Triangle Health Privacy Policy

Effective Date: July 6, 2025 Last Updated: February 24, 2026

Triangle Health, its affiliates, and subsidiaries ("Triangle Health" "we," "our," or "us") values your privacy. This Privacy Policy ("Policy") describes how Triangle Health collects, uses, discloses, and otherwise processes personal information described in this Policy, as well as the rights and choices individuals may have regarding such personal information.

Supplemental Privacy Notices

California Residents. If you are a California resident, please refer to the California Notice at Collection section below for important information about the categories of personal information we collect and disclose, as well as your rights under California privacy laws.

Consumer Health Data Privacy Notice. For Washington and Nevada residents, please refer to our Consumer Health Data Privacy Notice for additional information about how we process consumer health data under applicable consumer health data privacy laws.

For additional information about the privacy choices you may have regarding your personal information, please review the Your Privacy Choices section below.

By using our Services (as defined below), you agree that your personal information will be handled as described in this Policy. Your use of our Services and any dispute over privacy, is subject to this Policy and our Terms and Conditions, available at https://app.trianglehealth.com/terms, including their applicable terms governing limitations on damages and the resolution of disputes.

Table of Contents

1. Scope

2. Personal Information Collected

3. How We May Use Personal Information

4. Disclosures of Personal Information

5. Cookies and Other Tracking Mechanisms

6. Your Privacy Choices

7. External Links and Features

8. Children's Privacy

9. Security

10. California Notice at Collection

11. Changes to this Policy

12. Contact Us

1. Scope

Except as otherwise described below, this Policy applies to our online and offline personal information processing activities including, but not limited to: visitors to our website where this Policy is posted, including https://app.trianglehealth.com/ (the "Site"); individuals who sign up for, or create an account with us (each, a "User"); individuals who subscribe to receive news, information, and marketing communications and materials from us; current, former, and prospective business partners, and service providers; and individuals who communicate or otherwise interact or engage with us or the services available through our Site or other online services (collectively referred to as the "Services").

If you provide us with personal information of anyone other than yourself (such as a patient or family member), please note that you are responsible for complying with all applicable privacy and data protection laws prior to providing that information to us (including obtaining consent, if required).

To the extent we act as a "business associate" to your healthcare provider, our use and disclosure of Protected Health Information is governed by the Health Insurance Portability and Accountability Act (HIPAA) and our Business Associate Agreement with that provider and not this Policy.

Additional Notices. Depending on how you interact or engage with us, we may provide you with additional or supplemental privacy notices. These additional notices will control to the extent there is a conflict with this Policy. For example, this Policy does not apply to the personal information we collect and process about job applicants and candidates for employment with us, or to employees or contractors with whom we work.

2. Personal Information Collected

We collect personal information directly from you, from third-party sources, and automatically through your use of the Services. To the extent permitted by applicable law, we may combine the personal information we collect from publicly available or third-party sources. The personal information we collect varies depending upon your use of our Services and our interactions with you.

Personal Information Collected Directly. We may collect the following personal information directly from you:

• Communications and Interactions. When you communicate or interact with us or our Services, including if you complete forms on our Site, interact with our social media pages, submit content to the Services, or otherwise engage with us or our sponsored content, we may collect your name, email address, phone number, or other similar identifiers, as well as your message, the nature of your inquiry, and any other information you choose to provide.

• Account and Profile Information. When you sign in or create an account in connection with our Services, we may collect your name, email address, phone number, username, as well as any other information used in connection with accessing your account or that you otherwise submit to us through your account.

• Health Information. When you submit information about your medical history. Please see our Consumer Health Data Privacy Notice for information about how we collect and use consumer health data.

• Purchases and Payments. When you make a purchase or payment through our Services, we may collect information such as payment type, payment card details, billing information, shipping address, purchasing information, such as details of SKUs and products purchased, and any other financial or commercial-related information necessary to enable our Services.

• Chat Function. We may collect information you submit through our chat functions we make available through the Services. We and any service providers we use to administer these features may record your communications with us for purposes of the Services. These service providers may also maintain communication records regarding information provided to us.

• Promotional Information. If you agree to receive marketing communications from us, we may collect your contact details, preferences, and if relevant, information about your account and profile, including the Services and features you use.

• Responses and Feedback. If you participate in surveys, questionnaires, or research activities or initiatives conducted by us, such as for market research, user satisfaction, or other similar purposes, we may collect your responses and feedback, and any other information you choose to provide.

• Preferences and Other Requests. We may collect information about your preferences, including communications preferences, preferences related to your use of our Services, and any other preferences or requests you provide when interacting with us.

• Business Development Information. To assess and pursue potential business opportunities, we may collect and receive personal information about current, former, and prospective business partners, and vendors and service providers, including contact information and other similar identifiers, company and professional-related information, and communications records.

Personal Information Collected from Third Parties. We may collect and receive personal information from third party sources, such as business partners, family and other authorized representatives, and service providers or other third parties who provide services or perform functions on our behalf. We may collect the following information from third-party sources:

• Sign-in Authentication Partners. When you register for or log into the Services using another service, that service will send your information to us to create your account with us. For example, we may use Google Sign-in for user authentication. Our use of information received from Google APIs complies with Google's privacy and data use policies.

• Lead and Prospect Information. We may receive lead information from third parties about prospective customers that may be interested in our Services. We may also engage with third parties to enhance or update our customer information. For example, we may receive certain personal information from data analytics and marketing providers for marketing and advertising purposes, and for purposes of reaching new customers.

• Referral Information. We may offer users the ability to invite friends or refer other users to access or use our Services. In doing so, we may collect and receive certain personal information about individuals referred to our Services.

Personal Information Collected Automatically. We may automatically collect or derive personal information related to your use of our Services, including through the use of cookies, pixel tags, and other similar technologies. This may include

• Device and Browsing Information. When you use our Services, we may collect browser type, domain name, page views, access times, date/time stamps, operating system, language, device type, unique ID, Internet service provider, referring and exiting URLs, clickstream data, and other similar device and browsing information.

• Activities and Usage. We also may collect activity information related to your use of the Services, such as information about the links clicked, searches, features used, items viewed, time spent within the Services, your interactions with us within the Services, and other similar activity and usage information.

• Location Information. We also may collect or derive general location information, such as through your IP address.

For more information about our use of cookies and other similar technologies, please see the Cookies and Other Tracking Mechanisms section below.

3. How We May Use Personal Information

We may collect, use, disclose and otherwise process personal information for the following purposes:

• Services and Support. To enable our Services, communicate with you about your use of the Services, provide troubleshooting, technical support, and for similar support purposes, respond to your inquiries, fulfill your requests, and to otherwise run our day-to-day operations. Certain of our Services may be provided using our artificial intelligence models and tools.

• Account Creation and Management. To enable account creation and management, including allowing you to create a profile and set preferences.

• Analytics and Improvement. To better understand how users access and use the Services, and for other research and analytical purposes, such as to evaluate, develop, and improve our Services and business operations, and for internal quality control and training purposes.

• Communication. To respond to your questions, send you requested materials and newsletters, as well as information and materials regarding our Services and our offerings. We may also use this information to send administrative information to you, for example, information regarding the Services and changes to our terms and policies.

• Customization and Personalization. To tailor content we may send or display on the Services, including to offer location customization and to otherwise personalize your experiences and offerings.

• Marketing and Advertising. For marketing, advertising, and promotional purposes. For example, to send you promotional information about our Services, including information about new offerings, as well any other information that you sign up to receive. We do not share any health-related or sensitive personal information with third parties for their advertising or marketing purposes.

• Research and Surveys. To administer surveys and questionnaires, such as for market research or user satisfaction purposes.

• Insight Development and Data Enhancement. We may combine personal information collected through the Services with other information that we or third parties collect in other contexts to obtain insights into how our Services are used.

• Security and Protection of Rights. To protect the Services and our business operations, and to protect our rights or those of our stakeholders; to prevent and detect fraud, unauthorized activities and access, and other misuse; where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party, or violations of our Terms of Use.

• Compliance and Legal Process. To comply with applicable legal or regulatory obligations, including as part of a judicial proceeding, to respond to a subpoena, warrant, court order, or other legal process, or as part of an investigation or request from law enforcement or a governmental authority.

• Auditing, Reporting, and Other Internal Operations. To conduct financial, tax and accounting audits, audits and assessments of our operations, including our privacy, security and financial controls, as well as for risk and compliance purposes. We may also use personal information to maintain appropriate business records and enforce our policies and procedures.

• General Business and Operational Support. To assess and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions such as financings, and to administer our business, accounting, auditing, compliance, recordkeeping, and legal functions.

AI Features. We use artificial intelligence (AI) technologies to enhance, improve, and provide our Services. To deliver AI-powered features, the app sends information you submit — including health data, documents, and messages — to the following third-party AI service providers for processing:

• Google Gemini (Google LLC)
• Azure OpenAI (Microsoft Corporation)
• OpenAI (OpenAI, L.L.C.)
• LandingAI (LandingAI, Inc.)
• Anthropic Claude (Anthropic, PBC)
• Groq (Groq, Inc.)
• Perplexity (Perplexity AI, Inc.)

Your data is not retained by these services and is not used to train their models. These providers process your data solely to deliver functionality within the Services and operate under zero data retention agreements. Each third-party AI service provider is contractually required to maintain data protection standards equivalent to or exceeding those described in this Policy and is subject to our vendor management processes.

We may use AI technologies for our legitimate business purposes to process the information you submit as described in this Policy to improve the efficiency and accuracy of our Services. The information we process through our use of AI systems is subject to the same protection and security measures discussed in this Policy. We will update this Policy to reflect any changes to the third-party AI service providers we use.

4. Disclosures of Personal Information

We may disclose the personal information we collect for the purposes described above and as follows:

• Vendors and Services Providers. We may disclose personal information we collect to our service providers, processors, and others who perform functions on our behalf. These may include, for example, IT service providers, help desk, payment processors, analytics providers, consultants, auditors, and legal counsel.

Third-Party AI Service Providers. To provide AI-powered features within the Services, we disclose personal information, including health data, documents, and user-submitted messages, to third-party AI service providers, including Google Gemini, Azure OpenAI, OpenAI, LandingAI, Anthropic Claude, Groq, and Perplexity. These providers process data under zero data retention agreements, do not retain your personal information after processing, and do not use your data to train their models.

• Affiliates and Subsidiaries. We may disclose personal information we collect to our affiliates or subsidiaries who will use and disclose this personal information in accordance with this Policy.

• Business Partners. Any information that we collect and process on behalf of a business client will be disclosed to the business client and otherwise shared as directed by that business client.

• Third Party Marketing and Analytics Providers. We may disclose or make available personal information to third party platforms and providers that we use to provide or make available certain features or portions of the Services, or as necessary to respond to your requests. We may also make personal information available to third parties to support our marketing, analytics, advertising, and campaign management. We do not share any health-related or sensitive personal information with third parties for their advertising or marketing purposes.

• Compliance and Legal Obligations. We may disclose personal information to third parties to comply with our legal and compliance obligations and to respond to legal process. For example, we may disclose information in response to subpoenas, court orders, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements. This may include regulators, government entities, and law enforcement as required by law or legal process. Additionally, it may include certain disclosures that we are required to make under applicable laws, such as the names of sweepstakes and contest winners.

• Security and Protection of Rights. We may disclose personal information where we believe it is necessary to protect the Services, our rights and property, or the rights, property and safety of others. For example, we may disclose personal information in order to (i) prevent, detect, investigate and respond to fraud, unauthorized activities and access, illegal activities, and misuse of the Services, (ii) situations involving potential threats to the health, safety, or legal rights of any person or third party, or (iii) enforce, and detect, investigate and take action in response to violations of our Terms of Use. We may also disclose information, including personal information, related to litigation and other legal claims or proceedings in which we are involved, as well as for our internal accounting, auditing, compliance, recordkeeping, and legal functions.

• In Support of Business Transfers. If we, or our affiliates are, or may be acquired by, merged with, or invested in by another company, or if any of our assets are, or may be, transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected from you to the other company. We may also share certain personal information as necessary prior to the completion of such a transaction or corporate transactions such as financings or restructurings, to lenders, auditors, and third-party advisors, including attorneys and consultants, as part of due diligence or as necessary to plan for a transaction.

• Aggregate and Deidentified Information. Notwithstanding anything else in this Policy, we may use, disclose, and otherwise process aggregate and deidentified information related to our business and the Services with third parties for quality control, analytics, research, development, and other purposes.

• Other Disclosures. We may disclose personal information in other ways not described above, but will notify you and, if necessary, obtain your consent.

5. Cookies and Other Tracking Mechanisms

We use cookies, pixels, local storage objects, log files, APIs, and other mechanisms to automatically collect browsing, activity, device, and similar information within our Services and to target advertising and content. We may also engage third-parties or service providers to do the same. We use this information to, for example, analyze and understand how visitors interact with our Services; identify and resolve bugs and errors in our Services; assess, secure, protect, optimize and improve the performance of our Services; conduct analytics activities and limited marketing related to non-health information; and personalize content in our Services. We do not use patient health information --- including diagnoses, treatments, or chat content --- for marketing, advertising, or any cookie-based tracking. To manage your preferences regarding cookies, targeted advertising, and other tracking mechanisms within our Services, please see Your Privacy Choices below.

Cookies. Cookies are alphanumeric identifiers that we transfer to your device's hard drive through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Services, while others are used to enable a faster log-in process, support the security and performance of the Services, or allow us to track activity and usage data within Service.

Pixel Tags. Pixel tags (sometimes called web beacons or clear GIFs) are tiny graphics with a unique identifier, similar in function to cookies. While cookies are stored locally on your device, pixel tags are embedded invisibly within web pages and online content. We may use these, in connection with our Services to, among other things, track the activities of users, help us manage content and compile usage statistics. We may also use these in HTML e-mails we send, to help us track e-mail response rates, identify when our e-mails are viewed, and track whether our e-mails are forwarded.

Local Storage Objects. Local storage is a web storage mechanism that allows us to store data on a browser that persists even after the browser window is closed. Local storage may be used by our web servers to cache certain information in order to enable faster loading of pages and content when you return to our websites. You can clear data stored in local storage through your browser. Please consult your browser help menu for more information.

Third-Party Analytics and Tools. We use third party tools, such as Google Analytics, which are operated by third party companies. These third-party analytics companies may use cookies, pixels, and other similar tools to collect usage data about our Services in order to provide us with reports and metrics that help us evaluate usage of our Services and improve performance and user experiences. To learn more about Google's privacy practices, please review the Google Privacy Policy at https://www.google.com/policies/privacy/partners/. You can also download the Google Analytics Opt-out Browser Add-on to prevent their data from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout.

Targeted Advertising. We work with third parties, such as ad networks, channel partners, mobile ad networks, analytics and measurement services and others ("third-party ad companies") to personalize content and display advertising within our Services, as well as to manage our advertising on third-party sites, mobile apps, and online services. We may share certain information with these third-party ad companies, and we and them may use cookies, pixels tags, and other tools to collect usage and browsing information within our Services, as well as on third-party sites, apps and services, such as IP address, location information, device ID, cookie and advertising IDs, and other identifiers, as well as browsing information. We and these third-party ad companies use this information to provide you more relevant ads and content within our Services and on third-party sites and apps, and to evaluate the success of such ads and content.

Cross-Device Tracking. We and our third-party providers may use the information we collect within our Services and on other third-party sites and services to help us and these third parties to identify other devices that you use (e.g., a mobile phone, tablet, other computer, etc.).

Third-Party Advertising. We work with third parties, such as ad networks, channel partners, mobile ad networks, analytics and measurement services and others ("third-party ad companies") to personalize content and display advertising within our Services, as well as to manage our advertising on third-party sites, mobile apps and online services. We may share certain information with these third-party ad companies, and we and them may use cookies, pixels tags, and other tools to collect usage and browsing information within our Services, as well as on third-party sites, apps, and services, such as IP address, location information, device ID, cookie and advertising IDs, and other identifiers, as well as browsing information. We and these third-party ad companies use this information to provide you more relevant ads and content within our Services and on third-party sites and apps, and to evaluate the success of such ads and content.

6. Your Privacy Choices

We make available several ways that you can manage your privacy choices and submit privacy requests related to your personal information. Some of these choices are browser and device specific, which means that you need to set the preference for each browser and device you use to access our Services. In addition, if you delete or block cookies, you may need to reapply these preferences to each browser and/or device used to access our Services.

These options include:

• Account and Profile Information. You can review and update some of the personal information we maintain about you by logging into your account and updating your profile information directly within our Services.

• Marketing Communications. We may send periodic promotional emails or other similar communications to you, in accordance with applicable law. You may opt-out of these communications by following the instructions provided to you in the communication. If you opt-out of receiving promotional content from us, we may still send you communications about your account or any services you have requested or received from us. Additionally, you can manage your communication preferences in your account settings.

• Push Notifications. You can manage the type of push notifications you receive from us by adjusting your device settings or by modifying the settings within our Services.

• Cookie Settings. To prevent cookies from tracking your activity on our Site or visits across multiple websites, you can set your browser to block certain cookies or notify you when a cookie is set; you can also delete cookies. The "Help" portion of the toolbar on most browsers will tell you how to prevent your device from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to delete cookies. Visitors to our Site who disable cookies will be able to browse the Site, but some features may not function.

• Browser Signals/Do Not Track. Our Site currently does not respond to "Do Not Track" signals. You may, however, disable certain tracking as discussed in this section (e.g., by disabling cookies); you also may opt-out of targeted advertising by following the instructions in the Industry Ad Choice Programs section below.

• Industry Ad Choice Programs. You can also control how participating third-party ad companies use the information that they collect about your visits to our Site and those of third parties, in order to display more relevant targeted advertising to you. If you are in the U.S., you can obtain more information and opt out of receiving targeted ads from participating third-party ad networks at http://aboutads.info/choices (Digital Advertising Alliance). Opting out of participating third party ad networks does not opt you out of being served advertising. You may continue to receive generic or "contextual" ads on our Site. You may also continue to receive targeted ads on other websites, from companies that do not participate in the above programs.

7. External Links and Features

Our Service may contain links to third-party websites or features or provide certain third-party connections or integrated services. Any access to and use of such linked websites, features, or third-party services is not governed by this Policy. We are not responsible for the information practices of such third parties, including their collection, use, and disclosure of your personal information. You should review the privacy policies and terms for any third parties before proceeding to those websites or using those third-party features or services.

8. Children's Privacy

Our Services are not designed for children, and we do not knowingly collect personal information from children under 18. However, a User may use our Services to provide health information about a minor child where permitted by law and with appropriate authorization. If you are a parent or legal guardian and you believe we have collected your child's information in violation of applicable law, please contact us using the contact information in the Contact Us section below.

9. Security

We have implemented safeguards intended to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction. Please be aware that despite our efforts, no data security measures can guarantee security.

10. California Notice at Collection

This section of the Policy provides additional information for California residents and describes our information practices pursuant to the California Consumer Privacy Act 2018, as amended by the California Privacy Rights Act 2020, and its implementing regulations (the "CCPA"). Depending on how you interact or engage with us, we may provide you with other privacy notices with additional details about our privacy practices.

This section applies to "personal information" as defined in the CCPA, whether collected online or offline. This section does not address or apply to our handling of personal information that is exempt under the CCPA.

Categories of Personal Information Collected and Disclosed. Depending on how you use the Services, we may collect (and have collected in the prior 12 months) the following categories of personal information:

Categories of Personal Information Collected	Categories of Third Party Disclosures
Identifiers. Such as name, alias, email, phone number, username, unique personal identifier, online identifier, IP address, or other similar identifiers.	- Advisors and agents<br>- Advertising networks<br>- Data analytics providers<br>- Internet service providers, operating systems, and platforms<br>- Parties you Authorize, Access or Authenticate
Other personal information. Such as gender and date of birth.	- Internet service providers, operating systems, and platforms<br>- Parties you Authorize, Access or Authenticate
Customer Records. Such as account information and customer records that contain personal information, such as name, account name, other characteristics or descriptions, email, address, phone number, and other contact information, communications preferences, billing and payment information, and other information you provide in order to use our Services.	- Advisors and agents<br>- Data analytics providers<br>- Internet service providers, operating systems, and platforms<br>- Parties you Authorize, Access or Authenticate
Commercial Information. Such as records of products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.	- Advisors and agents<br>- Data analytics providers<br>- Internet service providers, operating systems, and platforms<br>- Parties you Authorize, Access or Authenticate
Internet and electronic network activity information. Such as browsing history, clickstream data, search history, and information regarding interactions with our Site, advertisements, or emails, including other usage data related to your use of our Services or other online services.	- Advertising networks<br>- Data analytics providers<br>- Internet service providers, operating systems, and platforms<br>- Parties you Authorize, Access or Authenticate
Geolocation Data. Such as general location information about a particular individual or device.	- Data analytics providers<br>- Internet service providers, operating systems, and platforms
Audio, Visual, and Other Electronic Data. Such as information collected via call recordings if you are interacting with us, recorded meetings and videos, photographs	- Internet service providers, operating systems, and platforms<br>- Parties you Authorize, Access or Authenticate
Professional information. Such as job title, company name, business email, business phone number, and other similar professional-related information.	- Parties you Authorize, Access or Authenticate
Protected Classifications. Includes characteristics of protected classifications under applicable federal and state laws, such as disability information, and information you voluntarily provide (e.g. gender, marital status)	- We do not disclose this category of personal information.
Sensitive Personal Information. Account log-in, financial account, debit card, or credit card number in combination with any required security or access code or credentials allowing access to an account; Genetic and health data; Biometric data; Personal information collected and analyzed concerning a consumer's health.	- Affiliates and subsidiaries<br>- Internet service providers, operating systems, and platforms<br>- Third-party AI service providers (under zero data retention agreements)<br>- Parties you Authorize, Access or Authenticate

We have also disclosed the above categories of personal information to our service providers for business purposes in the past 12 months.

Source of Personal Information. We generally collect personal information from the following categories of sources:

• Directly or indirectly from you;

• Our affiliates and subsidiaries; and

• Adult representatives authorized by you.

Purposes of Collection, Use, and Disclosure. As described in the How We May Use Personal Information section above, in general, we collect and otherwise process personal information for the following business or commercial purposes, or as otherwise directed or consented to by you:

• Services and support;

• Account creation and management;

• Analytics and improvement;

• Communication;

• Customization and personalization;

• Marketing and advertising;

• Research and surveys;

• Insight development and data enhancement;

• Security and protection of rights;

• Compliance and legal process;

• Auditing, reporting, and other internal operations; and

• General business and operational support.

Sensitive Personal Information. Notwithstanding the purposes described above, we do not collect, use, or disclose "sensitive personal information" beyond the purposes authorized by the CCPA.

Retention of Personal Information. We retain your personal information for as long as needed or permitted, based on the reason we obtained it (consistent with applicable law). When deciding how long to keep your personal information, we consider whether we are subject to any legal obligations (e.g., any laws that require us to keep records for a certain period before we can delete them) or whether we have taken any legal positions (e.g., issued any legal holds or otherwise need to preserve the information). Rather than delete your data, we may also deidentify it by removing identifying details. Where we have committed to maintaining and using personal information in a deidentified form, we agree not to reidentify deidentified data except as permitted by applicable law.

Sales and Sharing of Personal Information. The CCPA defines "sale" as disclosing or making available personal information to a third-party in exchange for monetary or other valuable consideration, and "sharing" includes disclosing or making available personal information to a third-party for purposes of cross-contextual behavioral advertising.

While we do not disclose personal information to third parties in exchange for monetary compensation, we may be considered as "selling" or "sharing" personal information under the CCPA because of our use of third-party ad or analytics cookies and other tools. We "sell" or "share" the following categories of personal information:

• Identifiers

• Internet or other electronic network activity information

We disclose these categories to third-party advertising networks, analytics providers, and social networks or purposes of marketing and advertising. We do not sell or share personal information about individuals we know are under the age of 16.

California Privacy Rights. The CCPA provides California residents with specific rights regarding personal information. Subject to certain conditions and exceptions, California residents have the following rights with respect to their personal information:

1. Right to Know (Access & Portability). You have the right to request:

   (i) the categories or personal information we collected about you;

   (ii) the categories of sources from which the personal information is collected;

   (iii) our business or commercial purposes for collecting, selling, or sharing personal information; the categories of third parties to whom we have disclosed personal information; and

   (iv) a copy of the specific pieces of personal information we have collected about you.

2. Right to Correct. You have the right to request we correct inaccurate personal information.

3. Right to Delete. You have the right to request we delete your personal information.

4. Right to Opt-Out of Sales and Sharing. You have the right to opt-out of "sales" and "sharing" of your personal information as those terms are defined under the CCPA. To exercise these rights, please use the Do Not Sell or Share My Personal Information/Your Privacy Choices link at the bottom of our website. You also have the right to opt-out of "sales" and "sharing" of your personal information using an opt-out preference signal. If our site detects that your browser or device is transmitting an opt-out preference signal, such as the "global privacy control"---or GPC--- signal, we will opt that browser or device out of the use of cookies or other tools on our site that result in a "sale" or "sharing" of your personal information. If you come to our site from a different device or from a different browser on the same device, or if you clear your cookies, you will need to opt-out again, or use an opt-out preference signal, for that browser and/or device as well.

5. Right to Limit Use and Disclosure. You have the right to limit use of sensitive personal information under the CCPA.

6. Right to Non-Discrimination. We will not discriminate against you for exercising any of the rights described in this section.

Exercising Your Privacy Rights. If you are a California resident and would like to exercise your CCPA rights, you may do so via any of the methods described below:

• Email us at privacy@trianglehealth.com

Verification. Before responding to your request, we must first verify your identity using the personal information you recently provided to us. You must provide us with your full name and email address. We will take steps to verify your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

Authorized Agents. You may designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

Shine the Light Law

Under California's "Shine the Light" law (Cal. Civ. Code § 1798.83), California residents who provide us certain personal information are entitled to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing use. Such requests may be made once per calendar year for information about any relevant third-party sharing in the prior calendar year. To submit a "Shine the Light" request, email us using the Contact Us information below, and include in your request a current California address and your attestation that you are a California resident.

11. Changes to this Policy

This Policy is current as of the effective date set forth above. We may change this Policy from time to time, so please be sure to check back periodically. We will post any updates to this Policy on this page. If we make material changes to how we collect, use, or disclose the personal information we have previously collected, we will endeavor to provide you prior notice as required by applicable law, such as by emailing you or posting prominent notice on our website or within the Services.

12. Contact Us

If you have any questions or concerns regarding this Policy or our privacy practices, you may contact us at privacy@trianglehealth.com.