LiveMetric Privacy Policy

The Effective Date of this Privacy Policy: 2/21/2021 This Privacy Policy supersedes any prior agreements or earlier versions of this Privacy Policy between you and LiveMetric for the use of the Services.

LiveMetric is a multinational company providing digital health products and services. Our objective is to help the users of our services live better, healthier lives.

When you use our Services, including via the LiveMetric App, our devices and/or via our website/s, we may collect the following types of information: Your name, email address, date of birth, gender, height and weight. You may also choose to provide additional, optional information, which may include your blood pressure goals, address, phone number, country information and payment information. (“herunder: Personal Information”) In addition we collect Blood pressure measurement and heart rate (Beats Per Minute or BPM) readings, which are stored and managed in the LiveMetric App. We may also collect irregular heartbeat, body mass index, body fat percentage, ambient temperature (the air temperature where the LiveMetric Band is, the number of steps and distance walked per day, and /or per 24 hour period and/or per certain parts of the week, the average number of steps per week or 7-day period, the average length of your step, motion, movement and location including location in the background. We may also collect data on your own estimations as to the time of day you go to sleep and wake up. (hereunder ”Measurement Information”) When you use our Services, we may receive certain usage data, including usage data from or about the LiveMetric Band and the LiveMetric App. This may include information about your interactions with the Services. Such interactions may include, but are not limited to, installing applications or software, creating a log in logging to your account, or pairing the LiveMetric device to your mobile device and account. We may also collect data about the devices and/or computers you use to access the Services, including IP addresses, times and dates of use, browser type, language, operating system, mobile device information (including unique device and application identifiers), the referring web page, pages viewed on our website, as well location (contingent on the permissions you may have granted us) and cookie information. We may also retain additional data in cases you specifically provide it to us when contacting us, or when attending to a request and/ or service complaint you may file with us. (hereunder ”Usage Information”) Hereunder, Personal Information, Measurement Information and Usage Information may be referred to collectively as “The Information” or “Information” or “The Data”

To the extent that The Information we may collect is considered health data or another special category of personal data which are subject to the European Union’s general Data Protection Regulation (“GDPR”), we will ask for your explicit consent to process the data. We ask and obtain your consent separately when you take actions leading to our obtaining the data. You may use the account settings at any time in order to remove or limit your consent.

Yes. Where applicable, our privacy policy herein adheres to and complies with the the General Data Protection Regulation (EU) 2016/679(GDPR), including with what has been known as the Data Protection Directive (Directive 95/46/EC). This privacy policy details hereunder the key principles relating to the protection of fundamental rights and freedoms in the processing of personal data which we comply with.

We use the data we collect in order to provide, develop and personalize our Services. For example, we may need to use some or all of your information collected in order to provide you with summary reports of your blood pressure readings and activity or in order to provide you with customer care. We may also personalize the Services and develop new ones. We may also use it to troubleshoot and protect against errors. When you allow us to collect exact location data, we may use that data to provide, personalize and improve features of the Services and/or pair your mobile device with our devices. We may use your information in order to send you automatic Service notifications and come back to you when you contact us. We may also use your information to make you aware of new or current products or features that we think may be of interest to you. You can stop or limit this by using the account settings or by using the “unsubscribe” button an email or text message. We also use the information we collect to promote safety and security of the Services. We use cookies and similar technologies for the purposes outlined above. For more information, please read our Cookie Use statement. For personal data that is subject to the GDPR, we rely on legal bases to process the data. These include, but not limited to, when you have given your consent and/or when such processing is required to fulfill our contractual obligations to you.

With the exception of the limited circumstances below, we do not share your personal information. These special circumstances are:

• When you explicitly direct us to disclose your information to others

• When you explicitly agree that we share your information with third parties.

• When providing information to our corporate affiliates or service providers who, based on our instructions, process it for us or provide you with customer support, all in compliance with this particular policy and applicable confidentiality measures

• When required by law, regulation legal process or governmental request

• When required to assert our legal rights, investigate illegal activity or defend legal claims. Note that our policy is to notify you of legal process seeking access to your information unless prohibited by law.

We may share non-personal information that is completely de-identified and/or aggregated so that it cannot reasonably be used to identify a specific individual. We may disclose such information publicly. If we become involved in a merger, acquisition, or a sale of assets, we will continue to take measures to protect the confidentiality of personal information and provide affected users with notice before transferring personal information to a new entity

We have implemented reasonable precautions to protect the information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our best efforts, no data security measures can guarantee security. You should take steps to protect against unauthorized access to your passwords, phone, and computer by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password private. We are not responsible for any lost, stolen, or compromised passwords or for any activity on your account via unauthorized password activity.

You may access and modify personal information that you have submitted by using your LiveMetric App and updating your profile information. Your personal data is stored and accessible on your device. If you contact us in order to receive customer support, we may store your contact information on our Cloud. We do not store on our coud any of your measurement information and that is stored only on your mobile device. You can ask to delete your personal information and/or account at any time by contacting Customer Support at privacy@livemetric.com. Please note that it may take a bit of time to delete your account information, and we may preserve it for legal reasons or to prevent harm.

We may send periodic promotional or informational emails to you. You may opt-out of such communications by following the opt-out instructions contained in the email itself. Please note that it may take up to 10 business days for us to process opt-out requests. We may still send you emails about your account or any services you have requested or received from us. Users Under 18 Our services are not designed for users under 18. If we discover that a user under 18 has provided us with personal information, we will delete such information from our systems. Your California Privacy Rights. This Privacy Policy complies with the California Consumer Privacy Act (CCPA), which requires that we provide California residents with notice that you have the right to:

• opt-out of the sale of personal information,

• know about personal information collected, disclosed or sold,

• to request deletion of personal information, and

• to be treated without discrimination should you exercise these rights.

More information regarding the: sources from which we collect personal information can be found above, the business and commercial purposes for which we collect your personal information, the categories of recipients with whom personal information is shared or sold can be found above. We do not sell any personal information collected from your use of the LiveMetric Services. To make a request under the California Consumer Privacy Act, or for any questions or concerns about our Privacy Policy or practices, please contact us at privacy@livemetric.com.

Individuals located in the European Economic Area (EEA) have certain rights in respect of your personal information. LiveMetric will provide the capabilities to exercise these certain rights to all our worldwide users, including:

• the right of access to your personal data;

• the right to correct or rectify any inaccurate personal data;

• the right to restrict or oppose processing of personal data;

• the right to erase your personal data; and

• the right to personal data portability.

We rely on your consent as a lawful basis processing personal data for the following purposes:

• initial collection of personal data through the Service;

• providing you with marketing or promotional communications. You may opt out of such communications at any time by clicking the “unsubscribe” link found within LiveMetric’s email updates.

We may process personal information in order to provide our services. Additionally, we may process personal information based on our contractual obligations to provide you the Service as described in the above, including:

• To enable and personalize the Services to function as expected;

• To communicate with you in response to customer service inquiries, to deliver non-promotional, service-related emails, or to administer surveys and questionnaires; and

• To tailor your experience based on your general region. For example, we process Clinical Interpretation Service requests from EEA-based users through an EEA-based Clinical Interpretation Service partner.

• This Privacy Policy May Not Apply to All EEA Users. This Privacy Policy does not apply to EEA users using the Services under direction from a physician and where the physician and the patient have an agreement between them covering the use of the Services; in such a case the physician or his/her institution controls data collected from/by KardiaMobile and the App, and the physician’s or his/her institution’s privacy policy will apply, not this Privacy Policy.

You may reach out to us if you have any questions or requests, including about deleting your data ( as indicated above) at:privacy@livemetric.com LiveMetric (Medica) S.A. 40 rue Glesener Luxembourg L-1630 If you are an EEA customer and are unable to reach LiveMetric at the contact information provided above regarding your issue, you have the right to contact your local Data Protection Authority. Please also review our Cookie Use Statement below for further information on how to stop the use of cookies. In addition to the various controls detailed above, if you reside in a Designated Country, you may opt to restrict our processing of your data in certain circumstances.

If you have any further questions or require assistance on your rights, you may reach out to our data information officer whose contact details are listed below. If you reside in a Designated Country, you have a right to lodge a complaint with your local data protection authority or with our Data Protection Commissioner: Ms. Chen Botvin LiveMetric (Medica) S.A. 40 rue Glesener Luxembourg L-1630 DPO@livemetric.com

If you reside in the European Economic Area, you have the right under the General Data Protection Regulation to request from LiveMetric access to and rectification or erasure of your Personal Data, data portability, restriction of processing of your Personal Data, the right to object to processing of your Personal Data, and the right to lodge a complaint with a supervisory authority. To request access to or rectification, portability or erasure of your Personal Data, or to delete your LiveMetric account, use our mobile apps or contact our customer support team. To the extent that LiveMetric’s processing of your personally identifiable data is subject to the General Data Protection Regulation, LiveMetric relies on its legitimate interests, described above, to process your data. With your consent, LiveMetric may also process other information that constitutes your Personal Data for direct marketing purposes and you have a right to object to LiveMetric’s use of your Personal Data for this purpose at any time.

Subject to applicable law, you also have the right to (i) restrict LiveMetric’s use of other information that constitutes your personal identifiable data and (ii) file a complaint with your local data protection authority or the Dutch Data Protection Commissioner, which is LiveMetric’s lead supervisory authority in the European Union. If you are a resident of the European Economic Area and believe we maintain your Personal Data within the scope of the General Data Protection Regulation (GDPR), you may direct questions or complaints to our lead supervisory authority: Dutch Data Protection Commissioner: Autoriteit Persoonsgegevens Postbus 93374 2509 AJ DEN HAAG, The Netherlands Phone: (+31) 708 88 85 00 Fax: (+31) 708 88 85 01

Generally, if you are based in the United States or Canada, or any other location outside of the European Union, any information you provide, including any personal information, is expected to be transferred to and processed by a computer server located within the United States, and if you are based in the European Economic Area or Switzerland, any information you provide, including any personal information, will be transferred to and processed by a computer server located within the European Union. LiveMetric is an international business. To offer our products, apps and services, we may need to transfer your Personal Data to countries other than the one in which you live. We deploy the following safeguards if LiveMetric transfers Personal Data originating from the European Union or Switzerland to other countries not deemed adequate under applicable data protection law:

• Regardless of where your information is processed, we apply the same protections described in this policy, and all LiveMetric local entities are required to follow the privacy practices set forth in this Privacy Policy.

• Any transfers of Personal Data from the European Economic Area (“EEA”) or Switzerland to the United States are done pursuant to European Commission approved Model Contractual Clauses: E.U.-U.S. Privacy Shield and Swiss-U.S. Privacy Shield. These frameworks were developed to enable companies to comply with data protection requirements when transferring Personal Data from the European Union and Switzerland to the United States. The U.S. Federal Trade Commission has jurisdiction over LiveMetric’s compliance with the Privacy Shield. To learn more about the Privacy Shield Program, please see http://www.privacyshield.gov/welcome.

• In the context of an onward transfer of data, LiveMetric retains responsibility for the processing of personal information it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf, and shall remain liable if its agent processes such personal information in a manner inconsistent with the EU-US and Swiss-US Privacy Shield Principles, unless we prove that we were not responsible for the event giving rise to the damage.

In compliance with the EU-US and Swiss-US Privacy Shield Principles, LiveMetric commits to resolve complaints about your privacy and our collection or use of your personal information. European Union or Swiss individuals with inquiries or complaints regarding this privacy policy should first contact LiveMetric at privacy@livemetric.com

We may make changes to this Privacy Policy from time to time. The most recent version of the Privacy Policy is reflected by the version date at the top of this Privacy Policy. All updates and amendments are effective immediately upon notice, which we may give by any means, including, but not limited to, by posting a revised version of this Privacy Policy or other notice on the Website. We encourage you to review this Privacy Policy often to stay informed of changes that may affect you, as your continued use of the Website signifies your continuing consent to be bound by this Privacy Policy. Our electronically or otherwise properly stored copies of this Privacy Policy are each deemed to be the true, complete, valid, authentic, and enforceable copy of the version of this Privacy Policy which were in effect on each respective date you visited the Website.