Privacy Policy

1. Overview

Green Sun Medical, LLC ("Green Sun Medical," "Green Sun," "we," "us," or "our") provides dynamic orthotic technologies that aid in treating spinal deformities, including the Whisper brace hardware and a pre-loaded software application (collectively, the "Device") that interacts with a mobile software application (the "App") to track, record, and assess a variety of data points to help a health care provider monitor, assess, and ensure effective treatment and comfort of the brace and help treat or prevent spinal deformities ("Treatment Data").

The Device and the App, working together, enable individuals ("Individual Users") using a Device to authorize Green Sun Medical to share this information on the Individual User's behalf with their physicians ("Physician Users") via a web-enabled interactive platform (the "Platform"). In addition, we collect certain information via our website at whisperforscoliosis.com (our "Site").

This Privacy Policy ("Policy") explains what information we collect, how we use that information, and what we do to protect it. This Policy applies to all personal data of individuals collected or used by us, whether such information results from your use of the Device or by registering for an Account or submitting information via the Platform or the Site.

This Privacy Policy is incorporated into and is subject to the Green Sun Medical Terms of Use (the "Agreement").

Green Sun Medical reserves the right, in its sole and absolute discretion, to modify this Policy (in whole or in part) from time to time, and any such modification shall be immediately effective upon posting by Green Sun Medical on the Site. It is important that you review this Policy regularly to ensure you are updated as to any changes and fully understand the terms and conditions set forth herein. If you have any questions concerning this Policy, please email Green Sun Medical at whisperconnect@greensunmedical.com. If you do not agree to any changes made to this Policy, you should observe the Agreement and cease all use of the App, Device, and/or Site.

2. Types of Information We Collect

When you visit our Site, use your Device, or register for an account on our Platform ("Account"), you may provide us one or more of the following types of information: personal information ("PII"), personal health information ("PHI"), and indirect, non-personally identifiable usage information ("Usage Data").

PII and PHI

When you set up your Device, register for an Account, or order a Device, we may collect the following types of PII:

• Name
• E-mail address
• Gender
• Date of birth
• Mailing address
• Telephone number

You may choose not to provide your PII; however, setting up your Device and creating an Account is a prerequisite for using the full functions of a Device on our Platform.

In addition, when you use your Device or your Account, we may collect the following types of PHI:

• Medicare and secondary insurance information
• Age
• Height
• Weight
• Prescribing physician and office
• Symptoms and activities you report, by time and date
• Activity level during monitoring
• Patient identification number
• Clinical information and diagnostic results

Health Information Privacy

PHI is entitled to special protections under the law, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Green Sun Medical makes the Notice of Privacy Practices Concerning Your Personal Health Information available in accordance with the HIPAA Privacy Rule (a federal regulation officially known as the Standards for the Privacy of Individually Identifiable Health Information). The HIPAA Privacy Rule is distinct from Green Sun Medical's Notice of Privacy Practices Concerning Your Personal Health Information, which describes in detail your rights and Green Sun Medical's obligations with respect to individually identifiable PHI that Green Sun Medical may receive both online and offline. PHI is health information, including demographic information collected from an individual, that: (1) is created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse; and (2) relates to the past, present, or future physical or mental health or condition of an individual, the provision of healthcare to an individual, or the past, present, or future payment for the provision of healthcare to an individual, and (i) identifies the individual, or (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. Together, this Policy and the Notice of Privacy Practices Concerning Your Personal Health Information describe how Green Sun Medical uses a User's individually identifiable personal information and health information (identified therein as personal health information).

Usage Data

In order to maintain and improve our services, we may collect non-personally identifiable Usage Data about how you use the Device, Platform, and Site. This information is collected by automated means, including by using certain standard web measurement and tracking technologies such as "cookies," web server logs, or other statistics programs.

We use cookies for things like:

• Authentication: to help us authenticate you to deliver personalized content
• Security: to protect you, us, and others, and help us detect fraud and other violations of our Terms of Use
• Performance: to make our Site or Platform easier and faster to use
• Features: to enable features and store information about you (including on your Device or in your browser cache) and your use of a Device or our Platform or this Site
• Analytics and Research: to monitor and evaluate the use of Devices, the Platform, or our Site

Your browser may have an option that allows you to accept cookies, reject cookies, or receive notification when a cookie is sent, but you should note that the use of such restrictive browser settings may limit your use of this Site or the Platform. No personally identifiable information is used in this process.

You may be able to opt out of third-party advertiser and ad network placement of cookies for targeted advertising by visiting the Network Advertising Initiative, the Digital Advertising Alliance, and Google Ads Settings. You will continue to receive generic ads by companies not listed with these opt-out tools.

You may also be able to disable placement of some (but not all) cookies by setting your browser to decline cookies, though this may worsen your user experience. If you delete your browser cookies, your opt-out cookie will also be deleted. Additionally, if you change computers or web browsers, you will need to opt out again. A useful resource for information about deleting and controlling cookies can be found at AboutCookies.org.

If you enable location data for your Device (including any pre-installed native application), you are expressly agreeing that we may use your location data to provide our services and collect your Treatment Data. You may disable location services at any time in your device settings.

Finally, we may de-identify your PII to make it anonymous and use it in an aggregate form, either alone or in combination with Usage Data, to create reports about trends or analyses of treatments, disorders, or conditions, demographic information, and performance information about our Device. This type of information is referred to as "Aggregate Data" and has been de-identified in compliance with the U.S. Department of Health and Human Services' Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule, and does not identify you personally. We reserve the right to share Aggregate Data with third parties, including for marketing purposes or to publish Aggregate Data in white papers, publications, or reports.

3. How We Use Your Information

We use the information we collect in several different ways for a variety of purposes, including:

• To provide, develop, maintain, operate, and improve our services, Devices, Platform, and our Site
• To track and calculate your Treatment Data and provide it to your Physician User
• To provide Individual Users with the ability to store, review, and edit their PII and PHI on the Platform, and to share their PHI with the Physician Users they designate and authorize
• To send service messages and information about our services, Devices, Platform, and our Site in which you may be interested
• To communicate with you and respond to your customer service inquiries
• To communicate with you about other products, services, and promotional events
• To fulfill any orders you place for our products or services
• To improve our products and services

4. Sharing Information

We may disclose your PII for permitted business purposes with our preferred service providers, business partners, and others, consistent with applicable law. However, if your consent is required by law, or we believe that your consent is appropriate in the circumstances, we will obtain your consent before sharing your PII. When we share your PII with business partners, our agreements with these partners will limit the purposes for which your PII can be used. We will not sell or rent your PII to third parties for their own purposes.

We will only disclose your PHI to your Physician User, as directed by you at the time you set up your Account. Our Device, Site, and Platform are provided directly to Individual Users who direct us to share their PHI with the Physician Users they authorize. We are not a business associate of any Physician User. We only disclose and share your PHI under the circumstances described in our Notice of Privacy Practices Concerning Your Personal Health Information.

We may also share your PII with our preferred service providers, consultants, or related third parties in order to provide you with the products and services you request. For example, they may handle your Device orders, credit card processing, data management, email distribution, delivering the Device to you, or providing you with the Platform or Site as you requested. The service providers to whom we disclose your PII are obliged to use such personal information only to provide services to us, and are not authorized by us to use or disclose your personal information except as necessary to perform services on our behalf, as specifically authorized by us or you, or to comply with legal requirements.

We also may share information where required by law.

Green Sun Medical expressly reserves the right to transfer any and all such information, including without limitation personal information, to a successor in interest of Green Sun Medical that acquires rights to that information as a result of the sale of Green Sun Medical or the acquisition of all or substantially all of its assets.

5. Data Security

Green Sun Medical uses good faith physical, managerial, and technical safeguards to preserve the integrity and security of User personal information. Green Sun Medical attempts to restrict access to PII and PHI to those employees, agents, contractors, and representatives who need access to perform their job functions, such as customer service personnel and technical staff. Green Sun Medical cannot, however, ensure or warrant the security of any information transmitted to Green Sun Medical; users do so at their own risk. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of your information at any time. For any additional information about the security measures Green Sun Medical uses on the Site, please contact Green Sun Medical at whisperconnect@greensunmedical.com.

6. Information from Children

This Site is not intended for children under the age of thirteen (13). We do not knowingly collect or solicit personal information from or communicate with children under the age of thirteen via the Site. If you believe we have collected the personal information of an individual under the age of thirteen, please contact us immediately at whisperconnect@greensunmedical.com.

Any Individual Users of the Platform or Device who are under eighteen (18) years of age may only use the Platform or Device if they are under the direct supervision of a parent or legal guardian. In such cases, the parent or legal guardian is required to set up and be the owner of the Account and is solely responsible for monitoring all activity on such Account and for all PII and PHI collected via such Account. The parent or legal guardian may review, edit, or remove any PII or PHI contained in such Account. You may not establish an Account if you are under the age of eighteen (18) years of age except as described in this section.

7. How We Handle Data From International Users

The servers from which we provide the Platform and Site, and to which all Treatment Data, PII, and PHI are sent, are located in the United States. If you are physically located within the European Union, you may not submit any PII or PHI to Green Sun Medical or use the Device, Site, or Platform.

If you believe that we have not adhered to this Policy, please contact us by e-mail at whisperconnect@greensunmedical.com.

To edit or delete any information contained in your Account, please log in and update your profile. To unsubscribe from an email or other messaging, please follow the instructions in any email or messages you receive.

8. California Residents

California Civil Code Section 1798.83 permits Individual Users who are California residents to request and obtain from us a list of what personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year, and the names and addresses of those third parties. Requests may be made only once a year and are free of charge. Under Section 1798.83, Green Sun Medical currently does not share any personal information with third parties for their direct marketing purposes.

9. Other Terms and Conditions

In addition to this Policy, your access to and use of any Device, the Platform, or our Site is subject to our Terms of Use [INSERT LINK], including the disclaimer that Green Sun Medical does not provide medical advice or information and only facilitates communication of Treatment Data for informational purposes between Individual Users and their approved Physician Users. You should always consult your designated Physician User regarding your Treatment Data and any related condition. If you have a medical emergency, always call 911. We are not responsible for any health condition related to Treatment Data.

10. Questions?

If you have any questions regarding privacy while using the Device, Platform, or our Site, or have questions about Green Sun Medical's practices, or wish to review or update your information, please contact Green Sun Medical at:

11. Privacy Policy Updates

This Privacy Policy is subject to revision at any time, and if Green Sun Medical makes any substantial changes in the way it collects, uses, or discloses User personal information, Green Sun Medical will, at its own discretion, post a notice on this page or send Users an e-mail. If a User objects to any such changes, the User must cease using the Website and Services. A User's continued use of the Website or Services following notice of any such changes shall indicate acknowledgement of such changes and agreement to be bound by the terms and conditions of such changes.