NexJ Connected Wellness Privacy Notice

Introduction

NexJ Health is committed to protecting your privacy. This privacy notice applies to the data collected by NexJ Health through NexJ Connected Wellness. It does not apply to data collected by NexJ Health through other online or offline NexJ Health sites, products or services.

NexJ Connected Wellness is a personal health platform that lets you gather, edit, add to, store, and share health information online. With NexJ Connected Wellness, you can control your own health records. You can also share your health information with family, friends, health care professionals, mobile phone applications, health related devices, and online tools.

You can choose to share information with separate applications that can connect with or run on NexJ Connected Wellness ("Applications") to use, edit and add to your health record. Applications can help you manage your information and find relevant health information.

You can choose to share specific information (or all information) with:

• Other people (such as friends and family)
• Applications (such as Applications that add data to your health records, provide information to your healthcare provider, or use some of your health records to provide information to you about managing your health)

Please read the NexJ Connected Wellness - End User Terms of Use.

1. Collection of your personal information

NexJ Connected Wellness asks you to enter an identifier and password to sign in. The first time you sign in to Connected Wellness you may be asked to provide personal information such as name, date of birth, email, and residential address. Depending on which features you use, you may be asked for additional information for that feature (such as the name of your health care provider or insurance information).

NexJ Health may use the email address you provide to send you an email requesting that you validate your email address, to include in sharing invitations you send through Connected Wellness. Your email may also be used to communicate that information or messages are available to you on NexJ Connected Wellness. As described in their privacy statements, Applications you authorize may also use your email address.

NexJ Connected Wellness allows you to manage one or more health records, such as the ones you create for yourself and your family members. Generally, you choose what information to put in your records. Depending on the Applications that you use on NexJ Connected Wellness you may be asked to consent to the release of a copy of medical records or information from a health care organization or provider. When you consent to the release of a copy of medical records or information to NexJ Connected Wellness, the health care organization or provider remains the custodian of the original records and you are responsible for managing the copy released to NexJ Connected Wellness. Examples of the types of information you can store in your health record on NexJ Connected Wellness include:

• Discharge summaries from hospitalizations
• Transitional care management plans created after your release from hospital
• Health care appointment details
• eConsult information in preparation for medical appointments
• Pictures of meals and food you've eaten
• Fitness related activities such as aerobic sessions
• Measurements such as blood glucose, weight and blood pressure
• Lab results
• Medications
• Health history

You can use Applications to enter a wide range of health information into your health record. You can give Applications permission to view, add, modify, and/or delete information in a record. Some Applications store their own copy of the information they access. If an Application has its own privacy statement, NexJ Connected Wellness will provide you a link to such privacy statement at the time you are authorized to access the Application. Please read the Application's privacy statement for information such as where and how the Application may use, store and transfer your information; what additional information it may collect; how you can review, edit and delete the information it holds and other choices you may have.

You can also store files, and can add or edit some information directly when logged into NexJ Connected Wellness.

By default, you are the custodian of any records you create on NexJ Connected Wellness. You may invite additional people to be custodians. Some of the information you store in the records you manage may be highly sensitive, so you need to consider carefully with whom you choose to share the information.

2. Sharing your Personal Health Information

A key value of NexJ Connected Wellness is the ability to share your health information with people and services who can help you meet your health-related goals. For example, you can share health information from records you control:

• To get your primary physician's assistance with a transitional care management plan after your release from hospital
• To get family members to help you manage your health
• To use products and services that can improve or monitor your health
• To provide health information to a health coach who can assist you in meeting health and fitness goals

You can share information in a health record you are custodian of with another person by sending a sharing invitation via email through NexJ Connected Wellness. If the person accepts your sharing invitation and has or creates a NexJ Connected Wellness account, you have given him or her access to that information. You can add or remove people from sharing your account.

You can also share personal information and health information with Applications. You decide which Applications you want to use. You may need to agree to additional terms of use, an additional privacy statement and new financial terms before using a new Application. You can revoke an Application's access to your data at any time. The access you grant to an Application through NexJ Connected Wellness is active until you revoke it.

3. Accuracy of your Personal Information

NexJ Health works hard to ensure that the information within NexJ Connected Wellness is accurate. Nevertheless, participants should be vigilant of the accuracy of their own data. The method for updating information depends on the information source.

Personal health information within NexJ Connected Wellness is entered via one of:

• Entered by the Participant themselves,
• Entered by a person whom the Participant has granted access,
• Entered by their Health Care Provider, or
• Imported from a Health Care Provider system via system integration.

In the case of self-entered information, the Participant can correct the information themselves.

In the case of information entered by the Health Care Provider or a system integrated to NexJ Connected Wellness, the Participant must make the change request through the originating Health Care Provider or their Organization. Contacting the information source is necessary because NexJ Connected Wellness does not modify or provide edit capabilities for information received from other systems.

4. Processing of Personal Information

The legal basis for the collection and processing of any personal information or data is to meet NexJ Health’s contractual obligations to you, service providers and employees. NexJ Health uses personal information collected through NexJ Connected Wellness, including health information, to provide NexJ Connected Wellness service, and as described in this privacy notice and the end user terms of use and in the terms of use and privacy statements of NexJ Connected Wellness Applications that you use.

In support of these uses NexJ Health may use and process personal information and data for the following purposes:

• To provide you with the health coaching and patient health management services offered by the NexJ Connected Wellness platform
• To analyze and optimize information and data in order to improve the NexJ Connected Wellness platform and the services provided
• To provide you with important information about NexJ Connected Wellness and Applications, including critical updates and notifications
• To send you newsletters if you opt-in
• To display relevant advertisements if you opt in
• To assist us with complying with applicable laws

NexJ Health occasionally hires other companies and contractors to provide limited services on our behalf, such as security audits for example. NexJ Health gives those companies and contractors access only to the personal information they need to provide the services. NexJ Health requires these companies and contractors to maintain the confidentiality of the information and prohibit them from using the information for any other purpose. These companies and contractors are also required to follow our policies and procedures related to the treatment of personal information and health information.

NexJ Health may access and/or disclose your personal information if NexJ Health believes such action is necessary to: (a) comply with the law or legal process served on NexJ Health; (b) protect and defend the rights or property of NexJ Health (including the enforcement of our agreements); or (c) act in urgent circumstances to protect the personal safety and welfare of NexJ Connected Wellness users or members of the public.

4.1 Data Subject Rights

At any point while NexJ Health is in possession of or is processing your persona data or information, all Data Subjects have the following rights:

• Transfer personal data from one electronic processing system to and into another electronic processing system;
• Know what data has been collected about you and how such data has been processed;
• Make changes to inaccurate data;
• Withdraw consent to have your data processed and to have your personal data deleted. Note that NexJ Health may be obligated to retain certain personal data on behalf of health professionals in order to comply with applicable laws;
• Be informed, in clear and plain language, of what data is being collected and processed.
• The right to know whether data concerning you is being processed and if so, the right to access it;
• The right to limit the scope of processing of your personal data. Limiting the scope of processing may impact your ability to use the NexJ Connected Wellness platform;
• The right to object to having your personal data processed. Objecting to having your personal data processed will impact your ability to use the NexJ Connected platform;
• The right to not be subject to processing done solely on an automated basis (i.e., profiling).

Furthermore, you can request the following information:

• Identity and the contact details of the person or organisation that has determined how and why to process your data.
• Contact details of the Data Protection Officer, where applicable.
• The purpose of the processing as well as the legal basis for processing.
• If the processing is based on the legitimate interests of NexJ Health or a third party such as one of its clients, information about those interests.
• The categories of personal data collected, stored and processed.
• Recipient(s) or categories of recipients to whom the data are/will be disclosed.
• How long the data will be stored.
• Details of your rights to correct, erase, restrict or object to such processing.
• Information about your right to withdraw consent at any time.
• How to lodge a complaint with the Office of the Information Commissioner (Data Protection Regulator) or Personal Data Protection Commission (PDPC).
• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
• The source of personal data if it wasn’t collected directly from you.
• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

To access personal data held, identification will be required

NexJ Health will accept the following forms of identification when information on your personal data is requested. A copy of your driver’s license, passport, birth certificate and utility bill, bank statement, or credit card statement not older than three months old. A minimum of one piece of photographic identification listed above and a supporting document is required. If NexJ Health is dissatisfied with the quality, further information may be sought before personal data can be released.

All requests should be made to dataprotection@nexjhealth.com with subject: Data Access Request.

4.2 Complaints

If you wish to make a complaint about how your personal data is being processed by NexJ or its partners, you have the right to complain. Please refer to Section 12 for Enforcement of this Privacy Statement and Contact Information. If you do not get a response within 30 days, you can complain to your local supervisory authority.

4.3 Cross Border Transfer of Personal Information

NexJ Health uses third-party service providers that processes your personal information on servers located in the region where it is collected. In general, personal information is not stored outside the region where your account was created, although it may be processed in other countries.

Where your personal information is transferred between these third-party service providers, we take appropriate safeguards to require that it remains protected in accordance with this Privacy Notice and the privacy laws of the countries in which we operate.

If your account is based in Canada and the organization you are part of has enabled AI-powered features, personal information provided as input to those features will be processed and stored in the United States for a limited duration.

Data retention for personal information is minimized and configured for automatic deletion after a defined period. If your organization has not enabled AI-powered features, personal information is stored within Canada only. To confirm whether your organization has enabled AI-powered features, please contact privacy@nexjhealth.com.

4.4 Generative AI Powered Features

NexJ Connected Wellness users may provide personal data as an input to a generative AI powered feature, which could result in personal data being provided as an output.

Machine learning models used by NexJ Connected Wellness do not retain personally identifiable information.

5. Aggregated, De-Identified and Anonymized Personal Information

NexJ Health may process aggregated information from NexJ Connected Wellness and Applications to improve the quality of NexJ Connected Wellness and for marketing NexJ Connected Wellness and Applications (e.g. to inform prospective platform sponsors and subscribers about NexJ Connected Wellness use). Aggregated information is not associated with any individual user and no user can be identified from it. NexJ Health may also use de-identified and anonymized information for research and statistical purposes and to improve the quality of NexJ Connected Wellness.

6. How NexJ Health Safeguards your Confidential Information

NexJ Connected Wellness is a secure cloud-based platform accessible from a desktop browser or mobile device. All applications access the NexJ Connected Wellness cloud through an Application Programming Interface (API) and pass through a perimeter security gateway to ensure that only authenticated users can access the system. The security gateway also protects against malicious attacks, viruses and malware.

If a NexJ Connected Wellness user (e.g. participant) has a relationship with another NexJ Connected Wellness user, as may be the case between a patient and a healthcare professional, and if those users intend to communicate data from their own clinical systems (for example, another EMR, or EHR, external to NexJ Connected Wellness), then NexJ Connected Wellness may exchange data with those external systems. Such communication is performed over a secure connection.

6.1 Who Can Access Your Personal Health Information?

Only individuals that have been given explicit access by the participant (i.e. patient) can view the participant's personal health information. This is based on the participant's defined Circle of Care - anyone the participant chooses to invite to support and participate in their own health and wellness, such as healthcare providers, family, friends, and advocates. Providers can invite participants to join the platform. Providers can only access health information from participants they have invited to the platform, or from those participants that have added that provider to their Circle of Care.

NexJ Connected Wellness has been designed from the ground-up to protect Personal Health Information (PHI) to the utmost degree. Our NexJ Health operational and support processes are designed with protection of PHI in mind as well.

The following safeguards are in place:

• Data is stored in encrypted format in the NexJ Connected Wellness database
• Data is stored in the jurisdiction in which it is collected
• All data transmitted within the system is transferred using secure HTTPS connections
• The NexJ Connected Wellness website is only accessible to providers and participants through HTTPS
• Strong passwords are enforced by the system
• All transactions within the system are logged using ATNA-compliant audit records to allow monitoring or activity, as well as investigation of any possible privacy or security breaches
• All NexJ Health employees are subject to a criminal and background check
• All NexJ Health employees sign Privacy and Confidentiality Agreements
• All staff involved with NexJ Connected Wellness are given specific training in Privacy and Security, including training on the handling of PHI
• Access to the production environment is carefully controlled and only a small number of IT staff have access to the production system
• NexJ Health has defined and detailed procedures to handle security and privacy breaches
• NexJ Connected Wellness systems are hosted in Tier IV data centers managed by our cloud provider that maintains an industry-leading array of security and privacy certifications, including SOC 2, ISO 27001, HITRUST and many others.

6.2 Cryptography

NexJ Health takes effective measures to ensure that your information stays confidential on the Internet. NexJ Health uses strong encryption to conceal your information from those whom you have not authorized to access it. All web sessions for NexJ Connected Wellness are encrypted. Communications between NexJ Health and its partners' Internet gateways (for example between NexJ Health and a partnering hospital) use digital certificates to confirm the identities of the communicating servers. Encrypted Virtual Private Networks (VPNs) are often used to provide an additional layer of confidentiality assurance.

6.3 Regulatory Compliance

In the jurisdictions where NexJ Connected Wellness is offered, NexJ Health complies with all applicable legal requirements. This includes HIPAA, PHIPA, GDPR, and PCI-DSS.

6.4 Privacy and Security Awareness

No system can promise to be secure under all circumstances. NexJ Health's commitment is to take commercially reasonable steps to minimize threats to your data security. NexJ Health takes this commitment seriously.

NexJ Health periodically commissions independent Privacy Impact Assessments (PIAs) and Threat Risk Assessments (TRAs) of NexJ Connected Wellness. The results of these assessments are updated regularly, and help us to plan protections against any new threats to your information that may develop. These Assessments are an assurance to you, and to our data partners, that your data is safe within our systems. NexJ Health has satisfied all of its data partners of the thoroughness of these Assessments. A summary of these Assessments is available on request.

7. Account Access and Controls

You consent to the creation of an account on NexJ Connected Wellness. The required account information consists of a small amount of information such as your name, email address and region. NexJ Health may request additional information, but NexJ Health clearly indicates that such information is optional. You may also consent to the release of information from a third party (such as a health care organization) to NexJ Connected Wellness. You can review and update your account information. You can modify, add or delete any optional account information by signing into NexJ Connected Wellness or by contacting privacy@nexjhealth.com.

You can close your account by submitting an account closure request on NexJ Connected Wellness or by contacting privacy@nexjhealth.com. NexJ Health may wait for a short time period before permanently deleting your account in order to help avoid accidental or malicious removal of your information or to comply with any applicable laws.

8. Sharing Records with Applications

NexJ Health provides you with information about Applications that run on NexJ Connected Wellness. You should review information about the Applications including their privacy statements and terms of use prior to using them or allowing them to access your health information. If you have any concerns about an Application please contact privacy@nexjhealth.com.

8.1 Google Health

If you choose to connect Google Health to NexJ Connected Wellness, we may collect and use the following categories of information when they are available from your connected device or application:

• Daily steps;
• Exercise and stress-reduction activities;
• Weight;
• Heart rate and heart rate variability; and
• Sleep information, including sleep duration, timing, awake periods, and sleep stages.

We may also collect limited technical information, such as your time zone and connected device identity. We use this information to assign measurements to the correct local date and time and to help prevent duplicate data from being imported.

We may use your Google Health data to provide health coaching, wellness tracking, and related services within NexJ Connected Wellness. Our use of your information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including its Limited Use requirements. We do not use Google Health data for advertising, sell it to data brokers, use it to make credit decisions, or use it for medical device purposes.

Google Health data is stored in NexJ Connected Wellness. Validic, our wearable device integration service provider, acts as our data processor and supports the connection to Google Health and the transfer of data to our platform.

You can stop the collection of new Google Health data at any time by opening the Apps and Devices page in NexJ Connected Wellness under Settings and pressing Disconnect for Google Health.

If you want to close your NexJ Connected Wellness account, open the Settings page and press Request Account Closure. For more information, refer to Section 7 (Account Access and Controls) above. Your request will be handled in accordance with the account closure and data retention provisions of this Privacy Policy.

9. Deleting Records including Health Information

Generally, you can delete records and health information using NexJ Connected Wellness. Alternatively, you can contact privacy@nexjhealth.com to delete records or health information. Deleting records and health information is permanent. NexJ Health may wait for a short time period before permanently deleting your records or health information in order to help avoid accidental or malicious removal of your information.

10. Use of Cookies

NexJ Health uses cookies with NexJ Connected Wellness to enable you to sign in and to help personalize your NexJ Connected Wellness experience. A cookie is a small text file that a web page server places on your hard disk. NexJ Health uses industry standard best practices to ensure our use of cookies does not put your personal information at risk.

10.1 Opt-Out of Cookies

If you do not want your browser to accept cookies, you can modify the cookie option in your browser’s settings. However, some Site features or services may not function properly or be accessible without cookies.

11. Changes to this Privacy Statement

NexJ Health may occasionally update this privacy statement. When NexJ Health does, the "Last Updated" date at the top of the privacy statement will be revised. For material changes to this privacy statement NexJ Health will notify you of the changes either by email or by notifying you through NexJ Connected Wellness. Your continued use of NexJ Connected Wellness constitutes your agreement to this privacy statement and any updates.

12. Enforcement of this Privacy Statement and Contact Information

If you have any urgent questions related to this Privacy Statement or any urgent privacy or security concerns please contact privacy@nexjhealth.com.

NexJ Health treats all privacy concerns, including complaints or challenges, with the utmost confidentiality.

NexJ Health's Chief Privacy Officer, Sabina Girard, is responsible and accountable for this privacy statement and privacy related concerns with respect to NexJ Connected Wellness. She can be reached at the following address:

13. Consent

By agreeing to this privacy notice you are consenting to NexJ Health collecting and processing your personal information and data for the purposes outlined. You further consent to the disclosure of personal data and any other privacy practices set out in this privacy notice. NexJ Health expressly reserves the right to change this privacy notice at any time. Please check here regularly to see the latest version of this notice.

You can withdraw consent at any time by emailing dataprotection@nexjhealth.com with subject: Web Privacy or by writing to the Chief Privacy Officer at the contact details above.