Privacy Policy

PickUp Health, Inc. ("PickUp Health," "we," "us," or "our") provides patient communication services to physician practices and other healthcare organizations. On their behalf, we communicate with patients and caregivers by telephone and text message, using automated and AI-assisted tools overseen by trained personnel, and we route what we learn to the patient's care team.

This Privacy Policy explains how we process personal information when you (i) visit or use any website we own or operate that links to this Privacy Policy (each, a "Site"); (ii) call or text a PickUp Health telephone number, or receive a call or text from us on behalf of your healthcare provider; or (iii) otherwise contact or engage with us. The Site and the services we provide through it are together the "Service."

By accessing or using the Service, or otherwise providing us with personal information, you acknowledge this Privacy Policy and our Terms of Service. Unless otherwise defined in this Privacy Policy, capitalized terms have the meanings given in our Terms of Service.

Health Information

When we create, receive, maintain, or transmit protected health information ("PHI") for a physician practice or other healthcare organization, we do so as that organization's business associate under the Health Insurance Portability and Accountability Act of 1996 and its regulations ("HIPAA"), under a written business associate agreement.

That organization's Notice of Privacy Practices describes how your PHI may be used and disclosed and the rights you have over it. We use and disclose PHI only as our business associate agreement and HIPAA permit. Where this Privacy Policy and HIPAA or a business associate agreement differ as to PHI, HIPAA and the business associate agreement control.

To exercise your rights over PHI, such as access to or amendment of your records, please contact your healthcare provider. If you contact us, we will forward your request to them.

1. Definitions

1.1. Personal Information. For purposes of this Privacy Policy, "personal information" or "personal data" means any information that, alone or in conjunction with other information or data, identifies or is linked to a particular individual or household and that is subject to, or otherwise afforded protection under, a data protection law, statute, or regulation. It does not include de-identified data that is not attributable to a particular individual or household and that is not otherwise subject to a data protection law, statute, or regulation.

1.2. De-identified Data. PickUp Health may de-identify personal information. We create de-identified data from PHI only by a method HIPAA permits and only as our agreements with healthcare organizations allow. We do not attempt to re-identify de-identified data, and we do not sell or license it as a standalone data product.

2. Information Collection and Use

We collect several different types of information to provide and improve our Service, to comply with our legal obligations, and for the other reasons set forth in this Privacy Policy. When you do not provide personal information, we may not be able to provide you the Service or complete a request you made.

3. Types of Data Collected

3.1. Personal Identifiers. When a healthcare organization enrolls you, or when you register for an account on our Service, we may receive or ask for personal identifiers, which may include:

• First name and last name

• Telephone number

• Email address

• Mailing address

• Date of birth

If you are a patient, your healthcare provider may also share information about your care with us, such as conditions, medications, care plans, recent visits, and upcoming appointments. That information is PHI and is handled as described under Health Information above.

3.2. Communications Content and Recordings. When you call or text a PickUp Health telephone number, we collect and store your telephone number, the content of your conversation or messages, and our responses. Calls may be recorded and transcribed. When you are interacting with an automated or AI system, we tell you so, and we tell you when a call may be recorded.

We use recordings, transcripts, and messages to provide the Service to your healthcare provider, including to summarize conversations, route requests and concerns to your care team, and prepare documentation that trained personnel review. We do not create voiceprints to identify or authenticate you.

We also keep records of our communications with the staff of the healthcare organizations we serve, including support requests.

3.3. Usage Data. When you access and use the Site, we automatically collect details of your access to and use of the Site, including traffic data, usage logs, and the resources that you access and use on or through the Site. This usage data may include your computer's Internet Protocol (IP) address, browser type and version, the pages of our Site that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data. When you access the Site through a mobile device, we may collect information about your device, such as its type, operating system, IP address, and browser type.

4. Tracking and Cookies Data

The Site uses only those cookies and similar technologies, if any, that it needs to work. We do not use third-party advertising, analytics, or marketing pixels or similar tracking technologies on the Site.

Cookies are files with a small amount of data, which may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. If you do not accept cookies, some portions of the Site may not work.

5. Sources of Information

We collect personal information from the following sources:

5.1. Directly from You. We collect personal information directly from you when you call or text a PickUp Health telephone number, register for an account, submit a form on the Site, or otherwise contact us.

5.2. From Healthcare Organizations. Healthcare organizations that use the Service provide us with information about their patients and staff so that we can provide the Service to them.

5.3. Automated Collection. As described above, we collect usage data and cookie data through automated means when you use the Site.

5.4. Service Providers and Other Third Parties. We receive information from service providers that help us operate the Service, such as telecommunications carriers (call and message delivery data). Where a healthcare organization directs it, we may also receive information from health information exchanges and similar health data services. For business contacts, we may use publicly available sources.

6. Use of Personal Data

PickUp Health uses personal information to:

• Provide the Service to healthcare organizations under our agreements with them

• Enable patients and caregivers to communicate with their care team by voice and text

• Route requests, concerns, and information to the patient's care team

• Prepare summaries and documentation for review by trained personnel and by the patient's healthcare provider

• Schedule appointments and send appointment reminders

• Provide customer support to the healthcare organizations we serve

• Notify you about changes to our Service

• Monitor the quality and safety of the Service, including review of interactions by trained personnel

• Detect, prevent, and address technical and security issues

• Comply with legal obligations

• Carry out any other purpose for which we obtain your consent, as the law permits

We may use de-identified data to improve the Service, including our AI systems, as our agreements with healthcare organizations allow. We do not train AI systems on identifiable patient information. We do not use recordings of patients' voices to train AI systems unless the healthcare organization has authorized it and the law permits it.

We call and text patients only about their care and only as permitted by law, including the consent requirements that apply to automated calls and texts. We do not send marketing or promotional messages to patients. Section 7 describes our text messaging practices.

7. Text Messages and Mobile Information

We send text messages on behalf of healthcare organizations that use the Service, to patients and caregivers who have agreed to receive them. Most messages are sent in the healthcare organization's name, and its own text messaging terms and privacy policy also apply. We may send service messages, such as enrollment confirmations, in our own name.

How you opt in: (a) when your healthcare provider enrolls you, you give the provider your mobile number and agree, on a written or electronic consent form, to receive care-related text messages from the provider, sent through PickUp Health; or (b) you text the number your provider gave you and reply YES when we ask you to confirm. Our first message confirms your enrollment and tells you how to get help and how to opt out. Our Text Messaging Terms show the consent language and sample messages.

• Message frequency varies with your care.

• Message and data rates may apply.

• Reply STOP to any message to opt out. You will receive one message confirming your opt-out.

• Reply HELP to any message for help, or contact us at support@pickuphealth.ai.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support of services, such as customer service and message delivery, is permitted. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Our Text Messaging Terms, which form part of our Terms of Service, describe the program in full.

8. Transfer of Data

We store personal information, including PHI, in the United States. Some of our personnel and service providers may access personal information from outside the United States, as permitted by our agreements with healthcare organizations. When they do, we apply contractual and technical safeguards.

If you are located outside the United States and choose to provide information to us, you acknowledge that your personal information will be transferred to, and stored in, the United States, where data protection laws may differ from those in your jurisdiction.

9. Data Retention

We retain personal information for as long as needed to provide the Service, to meet our obligations to the healthcare organizations we serve, to comply with our legal obligations (including medical record and billing documentation retention requirements), and to defend our legal interests.

Call recordings, messages, service notes, and related communication records are retained for the period that our agreements with healthcare organizations and the law require. In all other cases, we retain personal information for as long as needed to fulfill the purposes described in this Privacy Policy.

10. Disclosure of Data

We do not sell personal information. We share personal information only as described below, and we share PHI only as HIPAA and our business associate agreements permit. We do not share personal information, including voice recordings, with third parties that we have reason to believe use it for their own direct marketing purposes.

10.1. With Your Healthcare Provider. We share information from your calls and messages, and documentation we prepare, with the healthcare organization that enrolled you, so that your care team can act on it.

10.2. Service Providers. We share personal information with companies that provide services on our behalf, such as cloud hosting, telecommunications and messaging, AI processing, customer support, and analysis that improves the quality of our Service. Service providers that handle PHI do so under business associate agreements.

10.3. Disclosure for Law Enforcement. PickUp Health may be required to disclose personal data if required to do so by law or in response to valid requests by public authorities (for example, a court or a government agency).

10.4. Legal Requirements. PickUp Health may disclose personal data in the good faith belief that such action is necessary to:

• Comply with a legal obligation

• Protect and defend the rights or property of PickUp Health

• Prevent or investigate possible wrongdoing in connection with the Service

• Protect the personal safety of users of the Service or the public

• Protect against legal liability

10.5. Payments. Payments by the healthcare organizations we serve may be processed by a third-party payment processor. PickUp Health does not store full payment card information. Information provided to a payment processor is subject to its privacy policy and terms of use.

10.6. Business Restructuring. If PickUp Health decides to sell, buy, divest, merge, or otherwise reorganize its businesses, we may disclose personal information to the extent reasonably necessary to negotiate or complete the transaction. Any transfer of PHI will comply with HIPAA and our business associate agreements.

10.7. Consent. We may also disclose personal information that is not PHI with your consent. Disclosures of PHI that require your authorization under HIPAA are made only with that authorization.

11. Security of Data

We store personal information, including recordings, with cloud infrastructure providers that have signed business associate agreements with us.

We maintain a written information security program designed to meet the HIPAA Security Rule, including encryption of PHI in transit and at rest, access controls and multi-factor authentication for systems containing PHI, workforce training, and periodic risk analysis. No method of transmission over the Internet or of electronic storage is 100% secure, and we cannot guarantee absolute security.

12. U.S. State Privacy Rights

Pursuant to California's "Shine the Light" law, California residents who provide personal information to obtain products or services for personal, family, or household use may request, once a calendar year, information about the personal information we shared, if any, with other businesses for their own marketing uses. PickUp Health does not share personal information with third parties that we know or have reason to believe use it for independent direct marketing.

Health information we handle under HIPAA is generally exempt from U.S. state consumer privacy laws. If a state privacy law gives you rights over other personal information we hold about you, you may exercise them, and ask any questions about our data processing, by contacting us as described in Section 19.

13. Marketing Preferences

We may send marketing emails to business contacts at healthcare organizations. You may opt out at any time by using the "unsubscribe" link in our emails or by contacting us as described in Section 19. We do not send marketing to patients.

14. Sale of Personal Information

PickUp Health does not sell personal information to third parties for monetary or other valuable consideration. Nevada residents may submit a request directing us not to sell personal information we maintain about them by contacting us as described in Section 19.

15. "Do Not Track" Signals

Some web browsers transmit "do-not-track" signals. Because browsers incorporate and activate this feature differently, it is not always clear whether users intend these signals to be transmitted. Unless otherwise required by law, we do not currently act on these signals.

16. Links to Other Sites

Our Site may contain links to sites that we do not operate. If you click a third-party link, you will be directed to that third party's site. This Privacy Policy does not apply to third-party websites, and we advise you to review their privacy policies.

17. Children

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the Site. If you are a parent or guardian and believe your child has provided us with personal information through the Site, please contact us as described in Section 19. If a healthcare organization enrolls a patient under 18, communications take place as that organization directs and the law permits, and the information is PHI handled as described under Health Information.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version and change the effective date above. We may also notify you of material changes by email or text message. You should review this Privacy Policy periodically.

19. Contact Information

If you have questions about this Privacy Policy or our handling of your personal information, or would like to exercise a data privacy right, please contact us at:

PickUp Health, Inc.

privacy@pickuphealth.ai