days where reasonably necessary, in which case we will notify you of the extension within the initial 45-day period. We will respond to your request free of charge up to twice per year.

Appeals

If we decline to take action on your request, we will inform you of our decision and the reasons for it within the applicable response period. You may appeal our decision by contacting us at questions@collectiveos.health with the subject line “TDPSA Appeal.” We will respond to your appeal within 60 days. If your appeal is denied, you may submit a complaint to the Texas Attorney General at: https://www.texasattorneygeneral.gov.

Sensitive Data

We collect certain sensitive personal data, including health and medical information, as described in our Privacy Notice. We obtain your consent prior to processing such sensitive data.

Global Opt-Out Signals

As described in our Privacy Notice, our Platform is designed to honor the Global Privacy Control (GPC) signal. When we detect a valid GPC signal, we disable non-essential cookies and refrain from targeted advertising for that browser session.

For information about your rights with respect to Protected Health Information, please see your Provider's Notice of Privacy Practices, available at https://enhance.md/privacy-policy.

We have implemented measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Platform, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Platform. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures deployed on our Platform.

We may change or update this Privacy Notice at any time. It is our policy to post any changes we make to our Privacy Notice on this page. If we make material changes to how we treat our users' Personal Information, we will notify you by email and by posting the updated Privacy Notice on our Website. The date this Privacy Notice was last revised is identified at the top of the page. You are responsible for periodically visiting our Platform and this Privacy Notice to check for any changes.

YOUR CONTINUED USE OF OUR PLATFORM FOLLOWING THE POSTING OF CHANGES CONSTITUTES YOUR ACCEPTANCE TO SUCH CHANGES.

If you have any questions, concerns, complaints, or suggestions regarding our Privacy Notice or the ways in which we collect and use your Personal Information described in this Privacy Notice, have any requests related to your Personal Information pursuant to applicable laws, or otherwise need to contact us, please contact us using this Contact Information.

CollectiveOS
13201 Northwest Freeway, Suite 800
Houston, TX 77040
questions@collectiveos.health
(832) 280-7898