Privacy Policy

Welcome to the VascAI AI Companion, a patient support tool that helps patients and the people who care for them understand and act on the recommendations they receive from their healthcare providers. This Privacy Notice explains how VascAI, Inc. ("VascAI," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal data in connection with its platform, https://www.vascai.com, the patient portal at https://patient.vascai.com, the AI Companion mobile app, as well as any specific product, service, or application that references or links to this Privacy Notice (the "Services"). We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.

This Privacy Notice does not address our privacy practices relating to VascAI job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.

This Privacy Notice covers the AI Companion and the other consumer-facing Services described above. If your provider, clinic, community-based organization, or health plan uses VascAI products in connection with your care, their handling of your information is described in their own privacy notices and, where applicable, is governed by their agreements with us.

Your health information, recordings, transcripts, notes, and summaries are never sold and are never used for advertising. Certain device and browsing information collected on our public marketing website is shared with advertising partners, which may be considered a "sale" or "sharing" under some state privacy laws. See the Targeted Advertising Preferences section below and the Additional United States Privacy Disclosures for details and for how to opt out.

Our Collection and Use of Personal Data

The categories of personal data we collect depend on how you interact with us and our Services. For example, you may provide us your personal data directly when you create an account, record an appointment, share a summary with someone who helps with your care, respond to a survey, or otherwise contact us or interact with us.

We also collect personal data automatically when you interact with our Services and may also collect personal data from other sources and third parties.

Personal Data Provided by Individuals

We collect the following categories of personal data individuals provide us:

• ‍Contact Information, including first and last name, phone number, email address, preferred language, and communication preferences. We use this information primarily to fulfill your request, to communicate with you directly, and to send you communications in accordance with your preferences.
• ‍Account Information, including first and last name, email address, phone number, state of residence, preferred language, profile picture, account credentials or one-time passcodes, and the Services you have used. We use this information primarily to administer your account, provide you with our Services, communicate with you regarding your account and your use of our Services, and for customer support purposes.
• ‍Customer Content, including any files, documents, audio, notes, images, data, or communications you choose to input, upload, or transmit to our Services. We use this content primarily to provide you with our Services, to facilitate your requests, and to improve our Services.Health Information,
• Health Information, such as audio recordings and transcripts of your appointments with your healthcare professionals, the summaries and next steps the AI Companion generates from them, medications, conditions, and any other health-related information you provide to us. We use this information to provide you with our Services.Survey and Research Information,
• Survey and Research Information, including information you provide when you complete a survey, submit a testimonial, or participate in a product research session. We use this information primarily to respond to your submission, communicate with you, conduct research, and improve our Services.Feedback and Support Information,
• Feedback and Support Information, including the contents of messages sent through email addresses or other contact information we make available, as well as recordings of calls with us, where permitted by law. We use this information primarily to investigate and respond to your inquiries, to communicate with you via email, phone, text message, or in-app chat, and to improve our Services.

If you choose to contact us, we may need additional information to fulfill the request or respond to your inquiry. We may provide additional privacy disclosures where the scope of the request we receive or personal data we require fall outside the scope of this Privacy Notice. In that case, the additional privacy disclosures will govern how we may process the information you provide at that time.

• ‍Information About Your Device and Network, including the device type, manufacturer, and model, operating system, IP address, browser type, Internet service provider, app version, and unique identifiers associated with you, your device, or your network. We use this information so that the Services work reliably and remain secure.
• Information About the Way Individuals Use Our Services and Interact With Us, including how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, which features you use, and other actions you take within the Services. We use this information to operate, troubleshoot, secure, and improve the Services.
• Information About Your Location, including general geographic location that we or our third-party providers may derive from your IP address, as well as more precise geolocation only when you grant us access through your device settings.

Recording and Consent

Recording only starts when you turn it on, and you can pause, stop, review, and delete a recording at any time. Because a recording captures the voices of everyone present, the law in California and certain other states requires that everyone being recorded consent before recording begins.

Please ask before you record. Let your provider and anyone else present know that you plan to use the AI Companion, and obtain their agreement before you start. If someone does not want to be recorded, do not record. The app prompts you to confirm consent before each recording. You are responsible for obtaining the consent of others present.

Personal Data Automatically Collected

We, and our third-party partners, automatically collect information about how you access and use our Services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal data we collect directly from you or receive from other sources.

• ‍Single Sign-On: We may provide you the ability to log in to our Services through certain third-party accounts you maintain. When you use these single sign-on protocols, we do not receive your login credentials for the relevant third-party service. Instead, we receive tokens that help identify you in our system and confirm you successfully authenticated.Mobile Sign-On:
• Mobile Sign-On: We may provide you the ability to authenticate yourself using facial, fingerprint, or other biometric recognition technology available through your mobile device. We do not store or have access to this biometric information. Your mobile device performs the authentication and only tells us whether it succeeded.From Members of Your Care Team:
• From Members of Your Care Team: As part of our Services, we provide you with the opportunity to share summaries and notes with a care team, which may include a community health worker, a provider, a family member, or another person who helps with your care. If you choose to share with other users of our Services, we may receive personal data about you from them.From Your Provider or Health Plan,
• From Your Provider or Health Plan, where you have asked us to connect your AI Companion account to a clinic, community-based organization, or health plan that uses VascAI products, and only to the extent you have authorized that connection.Advertisers, Influencers, and Publishers:
• Advertisers, Influencers, and Publishers: We engage in advertising both on our Services and through third-party services. Advertisers, influencers, and publishers may share personal data with us in connection with our advertising efforts. For example, we may obtain information about whether an advertisement led to a successful engagement between you and a third party. This does not include Health Information.Business Partners:
• Business Partners: We may receive your information from our business partners, such as companies that offer their products or services as part of or in connection with our Services. For example, certain of our Services allow you to integrate third-party services such as Apple HealthKit. If you choose to use these integrations, we may receive information from that partner.Service Providers:
• Service Providers: Our service providers that perform services on our behalf collect personal data and often share some or all of this information with us. For example, we receive personal data you may submit in response to requests for feedback to our survey providers.Other Sources:
• Other Sources: We may also collect personal data about you from other sources, including publicly available sources, or through transactions such as mergers and acquisitions.
• ‍Inferences: We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you. We do not generate inferences from Health Information for advertising purposes.

Website Analytics Information, collected by analytics and tag management services we use on our public marketing website (https://www.vascai.com and its subpages, excluding https://patient.vascai.com and any account, intake, visit, care team, or other authenticated pages where Health Information is submitted). Specifically, we use Google Analytics and Google Tag Manager, services provided by Google LLC, to measure and understand how visitors interact with our marketing website and to load and manage measurement tags. Information collected through these services includes IP address (which we have configured to be truncated prior to storage), device and browser metadata, referring URL, pages viewed, links clicked, time spent on pages, and approximate geographic location derived from IP address. We have enabled IP anonymization and have disabled the features that share data with other products for advertising purposes.

We do not use automatic data collection technologies on https://patient.vascai.com, on other authenticated pages, or within the AI Companion app to build advertising profiles or to deliver targeted advertising. Google’s use of information collected on our marketing website is also governed by Google’s privacy policy, available at https://policies.google.com/privacy. For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the Your Privacy Choices section below.

Personal Data from Other Sources and Third Parties

We may receive the same categories of personal data as described above from the following sources and other parties:

Additional Uses of Personal Data

In addition to the primary purposes for using personal data described above, we may also use personal data we collect to:

• Fulfill or meet the reason the information was provided, such as to fulfill our contractual obligations or to deliver the Services requested;
• Manage our organization and its day-to-day operations;
• Communicate with you, including via email, text message, in-app chat, and telephone;
• Facilitate the relationship we have with you;
• Request you provide us feedback about our Services;
• Address inquiries or complaints made by or about an individual in connection with our Services;
• Create and maintain accounts for our users;
• Verify your identity and entitlement to our Services;
• Market our Services, including through email, phone, text message, push notification, and social media;
• Provide custom, personalized content and information on our marketing website, including targeted content and advertising, and identify you across multiple devices;
• Administer, improve, and personalize our Services, including by recognizing you and remembering your information when you return to our Services;
• Develop, operate, improve, maintain, protect, and provide the features and functionality of our Services;
• Generate transcripts, summaries, next steps, and other AI-assisted outputs from your audio recordings and submitted health information, using third-party AI service providers as described in the "Our Disclosure of Personal Data" section;
• Identify and analyze how you use our Services;
• Create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice;
• Conduct research and analytics on our user base and our Services;
• Test, enhance, update, and monitor the Services, or diagnose or fix technology problems;
• Help maintain and enhance the safety, security, and integrity of our property, Services, technology, assets, and business;
• Defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Service), as well as to resolve disputes and to protect the interests and rights of third parties;
• Detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity;
• Facilitate business transactions and reorganizations impacting the structure of our business;
• Comply with contractual and legal obligations and requirements;
• Fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.

We do not use recordings, transcripts, or notes that identify you to train our own AI models, and we do not permit our AI service providers to use them to train their general-purpose models. We use paid, enterprise API tiers that are contractually configured so that your data is not used to train the providers’ general-purpose models. Where we conduct model development or evaluation work of our own, we use de-identified or aggregated data, or data you have separately and expressly permitted us to use.

Our Disclosure of Personal Data

We disclose or otherwise make available personal data in the following ways:

• ‍To Your Care Team: As part of our Services, you may choose to share summaries, next steps, and notes with a care team, which may include a community health worker, a provider, a family member, or another person who helps with your care. We disclose the Contact Information, Customer Content, and Health Information that you select, and only to the people you select. You can stop sharing at any time.To Other Customers and the General Public:
• To Other Customers and the General Public: If you interact with us on social media, or post a review, that information will be available to other members of the public interacting with us on those same platforms, based on the applicable privacy settings and intended recipients. Individuals who view content can reshare or redistribute it both on and off the platform.To Service Providers:
• To Service Providers: We engage other third parties to perform certain services on our behalf in connection with the uses of personal data described above. These providers may process personal data on our behalf or have access to personal data while performing services for us, under contracts that require them to protect it and to use it only to provide their service to us. Our service providers include, without limitation, Microsoft Corporation, which provides the Microsoft Azure cloud infrastructure on which the Services are hosted, and Google LLC, which provides Google Analytics and Google Tag Manager on our public marketing website.To Third-Party AI Service Providers:
• To Third-Party AI Service Providers: We use third-party artificial intelligence service providers to power transcription, summarization, and content-generation features within the Services. Specifically, audio recordings are sent to Microsoft Corporation (Azure AI Speech) for automated speech recognition, and the resulting transcripts, together with related health information you submit, are sent to Microsoft Corporation (Azure OpenAI Service), Google LLC (paid Gemini API), and Anthropic PBC (paid Claude API) for summarization, next-step generation, and other AI-assisted outputs. We use paid, enterprise API tiers in each case. These providers are contractually bound to: (i) use your data only to provide these services to VascAI; (ii) maintain confidentiality and security protections at least equivalent to those described in this Privacy Notice; and (iii) not use your data to train their general-purpose AI models.To Marketing Providers:
• To Marketing Providers: We coordinate and share personal data with our marketing providers in order to advertise and communicate with you about Services we make available. We do not share Health Information with marketing providers.To Ad Networks and Advertising Partners:
• To Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our public marketing website, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our marketing website through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. We do not disclose Health Information, recordings, transcripts, notes, or summaries to ad networks or advertising partners, and these technologies are not used on https://patient.vascai.com or within the AI Companion app.To Business Partners:
• To Business Partners: We may share personal data with our business partners, or we may allow our business partners to collect personal data directly from you in connection with our Services. Our business partners may use your personal data for their own business and commercial purposes.To Other Businesses as Needed to Provide Services:
• To Other Businesses as Needed to Provide Services: We may share personal data with third parties you engage with through our Services or as needed to fulfill a request or transaction.In Connection with a Business Transaction or Reorganization:
• In Connection with a Business Transaction or Reorganization: We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a transaction. In the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.To Facilitate Legal Obligations and Rights:
• To Facilitate Legal Obligations and Rights: We may disclose personal data to third parties, such as legal advisors and law enforcement:
  • in connection with the establishment, exercise, or defense of legal claims;
  • to comply with laws or to respond to lawful requests and legal process;
  • to protect our rights and property and the rights and property of our agents, customers, and others, including to enforce our agreements, policies, and terms of use;
  • to detect, suppress, or prevent fraud;
  • to protect the health and safety of us, our customers, or any person; or
  • as otherwise required by applicable law.
• ‍With Your Consent or Direction: We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites. We may also provide you with the option to share visit summaries with individuals of your choice who are not VascAIusers. Once the information has been shared at your direction, the information is no longer subject to this Privacy Notice.

• ‍Email Communication Preferences: You can stop receiving promotional email communications from us by clicking on the "unsubscribe" link provided in any of our email communications. Please note you cannot opt out of service-related email communications (such as account verification or service update emails).Phone and Text Preferences:
• Phone and Text Preferences: You can stop receiving promotional phone communications by informing the caller you no longer wish to receive them, or by replying STOP to any of our promotional text messages. We may need to continue to communicate with you by phone or text for certain service-related messages, such as sending a verification code.Push Notification Preferences:
• Push Notification Preferences: You can stop receiving push notifications from us by changing your preferences in your device’s notification settings menu or in the app. We do not have control over your device’s notification settings.Direct Mailing Preferences:
• Direct Mailing Preferences: You can stop receiving promotional direct mail communications from us by contacting us at privacy@vascai.com.

We do not sell or share your Health recordings, transcripts, notes, or summaries, and we never use them for advertising. Our disclosures of device and browsing information to ad networks and advertising partners may qualify as a "sale" or "sharing" of personal data under certain state privacy laws. See Targeted Advertising Preferences below for how to opt out.

• ‍Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information.Digital Advertising Alliance:
• Digital Advertising Alliance: The Digital Advertising Alliance allows individuals to opt out of receiving online interest-based targeted advertisements from participating companies. Please follow the instructions at https://optout.aboutads.info/?c=2&lang=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising.Network Advertising Initiative:
• Network Advertising Initiative: The Network Advertising Initiative similarly allows individuals to opt out of receiving online interest-based targeted advertisements from participating companies. Please follow the instructions at https://optout.networkadvertising.org/?c=1.Platform-Specific Opt-Out Programs:
• Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform. Please refer to your platform provider’s user guides for additional information.

Your Privacy Choices

The following privacy choices are made available to all individuals with whom we interact. You may also have additional choices regarding your personal data depending on your location or residency. Please refer to our Region-Specific Disclosures below for information about additional privacy choices that may be available to you.

• Turn recording on or off, and pause or stop a recording at any time.
• Review, download, or delete your recordings, transcripts, summaries, and notes.
• Choose what to share with your care team, and stop sharing later.
• Update your account details, or close your account entirely.

Your Controls in the AI Companion

You are in charge of your information. In the app you can:

We keep your recordings, transcripts, notes, and summaries for as long as you have an account, unless you ask us to delete them. If you delete a recording or note, we remove it from your account right away and delete it from our systems within 90 days. If you close your account, we delete or de-identify your information within 90 days. In both cases we keep only what we must keep by law.

Communication Preferences

Withdrawing Your Consent

Where we have your consent for the processing of your personal data, including your consent to record an appointment or to process health information, you may withdraw your consent by stopping recording in the app, deleting the relevant content, or contacting us as set forth in the Contact Us section below.

Automatic Data Collection Preferences

Where a VascAI-specific preference manager or privacy setting is not available, you may be able to use third-party tools and features to further restrict our use of automatic data collection technologies. For example, most browsers allow you to change browser settings to limit automatic data collection technologies on websites, most email providers allow you to prevent the automatic downloading of images in emails, and many devices allow you to change your device settings to limit automatic data collection technologies for device applications.

Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our Services. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.

Targeted Advertising Preferences

We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests, developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for these purposes are primarily collected through automatic data collection technologies on our public marketing website, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our partners collect to the same person.

Health Information, recordings, transcripts, notes, and summaries are excluded from all of this. They are never used for advertising and are never shared with advertising partners.

In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to exercise further control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:

Please note that when you opt out of receiving interest-based advertisements through one of these programs, it does not mean you will no longer see advertisements from us. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs.

Modifying or Deleting Your Personal Data

You can review, correct, and delete most of your personal data directly in the app. If you have any questions about reviewing, modifying, or deleting your personal data, you can contact us directly at privacy@vascai.com. We may not be able to modify or delete your personal data in all circumstances, for example where we are required to retain it by law.

Partner-Specific Preferences

The device or platform you use to interact with us may provide you additional choices regarding the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our Services from accessing certain types of information from your device, such as your microphone, contact lists, or precise geolocation data. Please refer to your device or platform provider’s user guides for additional information.

Minors and Parental Use

Accounts on the AI Companion are for individuals 18 years of age and older. Individuals under the age of 18 may not create their own account or otherwise provide us with personal data directly.

A parent or legal guardian who is 18 or older may create and control an account and use the AI Companion in connection with the care of a minor for whom they are responsible. In that case, the parent or guardian holds the account, is responsible for the information entered into it, and is responsible for obtaining any consent required to record an appointment, including the consent of the minor where required. Information about the minor is treated as Health Information under this Privacy Notice and receives the same protections. The parent or guardian may review, correct, download, and delete that information using the controls described in Your Privacy Choices.

We do not knowingly collect or solicit personal data directly from children under the age of 18 outside of this parental or guardian arrangement, and we do not sell or share the personal data of individuals we know to be under 16 years of age for targeted advertising purposes. If we learn that a child under 18 has created an account without a parent or guardian, we will promptly delete that account and the associated personal data.

Medical Records and HIPAA

The notes and summaries you create in the AI Companion are your personal copy, created for your own use. They are not your official medical record. Your clinic or provider keeps your official medical record, and their handling of it is covered by their own privacy practices and by health privacy laws such as HIPAA.

Sharing a summary from the AI Companion with your care team does not change your official medical record. If you want something added to that record, ask your provider directly.

VascAI maintains a HIPAA compliance program and, where we provide services to a covered entity such as a clinic or health plan, we act as a business associate under a business associate agreement. Information you create in the consumer AI Companion for your own use is governed by this Privacy Notice rather than by that agreement, and we apply the same security controls to it either way.

Security of Personal Data

We have implemented reasonable physical, technical, and organizational safeguards that are designed to protect your personal data. These include encryption of data in transit and at rest, access controls limiting which people and systems can reach your information, and ongoing monitoring and review of our security practices.

The Services are hosted on Microsoft Azure in the United States. We maintain a HIPAA compliance program and a SOC 2 Type II report, and we monitor our security controls. However, despite these controls, we cannot completely ensure or warrant the security of your personal data.

Retention of Personal Data

We retain the personal data we collect about you for as long as you maintain an account with us, so that your recordings, transcripts, notes, and summaries remain available to you. You control this. When you delete a recording, transcript, note, or summary, we remove it from your account immediately and delete it from our systems, including backups, within 30 days. If you close your account, we delete or de-identify your information within 30 days. In each case we retain only what we are required to keep by law, or as needed to resolve disputes or protect our legal rights.

To determine the appropriate duration of the retention of personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, and whether we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting, and other applicable obligations.

Once retention of the personal data is no longer reasonably necessary for the purposes outlined above, we will either delete or deidentify the personal data or, if that is not possible (for example, because personal data has been stored in backup archives), we will securely store the personal data and isolate it from further active processing until deletion or deidentification is possible.

Third-Party Websites and Services

Our Services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.

Region-Specific Disclosures

We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:

• United States: If you are a resident of the United States, please see the Additional United States Privacy Disclosures below, including a description of the personal data rights made available to residents of certain states under applicable law.

Updates to This Privacy Notice

We may update this Privacy Notice from time to time. When we make changes to this Privacy Notice, we will change the date at the beginning of this Privacy Notice. If we make material changes, we will notify individuals by email to their registered email address, by prominent posting on this website or our other platforms, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise provided.

Contact Us

If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please contact us:

• Email: privacy@vascai.com

‍

ADDITIONAL UNITED STATES PRIVACY DISCLOSURES

These disclosures supplement the information contained in our Privacy Notice by providing additional information about the privacy rights available to individual residents of certain states in the United States and our personal data processing practices relating to those individuals. For a detailed description of how we collect, use, disclose, and otherwise process personal data, please read our Privacy Notice.

Nevada Residents

If you are a resident of the state of Nevada in the United States, you have the right to opt out of the sale of your personal data. You may submit a request to opt out of the sale of your personal data by emailing us at privacy@vascai.com.

California Residents

California’s "Shine the Light" law (Civil Code Section 1798.83) provides certain rights to California residents that have an established business relationship with us with regard to the disclosure of certain types of personal data to third parties for their direct marketing purposes. It is company policy that we do not disclose personal data to third parties for their direct marketing purposes if a consumer has opted out. To opt out of having your personal data disclosed to third parties for their direct marketing purposes, please email us at privacy@vascai.com.

California residents also have rights under the California Consumer Privacy Act, as amended, including the right to know, access, correct, and delete personal information, the right to limit the use of sensitive personal information, and the right not to receive discriminatory treatment for exercising these rights. These rights are described in the Your Additional U.S. Privacy Choices section below, including the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell or share sensitive personal information, including Health Information, and we do not use sensitive personal information for purposes other than those permitted without a right to limit.

Connecticut Residents

If you are a resident of the state of Connecticut in the United States, the following supplementary disclosures apply to you.

Personal Data Disclosures, Sales, and Targeted Advertising

• ‍Ad Networks and Advertising Partners: The categories of personal data sold and/or shared include: internet service provider, operating system, device type, model and manufacturer, device ID, click stream data, browser type, time and date you visited our marketing website, Ad ID, IP address, general geolocation (derived from your IP address), and URLs visited.

We disclose all of the categories of personal data we collect to the categories of recipients set forth in the Our Disclosure of Personal Data section of our Privacy Notice. Our disclosure of personal data to the following categories of third parties qualifies as the sale of personal data or the sharing or processing of personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as "targeted advertising" or "cross-context behavioral advertising") under certain privacy laws:

Health Information and other sensitive personal data are not sold or shared for targeted advertising. The data described above is collected on our public marketing website only, and not on https://patient.vascai.com or within the AI Companion app.

Subject to certain legal limitations and exceptions, you may be able to limit or opt out of the sale of personal data or the processing of personal data for purposes of targeted advertising (as described in the Your Additional U.S. Privacy Choices section below).

Please note we do not sell the personal data of individuals we know to be less than 16 years of age or share such information for targeted advertising purposes.

Sensitive Personal Data

• ‍Health Information, such as audio recordings and transcripts of meetings with your healthcare professionals, the summaries and next steps generated from them, medications, conditions, and any other health-related information you provide to us.
• ‍Precise Geolocation Data, where you have granted us access through your device settings.

The following personal data elements we collect may be classified as "sensitive" under certain privacy laws:

We use sensitive personal data for the purposes set forth in the Our Collection and Use of Personal Data section of our Privacy Notice, and only to provide and support the Services you have asked for. Subject to certain legal limitations and exceptions, you may withdraw your consent for our processing of sensitive personal data (as described in the Your Additional U.S. Privacy Choices section below). Audio recordings, transcripts, and other Health Information you submit may be processed by third-party AI service providers (Microsoft Corporation, Google LLC, and Anthropic PBC) as described in the "Our Disclosure of Personal Data" section above, solely to deliver the transcription, summarization, and content-generation features of our Services. We do not sell sensitive personal data and we do not use or disclose it for targeted advertising.

Deidentified Information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Automated Decision-Making and Profiling

The AI Companion generates transcripts, summaries, and suggested next steps from information you provide. These outputs are a support tool. They do not constitute medical advice, they do not replace your provider or your official medical record, and they are not used to make decisions that produce legal or similarly significant effects concerning you. We do not conduct automated processing of personal data for the purposes of evaluating, analyzing, or predicting an individual’s personal aspects in furtherance of decisions that produce legal or similarly significant effects.

[Confirm this characterization remains accurate if AI outputs are ever used in eligibility, coverage, care assignment, or similar determinations.]

• ‍Right to Know: The right to confirm whether we are processing personal data about you.
• ‍Right to Access and Portability: The right to obtain access to the personal data we have collected about you and, where required by law, the right to obtain a copy of the personal data in a portable and, to the extent technically feasible, readily usable format.Right to Correction:
• Right to Correction: The right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing.Right to Control Over Sensitive Personal Data:
• Right to Control Over Sensitive Personal Data: The right to exercise control over our collection and processing of certain sensitive personal data.Right to Opt-Out of Targeted Advertising:
• Right to Opt-Out of Targeted Advertising: The right to direct us not to use or share personal data for certain targeted advertising purposes.Right to Opt-Out of Sales:
• Right to Opt-Out of Sales: The right to direct us not to sell personal data to third parties.Right to Deletion:
• Right to Deletion: The right to have us delete personal data we maintain about you.

Your Additional U.S. Privacy Choices

Subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

You may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights.

Submitting Privacy Rights Requests

To submit a request to exercise any of the rights described above, please email us at privacy@vascai.com. Many of these rights can also be exercised directly in the app.

To exercise your right to opt out as it relates to the use of cookies and related technologies that involve the sale of personal data or the use of personal data for targeted advertising purposes, you can enable the Global Privacy Control, which means that any cookies that constitute sales or are used for targeted advertising should already be turned off. Please note this opt-out tool is website, device, and browser specific, so you will need to change your preferences on each device and browser you use. You can also follow the steps set forth in the Automatic Data Collection Preferences and Targeted Advertising Preferences sections of our Privacy Notice.

Before processing your request to exercise certain rights (including the Right to Know, Access and Portability, Correction, and Deletion), we will need to verify your identity and confirm you are a resident of a state that offers the requested right or rights. In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or where you are not a resident of an eligible state.

Submitting Authorized Agent Requests

In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf where we can verify the authorized agent’s authority to act for you. In order to verify that authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf.

Appealing Privacy Rights Decisions

You may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by replying to the communication resolving your original request.

‍

WASHINGTON AND NEVADA CONSUMER HEALTH DATA PRIVACY NOTICE

Last Updated: March 1, 2026

This Consumer Health Data Privacy Notice (the "Consumer Health Notice") supplements the VascAI Privacy Notice and explains how we collect, use, disclose, and otherwise process Consumer Health Data (as defined below) of residents of the state of Washington or Nevada, or individuals whose Consumer Health Data is collected in those states through our Services.

This Consumer Health Notice does not address privacy practices relating to VascAI job applicants, employees, and other personnel. Please note that this Consumer Health Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law.

Our Collection and Use of Consumer Health Data

The term "Consumer Health Data" as used in this Consumer Health Notice means any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in the Washington My Health My Data Act or the Nevada Consumer Health Data Privacy Law (the "Consumer Health Privacy Laws"). The Consumer Health Data we collect depends on the context of your interactions with us and, in most cases, is information that you decide to share with us. Consumer Health Data does not include information that is considered deidentified under the Consumer Health Privacy Laws.

Examples of Consumer Health Data that we may collect include:

• Audio recordings and transcripts of your appointments with healthcare professionals, and the summaries and next steps generated from them.
• Information you share about your health-related conditions, symptoms, experiences, diagnoses, testing, medications, or treatments.
• Any health-related information that you share with our customer support services.
• Precise location data that could reasonably indicate that you are attempting to acquire or receive health services, where you have granted location access.
• Other information that may be used to infer or derive data related to the above or other health-related information.

We may process and use your Consumer Health Data (including with your consent where required by the Consumer Health Privacy Laws) for the following purposes:

• To manage and provide the Services, including generating transcripts, summaries, and next steps.
• To share information with the care team members you select, at your direction.
• To manage, provide, maintain, secure, and improve our business and Services.
• To respond to your questions, concerns, and other requests for assistance.
• To create anonymous, aggregated, or de-identified data.

• ‍To Your Care Team: If you choose to share summaries or notes with a community health worker, provider, family member, or other person who helps with your care, we will disclose the Consumer Health Data you select to the people you select.To Service Providers:
• To Service Providers: We work with a variety of service providers who help us process your Consumer Health Data, such as Microsoft Corporation, which provides the Azure cloud infrastructure on which the Services are hosted, under contracts that require them to protect it.
• ‍To Third-Party AI Service Providers: We share Consumer Health Data with Microsoft Corporation (Azure AI Speech, for automated speech recognition of audio recordings; and Azure OpenAI Service), Google LLC (paid Gemini API), and Anthropic PBC (paid Claude API) for summarization and content generation, solely to provide the AI-powered features of the Services. These providers are contractually prohibited from using your Consumer Health Data for any other purpose, including training their general-purpose AI models.In relation to Business Transactions:
• In relation to Business Transactions: We may take part in or be involved with a business transaction, such as a merger. We may disclose Consumer Health Data to a third party during the negotiation of or in connection with such a transaction.In relation to Legal Obligations and Rights:
• In relation to Legal Obligations and Rights: We may disclose Consumer Health Data to third parties in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal processes; to protect our rights and property and the rights and property of others; to detect, suppress, or prevent fraud; to protect the health and safety of us and others; or as otherwise required by applicable law.With Your Consent:
• With Your Consent: We may disclose Consumer Health Data about you to other parties with your consent or at your direction. We may also provide you with the option to share visit summaries with individuals of your choice who are not VascAI users. Once the information has been shared at your direction, the information is no longer subject to this Privacy Notice.

• ‍Right to Access and Confirm: You may have the right to confirm whether we are collecting, sharing, or selling Consumer Health Data about you and with whom we may be disclosing such data, and to access such data.
• ‍Right to Withdraw Consent: If you have provided your consent for our processing or sharing of your Consumer Health Data, you may have the right to withdraw your consent.Right to Delete:
• Right to Delete: You may have the right to request that we delete your Consumer Health Data and that all third parties to whom we have disclosed your Consumer Health Data delete such data.

We do not use Consumer Health Data to build advertising profiles, to provide targeted offers, or for any advertising purpose.

Sources of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with our Services and, in most cases, is information that you decide to share with us, principally through recordings you choose to make and notes you choose to enter. For more information, please see the Our Collection and Use of Personal Data section of our Privacy Notice.

Our Disclosure of Consumer Health Data

We may share the categories of Consumer Health Data set forth above as follows:

• ‍Washington: www.atg.wa.gov/file-complaintNevada:
• Nevada: ag.nv.gov/Complaints

We do not sell Consumer Health Data, we do not share it for targeted advertising, and we do not disclose it to advertising networks or advertising partners. The device and browsing data we share with advertising partners is collected on our public marketing website only and does not include Consumer Health Data.

Your Privacy Rights

The Consumer Health Privacy Laws provide the following rights with respect to Consumer Health Data we collect about you:

How to Exercise Your Privacy Rights

To exercise any of the privacy rights set forth above or to review or request changes to data, please submit a request by emailing us at privacy@vascai.com. Many of these rights can also be exercised directly in the app.

Before processing your request, we will need to authenticate your identity. To do so, we will generally require matching a minimum amount of information you provide us with the information we maintain about you in our systems. This process may require us to request additional information from you, including your email address and phone number.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to authenticate your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for our decision.

Appealing Privacy Rights Decisions

If your request to exercise a right under the Consumer Health Privacy Laws is denied, you may appeal that decision by contacting us at privacy@vascai.com. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable State Attorney General:

Changes to this Consumer Health Data Privacy Notice

We may update this Consumer Health Notice from time to time. When we make changes, we will notify you by changing the date at the beginning of this Consumer Health Notice. If we make material changes, we will notify individuals by email to their registered email address, by prominent posting on this website or our other platforms, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise specified.