Privacy Policy

Effective Date: October 9, 2026

Palmos Labs, Inc. ("Palmos Labs," "we," "us," or "our") operates an AI-powered clinical surveillance platform for cancer treatment monitoring through our mobile application, web application, and paired wearable device integrations (collectively, the "Services"). This Privacy Policy describes how we collect, use, disclose, store, and protect your personal information when you use our Services. Our Services are also governed by our Terms of Use which are incorporated by reference.

Required Disclosures

Palmos Labs offers the Services only to U.S. residents located in the United States. The Services are not directed to, and are not intended for use by, individuals outside the United States. By using the Services, you represent that you are a U.S. resident. If we learn that a user does not meet these requirements, we may suspend or close the account.

An independent third party has assessed Palmos Labs's data protection program, and our production systems are hosted in environments operated by our infrastructure providers, including Amazon Web Services ("AWS"). We apply safeguards designed to meet HIPAA standards to the health and biometric sensor data we collect, including data from supported wearable devices.

Palmos Labs provides the Services directly to you, not on behalf of your healthcare provider or health plan. If you have directed your healthcare provider or health plan to share your "protected health information" ("PHI") with us, the information we receive from them will no longer be subject to HIPAA, and HIPAA generally does not govern how we handle it. Your information is instead protected under this Privacy Policy and applicable U.S. federal and state privacy laws, including the FTC Health Breach Notification Rule and state consumer health data laws. We voluntarily apply safeguards designed to meet HIPAA standards, and we require vendors that handle your health information to agree to appropriate data protection terms in accordance with this approach.

1. Scope

This Privacy Policy applies to personal information collected through our mobile application (available on Apple App Store and Google Play Store), our web application, our website (palmoslabs.com), paired wearable device integrations, and all communications with us. This Policy does not apply to third-party websites, applications, or services that may be linked to or integrated with our Services. If you are a Washington or Nevada resident, please also review our Consumer Health Data Privacy Policy [link], which describes our practices regarding consumer health data under those states' laws.

2. Information We Collect

2.1 Personally Identifiable Information ("PII")

We collect the following PII directly from you:

• First name, last name, and preferred name
• Mailing address
• Email address
• Date of birth (used for age verification)
• Account credentials, including password
• Healthcare provider information
• Hand-signed or electronic signatures (for consent and authorization forms)

2.2 Health and Biometric Sensor Data

Collection of health and biometric sensor data requires your affirmative opt-in via our In-App Health Data Consent Screen presented at device pairing. When you opt in, we collect:

• Heart rate, resting heart rate, and heart rate variability ("HRV")
• Blood oxygen saturation ("SpO2")
• Skin temperature
• Approximate geolocation data (from paired wearable devices), which we use to track weather and environmental factors that may impact your respiratory health
• Device-reported timestamps and metadata

We also may collect:

• Step counts, activity intensity, calories burned, and workout data
• Electrocardiogram ("ECG") recordings (if your device supports this feature)
• Electrodermal Activity ("EDA") recordings (if your device supports this feature)

We also collect electronic medical records ("EMR") and electronic health records ("EHR") data including diagnoses, medications, laboratory results, and clinical notes when you authorize your healthcare provider to disclose such records to Palmos Labs via a signed Patient Directive and Authorization for Disclosure of Health Information.

2.2A Patient-Reported Information

We collect information you enter in the Services, including daily check-ins, symptoms and side effects, medication adherence, and mood or quality-of-life responses.

2.3 Sensitive Personal Information

Health information, biometric data, precise geolocation data and account log-in credentials are treated as "sensitive personal information" under applicable US state privacy laws.

2.4 Automatically Collected Information

When you use our Services, we automatically collect:

• Device identifiers, device model, and operating system
• Internet Protocol ("IP") address, approximate location derived from IP address, and time zone
• App usage data, including screens viewed, features used, session duration, and crash logs
• Firebase Analytics, Crashlytics, and Firebase Performance data (screen-name templates, app-instance IDs, device model, OS/app version, language, coarse country/region from IP, per-request timing, and error events)
• Glitchtip error and crash tracking data (backend and web)

We use analytics and crash-reporting tools, including Firebase and GlitchTip, to understand how the Services are used and to fix problems. These tools may receive information about which screens and features you use and the types of data involved in an error, linked to an app or device identifier. They do not receive your name, email address, or the content of your health information, such as your symptoms, answers, readings, or diagnoses. We do not allow these providers to use this information for advertising.

Our website (palmoslabs.com) does not use cookies or similar technologies. Our web application is an authenticated user dashboard that uses browser storage to keep you signed in and to protect your account. We do not use cookies or similar technologies for advertising.

2.5 Information from Third Parties

We may receive information from:

• Wearable device platforms you authorize (Samsung Health, Polar, Masimo) via their respective APIs
• Healthcare providers or health information exchanges you authorize to share your medical records
• Google Places API, used for address autofill and pharmacy locator features within the app

3. How We Collect Information

We collect information through three channels:

• Directly from you: during account registration, through in-app forms, daily check-ins, consent and authorization processes, and support communications.
• Automatically: through your use of the Services and paired wearable devices, via analytics and performance monitoring tools.
• From authorized third parties: when you authorize wearable device platforms or healthcare providers to share data with us.

4. Consent and Authorization Framework

We use separate, purpose-specific consents and authorizations for different data practices:

4.1 In-App Health Data Consent Screen

Presented at device pairing. Provides opt-in consent for the collection of health and biometric sensor data from your wearable device.

4.2 In-App Sharing Consent Screen

Presented as a separate, dedicated screen. Provides opt-in consent for outbound disclosure of your health data to your designated healthcare provider.

4.3 Patient Directive and Authorization for Disclosure of Health Information

Signed authorization under HIPAA and the 21st Century Cures Act directing your healthcare provider to disclose your medical records to Palmos Labs.

4.4 Patient Authorization for Use and Disclosure of Health Information for Research and Product Development

Signed authorization permitting Palmos Labs to use your identifiable health information for internal research and product development purposes.

We comply with state consumer health data laws, including the Washington My Health My Data Act (MHMDA), Nevada SB 370, the Colorado Privacy Act, the Connecticut Data Privacy Act (CTDPA), and the Virginia Consumer Data Protection Act (CDPA). We obtain additional consent or written authorization as required by applicable state law. We do not sell consumer health data. We maintain written retention and destruction schedules as required by law. We may use, share, and sell data that has been de-identified in accordance with Section 6.6

You may withdraw any consent or revoke any authorization at any time by following the procedures described in the applicable consent or authorization document, or by contacting us at privacy@palmoslabs.com. Withdrawal of consent does not affect uses or disclosures we made before the withdrawal.

5. How We Use Information

We use the information we collect for the following purposes:

• To operate, maintain, and provide the Services, including delivering personalized insights, trends, and wellness recommendations
• To generate insights, risk indicators, and alerts using automated and AI-based analysis
• To verify your identity and manage your account
• To communicate with you about your account, the Services, and security matters
• To generate aggregated and de-identified analytics for service improvement and internal reporting
• To detect, prevent, and address fraud, security incidents, and technical issues
• To comply with legal obligations, including FTC regulations and applicable state privacy laws
• For internal research and product development – only with your separate, specific authorization for identifiable health and biometric data (Patient Authorization for Research and Product Development)
• To respond to your inquiries and provide customer support

We do not use your personal information for profiling to support decisions that produce legal or similarly significant effects concerning you. Insights and alerts generated by the Services are intended to support, not replace, the judgment of you and your healthcare providers.

THE SERVICES ARE NOT EMERGENCY SERVICES, AND YOUR DATA IS NOT MONITORED IN REAL TIME. IF YOU ARE EXPERIENCING A MEDICAL EMERGENCY, CALL 911.

6. How We Share Information

We do not sell your personal information. We do not engage in cross-context behavioral advertising. We do not use your personal information for targeted advertising.

6.1 Service Providers and Sub-Processors

We share information with service providers who assist in operating the Services, including cloud infrastructure (AWS), data analytics (Databricks), communications, identity verification, customer support, and monitoring services. These providers are bound by written contracts that restrict their use of your information to services performed on our behalf.

6.2 Wearable Device Platforms

We exchange data with wearable device platforms (Samsung Health, Polar, Masimo) through their APIs as necessary to collect your authorized health and biometric sensor data. Your use of these platforms is governed by their own terms and privacy policies.

6.3 Healthcare Providers and Covered Entities

We share your health data with your designated healthcare provider(s) only after you authorize such sharing via the In-App Sharing Consent Screen. Such sharing is subject to any applicable Business Associate Agreements.

6.4 Legal and Regulatory Disclosures

We may disclose your information in good faith when we believe disclosure is necessary to comply with applicable law, legal process, or governmental request; to enforce our Terms of Use; to protect the safety, rights, or property of Palmos Labs, our users, or the public; or to detect, prevent, or address fraud, security, or technical issues.

6.5 Business Transfers

In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to a successor entity, subject to the protections of this Privacy Policy and with advance notice to you.

6.6 Aggregated and De-Identified Information

We may use, share, and sell aggregated or de-identified information that cannot reasonably be used to identify you, in accordance with applicable de-identification standards. We de-identify health information using HIPAA compliant methods. We keep and use de-identified information only in de-identified form and will not try to re-identify it, except as allowed by law, such as to test whether our de-identification methods work. When we share or sell de-identified information, we require the recipient to agree in writing not to re-identify it and to impose the same requirement on any further recipient of the information.

7. Data Storage, Security, and Infrastructure

7.1 Data Location

We store and process personal information primarily in the United States.

7.2 Security Measures

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption in transit using TLS 1.2 or higher
• Encryption at rest using AES-256
• Role-based access controls with least-privilege principles
• Mandatory multi-factor authentication ("MFA") for all production system access
• Network isolation using Virtual Private Cloud ("VPC") architecture, private subnets, and security groups
• AWS Key Management Service ("KMS") for encryption key management with automatic key rotation
• Comprehensive audit logging
• Regular vulnerability assessments, penetration testing, and continuous monitoring

7.3 Breach Notification

In the event of a breach of health information or other personal information, we will provide notification as required by applicable laws.

8. Data Retention

We retain your information for the following periods, unless you request deletion as set forth in Section 9:

If we retain information after a deletion request because an exception applies (for example, a legal recordkeeping obligation), we will tell you which information we retained and why, and we will use it only for that purpose.

9. Your Rights

Certain states in the U.S. provide (now or in the future) their state residents with rights related to their personal information. Consistent with these laws, Palmos Labs gives you options to access, edit, or remove certain information, as well as choices about how we contact you. Although some of these rights apply generally, certain rights will only apply to limited individuals or circumstances. To the extent that these laws apply to us and to you, you may exercise the following rights:

• Right to Know/Access: Request information about the categories and specific pieces of personal information we have collected about you.
• Right to Correction: Request correction of inaccurate personal information.
• Right to Deletion: Request deletion of your personal information, subject to certain exceptions.
• Right to Data Portability: Receive a copy of your personal information in a portable and readily usable format.
• Right to Opt Out of Sale/Sharing/Targeted Advertising: We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.
• Right to Limit Use of Sensitive Personal Information: Request that we limit our use of your sensitive personal information to purposes necessary to provide the Services.
• Right to Withdraw Consent: Withdraw any consent or revoke any authorization independently at any time.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Appeal: If we deny your privacy request, you have the right to appeal our decision. To appeal, email privacy@palmoslabs.com with the subject line "Privacy Request Appeal" within 45 days of our decision. We will respond within the time required by applicable law. If we deny your appeal, you may contact your state Attorney General.

9.1 How to Exercise Your Rights

To submit a request, contact us at privacy@palmoslabs.com. We will verify your identity before processing any request. We will respond within forty-five (45) days of receiving your request, with an extension of up to an additional forty-five (45) days where reasonably necessary. You may disconnect your wearable device at any time through your account settings. Authorized agents are accepted in California and other states where applicable.

10. Children's Privacy

Our Services are not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children under 13. We use date of birth for age verification and enforcement. For minors under the age of sixteen (16), we apply additional protections as required by applicable laws. If we discover that we have collected personal information from a child under 13, we will promptly delete such information. If you believe we might have any information from or about a child, please contact us at privacy@palmoslabs.com.

11. International Data Transfer

We operate exclusively in the United States. Our Services are designed for U.S. residents located in the United States, and we store and process personal information primarily in the United States.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will revise the "Effective Date" at the top of this Policy. For material changes, we will provide at least thirty (30) days' prior notice via email to the address associated with your account or through an in-app notification. Your continued use of the Services after the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. However, we will not use or disclose your health information in a materially different way than described when we collected it without first obtaining your affirmative consent.

13. Contact Information

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact our Privacy Officers (Chief Information Security Officer and Head of Operations):

• Email: privacy@palmoslabs.com
• Mail: Palmos Labs, Attn: Privacy, 19 Cumberland Street #3, San Francisco, CA 94110

You may also file a complaint with your state Attorney General regarding any suspected violation of state privacy law.