CLINEXA PRIVACY POLICY

Last revised on July 18, 2026

This privacy policy for Clinexa Health, Inc. (“Clinexa,” “Company,” “we,” “us,” or “our”), describes how and why we collect, store, use, and share (“process”) your information when you visit our website at tryclinexa.com (the “Site”) or use our appointment-concierge service (together with the Site, the “Services”). By using the Services, you acknowledge this Privacy Policy.

Health information. Clinexa helps you arrange healthcare appointments, so some of the information we handle is health-related. To the extent we create or receive protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”), that PHI is governed by the applicable requirements of HIPAA (including any applicable business associate agreement and, if we are ever required to publish one, a HIPAA Notice of Privacy Practices), not by this Privacy Policy, which governs information that is not PHI. Where we would disclose or sell PHI, we do so only under a signed authorization that satisfies HIPAA (45 C.F.R. § 164.508).

1. WHAT INFORMATION DO WE COLLECT?

We collect personal information that you voluntarily provide to us when you submit an appointment request, sign up for our waitlist or updates, express an interest in obtaining information about us or our products, when you participate in activities on the Site, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Site, the choices you make, and the products and features you use. The personal information we collect may include the following:

Marketing-site information: your name, your email address, and the organization you are affiliated with, when you contact us or sign up for our waitlist or updates.
Appointment-request information: when you use our appointment-concierge service, your name, telephone number, and email address; the specialty or type of care you are seeking, your preferred location, and your availability; and your insurance information, such as carrier, plan name, and member ID.
Partner contacts: when a pharmaceutical brand or other organization (“Partner”) engages with us, the business-contact information and campaign-configuration data it provides.
We collect health-related information, such as the specialty you are seeking, your insurance information, and appointment details, only as needed to provide the Services. We do not collect payment information from patients (the Services are free to patients), and we do not knowingly collect government-issued identifiers, education records covered by FERPA, or research participant data through the Site.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Site. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use the Site, and other technical information. This information is primarily needed to maintain the security and operation of the Site, and for our internal reporting purposes.

We use only a limited set of strictly necessary cookies for security and bot management, as described in Section 5; we do not use analytics, advertising, or tracking cookies.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for a variety of reasons, depending on how you interact with the Services, including:

To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
To deliver and facilitate delivery of the Services to you. We may process your information to provide you with the requested experience.
To research and arrange appointments on your behalf. We use the information you provide to research available providers and to contact healthcare providers (and their staff) on your behalf to arrange and confirm appointments.
To communicate with you. We process your information to contact you about your requests and bookings, including by telephone call, text message, and email, as described in our Terms of Service.
To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
To send administrative information to you. We may process your information to send you details about our products, changes to our terms and policies, and other similar information.
To generate aggregate reporting for our Partners. We process information to produce aggregate, de-identified reporting for our pharmaceutical-brand Partners regarding campaign activity.
To request feedback. We may process your information when necessary to request feedback and to contact you about your use of the Services.
To protect the Services. We may process your information as part of our efforts to keep the Services safe and secure, including fraud monitoring and prevention.
To identify usage trends. We may process information about how you use the Site to better understand how it is being used so we can improve it.
To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

The Services may use automated and artificial-intelligence systems to research providers and to prepare and send communications on your behalf. We do not use your personal information to train third-party artificial-intelligence models, and any model development we undertake uses only de-identified or aggregated data.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

Healthcare providers. To research and arrange appointments, we share with healthcare providers and their staff the information reasonably necessary to do so, such as your name, contact information, the care sought, and your insurance information. We do this to carry out the request you have asked us to fulfill and, where consumer-health-data or other applicable law requires your consent or authorization, only after we obtain it as described in Section 11. You may withdraw your consent or authorization, or ask us to stop contacting providers on your behalf, at any time and by any reasonable method, including by contacting us at privacy@tryclinexa.com.

Pharmaceutical-brand Partners. We share only aggregate, de-identified reporting with our Partners (such as total request and booking-confirmation counts for a campaign). We do not share individually identifiable patient information with Partners except under a separate, signed authorization you provide, as described in our Consumer Health Data Privacy Notice.

Service providers. We may share your data with third-party vendors, service providers, contractors, or agents (“third parties”) who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.

Legal and safety. We may disclose your information where required by law, regulation, or legal process, or where we believe disclosure is necessary to protect the rights, safety, or property of Clinexa, our users, or others.

Business transfers. If Clinexa is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we will notify you of any resulting change to this Privacy Policy.

No sale without authorization. We do not “share” your personal information for cross-context behavioral advertising, and we do not sell your personal information except pursuant to a separate, signed authorization you provide. Where the personal information is consumer health data, that authorization follows the process described in our Consumer Health Data Privacy Notice.

4. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

The Site may link to third-party websites, online services, or mobile applications and/or contain advertisements from third parties that are not affiliated with us and which may link to other websites, services, or applications. Accordingly, we do not make any guarantee regarding any such third parties, and we will not be liable for any loss or damage caused by the use of such third-party websites, services, or applications. The inclusion of a link towards a third-party website, service, or application does not imply an endorsement by us. We cannot guarantee the safety and privacy of data you provide to any third parties. Any data collected by third parties is not covered by this privacy policy. We are not responsible for the content or privacy and security practices and policies of any third parties, including other websites, services, or applications that may be linked to or from the Site. You should review the policies of such third parties and contact them directly to respond to your questions.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

The public marketing Site does not set first-party cookies, use analytics cookies or third-party analytics services, or use tracking pixels or advertising cookies. Our edge-security provider sets a small number of strictly-necessary cookies for bot management and security challenges. In addition, the logged-in patient and administrative portals set a small number of strictly-necessary, first-party functional cookies, such as session, one-time-passcode, and authentication cookies, that are required to operate the Services; these strictly-necessary cookies are exempt from consent requirements under the EU ePrivacy rules and the GDPR.

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

Should we offer you the ability to register and log in using your third-party social media account details, then where you choose to do so, we would receive certain profile information about you from your social media provider. The profile information we would receive may vary depending on the social media provider concerned, but would often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.

We would use any information we receive only for the purposes that are described in this privacy policy or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use and share your personal information, and how you can set your privacy preferences on their sites and apps.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from the Site is at your own risk. You should only access the Site within a secure environment. If we discover a security breach affecting your personal information, we will notify affected individuals, regulators, and others as and to the extent required by applicable law, including, where they apply, US state breach-notification laws and the FTC Health Breach Notification Rule, and, where such notice is required, without undue delay and within the time the applicable law requires.

8. DO WE COLLECT INFORMATION FROM MINORS?

The Services are intended solely for adults and are not directed to anyone under 18. You must be at least 18 years old to access or use the Services, and persons under 18 may not use the Services for any purpose. We do not knowingly solicit, collect, or market to anyone under 18 years of age. If we learn that we have collected personal information from a person under 18, we will take reasonable measures to promptly delete it from our records. If you believe a person under 18 has provided us with personal information, please contact us at privacy@tryclinexa.com.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy policy. Because we do not sell or share personal information for advertising, Global Privacy Control (“GPC”) signals do not currently affect our processing; we will honor GPC signals as a request to opt out of any “sale” or “sharing” of personal information under applicable law if we introduce any such activity.

10. U.S. STATE PRIVACY RIGHTS

Residents of certain U.S. states (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, and others) have additional privacy rights under state law. The specific rights available to you, and any exceptions, depend on your state of residence.

a. Your state privacy rights may include:

Right to Know / Access: to know what personal information we collect, use, disclose, and share, and to obtain a copy of it.
Right to Delete: to request deletion of your personal information, subject to legal exceptions.
Right to Correct: to request correction of inaccurate personal information.
Right to Portability: to receive your personal information in a portable, readily usable format.
Right to Opt Out of: the “sale” of personal information (we do not sell personal information except pursuant to a separate, signed authorization you provide — see our Consumer Health Data Privacy Notice for consumer health data); “targeted advertising” (we do not engage in targeted advertising); and profiling or automated decision-making that produces legal or similarly significant effects.
Right to Limit Sensitive Data: to limit our use and disclosure of your sensitive personal information (see subsection (b)).
Right to Non-Discrimination: not to be discriminated against for exercising your privacy rights.
Right to Appeal: to appeal our decision on your privacy request, where your state provides an appeal right.

b. Sensitive data. To provide the Services, Clinexa does collect certain sensitive personal information about you, in particular, the health-related and insurance information you provide to arrange appointments. Where your state’s law provides, you may have the right to limit our use and disclosure of this sensitive personal information to what is necessary to provide the Services, and we will honor that request. We do not use sensitive personal information for targeted advertising, and we do not sell it except pursuant to a separate, signed authorization you provide (the consumer-health-data authorization is described in our Consumer Health Data Privacy Notice). We do not intentionally collect other categories of sensitive data, such as precise geolocation, racial or ethnic origin, religious or philosophical beliefs, genetic data, biometric data used to identify you, or information about your sexual orientation.

c. To exercise your rights. Contact us at privacy@tryclinexa.com with your specific request and your state of residence. We will respond within the time required by your state’s law (generally within 45 days, which may be extended where the law permits). We may need to verify your identity before fulfilling your request.

d. Authorized agents. You may designate an authorized agent to submit a request on your behalf. We will require verification of your identity and of the agent’s authority to act for you.

11. CONSUMER HEALTH DATA (STATE-LAW NOTICE)

Some of the health-related information we collect to provide the Services may be “consumer health data” under state laws such as Washington’s My Health My Data Act, Nevada’s consumer-health-data law (SB 370), and Connecticut’s data-privacy law. If you are a resident of one of these states, the following applies in addition to your rights in Section 10.

a. Your consumer-health-data rights may include: to confirm whether we collect, share, or sell your consumer health data and to access it; to withdraw your consent to our collection or sharing of your consumer health data, and to revoke any signed authorization to sell it or to disclose it in a form that identifies you; to request deletion of your consumer health data; and not to be discriminated against, or denied the Services, for exercising these rights (except where the data is necessary to provide a service you have requested).

b. Consent and authorization. Where these laws apply, we will collect your consumer health data only with your consent; we will share it beyond what is necessary to provide the service you requested only with your separate consent, which you may decline or withdraw; and we will not sell it, or disclose it in a form that identifies you to a pharmaceutical or brand partner, without your separate, signed authorization. These consents and the authorization are described in our Consumer Health Data Privacy Notice.

c. How to exercise. The categories of consumer health data we collect, the recipients with whom we share it, and how you give, decline, and withdraw your consent and authorization are described in our Consumer Health Data Privacy Notice; you may also contact us at privacy@tryclinexa.com.

12. DO WE MAKE UPDATES TO THIS PRIVACY POLICY?

We may update this privacy policy from time to time. The updated version will be indicated by an updated “Last revised” date at the top and will be effective when posted, except where applicable law requires individual notice for material changes. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

13. HOW CAN YOU CONTACT US ABOUT THIS PRIVACY POLICY?

If you have questions or comments about this privacy policy, you may contact us at privacy@tryclinexa.com or by post to:

Clinexa Health, Inc.

131 Continental Drive, Suite 305, Newark, Delaware 19713

USA