Kelvi Clinician Privacy Policy

This Privacy Policy explains how Hypothermia Devices, Inc., doing business as Kelvi ("Kelvi," "we," "us"), collects, uses, shares and protects information when you use the Kelvi Clinician app for iOS and Android (the "app"). Patients using the Kelvi Patient app are covered by the Kelvi Patient Privacy Policy, and our website at kelvi.com is covered by a separate privacy policy.

Information we collect

Account and profile information you provide

• Your email address, first and last name, employer, position and preferred language
• Your password, which we store only in hashed form, never as readable text
• A profile photo, if you choose to add one. You can take it with your camera or choose it from your photo library, and the app accesses only the photo you take or select.
• The date you accepted our terms

Patient and treatment information

• The patients on your patient list, including the name and email address of any patient you invite
• Treatment plans you create, including temperatures, durations, number of cycles, body area and purpose
• Treatments you assign to patients, including schedules, directions, and each patient's starting pain level and range of movement
• A record of each treatment session you run, and any notes you enter for a manually recorded session
• Treatment history and survey responses from patients linked to you

Device and technical information

• Crash reports when the app encounters an error. These include device identifiers, device model, operating system version, app version and technical details about the error.
• When the app communicates with our servers, our systems may record technical information such as your IP address and the time of the request.

Kelvi devices and software updates

The app connects to Kelvi devices over Bluetooth to send treatment settings and show treatment progress. It does not send your name, your patients' names or other personal information to the device.

The app also checks our servers for Kelvi device software updates. When you install one, the app connects to the device over the device's own Wi-Fi network to transfer the update.

How we use your information

We use your information to:

• Create and manage your account, verify your email address, and reset your password
• Let you create treatments, assign them to patients, run them, and review patient history
• Invite patients and maintain your patient list
• Provide software updates for Kelvi devices
• Send you service messages about your account and the app
• Diagnose crashes and fix problems with the app
• Create de-identified data, as described below
• Meet our legal obligations and protect the security of the app

We do not use your information for advertising, and we do not send you marketing.

De-identified data

We use treatment information to create de-identified data. De-identified data has had names, email addresses and anything else that identifies you or your patients removed. We use it, alone or combined with data from other users, to develop and improve heating and cooling therapy protocols and our products.

Where we handle patient information as your business associate, we create de-identified data only as permitted by the business associate terms in our Clinician Terms and Conditions, and in line with HIPAA's de-identification standard.

De-identified data is not personal information. It is not covered by the rest of this policy and is not removed when you delete your account.

How we share your information

We do not sell your information. We share it only as follows:

• Patients you link with. A patient you link with can see your name and profile information, and the treatment plans and sessions you assign them. Removing the link ends their access through the app.
• Service providers. We use companies that help us run the app, including Microsoft Azure, which hosts our servers and database; Amazon Web Services, which hosts our device software update service; Sentry, which processes crash reports; and a provider that delivers our emails. They may use your information only to provide services to us, and must protect it with the same level of protection described in this policy.
• Legal requirements. We may disclose information when required by law, such as in response to a subpoena or court order, or to protect the rights, safety or property of Kelvi, our users or others.
• Business transfers. If Kelvi is involved in a merger, acquisition or sale of assets, your information may transfer as part of that transaction, subject to this policy.
• With your consent. We may share your information for other purposes when you ask us to or give us permission.

We do not allow third parties to collect information about your activity across other apps or websites through the app.

HIPAA and your patients' information

This policy covers your own information as a user of the app. Your patients' information is handled differently.

If you are a "covered entity" under the Health Insurance Portability and Accountability Act (HIPAA), Kelvi acts as your "business associate" for the patient information you enter or access through the app. We handle that information on your behalf, under HIPAA and the business associate terms in our Clinician Terms and Conditions, which limit how we may use and disclose it.

You remain responsible for your own obligations to your patients, including responding to their requests to access, correct, restrict or receive an accounting of disclosures of their records. If a patient contacts us with such a request, we will refer them to you.

We also protect health information as required by California law.

Accessing and updating your information

You can view and update your profile information in the app at any time. For any other request about your information, email us at info@kelvi.com.

Retention and deletion

We keep your information for as long as your account exists. You can delete your account at any time:

• In the app. Open Settings, then select Delete Account. Your account and its data are deleted immediately.
• On our website. If you cannot sign in, have forgotten your password, or have already uninstalled the app, request deletion at kelvi.com/delete-account. Requests are processed within 30 days.

Deleting your account permanently deletes your account and all personal data associated with it, including your profile information, the treatment plans you created, the assignments you made and the sessions you ran. If your account is linked to a patient, that link is removed. Their account remains, but anything that came from your account, such as assigned treatment plans and sessions, is removed from theirs as well. Likewise, if a patient you are linked with deletes their account, their profile, the treatments assigned to them, their sessions and their survey responses are removed from your account.

The app is not intended to be your system of record. Keep any patient records you need in your own systems, because deleted data cannot be recovered.

We may need to retain certain information when we have a legal obligation or lawful basis to do so. Residual copies may remain in encrypted backups for a limited period until they are routinely deleted.

The app stores a copy of your information on your phone so it can work offline. Uninstalling the app removes that copy but does not delete your account.

Security

We use reasonable administrative, technical and physical safeguards to protect your information, consistent with the HIPAA Security Rule. These include encrypting information sent between the app and our servers, storing passwords only in hashed form, and keeping backups encrypted. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Because the app holds patient information, please keep your phone and password secure, and tell us at info@kelvi.com if you think someone else has accessed your account.

Children

The app is intended for healthcare professionals and is not directed to children. We do not knowingly collect personal information from children under 13, and you may not use the app to invite or register patients under 13. If we learn that we have collected information from a child under 13, we will delete it. If you believe this has happened, contact us at info@kelvi.com.

Do Not Track

Some browsers and devices offer a "Do Not Track" setting. There is no common standard for responding to these signals, so the app does not respond to them. The app does not track you across other apps or websites.

Changes to this policy

We may update this policy from time to time. When we do, we will post the updated policy on this page and change the effective date above. If we make material changes, we will notify you by email or through the app.

Contact us

If you have any questions about this Privacy Policy, you can contact us:

• By email: info@kelvi.com
• By visiting this page on our website: kelvi.com/contact