1. Introduction

Welcome. This Privacy Policy ("Policy") describes how ContinuumCare.ai ("Continuum," "ContinuumCare.ai," "CCAI", "Company," "we," "our," or "us") collects, uses and discloses information we obtain about your use of ContinuumCare.ai websites, ContinuumCare Mobile Apps ("the Sites") and the use of ContinuumCare.ai software ("the SW"), collectively "the Services".

ContinuumCare.ai provides software and digital Services designed to help individuals, families, caregivers, and trusted care partners collect, organize, monitor, understand, share, and manage health, wellness, and caregiving information. Our Services may include websites, mobile applications, web applications, communications, integrations, artificial intelligence-powered tools, family care coordination features, and related technologies.

We recognize that information concerning an individual's health, wellness, medical history, symptoms, medications, laboratory results, functional status, caregiving activities, and related matters is sensitive. We are committed to protecting such information and providing transparency regarding our privacy practices.

This Privacy Policy explains:

• What information we collect

• How we collect information

• How we use information

• When we share information

• Your rights and choices regarding your information

• How we protect information

• How artificial intelligence technologies are used within the Services, and

• How applicable privacy laws may affect your rights.

This Privacy Policy applies to all users of the Services, including: Individuals using the Services for themselves, Family members, Caregivers, Care recipients, Authorized representatives, Trusted contacts and Other users of the Services.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

2. Important Limitations of the Services

2.1 Not Medical Care

Continuum is a technology company. Continuum is not a physician, nurse, hospital, medical practice, health insurer, pharmacy, emergency service provider, licensed healthcare provider, or provider of medical treatment.

The Services are intended to support personal health monitoring, wellness tracking, caregiving coordination, health education, information organization, and communication among users and their authorized care networks.

Nothing contained within the Services constitutes:

• Medical advice

• Medical diagnosis

• Medical treatment

• Clinical decision-making

• Prescription recommendations

• Professional healthcare services, or

• Emergency medical services.

Users should consult qualified healthcare professionals regarding any medical condition, symptom, medication, diagnosis, treatment decision, or healthcare concern.

2.2 Emergency Situations

The Services are not intended for emergency use. Users should not rely upon the Services for urgent medical needs. If you believe that you or another individual may be experiencing a medical emergency, immediately call 911 in the USA or local emergency services.

2.3 AI Generated Input and Output

Certain features of the Services may utilize artificial intelligence, machine learning, predictive analytics, or automated processing technologies.

AI generated inputs involve extraction and structuring of health-related information from uploaded documents such as photographs of device readouts (e.g., blood pressure monitor) and text (e.g., lab reports). The input formats include but are not limited to jpeg, PNG and pdf. The documents are de-identified (i.e., your personal health information is removed) prior to the use of third party LLMs to analyze them. We maintain internal review processes to monitor AI performance of digitization of uploaded documents, identify and correct errors, and address potential harms.

AI generated outputs may: Contain inaccuracies, Be incomplete, Be outdated, Misinterpret uploaded information, or Produce incorrect conclusions. Users are solely responsible for evaluating the accuracy and appropriateness of AI generated outputs. AI generated content should not be relied upon as a substitute for professional medical experience and judgment.

2.4 We Are a Worldwide Company

Whether you are using our Services from the USA or from any location outside the USA, by using or downloading the Services, you agree that your personal information, including any information about your health that you provide directly to us or that we collect through your use of the Service, may be transferred to and stored in the United States and handled as described in this Policy.

3. Information We Collect About You

We may collect information directly from users, from authorized third parties, from integrated technologies, and automatically from your interactions with the Services. The categories of information we collect may include the following.

3.1 Account Information

When creating or maintaining an account, we may collect: Name, Nick name, Email address, Telephone number, Mailing address including postal code, Time zone, Username, Password credentials, Authentication information, Account preferences and settings, Communication preferences, Emergency contact information. Payment information using Credit card, Debit card, Bank transfer and other payment information is handled in compliance with PCI standards in conjunction with major payment systems.

3.2 Health and Wellness Information

Users may voluntarily submit health-related information, including but not limited to: Blood pressure measurements, Heart rate, Weight, Oxygen saturation, Blood glucose readings, ECGs, Laboratory results, Diagnostic reports, Medication information, Vaccination records, Allergies, Symptoms, Functional and frailty status information, Activity information, Sleep information, Nutrition information, Health goals, Care plans, Wellness assessments and Family health history.

Users control whether such information is submitted to the Services.

3.3 Uploaded Documents

Users may upload documents and images including but not limited to: Laboratory reports, Medical records, Hospital discharge summaries, Physician reports, Insurance documents, Medication lists, Imaging reports, Caregiver notes, Advance directives, Health assessments.

Our systems may process uploaded content to extract information, organize information, summarize content, or generate educational explanations.

3.4 Family and Caregiving Information

Users may submit information concerning: Family members, including family health history; Care recipients, Caregivers, Authorized representatives, Trusted contacts, Emergency contacts, Physicians and healthcare providers. Users represent that they possess all permissions and legal authority necessary to provide such information.

3.5 Device and Technical Information

When users access our Services, we may automatically collect: IP address, Browser type, Device type, Device identifiers, Operating system, Mobile carrier information, Geographic region, Application usage information, Error logs, Performance metrics.

3.6 Communications Information

We may collect information contained in communications with: Customer support, Product support, Technical support, User feedback channels, Surveys, Research activities.

3.7 Analytics Information

We may collect information regarding including, but not limited to: Feature usage, Session activity, User interactions, Clickstream data, Device performance and Service performance metrics. Such information helps us understand how users interact with the Services and improve our products.

4. How We Collect Information

We collect information through several methods:

4.1 Information You Provide

We collect information that users voluntarily provide when: Creating accounts, Uploading documents, Entering health information, Inviting caregivers, Participating in Family Care Circles, Contacting support, Responding to surveys.

4.2 Information Collected Automatically

Certain information is collected automatically through: Analytics tools, Device identifiers, Log files, Monitoring technologies.

4.3 Information From Authorized Third Parties

With appropriate authorization, we may receive information from: Family members, Caregivers, Healthcare providers, Health data integrations, Connected devices, Authorized third-party applications.

4.4 Information Generated Through the Services

Our systems may create additional information through: Data normalization, Trend analysis, Risk scoring, Health summaries, Educational explanations, AI-generated insights.

Such generated information may constitute derivative information derived from user-submitted information.

5. How We Use Your Information

We may use collected information for the following purposes:

• Service Delivery: To provide, maintain, operate, and improve the Services.

• Explain Health Information: To organize health information into formats that are tailored for users and caregivers and easier for users and caregivers to understand.

• Family Care Coordination: To facilitate communication and information sharing among authorized participants within Family Care Circles.

• AI and Educational Services: To generate summaries, explanations, educational content, trend analyses, and other informational outputs.

• Security: To maintain security, detect misuse, prevent fraud, investigate suspicious activity, and protect users.

• Customer Support: To provide assistance and respond to inquiries.

• Product Improvement: To develop new features, evaluate service performance, improve usability, and enhance user experience.

• Research and Analytics: To conduct internal research, analytics, quality assurance activities, and product development activities as further described in this Privacy Policy.

• Legal Compliance: To comply with legal obligations, regulatory requirements, court orders, and lawful governmental requests.

6. Family Care Circle

A core feature of Continuum is the Family Care Circle. The Family Care Circle allows users to share selected information with trusted individuals involved in caregiving, health advocacy, support, or family coordination.

Users Control: Who is invited; What information is shared; Permission levels; Revocation and discontinuation of access.

Authorize Participants: Family Care Circle participants may include: Family members; Friends; Caregivers; Care coordinators; Healthcare advocates; Other trusted individuals. They may be included in User's the Family Plan account, or may they may have their own account.

Responsibility for Sharing Decisions: Each Care receiver is solely responsible for granting permissions whether their information should be shared with a Family Care Circle Caregiver. Continuum cannot verify family relationships, caregiving status, or legal authority among participants.

Revocation of Access: Users may revoke permissions through available account settings. Revocation applies prospectively and may not affect information previously viewed, downloaded, copied, retained, or shared by authorized participants.

Discontinuation of Account: When a Care receiver discontinues their account, whether it is an individual account or part of a Family Plan, their data will immediately stop being accessible to their Caregivers.

Reliance on User Instructions: Continuum may rely on permissions, invitations, and access settings established by account holders and may act upon those instructions unless we have reason to believe they are unauthorized.

7. Data Ownership, User Rights, and Account Control

7.1 Ownership of User Information

As between Continuum and the user, users retain ownership of the information they submit, upload, enter, import, or otherwise provide to the Services ("User Information").

User Information may include: Personal information, Health and wellness information, Laboratory reports, Medical records, Caregiving information, Family information, Uploaded documents, Images, Communications, and Other content submitted through the Services.

Nothing in this Privacy Policy transfers ownership of User Information to Continuum.

7.2 License Granted to Continuum

In order to operate the Services, users grant Continuum a limited, non-exclusive, worldwide, revocable license to: Host User Information, Store User Information, Process User Information, Analyze User Information, Display User Information, Reproduce User Information, Transmit User Information, Generate derivative informational outputs based upon User Information, solely to provide, secure, maintain, improve, and support the Services and for the purposes described in this Privacy Policy.

This license terminates when User Information is deleted from the Services, subject to backup retention, legal obligations, audit requirements, and archival requirements described elsewhere in this Privacy Policy.

7.3 Access Rights

Subject to applicable law, users may request access to information maintained within their accounts. Access requests may include: Personal information maintained by Continuum, Categories of information collected, Sources of information, Purposes for collection and use, Categories of recipients receiving information. We may require identity verification before fulfilling requests.

7.4 Correction Rights

Users may request correction of inaccurate information maintained by Continuum. Where feasible, users may also update information directly through account settings. Continuum reserves the right to retain historical audit records reflecting prior versions of information when necessary for security, compliance, legal, or operational purposes.

7.5 Export and Portability Rights

Users may request a copy of certain information in a commonly used electronic format. The scope, format, timing, and method of export may vary depending upon: Technical feasibility; Legal requirements; Security considerations; Nature of the information requested.

7.6 Deletion Rights

Users may request deletion of information associated with their accounts. Deletion requests may be subject to exceptions permitting retention where necessary to: Comply with law; Resolve disputes; Enforce agreements; Maintain security; Prevent fraud; Exercise legal rights; Complete ongoing transactions; Maintain required business records. Certain information may remain within backup systems, audit logs, security records, or archived environments for limited periods after deletion requests are processed.

7.7 Account Closure

Users may close their accounts at any time. Account closure does not automatically result in immediate deletion of all information. Information may be retained according to the retention schedules described in this Privacy Policy.

8. AI Transparency and Automated Processing

8.1 Use of Artificial Intelligence

Continuum may use artificial intelligence ("AI"), machine learning, natural language processing, predictive analytics, large language models, optical character recognition, statistical modeling, and other automated technologies to support the Services.

Such technologies may be used to: Extract information from uploaded documents; Summarize medical records, Explain laboratory values, Identify trends, Generate educational content, Organize health information, Produce caregiver-friendly summaries, Generate reminders, Support wellness education.

8.2 Third-Party AI Processing

When you request an AI-generated digitization of your or your family care receiver's device or report, explanation, summary, or analysis, Continuum may securely transmit the minimum information reasonably necessary to one or more third-party AI service providers our behalf to generate the requested response. Depending on the feature used, this information may include de-identified or user-authorized demographic and health measurements, symptom descriptions, uploaded documents, laboratory values, medication information, and related contextual information necessary to produce the requested analysis. Our AI service providers are prohibited from using your identifiable information to train their own public AI models or for advertising purposes unless you separately authorize such use. AI providers process the information solely to provide the requested AI service to Continuum. AI-generated responses are returned to Continuum and displayed within the Services. Users may choose not to use AI-powered features, although doing so may limit certain functionality

8.3 Informational Purpose Only

AI-generated outputs are intended solely for informational, educational, organizational, and wellness-support purposes. AI-generated outputs do not constitute: Medical advice, Medical diagnosis, Medical treatment recommendations, Professional healthcare services, Clinical decision support. Users remain responsible for decisions made using information generated through the Services.

8.4 Potential Errors and Limitations

AI systems may: Produce inaccurate outputs, Misinterpret uploaded information, Generate incomplete summaries, Omit important details, Produce outdated information, Create incorrect inferences. Continuum does not guarantee the accuracy, completeness, reliability, or clinical validity of AI-generated outputs. Users should independently verify important information with qualified healthcare professionals.

8.5 Human Oversight

Continuum encourages users to review source information whenever available and to use human judgment when evaluating AI-generated outputs. AI outputs should not replace consultation with healthcare professionals.

8.6 Automated Processing

Certain processing activities may occur automatically without individualized human review. Examples may include: Categorization of records, Extraction of laboratory values, Trend detection, Risk scoring, Alert generation, Recommendation ranking. Users acknowledge that such processing is an inherent feature of the Services.

8.7 Future AI Capabilities

Continuum may introduce additional AI-powered features over time. Where required by law, additional notices, disclosures, consents, or controls may be provided before implementation of new AI capabilities.

9. Research, Analytics, Product Improvement, and AI Model Development

9.1 Internal Research and Analytics

Continuum may use information for internal research, analytics, testing, validation, quality assurance, product development, and operational improvement activities. These activities help us: Improve user experience, Enhance service performance, Improve AI systems, Evaluate product effectiveness, Detect errors, Develop new features.

9.2 De-Identification Practices

Where practical and legally permissible, Continuum may transform information into: De-identified information; Aggregated information, Statistical information, Anonymized information, Pseudonymized information. Such information may no longer identify a particular individual.

9.3 Research Activities

Continuum may use de-identified or aggregated information for: Health research, Wellness research, Caregiving research, User behavior analysis, Product evaluation, Publication of findings, Benchmarking studies. Any publication or disclosure of research results will be designed to prevent identification of individual users.

9.4 AI Model Training

Continuum may use de-identified, anonymized, aggregated, or otherwise lawfully processed information to: Train machine learning models, Improve AI systems, Validate algorithms, Measure model performance, Reduce bias, Improve accuracy. Unless expressly disclosed otherwise, Continuum does not use personally identifiable user information to train publicly available foundation models operated by unrelated third parties large language model APIs, and PHI or identified health data is never sent to those APIs without explicit consent.

9.5 Commercial Uses of De-Identified Information

De-identified, anonymized, aggregated, and statistical information may be used for commercial purposes, including: Research, Product development, Business analytics, Publications, Market analysis, Benchmark reporting. Such information will not intentionally identify individual users.

10. De-Identified Information, Service Providers, and Information Sharing

10.1 Service Providers

Continuum may engage third-party service providers to perform functions on our behalf. Examples include: Cloud hosting providers, Security vendors, Analytics vendors, Communication providers, Customer support providers, AI technology providers, Data storage providers, triage services, ECG/EKG independent review services. Service providers are authorized to access information only as necessary to perform contracted services.

10.2 Authorized Sharing

Information may be shared with individuals authorized by users, including: Family Care Circle participants, Caregivers, Healthcare advocates, Authorized representatives. Continuum relies upon permissions established by users.

10.3 Legal Compliance

We may disclose information when we reasonably believe disclosure is necessary to: Comply with law, Respond to subpoenas, Respond to court orders, Cooperate with regulators, Protect safety, Protect legal rights, Investigate fraud or misuse.

10.4 Corporate Transactions

Information may be transferred in connection with: Mergers, Acquisitions, Investments, Financings, Reorganizations, Bankruptcy proceedings, Asset sales. Any successor entity receiving information will remain subject to applicable legal obligations regarding such information.

10.5 No Sale of Personal Information

Continuum does not sell personal information in exchange for monetary consideration. If applicable privacy laws define certain disclosures as "sales" or "sharing," users may exercise rights provided under applicable law.

10.6 Marketing Communications

Continuum may send communications relating to: Product updates, Service announcements, Educational content, Newsletters, New features. Users may opt out of promotional communications at any time. Transactional and service-related communications may continue even after promotional communications are discontinued.

11. HIPAA Status, Consumer Health Data, and Regulatory Positioning

11.1 Continuum's Regulatory Status

ContinuumCare.ai is a consumer health, wellness, caregiving, and health information management platform. Except as expressly stated in any separate written agreement, Continuum does not operate as a: healthcare provider; hospital; physician practice; health plan; healthcare clearinghouse; or HIPAA Covered Entity. Users should not assume that all information submitted to the Services constitutes Protected Health Information ("PHI") subject to HIPAA. The applicability of HIPAA depends upon the source of information, the manner in which information is exchanged, and the contractual relationships involved.

11.2 Business Associate Relationships

In certain circumstances, Continuum may enter into a Business Associate Agreement ("BAA") with a healthcare provider, health plan, healthcare organization, or other Covered Entity. Where a valid BAA applies: HIPAA obligations may govern specific information, Additional privacy protections may apply, Additional security controls may be implemented, Specific contractual requirements may supersede portions of this Privacy Policy. Users participating through an enterprise customer, provider organization, or healthcare partner may receive separate notices describing those arrangements.

11.3 Consumer Health Information

Many users voluntarily upload information concerning: Medical conditions, Laboratory results, Vital signs, Symptoms, feelings and observations, Medications, Functional limitations, Caregiving activities, Wellness targets. Such information may be regulated under state consumer health privacy laws even when HIPAA does not apply. Continuum treats health-related information with heightened sensitivity regardless of whether HIPAA applies.

11.4 No Clinical Monitoring Obligation

The Services are designed to help users organize and understand information. Continuum does not undertake a duty to: Monitor health status, Review uploaded information, Detect emergencies, Contact physicians, Notify or alert emergency responders, Escalate clinical concerns. Users remain responsible for obtaining appropriate medical care and professional guidance.

11.5 No Medical Device Representation

Unless expressly stated otherwise, the Services are not intended to function as: Medical devices; Diagnostic tools; Clinical decision support systems; Emergency monitoring systems. Any health-related insights generated by the Services are intended for informational and educational purposes only.

12. Consumer Health Data Rights

12.1 Scope

Certain jurisdictions recognize special protections for consumer health data. Depending on applicable law, consumer health data may include information that identifies or can reasonably be linked to an individual's: Physical health, Mental health, Medical conditions, Diagnoses, Treatments, Symptoms, Medications, Vital signs, Disabilities, Healthcare services, Caregiving needs.

12.2 Collection and Use

Continuum collects consumer health data only for purposes reasonably necessary to: Provide requested Services, Facilitate caregiving coordination, Generate informational outputs, Improve platform functionality, Conduct analytics and research activities permitted by law, Maintain security and compliance.

12.3 User Rights

Subject to applicable law, users may request: Access to consumer health data; Correction of consumer health data, Deletion of consumer health data, Information regarding categories collected, Information regarding disclosures. We may verify identity before fulfilling requests.

12.4 Consent

Where required by law, Continuum will obtain appropriate consent before collecting, processing, sharing, or using consumer health data for purposes requiring consent. Users may withdraw consent where permitted by applicable law. Withdrawal of consent may affect availability of certain features or Services.

13. International Data Transfers and GDPR Compliance

13.1 Geographic Processing

Continuum may process information in: United States, Canada, India, and other jurisdictions where our service providers operate. Data protection laws may differ among jurisdictions.

13.2 Transfer Safeguards

Where required by applicable law, Continuum may implement safeguards including: Standard Contractual Clauses; Data Processing Agreements; Technical security measures; Organizational security measures; Vendor compliance reviews.

13.3 GDPR Rights

Continuum does not provide Services in GDPR jurisdiction countries. When Services are provided to individuals in GDPR jurisdictions we will update our Privacy Policy accordingly.

14. California Privacy Rights (CCPA/CPRA)

California residents have the right to receive notice regarding categories of personal information collected and purposes for collection. The categories described throughout this Privacy Policy constitute our California Notice at Collection.

15. Security and Information Protection

15.1 Security Program

Continuum maintains administrative, technical, physical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, destruction, loss, misuse, or theft.

Our security program is designed to be appropriate to: The sensitivity of information processed, The nature of the Services, Industry standards, Applicable legal requirements, Evolving security threats. No method of electronic transmission, storage, or processing can be guaranteed to be completely secure. Accordingly, Continuum cannot guarantee absolute security.

15.2 Technical Safeguards

Security measures may include: Encryption of information in transit using industry-standard protocols, Encryption of information at rest where appropriate, Role-based access controls, Least-privilege access principles, Multi-factor authentication; Security monitoring, Network security controls; Backup and recovery systems.

The specific controls employed may evolve over time as technologies and threats change.

15.3 Administrative Safeguards

Continuum implements security measures appropriate to the sensitivity of the information and the scale of our operations.

15.4 Vendor Oversight

Where third-party service providers process information on our behalf, Continuum may require contractual commitments concerning: Confidentiality, Security controls, Data protection, Compliance obligations. Continuum does not guarantee the actions or security practices of independent third parties.

15.5 User Responsibilities

Users are responsible for: Maintaining password confidentiality, Securing personal devices, Restricting unauthorized access to accounts, Reviewing Family Care Circle permissions, Promptly notifying Continuum of suspected account compromise.

15.6 Security Incidents

In the event of a security incident affecting information under our control, Continuum may investigate, mitigate, and provide notifications consistent with applicable law and contractual obligations.

Nothing in this Privacy Policy creates a contractual obligation to provide notification beyond what is required by law or applicable agreement.

16. Data Retention

16.1 Retention Principles

Continuum retains information only as long as you have an account with Continuum necessary to: Provide Services, Fulfill user requests, Maintain security, Resolve disputes, Comply with legal obligations, Support legitimate business operations. Retention periods may vary based on the type of information involved.

16.2 Backup Systems

Information may remain within backup systems for reasonable periods after deletion requests are processed. Backup copies are generally subject to restricted access and may be deleted according to backup lifecycle schedules.

16.3 Legal Holds

Continuum may retain information beyond standard retention periods when necessary to: Preserve evidence, Comply with court orders, Respond to investigations, Protect legal rights, Resolve disputes.

17. Children's Privacy

17.1 Services Intended for Adults

The Services are intended primarily for adults. Continuum does not knowingly direct the Services to children under the age of thirteen (13).

17.2 Children's Information

Dependent/minor health data, for example vaccines, can be uploaded by authorized adults. We do not knowingly collect personal information directly from children under 13 without appropriate legal authorization. If we become aware that personal information has been collected from a child in violation of applicable law, we may take steps to delete such information.

17.3 Information About Dependents

Users may upload information concerning family members, dependents, elderly relatives, or care recipients. Users represent that they possess the necessary rights, permissions, authority, or legal basis to provide such information.

18. Business Transfers and Corporate Transactions

18.1 Corporate Transactions

Continuum may participate in: Mergers, Acquisitions, Asset sales, Financings, Reorganizations, Strategic investments, Bankruptcy proceedings. Information maintained by Continuum may be transferred as part of such transactions.

18.2 Successor Organizations

Any successor entity acquiring information will generally be expected to honor applicable legal obligations relating to the information transferred. Users may receive notice of material changes in ownership or privacy practices where required by law.

18.3 Due Diligence Activities

Information may be disclosed during confidential due diligence processes conducted in connection with contemplated transactions, subject to appropriate confidentiality protections.

19. Changes to This Privacy Policy

19.1 Policy Updates

Continuum may revise this Privacy Policy from time to time. Reasons for updates may include: New products or features, Changes in law, Changes in technology, Changes in business operations, Changes in regulatory guidance.

19.2 Notice of Changes

When appropriate, Continuum may provide notice through: Website postings, Email communications, In-application notices, Account notifications.

19.3 Effective Date

Updated versions become effective as of the effective date stated at the top of the revised Privacy Policy unless otherwise specified. Continued use of the Services following an update constitutes acknowledgment of the revised Privacy Policy.

20. Contact Information

Questions, concerns, requests, complaints, and privacy-related inquiries may be directed to:

ContinuumCare.ai Email: support@continuumcare.ai

If Continuum designates a Data Protection Officer, EU Representative, UK Representative, or similar role in the future, contact information may be updated accordingly.

Contact: support@continuumcare.ai

Document Title: ContinuumCare.ai Privacy Policy

Last updated July 20, 2026 v3.5