MindMetrix has created the following "Privacy Policy" to inform you of its policies and practices regarding the collection, use and disclosure of information through the Services. This Privacy Policy applies to information you provide to us when you create your user account, or when you otherwise access our Services. Please note that the Services are not intended for use outside of the United States and this Privacy Policy applies only to users within the United States.

Capitalized terms not defined in this Privacy Policy shall have the meaning attributed in the Terms of Use. By your use of the Services you accept the terms contained in the Terms of Use and this Privacy Policy.

Information We Collect

MindMetrix limits the collection, use and processing of information to that which is required by MindMetrix to provide the Services and assist in the usability of the Site and the Platform. Information that is personally identifiable to you such as your name, email address is referred to as "Personal Information." Some Personal Information that we collect, use, and process (information collected and analyzed concerning your health, for example) is referred to as “Sensitive Personal Information.” By submitting information to us through the Site, Platform, or Services (when creating your account or completing an Assessment, for example), you expressly agree and consent to the processing of your information in accordance with this Privacy Policy.

The following are types of information we may receive:

• Identifiers such as: first and last name, user ID;
• Contact information such as: email address;
• Date of birth (to confirm assessment applicability);
• Health-related or medical information such as: a summary of your mental health symptoms, severity of your symptoms, information about your life which often has the ability to impact mental health, and the type of medications you may be taking (so that you can share relevant information with outside prescribers). PLEASE NOTE: As MindMetrix is not a healthcare provider, clearinghouse, or insurance company, we are not categorized as a covered entity subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Even so, MindMetrix is committed to ensuring the privacy and ethical use of user data and information.
• We utilize a third-party payment provider and we do not acquire or directly process any payment information (e.g., credit card information or bank account information). We do allow you to retain a link for that payment account (maintained by the payment provider) which is identified by the last four digits of the payment account.
• System information such as: browser type and IP address.
• Records and copies of your correspondence (including email addresses), if you contact us.
• Your responses to surveys that we might ask you to complete for research purposes.

This list is illustrative, not exhaustive; this Policy applies to all of your uses of the Services.

How We Collect Information

Self-provided information

We have access to and collect information provided by you, including information you voluntarily provide in setting up your account, purchasing the Services, using the Platform, or contacting us.

Automatically collected information

We may collect information about you through your use of the Services with software application tools and data files, such as cookies (as explained below), web log files, IP addresses, device state information, unique device identifiers, device hardware and OS information, and information relating to your login of your user account (“Usage Information”). You may be able to control such Usage Information through the control settings on your device. You may be required to permit such Usage Information to access and use our Services.

How We Use Your Information

We use your information as necessary to provide the Services and assist in the usability of the Site and the Platform. In addition, we may use your information in the following ways:

To offer relevant services

MindMetrix will use your information to provide the Services, communicate with you, and respond to your requests.

MindMetrix uses your Sensitive Personal Information, such as symptom information gathered through the Assessment, to facilitate the creation of content and information that may be relevant to you. You may choose to share that information with health care professionals, but MindMetrix does not automatically share this information unless you give your written consent.

To receive payment

Services provided through the Platform require payment by credit card. Accordingly, MindMetrix will collect Sensitive Personal Information, such as applicable financial information from individuals, and will use that information to perform billing and payment operations.

To improve our products and services

MindMetrix may use Usage Information to conduct analytics relating to the functionality of our Site, Platform, and Services. To the extent necessary to provide you with the Services, we may provide your Personal Information to other third-party contractors or business partners who work on our behalf to help us maintain the Site, Platform, or Services. MindMetrix will only share your Personal Information with third parties necessary to perform these functions or services.

For research

MindMetrix may, under certain circumstances, use de-identified and/or aggregated information and data of its users for research purposes. Research may be done either independently by MindMetrix, or jointly with third parties, and may be sponsored by, conducted on behalf of, or in collaboration with third parties. Research activities at MindMetrix concern the relationships between different mental health conditions and psychiatric treatment outcomes, including treatment problems and key factors in individual improvement. The information to be used will be limited to health information needed to conduct the research, and will not include any Personal Information, such as your name, address, or date of birth. All research published in professional journals must and will be approved by an Institutional Review Board (IRB) and deemed ethical. Your agreement to have your de-identified and/or aggregated information included in research is completely voluntary, and will not affect the Services you receive through MindMetrix. To opt-out of research use, or if you have any questions about research use, please email support@mindmetrix.com.

For communication

We may use your Personal Information to contact you through email or through notices posted on our websites, and other ways through our Services. We also use your Personal Information to send messages about how to use our Services, network updates, reminders, and promotional messages from us. Please be aware that you cannot opt out of receiving service messages from us, including security and legal notices.

How We Share Information

We may share your Personal Information with the following third parties for the following purposes:

• Your health care provider, at your request and with your express written consent. You may choose to have MindMetrix share your Assessment and related materials with your health care provider. MindMetrix does not automatically share this information. It is only shared with your written consent.
• Affiliates/partners. We may work with organizations with common ownership (affiliates) or partner with other companies in order to provide you with additional benefits. In the event that we enter into such a partnership, we may share your de-identified information with those partners.
• Law enforcement or pursuant to legal processes. It is possible that we will need to disclose information about you when required by law, subpoena, or other legal process or if we have a good faith belief that disclosure is reasonably necessary to (1) investigate, prevent or take action regarding suspected or actual illegal activities or to assist government enforcement agencies; (2) enforce our agreements with you; (3) investigate and defend ourselves against any third-party claims or allegations; (4) protect the security or integrity of our Services); or (5) exercise or protect the rights and safety of MindMetrix, our users, personnel or others. MindMetrix may disclose Personal Information when required by law or in the good-faith belief that such action is necessary in order to conform to the edicts of the law or comply with legal process served on MindMetrix. We do not disclose Sensitive Personal Information to law enforcement or pursuant to legal processes without an express Court Order.
• Merger/sale of business. In the event that MindMetrix enters into an agreement to be purchased by another company or to merge with another company, we may share Personal Information with that company. We will require that such purchasers continue to comply with the provisions as outlined in this Privacy Policy.

We may also share Usage Information with select third parties, including advertisers, for marketing or advertising purposes.

Security

We take precautions to protect your Personal Information, including reasonable physical, administrative, and technical safeguards. MindMetrix operates all its Services, including any payment information, across the Internet using secure connections (specifically Transport Layer Security/TLS/"HTTPS"/formerly known as SSL). All personnel and independent contractors of MindMetrix sign a confidentiality and nondisclosure agreement to protect your privacy.

For as long as we have your Personal Information, we will continue to protect the privacy and security of such Personal Information consistent with this Privacy Policy. However, no website, database or system is completely secure or “hacker proof.” You are also responsible for taking reasonable steps to protect your Personal Information against unauthorized disclosure or misuse. You are also responsible for protecting the security of your user account credentials and for any use of your user account.

Testimonials

Users of the Services can provide testimonials regarding their experiences with MindMetrix. From time to time, we may post testimonials on the Site. Testimonials contain Personal Information such as the individual’s first name and their statements about the Services. MindMetrix will obtain the individual’s consent prior to posting the testimonial.

Opt-out

When you create an account on the Site, you are opting in to receiving newsletters, emails and promotional materials from MindMetrix. At any time, you may opt-out of receiving such communications from MindMetrix by emailing us with your specific request at support@mindmetrix.com or, when available, through the Settings section of the Site. Note that opting out from such communications does not apply to our ability to communicate with you regarding non-marketing-related matters regarding your account or use of the Services.

Data Access and Deletion Requests

Depending on your state of residence, you may have the following rights:

• Right to access – means you can ask us for a copy of any Personal Information we have about you, if any.
• Right to correct – means you may ask us to change and/or correct any Personal Information we have about you.
• Right to delete – means you may ask us to delete any Personal Information we have about you and we will be happy to do so unless we are required to retain such information by law or regulation or we have a right to retain subject to a user agreement for our internal business purposes.
• Right to transfer – means you may request that a copy of your Personal Information in a commonly used and machine readable format be provided to you or to a third party you specify.
• Right to limit – means you have the right at any time to unsubscribe to any marketing communication from us and we will promptly honor such request. MindMetrix does not anticipate that its Services will be purchased or used outside of the United States or that the personal data it collects will be subject to international data privacy laws such as the General Data Protection Regulation (GDPR). If you have questions about your rights, or wish to make a request to access, correct, delete, transfer, or limit your personal information, please send an email to support@mindmetrix.com.

Links to Third Party Sites

The Site may contain links to other websites including social media widgets and "like" or "share" buttons. These other websites, third-party widgets and buttons are hosted by third parties and not by MindMetrix. MindMetrix is not responsible for the privacy practices or the content of such third-party websites or links. We encourage you to learn about the privacy practices and terms of use of those other companies, including their opt-out processes.

Protecting the Privacy of Children

Our Services are not provided to minors (i.e., persons under the age of 18). We elect to provide the Services only to persons 18 years of age or older, including any use of the Platform. By accessing or using our Services, you represent that you are not younger than 18. If we discover, or if you inform us, that an individual under 18 has provided us with Personal Information, we will close the account and delete that individual’s Personal Information; we will comply with the Children's Online Privacy Protection Act, 15 U.S.C. § 6501.06 and 16 C.F.R. §§ 312.1 – 312.12. We may, where permitted by law, retain certain information internally for purposes described in this Privacy Policy.

Changes to this Privacy Policy

We reserve the right to change, modify or update this Privacy Policy at any time, so please review it frequently. Any material changes in the way we use your Personal Information will be contained in the updated Privacy Policy posted on the Site. Your continued use of the Services will signify acceptance of the changes to the Privacy Policy.

More Information

If you have questions or concerns about our Privacy Policy, please email us at support@mindmetrix.com.

United States Addendum

The following additional terms may apply to you depending on where you reside in the United States. To the extent of any inconsistency, these terms take precedence over the terms in our Privacy Policy in relation to personal information that is collected and/or held in the United States. Please use the contact information in the Privacy Policy if you wish to access or correct any of your Personal Information that we hold or if you would like to report a potential breach by us of any applicable laws of the United States, our Privacy Policy, or this Addendum. We will promptly acknowledge and investigate any such reports.

The laws of the states described below are the ones we are currently aware of that require giving individual notice and/or consent with respect to our Services, and that provide for specific individual rights with respect to our Services. We recognize that other states also have laws that may affect your privacy rights with respect to our Services, and we direct you to the information in our Privacy Policy for a description of such rights. For all states, the following types of information and uses apply: As described further in our Privacy Policy, in the preceding twelve months, we or our service providers may have collected the below categories of Personal Information for business or commercial purposes:

• Identifiers (such as account information, name, email address, address, or phone number);
• Commercial information (such as transaction data);
• Internet or other network or device activity (such as IP address, unique device, advertising, and identifiers, browsing history or other usage data);
• Sensory information (such as audio recordings if you call our customer service);
• Other information that identifies or can be reasonably associated with you (such as user-generated content, e.g. reviews).

We collect the categories of Personal Information identified above from the following sources: (1) directly from you; (2) through your use of the Services; (3) affiliates; and (4) third-parties such as other users or our third-party providers. We or our service providers may collect the categories of information identified above for the following business or commercial purposes (as those terms are defined in applicable law):

• Our or our service provider’s operational purposes;
• Auditing consumer interactions on our Site (e.g., measuring ad impressions);
• Detecting, protecting against, and prosecuting security incidents, fraudulent or illegal activity and activity that violates any terms or policies;
• Bug detection, error reporting, and activities to maintain the quality or safety of our Services;
• Short-term, transient use, such as customizing content that we or our service providers display on Services;
• Providing the Services (e.g., account servicing and maintenance, data processing, customer service, advertising and marketing, analytics, communication about our Services, administering surveys and promotions, facilitating communications between users); Improving our existing Services and developing new Services (e.g., by conducting research to develop new products or features, or to train our employees on issues that our users need to be resolved);
• Other uses about which we notify you.

We describe our information sharing practices in the Privacy Policy. In the previous twelve months, we may have shared certain categories of Personal Information with third-parties for business purposes. For example, we may share your Personal Information with our research partners with whom we process your information. The Personal Information shared may include the following categories of Personal Information: (1) identifiers; (2) commercial information (such as the type of position you are seeking); (3) location information; and (4) other information that can be associated with you (such as information related to a research project).

Examples of these types of uses are identified below. We may also use the below categories of Personal Information for compliance with applicable laws and regulations, and we may combine the information we collect (“aggregate”) or remove pieces of information (“deidentify”) to limit or prevent identification of any particular user or device.

Table of Categories of Data, Uses and With Whom Shared:

We collect the categories of personal information identified above from the following sources: (1) directly from you; (2) through your use of the Services; (3) affiliates; and (4) third-parties such as other users or our third-party providers.

For Residents of California

If you are a California resident (as defined by the California Consumer Privacy Act), you may have certain rights.

This Notice for California Residents supplements the information in our Privacy Policy, and except as provided herein, applies solely to California residents (as defined by the California Consumer Privacy Act (CCPA) and amended by the Consumer Privacy Act Regulations (CPRA)). It applies to personal information (as defined by CCPA / CPRA) we collect on or through the Services and through other means (such as information collected offline, in person, and over the telephone). Until the CCPA / CPRA has specifically regulated business information, this Notice for California Residents does not apply to business information that does not constitute personal information.

Notice at Collection

Summary of Information We Collect

California law requires us to disclose information regarding the categories of personal information that we have collected about California consumers, the categories of sources from which we collect personal information, the business or commercial purposes (as each of those terms are defined by applicable law) for which we collect personal information, and the categories of parties with whom we share personal information. See the details as noted above for categories of information and uses.

Rights

If you are a California resident (as defined by the CCPA / CPRA), you may have certain rights. California law may permit you to request that we:

• Provide you the categories of personal information we have collected or disclosed about you in the last twelve months; the categories of sources of such information; the business or commercial purpose for collecting or selling your personal information; and the categories of third-parties with whom we shared personal information.
• Provide access to and/or a copy of certain information we hold about you.
• Request to opt-out of the sale or sharing of personal information.
• Delete certain information we have about you.

You may have the right to receive information about the financial incentives that we offer to you, if any. You also have the right to not be discriminated against (as provided for in applicable law) for exercising certain of your rights referenced herein. Certain information may be exempt from such requests under applicable law. In addition, we need certain types of information so that we can provide our Services to you. If you ask us to delete it, you may no longer be able to access or use our Services.

If you would like to exercise any of these rights, please submit a request at support@mindmetrix.com or visit www.mindmetrix.com. You will be required to verify your identity before we are able to fulfill your request, for instance by logging into your account. You can also designate an authorized agent to make a request on your behalf. To do so, you must provide us with written authorization or a power of attorney, signed by you, for the agent to act on your behalf. You will still need to verify your identity directly with us.

The CCPA / CPRA, sets forth certain obligations for businesses that “sell” personal information. We do not sell personal information. Metrics

California law may require us to compile the following metrics for the previous calendar year: the number of rights requests received, complied with, and denied, as well as the median number of days within which we responded to those requests. To the extent this obligation applies to us, we will update this section after the CCPA / CPRA has been in effect for a year.

California Shine the Light

If you are a California resident, you may ask for a list of third-parties that have received your information for direct marketing purposes during the previous calendar year. If we have shared your information, this list will contain the types of information shared, and we will provide this list at no cost. To make such a request, contact us at support@mindmetrix.com.

California Do-Not-Track Disclosure

We are committed to providing you with meaningful choices about the information collected on our Services for third-party purposes. That is why we are providing the NAI "Consumer Opt-Out" link, the DAA opt-out link, and a Google opt-out link. However, we do not currently recognize or respond to browser-initiated Do-Not-Track signals, as the Internet industry is currently still working on Do-Not-Track standards, implementations, and solutions.

For Residents of Colorado

The Colorado Privacy Act goes into effect as of July 1, 2023. If you are a resident of Colorado and you meet the definition of a “consumer,” you may have certain rights.

Summary of Information We Collect

Colorado law requires us to disclose information regarding the categories of personal data that we have collected about Colorado consumers, the categories of sources from which we collect personal information, the business or commercial purposes (as each of those terms are defined by applicable law) for which we collect personal information, and the categories of parties with whom we share personal information. See the details as noted above for categories of information and uses.

Rights

Colorado law may permit you to request that we act on a consumer’s following rights:

• Right of access to and/or a copy of certain information we hold about you.
• Right to correct for any inaccuracies in your personal data.
• Right to request that we delete your personal data.
• Right to obtain your personal data in a portable (and if technically feasible, readily usable) format.
• Right to request to opt-out of the sale of personal data, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects.

If you would like to exercise any of these rights, please submit a request at support@mindmetrix.com. You will be required to verify your identity before we are able to fulfill your request, for instance by logging into your account. You can also designate an authorized agent to make a request on your behalf. To do so, you must provide us with written authorization or a power of attorney, signed by you, for the agent to act on your behalf. You will still need to verify your identity directly with us.

To opt-out of such sale / sharing, you may email support@mindmetrix.com.

For Residents of Illinois

Rights

Residents of Illinois may have certain rights under the Biometric Information Privacy Act. Please note that while users may post pictures, videos or other file formats through the Platform, we do not digitally analyze any such data for any biometric identification purposes. We do not believe that a user’s election to upload such content constitutes “biometric information”, but if a user elects to include content that has images of persons included, please note that provision of such content constitutes the user’s consent that we may use such content through the Services or in a way that may become public as noted above. Part of our support for our Services may involve capturing voice or video recordings of you. We do not use such recordings for identification. If applicable you will be provided with our Consent and/or Lawful Basis to Collection and Processing of Personal Data notice for additional information.

For Residents of Nevada

Rights

Under Nevada law, certain Nevada consumers may opt out of the sale of “personally identifiable information” for monetary consideration to a person for that person to license or sell such information to additional persons. “Personally identifiable information” includes first and last name, address, email address, phone number, Social Security Number, or an identifier that allows a person to be contacted either physically or online. We do not engage in such activity; however, if you are a Nevada resident who has purchased or leased goods or services from us, you may submit a request to opt out of any potential future sales under Nevada law by emailing support@mindmetrix.com. Please note we will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.

For Residents of Virginia

The Virginia Consumer Data Protection Act went into effect as of January 1, 2023. If you are a resident of Virginia and you meet the definition of a “consumer,” you may have certain rights.

Summary of Information We Collect

Virginia law requires us to disclose information regarding the categories of personal data that we have collected about Virginia consumers, the categories of sources from which we collect personal information, the business or commercial purposes (as each of those terms are defined by applicable law) for which we collect personal information, and the categories of parties with whom we share personal information. See the details as noted above for categories of information and uses.

Rights

Virginia law may permit you to request that we act on a consumer’s following rights:

• Right to confirm if we are processing personal data we hold about you.
• Right to correct for any inaccuracies in your personal data.
• Right to request that we delete your personal data.
• Right to obtain your personal data in a portable (and if technically feasible, readily usable) format.
• Right to request to opt-out of the sale of personal data, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects.

If you would like to exercise any of these rights, please submit a request at support@mindmetrix.com. You will be required to verify your identity before we are able to fulfill your request, for instance by logging into your account. You can also designate an authorized agent to make a request on your behalf. To do so, you must provide us with written authorization or a power of attorney, signed by you, for the agent to act on your behalf. You will still need to verify your identity directly with us.

To opt-out of such sale / sharing, you may email support@mindmetrix.com.

For Residents of Utah

The Utah Consumer Privacy Act will go into effect as of December 31, 2023. If you are a resident of Utah and you meet the definition of a “consumer,” you may have certain rights.

Summary of Information We Collect

Utah law requires us to disclose information regarding the categories of personal data that we have collected about Utah consumers, the categories of sources from which we collect personal information, the business or commercial purposes (as each of those terms are defined by applicable law) for which we collect personal information, and the categories of parties with whom we share personal information. See the details as noted above for categories of information and uses.

Rights

Utah law may permit you to request that we act on a consumer’s following rights:

• Right to confirm if we are processing personal data we hold about you.
• Right to correct for any inaccuracies in your personal data.
• Right to request that we delete your personal data.
• Right to obtain your personal data in a portable (and if technically feasible, readily usable) format.
• Right to request to opt-out of the sale of personal data, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects.

If you would like to exercise any of these rights, please submit a request at support@mindmetrix.com. You will be required to verify your identity before we are able to fulfill your request, for instance by logging into your account. You can also designate an authorized agent to make a request on your behalf. To do so, you must provide us with written authorization or a power of attorney, signed by you, for the agent to act on your behalf. You will still need to verify your identity directly with us.

To opt-out of such sale / sharing, you may email support@mindmetrix.com.