Privacy Notice

1. Who we are and what this notice covers

We are AccurKardia Direct, LLC, a Delaware limited liability company with its principal office at 101 Avenue of the Americas, Suite 931, New York, New York 10013, and a wholly owned subsidiary of AccurKardia, Inc. We offer AccurBeat, a self-pay, at-home heart rhythm study or test that is ordered and interpreted by an independent medical practice.

This notice covers:

• the accurbeat.com website, our waitlist and any surveys we invite you to answer;

• your order;

• the kit (recording device, phone and accessories) we lend you;

• our emails, texts and calls, and your contacts with AccurBeat Support.

This notice does not cover:

• The medical practice. PCCL (Medicina Exclusiva) LLC, doing business as Medicina Exclusiva (the “Practice”), is an independent, physician-owned practice that is not owned or controlled by us. Its privacy notice and clinical consents govern its handling of your medical record and its own communications with you, including through Spruce, its secure messaging app. You can request its Notice of Privacy Practices through the Practice or ask Support to help you obtain it. This exclusion does not remove our own obligations when handling information for the Practice.

• AccurKardia, Inc.’s corporate website, accurkardia.com, which has its own privacy policy.

• Any future AccurBeat app or product that carries its own privacy notice.

2. How privacy rules apply

The rules depend on the information, why it is processed and the role in which we handle it. Protected health information, or PHI, includes identifiable information about health care or payment for care that we handle for the Practice under HIPAA. The table explains our roles; it does not divide all records into mutually exclusive databases.

What it includes

• Information handled for the Practice: Your questionnaire; ECG recording and related device data; report; clinical communications made available to us for our permitted functions; and identifying, eligibility, scheduling, payment, shipping and support information when handled for the Practice.
• Other personal information: Website, waitlist, survey, transaction and business records, only to the extent they are not PHI handled for the Practice. These records may still contain sensitive or health-related information.

Who is responsible

• Information handled for the Practice: The Practice is responsible for its clinical record and covered-entity obligations. We are responsible for our own obligations as its business associate and under other applicable law.
• Other personal information: We are responsible for our processing under this notice and applicable law. Inc. and other recipients remain responsible for their own applicable obligations.

Our role

• Information handled for the Practice: We use and disclose PHI only as HIPAA and our written business associate agreement permit. Before a subcontractor handles PHI for us, we require the agreements and safeguards applicable to its role. Workforce members are subject to access controls, confidentiality requirements and training.
• Other personal information: We determine the purposes of our processing within this notice and applicable law. Required consent is obtained separately. Calling a record our own does not create a right to use PHI for an unrelated purpose.

Your rights

• Information handled for the Practice: The Practice handles requests concerning its clinical record. We promptly route requests we receive and provide the assistance required by our agreements and law. See Section 11.
• Other personal information: Described in Section 11.

The same identifying information can appear in several systems. Information does not fall outside HIPAA simply because it also helps administer an order. A waitlist answer, survey response, support message, order or identifiable website activity may also reveal that you are seeking a health service and may be protected by other privacy laws even when it is not PHI. Where waitlist, inquiry, or order information constitutes consumer health data under applicable state law outside of HIPAA, we collect, use, and share it with our operational service providers only as strictly necessary to provide the waitlist, inquiry response, or service you have requested, or with your separate consent where required by law. This notice does not expand any permission to use or disclose PHI.

For activities outside our role as the Practice’s business associate, the FTC Health Breach Notification Rule applies when the activity meets that Rule’s requirements for a personal health record vendor, related entity or service provider. Other privacy, security and breach-notification laws may also apply.

3. Information we collect

Information you give us

• Identity and contact: name, email address, mobile number, shipping and billing address and age-verification information.

• Statements you confirm at checkout: that you meet the age requirement in the Terms, are ordering for yourself, will receive the kit inside our service area and are located in a state where the Practice can treat you, are not enrolled in Medicare or Medicaid, are paying for the service yourself, can follow the kit instructions, and agree to receive service texts.

• Payment: you enter your card through Stripe, our payment processor, which stores the saved payment method. We receive limited card details, such as brand, last four digits and expiration date, transaction records and a token used for the charges authorized by the Terms. We do not store full card numbers. If the physician does not order your study or you cancel before it is ordered, we delete the saved payment information and the associated ability to charge that card for the order. This is separate from retaining records of any completed charge, refund or dispute as described in Section 10.

• Waitlist and survey answers, including your interest in heart rhythm monitoring and any information you choose to add. We do not require a payment card to join the waitlist.

• Communications: your texts, emails and support requests, and information you provide on a call. We do not record or transcribe a call, or use an automated tool to summarize it, without telling you beforehand and obtaining any consent required by law.

• Feedback and reviews you choose to submit.

Information collected automatically

• Website data: IP address, browser and device type, pages viewed, time of visit, referring page and cookie identifiers (Section 7). We use the shipping address for delivery-area checks and may use approximate IP location for security and service-area screening. IP location does not establish your actual location for clinical care; you must give the Practice your actual location as required by the Terms.

• Kit and phone data: recording-device identifiers, battery and connection status, timestamps, available wear-status signals, transmission logs and phone-management records (Section 8). During your study, Support may check transmission status during business hours and contact you to restore a connection. This is not review of your heart rhythm. No live or daily rhythm review occurs during wear. Your report uses the complete recording retrieved from the recording device after it is returned; wireless transmissions may be incomplete. The ECG recording is handled for the Practice under Section 2.

• Message delivery data, such as delivery status and read receipts where the communication channel provides them. We do not embed third-party advertising trackers in our messages.

Information from others

• From the Practice: confirmation that the physician ordered or declined your study, scheduling details, and administrative information needed to deliver your report, all received as its business associate.

• From our service providers: shipping and delivery status from the carrier, payment results from Stripe, and delivery status from our messaging provider.We do not buy information about you from data brokers, and we do not collect information about you from social media.

4. How we use information

We use information for the purposes below. For PHI handled for the Practice, every use and disclosure remains limited by HIPAA, the business associate agreement and other applicable law. Any additional consent or authorization required for a use must be obtained separately.

• Serve your order: check administrative eligibility information, pass clinical intake information to the Practice for its eligibility decision, save your card and charge it after the physician orders your study, ship and retrieve the kit, provide technical support, and prepare technical analysis using AccurECG 2.0 and trained cardiac technicians under the Practice’s protocols. Analysis for the report follows completion of the study and retrieval of the recording from the returned device. We support delivery of the report when the Practice releases it and help arrange the included results consultation.

• Communicate with you about your order, kit and study (Section 6).

• Handle payments, refunds, the cancellation fee, the Kit Charge, disputes and chargebacks.

• Keep AccurBeat secure, detect fraud and misuse, and enforce the Terms.

• Improve the service: understand how it is used, fix problems, test changes and train our staff, using only information permitted for those purposes. Where practical, we use de-identified or aggregated information. Identifiable health information is not available for unrelated product development, research or general-purpose AI training merely because we provide the service.

• Meet legal and quality obligations: keep tax and accounting records, handle product complaints and quality records required by medical device regulations, respond to lawful requests, and protect health and safety.

• Send marketing emails when you separately ask to receive them, with an unsubscribe link in every marketing email. We do not use your clinical information or study history to choose marketing content. Advertising audiences are built only from website activity, as described in Section 7.

• Create de-identified data, as described below.

De-identified data. Where our business associate agreement with the Practice and the law allow, we and Inc. create information that meets the applicable de-identification standards, including HIPAA’s standard (45 C.F.R. § 164.514(b)) where applicable. Removing your name or replacing it with a code does not, by itself, make information de-identified. Once properly de-identified, the data is no longer PHI or personal information, and we and Inc. may use and share properly de-identified data to improve the service, develop, train, and validate products, ECG analysis algorithms, and software models, perform analysis and support research. We maintain it in de-identified form, do not try to re-identify it and require recipients to maintain those restrictions.

What we do not do. We do not sell your personal information. We share website activity for advertising only as described in Section 7. We do not share order, clinical or study information with advertisers, ad networks or data brokers, or use clinical information or study history for marketing. Software supports ECG analysis and administrative processing, but the Practice’s physician makes the clinical eligibility decision and interprets and signs the report; software does not replace that clinical judgment.

5. How we share information

We share information only as described below and as permitted by applicable law and the agreements governing it. For PHI, the business associate arrangements and HIPAA continue to control. Required consent or authorization is obtained separately; this list does not authorize an otherwise prohibited disclosure.

• The Practice: your contact and eligibility information, your questionnaire, your recording and its technical analysis, and support history that bears on your care.

• AccurKardia, Inc., our parent company, which supplies AccurECG 2.0 and related technology and services for AccurBeat. Its access is limited to its authorized functions under the applicable intercompany, service and business associate arrangements, and it may receive and use properly de-identified data as described in Section 4.

• Trained cardiac technicians who prepare the technical review under the Practice’s protocols. Access is limited to the assigned work and governed by workforce protections or the applicable service and business associate agreements.

• Wellysis, the recording-device manufacturer, does not receive your study data, and your recording is not sent to the manufacturer or its cloud services. Manufacturer inspection of returned equipment is addressed in Section 8.

• Spruce Health, which provides Direct’s service messaging and handles replies under the applicable service, security and business associate arrangements. The Practice separately controls its own Spruce communications with you.

• Other service providers: payment processing (Stripe), shipping (USPS), email delivery, cloud hosting, support tools, analytics (Section 7) and professional advisers. Each receives only the information needed for its function, with appropriate contractual and legal protections. Some recipients also have independent legal duties, such as financial recordkeeping. Carriers receive contact, delivery and tracking information; we do not put questionnaire answers, ECG recordings or report findings on shipping labels.

• Advertising platforms (such as Meta): website visit events and related identifiers collected by our pixels and tags, as described in Section 7. We do not send order, questionnaire, recording or report information to them.

• Legal and safety purposes: when required or permitted by applicable law and the restrictions governing the information, to respond to valid legal process, report a product-safety issue, protect health or safety, or establish or defend legal rights. A request or subpoena does not by itself override HIPAA or other applicable restrictions; we assess the legal basis and limit the information disclosed.

• At your direction: for example, when you ask us to send an itemized receipt to your flexible spending or health savings account administrator, with any authorization required by law. Sharing your medical record with another clinician is arranged through the Practice.

• Business transfers: information may be transferred in connection with a sale, merger or reorganization only as permitted by law and the agreements governing it, with appropriate confidentiality and security protections. The recipient remains subject to applicable restrictions. We or the recipient provide any required notice and obtain any required consent before materially different uses or disclosures. A transfer does not itself authorize broader use or a prohibited sale of health information.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information you provide to opt in to text messages, including your mobile number, your consent and opt-in records, is used only to send you the texts you asked for and is not shared, sold, rented or disclosed to anyone except as needed to deliver the messaging service or to comply with the law.

6. Texts, emails and calls

• Service texts. At checkout, you authorize automated service texts from Direct about your order, kit and study at the number you provide, as described in the Terms and checkout disclosure. These texts are required when ordering and are the main way we coordinate the study. We use Spruce Health and organizational numbers including (804) 669-9331. Message frequency varies, and message and data rates may apply. Reply STOP to stop or HELP for help, or contact Support. Carriers are not liable for delayed or undelivered messages.

• If you stop texts. Reply STOP or tell Support through another reasonable method that you want texts or automated calls to stop. We honor revocation within applicable legal deadlines and may send one non-promotional confirmation. Opting out does not cancel your study. We use an alternative channel for which we have lawful permission, such as manual calls, email or secure messages. A request directed to the Practice is handled under its own procedures; Support can help you reach it.

• What texts contain. Ordinary texts may not be secure. Direct keeps them to administrative logistics and reminders and does not text you about your report or include detailed findings. The Practice tells you when the report is ready through its own clinical communication channel. Do not send medical details, card information, passwords or security codes in ordinary texts or email.

• The Practice’s messages. The Practice communicates with you about clinical matters through Spruce, its secure messaging app, under its own privacy notice and consents.

• Email. We send order confirmations, shipping and return notices, kit instructions, receipts and support replies by email.

• Marketing. We send marketing emails when you separately ask to receive them, and every marketing email has an unsubscribe link. Marketing texts require a separate opt-in, are never a condition of purchase and may be stopped at any time. A marketing choice does not authorize otherwise prohibited use or disclosure of health information.

• Calls. We call about your order, kit or study, or when you ask us to, using channels for which we have lawful permission. Recording, transcription or automated summaries require advance notice and any consent required by law, as described in Section 3.

• Opting out of marketing does not stop messages we need to send about your order.

7. Cookies, analytics and advertising

• Essential technologies support security and checkout. Blocking them may prevent the affected features from working.

• Analytics. We use first-party and privacy-configured website analytics tools acting solely as our service providers for limited website performance and usage measurement. We configure analytics to exclude health-form entries, clinical records and other sensitive content, disable advertising features, and restrict provider use to the approved functions. Identifiers and retention are limited to what those functions require. Any analytics provider handling PHI must have the applicable business associate arrangement and lawful permission.

• Advertising. We may advertise AccurBeat on search and social platforms. We deploy advertising pixels, social-media trackers and retargeting tags on the AccurBeat website, and send visit events through advertising conversion interfaces. We do not currently send waitlist or inquiry events to advertising platforms; if we begin to, we will update this notice first. We do not place pixels or tags on checkout or order-confirmation pages, and we do not send order, questionnaire, recording or report information to advertising platforms. We measure campaigns using aggregate reports and reviewed internal methods.

• Your controls: use Cookie Settings on the AccurBeat website to turn off advertising pixels and tags and other non-essential technologies, or contact Support for help. Where law requires, we honor a recognized opt-out preference signal, including Global Privacy Control, for sale, sharing and targeted advertising. We apply the signal to the browser or device as required by law.

• Do Not Track. Because there is no common standard for “Do Not Track” signals, we do not respond to them. We do honor the Global Privacy Control signal as described above.

8. The phone and recording device we lend you

• The supplied phone is configured for the study. Device-management tools use status and management logs to restrict applications, support operation, apply updates and, where supported and appropriate, remotely lock or erase the phone. Routine erasure follows retrieval and preservation of information needed for your study and required records. We may take protective steps if a phone is lost or compromised. These functions do not provide clinical monitoring.

• Do not use the phone for personal purposes or sign in to personal accounts on it. Anything you add may be erased without notice when the phone comes back to us, and we do not back it up or return it.

• The recording device holds the complete ECG recording used for your report until we retrieve it after return. We preserve required study and clinical information on authorized systems before routine equipment erasure. We securely clear devices before reuse. Before manufacturer inspection, we remove patient data where feasible. If a damaged device cannot be cleared, we restrict access and any necessary repair disclosure under appropriate legal and contractual protections. Device erasure does not erase clinical records that must be retained.

• If a recording device or phone is lost or stolen, tell Support promptly so we can take available protective steps. Remote locking or erasure may not be available for the recorder or for a phone that is offline, so we cannot guarantee that a lost device can be disabled remotely.

9. How we protect information

• Safeguards. We maintain reasonable administrative, technical and physical safeguards appropriate to the information and our legal obligations, including access restrictions, workforce training, security procedures and contractual protections. Where we act as a business associate or subcontractor, we comply with the applicable HIPAA safeguards and agreements. We assess security risks and review our protections as the service and risks change. Ordinary texts and email are not made secure clinical channels by this notice.

• If something goes wrong. When an incident triggers a legal notification obligation, we notify the Practice, affected individuals, regulators and others as required for the information and our role. For PHI handled for the Practice, we report incidents to it and cooperate in required notifications while meeting our own duties. Applicable requirements may include HIPAA, the FTC Health Breach Notification Rule and New York’s security and breach-notification laws.

• No method of storage or transmission is perfectly secure. Tell us at once if you suspect misuse. We will never ask you for a password or one-time security code by text or email.

10. How long we keep information

We retain personal information only as long as reasonably necessary and permitted for the stated purposes. The periods below describe our retention criteria and general limits; they do not require us to retain every field for the full period. Shorter legal limits, valid deletion requests and the special rules for information handled for the Practice take priority.

• Contact information: Up to 5 years after your last order, only as needed for support, security or legal purposes. We delete earlier when appropriate or required.
• Payment information: The saved card remains available only while needed for charges authorized by the Terms and resolution of related matters. If no study is ordered or you cancel before ordering, we delete the saved payment information. After the authorized charge and return matters are resolved, we remove the saved charging credentials; necessary transaction records are retained separately.
• Order, payment, refund and Kit Charge records: Up to 10 years after the order, limited to records reasonably needed for tax, accounting, audit or legal purposes. We remove unnecessary personal detail earlier and apply shorter limits where required.
• Medical information we hold for the Practice: As required by applicable law and the Practice’s instructions under the business associate agreement. On termination, we return or destroy PHI where feasible. Information that must be retained or cannot feasibly be returned or destroyed stays protected, with further use limited to the purposes requiring retention.
• Support communications and text and email logs: Up to 5 years after the last relevant interaction, only as needed for support, security, quality or legal purposes. PHI handled for the Practice follows the medical-information rule above.
• Text opt-in and opt-out records: Consent and revocation evidence for up to 5 years after the last message or relevant revocation. We keep minimal suppression information as long as needed to honor an opt-out and applicable legal duties.
• Waitlist and survey data: Until the stated purpose is complete, and generally no longer than 24 months after your last interaction unless you renew the request. If you order, only information needed for the order or another lawful purpose moves into the applicable record category.
• Website logs and analytics: Up to 24 months after collection, only as needed for security or the disclosed measurement purposes. We delete or de-identify information earlier when the purpose no longer requires identifiable records.
• Quality and complaint records required by medical device regulations: As those regulations require.
• De-identified data: No fixed period while useful for the purposes in Section 4 and maintained in properly de-identified form.

We may retain information longer where a specific legal obligation or legal hold requires it, with use restricted accordingly. Deleted information may remain in restricted backups until removed through scheduled deletion cycles, subject to applicable deadlines. Backup retention does not authorize ordinary reuse of deleted information, and restored data remains subject to applicable deletion and suppression requirements.

11. Your choices and rights

• Access, correction and deletion. You can ask us to confirm whether we process your personal information, provide access and a portable copy, correct it or delete it. Email complaints@accurbeat.com, write to Section 15’s address or ask Support to route your request. We verify identity when required or appropriate, using only reasonably necessary information, and do not require an account to submit a request. We respond within 45 calendar days after receipt, or sooner where law requires. Any legally permitted extension is explained within the initial response period. We explain denials and applicable exceptions. Requests for the Practice’s medical record follow the separate rules below.

• Your medical record. Request access, copies, amendment or an accounting of disclosures through the Practice’s Spruce channel or its privacy contact. We promptly route requests we receive and assist as required by law and our agreements. HIPAA access requests are generally acted on within 30 calendar days, with one further 30-day extension only when the required written notice is given. Shorter applicable deadlines control; amendment and accounting requests follow their own rules. Deleting information we hold does not delete clinical records that must lawfully be retained.

• Marketing and texts. Use the unsubscribe link in any marketing email, reply STOP to any text, or contact us.

• Cookies and advertising. See Section 7.

• Authorized agents. You may authorize another person to make a request where permitted by law. We may request appropriate proof of authority and identity verification, except where the applicable right does not permit those requirements.

• No retaliation. We do not unlawfully deny service, change prices or provide a different level of service because you exercise a privacy right. If deleting information or withdrawing a necessary permission affects our ability to complete a requested service, we explain the specific effect and the applicable options under the Terms.

• Appeals. If we decline a request, you may ask us to reconsider by contacting complaints@accurbeat.com and identifying the request and why you disagree. We respond in writing within 45 calendar days after receipt, or sooner where law requires, explain our decision and provide the appropriate regulator’s contact information if we deny the appeal.

• State-specific rights. Depending on applicable law and our role, you may have additional rights to information about recipients, withdrawal of consent, deletion of consumer health data, limits on specified uses of sensitive information, and opt-outs from sale, sharing, targeted advertising or certain profiling. Use the contacts above to exercise a right. We do not sell personal information. We share website visit activity for cross-context behavioral advertising and targeted advertising, as those terms are defined by applicable law and described in Section 7; you can opt out using Cookie Settings (Section 7) or the contacts above. California residents: we do not disclose personal information to third parties for their direct marketing purposes under California Civil Code section 1798.83. See Section 7 for browser signals.

• Complaints. You may complain to us or contact a regulator directly; you do not have to complain to us first. Relevant authorities include the Federal Trade Commission (reportfraud.ftc.gov), the New York Attorney General (ag.ny.gov) and, for HIPAA-covered handling by the Practice or its business associates, the U.S. Department of Health and Human Services Office for Civil Rights (hhs.gov/ocr).

12. Where information is stored and who may access it from abroad

Our systems and service providers store information on servers located in the United States. Authorized personnel and service providers (such as trained cardiac technicians and technical support personnel) may remotely access information from outside the United States, including India and the United Kingdom, through secure, access-controlled environments. We limit access to assigned functions, implement technical controls designed to prevent unauthorized local downloading or retention outside our authorized systems, and require appropriate confidentiality, security and business associate arrangements. Processing must comply with applicable law and, for Practice information, the agreements governing that information. Any separate permission required by law is obtained separately.

13. Children

The AccurBeat clinical service is available only to adults aged 22 and older. Our website, waitlist and service are not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided information, contact us. We investigate and take the steps required by law, including deletion where appropriate. Clinical records that the Practice must retain remain subject to applicable recordkeeping and privacy requirements.

14. Changes to this notice

We may update this notice by posting a new effective date and version number, and we keep earlier versions available on request. Before a material change in how we use information already collected, we provide appropriate advance notice, including email where we have your address, and obtain any consent required by law before the new use begins. A notice update does not override existing legal or contractual restrictions or retroactively authorize a prohibited disclosure.

15. How to contact us

• Privacy questions and requests: complaints@accurbeat.com, or AccurKardia Direct, LLC, Attention: Privacy, 101 Avenue of the Americas, Suite 931, New York, New York 10013. You may also ask Support to route a privacy request.

• Order, kit and billing support: AccurBeat Support by text or telephone at (804) 669-9331 or email support@accurbeat.com, Monday through Friday, 9:00 a.m. to 5:00 p.m. Eastern Time, excluding U.S. federal holidays.

• Your medical record and clinical questions: contact the Practice through Spruce, its secure messaging app, Monday through Friday, 8:00 a.m. to 6:00 p.m. Eastern Time, or ask Support to help you reach it. The Practice can provide its privacy contact and Notice of Privacy Practices.

• In an emergency: call 911.