LIFEVAULT BIO, INC. D/B/A GOODCELL PRIVACY POLICY

Last Revised on June 5, 2020

Welcome to the Privacy Policy (“Privacy Policy”) for LifeVault Bio, Inc., the holding company of GoodCell (“LifeVault” “GoodCell” “we” or “us”). This Privacy Policy describes how we collect, use and disclose information about you (“Information”) related to your use of and access to the LifeVault sites, content, applications, services, tools and features, provided by us, including without limitation, the website www.goodcell.com (the “Site”), any of their subdomains, or any related sites, applications, widgets or online services offered by us (collectively, the “Services”). This Privacy Policy discloses our information collection and dissemination practices in connection with the Services. This Privacy Policy does not address personal information that you provide to us in other contexts (e.g., through a business or investment relationship not handled through the Services). Please read this Privacy Policy and our Terms of Service carefully. For purposes of this Privacy Policy, “you” and “your” means you as the user of the Services.

1. TYPES OF INFORMATION WE COLLECT

When you use the Services, we may collect and receive Information in the following categories:

• “Personal Information,” which means information that identifies you (whether directly or indirectly), such as your name, postal address, email address, telephone number, payment card information, health-related information, including your “Stored Materials” (defined below) and the results any genetic or other testing performed by us or on our behalf (“Testing Results”), and any other information that you submit, including answers to surveys or questionnaires, testimonials or other information regarding your experiences with LifeVault’s products or services); and
• “Non-Personal Information,” which means information that does not directly or indirectly identify, and cannot reasonably be used to identify, you. If Non-Personal Information is directly or indirectly associated with Personal Information, this Non-Personal Information is then treated as Personal Information.

Information we may collect about you includes:

• Registration details you provide when you create an account, such as your name, email address, telephone number, birthdate, username and password.
• Information you provide related to your cells from your peripheral blood, including, but not limited to: your DNA, plasma and peripheral blood mononuclear cells (collectively, your “Stored Materials”), as well as Information you provide related to your health history including, but not limited to: your family history, medical history, allergies, diet and exercise habits, and information related to other medical or health issues.
• Information we create and/or collect about you, including from our third party lab partners, in creating your Testing Results.
• Information you provide when you access or use the Services and each time you interact with the Services or otherwise with us, for example, when you update Information in your dashboard, communicate with us by telephone or email, and order or download updates. This includes your payment Information. We also store Information about the products you purchase through the Services, such as the product specifications, date of purchase, and details relating to any support issue.
• Information you provide in public forums through the Services, including using our review, comment, testimonials, post or similar functionality. As noted below, if you provide such Information to the Services, we will identify you by your initials and geographic location (e.g., state of residence) when posting such Information to any public or semi-public part of the Services, including the Site.
• Usage, viewing and technical Information, including your IP address or device identifier when you use the Services. If you access your account from a mobile device, that mobile device may also provide us with details of your location. Most mobile devices allow you to disable this functionality.
• Information we receive about you from third parties. For example, if you access the Services through a third party platform or log-in, we may also collect your email address and other Information associated with that third party, and any Information you have made public in connection with that service or which the third party shares with partner services. See also Section 9 (THIRD PARTY WEBSITES, REFERRALS AND LINKS).

2. HOW WE COLLECT YOUR INFORMATION

• We collect Information you provide to us when you: register with us; input Information into the Services; create user generated content; request products, services or information from us; participate in public forums or other activities through the Services; respond to customer surveys; or otherwise interact with us or the Services.
• We collect Information through unique identifiers (such as IP address or your mobile device advertising identifier). An Internet Protocol (“IP”) address is a number that automatically identifies the computer/device you have used to access the Internet. The IP address enables our server to send you the web pages that you want to visit, and it may disclose the server owned by your Internet Service Provider.
• Each time you access the Services, LifeVault collects some Information to improve the overall quality of your online experience. For example, we collect aggregate queries for internal reporting and also counts, tracks, and aggregates our users’ activity into our analysis of general traffic-flow on the Services.
• LifeVault uses cookies to improve your online experience when visiting the Site. Cookies are pieces of information that a website transfers to a user’s computer for purposes of storing information about a user’s preferences. Cookies in and of themselves do not personally identify users, although they do identify a user’s computer. Many websites use cookies as a standard practice to provide useful features when a user visits the website and most web browsers are set up to accept cookies. You can set your browser to refuse cookies, but some portions of the Site may not work properly if you refuse cookies. Some of the Site’s web pages may use web beacons in conjunction with cookies to compile aggregate statistics about website usage. A web beacon is an electronic image (also referred to as an “action tag,” “single-pixel,” or “clear GIF”) that is commonly used to track the traffic patterns of users from one web page to another in order to maximize web traffic flow and to otherwise analyze the effectiveness of websites. Some web beacons may be unusable if you elect to reject their associated cookies.
• We may also use services hosted by third parties, such as Google Analytics, to better understand who is using the Services, how people are using the Services and how to improve the effectiveness of the Services and its content, and to help those parties serve more targeted advertising to you across the Internet or help us serve more targeted advertising to you. These third parties may use cookies, pixel tags, or other technologies to collect and store Non-Personal Information such as time of visit, pages visited, time spent on each page of the Services, device identifiers, type of operating system used and other website(s) you may have visited. They might combine Information they collect from your interaction with the Services with Personal Information they collect from other sources. We do not have access to, nor control over, third parties’ use of cookies or other tracking technologies.

3. CONFIDENTIALITY OF TESTING RESULTS AND OTHER HEALTH INFORMATION

We understand that your health information is important to you and take appropriate measures to maintain the confidentiality of such information in accordance with applicable laws. We use and disclose your Testing Results in accordance with applicable laws, the terms of our GoodCell Consent for Testing Form and our Terms of Service. We also use and disclose Information that constitutes individual-level health information in accordance with applicable laws.

4. USE OF YOUR INFORMATION BY LifeVault

We use the Information that we collect from you to provide you with the Services, support and enhance your access to and use of the Services, to monitor which features of the Services are of most interest and to allow us to determine which features we need to focus on improving. If you choose to provide us with Personal Information, you consent to the transfer and storage of that information on our servers located in the United States, and to the use of that Personal Information in accordance with the terms of this Privacy Policy. The ways in which we may use your Information include the following:

• To provide you with the Services and other products and services you request.
• To administer your GoodCell account, respond to your inquiries and send you administrative and service communications.
• To communicate with you about your account or transactions with us and send you details or updates about features of the Services or changes to our policies.
• To process payments.
• To create anonymized and aggregated data sets that may be used for a variety of functions, including research, internal analysis, analytics, and other functions.
• To ensure consistency with local law and choices and controls that may be available to you.
• To personalize content and experiences and advertising.
• To determine whether you would be suitable to take part in surveys, polls or questionnaires that we are conducting.
• To detect, investigate and prevent activities that may violate our policies or be illegal.
• To optimize or improve the content, products, services, and features of the Services and develop new products and services.
• To evaluate customer response to our products and services, personalize and improve the Services and user experiences, to increase the functionality and user friendliness of the Services, to deliver content or features that match user profiles or interests.
• To monitor and analyze the Services usage and trends and otherwise measure the effectiveness of the services.
• To send you offers and promotions for our other products and services.

In some cases, LifeVault may use Personal Information submitted by you, such as your answers to questions or surveys about our products or services, your demographic or geographic information, to demonstrate the value of its products and/or services in marketing and/or advertising materials or media. In such cases, LifeVault shall not identify you as the source of such information without your express consent, and absent such consent, shall ensure that any such presented information is anonymized so that the information will not be attributable to you when and as presented.

5. SHARING YOUR INFORMATION WITH OTHER COMPANIES

We will not sell, lease, or rent your individual-level information (i.e., information about a single individual’s genotypes, diseases or other traits/characteristics) to any third party or to a third party for research purposes without your explicit consent. We will use your information and share it with third parties for scientific research purposes unless you have opted out of Data Sharing. Note that we will disclose your individual-level information only if we obtain additional explicit consent from you. We may share your Personal Information outside LifeVault in the following circumstances, which you consent to:

• When you allow us to share your Personal Information with another company, such as directing us to share your Personal Information with third-party sites or platforms, such as social networking sites. If you use third party sites or platforms made available through the Services (e.g., Facebook logon), those third parties will have access to your date to the extent that you have authorized their access. Please consult Section 9 below and the third party’s privacy policy for additional information.
• When you request our referral services to forward or share certain content with a friend, such as an email inviting a friend to use the Services or sharing certain content from the Services with a friend.
• When we contract or partner with a third party to provide services on our behalf, which we do for Services development and maintenance, to perform Testing on your Stored Materials, to distribute and transport materials, the collection of blood and to transfer materials to laboratories. We require all third parties to process your data in accordance with this Privacy Policy and as permitted by applicable data protection laws.
• In connection with the sale of a business (including merger, acquisition, or sale of all or a material portion of its assets, change in corporate control, or insolvency or bankruptcy proceedings).
• We may disclose your Personal Information to respond to subpoenas, court orders, legal process or governmental regulations, or to establish or exercise our legal rights or defend against legal claims. We may also disclose your Personal Information if we believe it is necessary to share information in order to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or as otherwise required by law or regulation.

In addition, we may share Non-Personal Information and anonymized and aggregated data sets with third parties, alone or in combination with the Non-Personal Information of other users.

6. PUBLIC VENUES AND SEMI-PUBLIC VENUES OF THE SERVICES.

If you use a message board, comment function, conversation pages, blogs, social community environments, profile pages, or other public or semi-public venue or forums of the Services, you will be identified on those venues by the username you submit.

7. POSTING REVIEW OR OTHER COMMENTS TO THE SERVICES

If you submit a review or provide other comments to the Services, and we display such comments on a public or semi-public part of the Services, we will identify you by your initials and geographic location (e.g., state of residence).

8. YOUR CONTROLS AND CHOICES

We provide you the ability to exercise certain controls and choices regarding our collection, use and sharing of your Information. Your controls and choices may include:

• You may correct, update and close your registration account.
• You may change your choices for newsletters and alerts.
• You may choose whether to receive from us offers and promotions for our products and services.
• You may request access to the Personal Information we hold about you and that we amend or delete it, although we may be entitled to retain some information for certain purposes (e.g., to comply with regulatory requirements).

You may exercise your controls and choices, or request access to your Personal Information, by modifying your profile or by contacting us at [email protected] or following instructions provided in communications sent to you. Please be aware that, if you do not allow us to collect Personal Information from you, we may not be able to deliver certain products and services to you, and some of our services may not be able to take account of your interests and preferences. If you have questions regarding the specific Personal Information about you that we process or retain, please contact us at [email protected].

9. THIRD PARTY WEBSITES, REFERRALS AND LINKS

The Site may contain links to third-party websites that may offer information of interest. We do not control such other online platforms and are not responsible for their content, their privacy policies, or their use of your Personal Information. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators except as disclosed on the Services. This Privacy Policy does not apply to those websites, and LifeVault recommends reviewing those websites’ privacy policies individually. Please keep in mind that Information you post on public or semi-public venues, including Information you share on third party social networking platforms (such as Facebook or Twitter) may also be viewable by other users of the Services and/or users of those third-party online platforms without limitation as to its use by us or by a third party. When you provide Information to a third-party online platform, the Information you provide may be separately collected by that third party. The Information the third-party online platform collects is subject to the third-party online platform’s privacy practices. Privacy choices you make on the third-party online platform will not apply to our use of the Information we collect directly through our Services. We expressly disclaim any and all liability for the actions of third parties, including but without limitation to actions relating to the use and/or disclosure of Personal Information by third parties.

10. SECURITY

Please note that Information you send to us electronically may not be secure when it is transmitted to us. We recommend that you do not use unsecure channels to communicate sensitive or confidential Information to us. From time to time, we review our security procedures to consider appropriate new technology and methods. Please be aware though that, despite our best efforts, no security measures are perfect or impenetrable. We will retain your Personal Information for the length of time needed to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required, or for the establishment, exercise or defense of legal claims, or for legitimate businesses purposes, or as provided by law. To provide secure credit card processing when ordering from us, orders placed through our Services are processed through our third party payment processor, Stripe, which operates under its own privacy policy. To learn more about our policies with respect to third parties, please see Section 9. To learn more about Stripe and its policies that apply when you make a payment through its services, please review the terms of such policies.

11. RESPONSE TO “DO NOT TRACK” SIGNALS

Do Not Track (DNT) is a privacy preference that users can set in some web browsers, allowing users to opt out of tracking by websites and online services. LifeVault and the Services recognize DNT.

12. CHILDREN’S PRIVACY

We do not seek or knowingly collect any Personal Information about children under 13 years of age. If we become aware that we have unknowingly collected Personal Information from a child under 13 years of age, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child under 13 years of age who has provided us with Personal Information, you may contact us at [email protected] to request it be deleted.

13. UPDATING THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time in which case we will update the “Last Revised” date at the top of this Privacy Policy. If we make changes that are material, we will use reasonable efforts to attempt to provide notice to you and, where required by applicable law, we will obtain your consent. Notice may be by email to you at the last email address you provided us, by posting notice of such changes on the Services, or by other means, consistent with applicable law. However, it is your sole responsibility to review the Privacy Policy from time to time to view any such changes. The updated Privacy Policy will be effective as of the time of posting, or such later date as may be specified in the updated Privacy Policy. If you do not accept this Privacy Policy, including any changes, then you must not access or use the Services.

14. CALIFORNIA PRIVACY RIGHTS

This Privacy Policy describes how we may share your Information for marketing purposes. It applies to all users of the Services, including California residents. If you are a user of the Services and a California resident under the age of 18, you may request to have your posted content or Information removed from the publicly viewable portion of this web site by emailing us at [email protected]. Content or Information may not be removed from our systems or databases. In certain situations, content or Information cannot be removed. As a California resident, you may contact us with any questions or to request a list of third parties to whom we may disclose Information for such third parties’ marketing purposes and the categories of Information we may disclose. See How to Contact Us below.

15. NEVADA RESIDENTS

Pursuant to Nevada law, you may direct a business that operates an internet website not to sell certain Personal Information a business has collected or will collect about you. GoodCell does not sell your Personal Information pursuant to Nevada law. For more information about how we handle and share your Personal Information or your rights under Nevada law, contact us at [email protected].

16. HOW TO CONTACT US

You may contact us regarding the use or disclosure of Personal Information or this Privacy Policy at: 179 Bear Hill Road, Suite 204, Waltham, MA 02451, by phone at 800-772-0593 or by e-mail at support[email protected].