Privacy Policy

Felt Technologies, Inc. (“Felt,” “we,” “our,” and/or “us”) values the privacy of individuals who use our application, websites, and related services (collectively, our “Services”). This privacy policy (the “Privacy Policy”) explains how we collect, use, and disclose information from users of our Services (“Users”). By using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service available in the application where you signed up for our Services.

We may process some of your information in the role of a “processor” on behalf of our mobile app customers and in the role of a “processor” or “Business Associate” on behalf of telehealth providers. In those contexts, our processing of your personal information is subject to and may be additionally restricted by Felt’s agreements with mobile app customers and telehealth providers. The mobile app providers and telehealth providers are data controllers and their privacy policies will apply to the processing of your personal information. We are not responsible for their privacy or data security practices, which may differ from those explained in this Privacy Policy.

We may collect a variety of information from or about you or your devices from various sources, as described below. We may collect some of this information as a processor on behalf of our health app partners. For more details on what information we collect on behalf of these partners, please see Appendix A.

A. Information You Provide to Us.

Registration and Account Information. When you sign up for an account, we may ask you for your name, phone number, email address, insurance information, and some information about your health and what topics you are interested in.

Communications. If you contact us directly, we may receive additional information about you, such as your name, email address, phone number, the contents of a message or attachments that you may send to us, and other information you choose to provide. When you communicate with us online, third party vendors receive and store these communications on our behalf.

Payment Information. If you make a payment on our Services, your payment-related information, such as credit card or other financial information, is collected by our third-party payment processor on our behalf.

B. Information We Collect When You Use Our Services.

Device Information. We receive information about the device and software you use to access our Services, including IP address (which can be used to derive your general location data), device type, device identifiers, web browser type and version, operating system version, and push notification tokens.

Usage Information. We automatically receive information about your interactions with our Services, like the pages or other content you view, referrer information (the website you visited before coming to our Services), and the dates and times of your visits.

Messages Between Users and Chatbots. When you communicate with chatbots through our Services, we and our third-party partners receive the content of the messages you send and receive and information about those messages, such as when they were sent or received.

Information from Cookies and Other Tracking Technologies. We and our third-party partners collect information about your activities on our Services using cookies, pixel tags, SDKs, or other tracking technologies.

C. Information We Receive from Other Sources.

Information from Partner Health Apps. If you connect one of our partner health apps to our Services, we may receive personal and health-related information from that app.

Health Insurers. If you choose to provide us with your insurance information, we may receive information from your insurance provider regarding whether your insurance covers our Services.

Telehealth Provider Partners. To the extent you become a patient of one of our telehealth provider partners, we may collect information about you for or on behalf of such telehealth providers as their business associate or processor, such as communications between you and the telehealth provider. We will process that information in accordance with our agreements with your telehealth providers.

We use the information we collect:

• To provide, maintain, improve, and enhance our Services;
• To train, develop, and improve the artificial intelligence, machine learning, and models that we use to support our Services;
• To personalize your experience on our Services such as by providing tailored content and recommendations;
• To understand and analyze how you use our Services and develop new products, services, features, and functionality;
• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
• To facilitate the connection of third-party services or applications, such as our partner health apps;
• For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;
• To generate anonymized or aggregate data containing only de-identified, non-personal information that we may use for any lawful purposes such as to publish reports;
• To send you text messages and push notifications;
• To facilitate transactions and payments;
• To find and prevent fraud and abuse, and respond to trust and safety issues that may arise;
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
• For other purposes for which we provide specific notice at the time the information is collected.

Affiliates. We may disclose any information we receive to our current or future affiliates for any of the purposes described in this Privacy Policy.

Vendors and Service Providers. We disclose information we receive to vendors and service providers retained in connection with the provision of our Services.

Telehealth Provider Partners. If you choose to connect with a telehealth provider, we will disclose information to them for their treatment and payment purposes.

Health App Partners. We may disclose the information we collect to the companies that provide your health apps that incorporate our Services.

Health Insurers. If you elect to provide us with your health insurance information to seek reimbursement for services provided to you by our telehealth provider partners, we may provide certain limited information about you to your health insurer for payment purposes.

Marketing. We may use your information to send you direct marketing communications and may work with vendors to help us deliver and manage those communications.

AI Service Providers. We may disclose information we receive to vendors that provide artificial intelligence services that provide backend support for our Services.

Analytics Partners. We may disclose your information to analytics providers to help us understand how users interact with our Services, monitor performance, and support product development and reporting.

Advertising Partners. We may use your information to promote our Services to you on platforms where our Services are available and may work with vendors to measure the effectiveness of our advertising.

As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.

Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected.

Consent. We may also disclose your information with your permission.

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional email messages from us, you will continue to receive administrative messages from us. You can opt out from our promotional SMS messages by replying “STOP” to our message.

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.

We do not knowingly collect, maintain, or use personal information from children under 18 years of age without the consent of a parent or legal guardian, and no part of our Services is directed to children without such consent. If a parent or legal guardian provides appropriate consent, we may collect, maintain, and use personal information from children in accordance with this Privacy Policy and applicable law. If you believe that a child has provided us with personal information without the required consent, please contact us at compliance@feltclinic.com, and we will take appropriate steps to delete such information.

Our Services are hosted in the United States and intended for visitors located within the United States. If you choose to use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the U.S. for storage and processing. We may also transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing.

For individuals in Washington and Nevada, please refer to our Consumer Health Data Privacy Policy for additional information about the processing of your information that is “consumer health data” as defined under those laws.

For individuals in California, you have rights under the California Consumer Privacy Act of 2018. Please see additional information below that is intended to satisfy our obligations under the CCPA to disclose certain information to you.

Personal Information We Collect About You. In the preceding 12 months, we have collected the following categories and specific types of consumer personal information:

How Your Personal Information is Collected. We collect most of this personal information directly from you—in person, by telephone, text or email and/or via our website and apps. See Information We Collect.

Why We Use Your Personal Information. We collect and/or share consumer personal information for the business purposes described in How We Use the Information We Collect.

Who We Share Your Personal Information With. In the preceding 12 months, we have sold or shared consumers’ personal information as described in How We Disclose the Information We Collect.

Categories of Personal Information We Sold or Shared. In the preceding 12 months, we have sold or shared the following categories of personal information: identifiers; Information that identifies, relates to, describes, or is capable of being associated with, a particular individual; Internet or other electronic network activity information as described in How We Disclose the Information We Collect.

Categories of Personal Information We Disclosed for a Business Purpose. In the preceding 12 months, we have disclosed the following categories of personal information for a business purpose: identifiers; Information that identifies, relates to, describes, or is capable of being associated with, a particular individual; Internet or other electronic network activity information as described in How We Disclose the Information We Collect.

How Long Your Personal Information Will Be Kept. We will keep your personal information while you have an account with us or while we are providing Services to you. Thereafter, we will keep your personal information for as long as is necessary:

• To respond to any questions, complaints or claims made by you or on your behalf;
• To show that we treated you fairly; or
• To keep records required by law.

We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods apply for different types of personal information.

When it is no longer necessary to retain your personal information, we will delete or anonymize it.

Your Rights Under the CCPA. You have the right under the California Consumer Privacy Act of 2018 (CCPA), and certain other privacy and data protection laws, as applicable, to exercise free of charge:

Disclosure of Personal Information We Collect About You

Specific Types of Personal Information Collected

Identifiers (e.g., a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers)

You have the right to know, and request disclosure of:

• The categories of personal information we have collected about you, including sensitive personal information;
• The categories of sources from which the personal information is collected;
• Our business or commercial purpose for collecting, selling, or sharing personal information;
• The categories of third parties to whom we disclose personal information, if any; and
• The specific pieces of personal information we have collected about you.

Please note that we are not required to:

• Retain any personal information about you that was collected for a single one-time transaction if, in the ordinary course of business, that information about you is not retained;
• Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information; or
• Provide the personal information to you more than twice in a 12-month period.

Disclosure of Personal Information Sold, Shared, or Disclosed for a Business Purpose

In connection with any personal information we may sell, share, or disclose to a third party for a business purpose, you have the right to know:

• The categories of personal information about you that we sold or shared and the categories of third parties to whom the personal information was sold or shared; and
• The categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom the personal information was disclosed for a business purpose.

You have the right to opt-out of the sale of your personal information or sharing of your personal information for targeted behavioral advertising. If you exercise your right to opt-out of the sale or sharing of your personal information, we will refrain from selling or sharing your personal information, unless you subsequently provide express authorization for the sale or sharing of your personal information.

To opt-out of the sale or sharing of your personal information, contact us at compliance@feltclinic.com.

Right to Limit Use of Sensitive Personal Information

You have the right to limit the use and disclosure of your sensitive personal information to the use which is necessary to:

Perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services;

To perform the following services: (1) Helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes; (2) Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business, if the consumer’s personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business; (3) Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business; and (4) Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business; and

• As authorized by further regulations.

You have a right to know if your sensitive personal information may be used, or disclosed to a service provider or contractor, for additional, specified purposes.

Right to Deletion

Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:

• Delete your personal information from our records; and
• Direct any service providers or contractors to delete your personal information from their records.
• Direct third parties to whom the business has sold or shared your personal information to delete your personal information unless this proves impossible or involves disproportionate effort.

Please note that we may not delete your personal information if it is reasonably necessary to:

• Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
• Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes;
• Debug to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise their right of free speech, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act;
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;
• Comply with an existing legal obligation; or
• Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Right of Correction

If we maintain inaccurate personal information about you, you have the right to request us to correct that inaccurate personal information. Upon receipt of a verifiable request from you, we will use commercially reasonable efforts to correct the inaccurate personal information.

Protection Against Retaliation

You have the right to not be retaliated against by us because you exercised any of your rights under the CCPA. This means we cannot, among other things:

• Deny goods or services to you;
• Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Provide a different level or quality of goods or services to you; or
• Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Please note that we may charge a different price or rate or provide a different level or quality of Services to you, if that difference is reasonably related to the value provided to our business by your personal information. We may also offer loyalty, rewards, premium features, or discounts consistent with these rights or payments as compensation, for the collection of personal information, the sale of personal information, or the retention of personal information.

How to Exercise Your Rights. If you would like to exercise any of your rights as described in this Privacy Policy, you can do so by contacting us at compliance@feltclinic.com.

Please note that you may only make a CCPA-related data access or data portability disclosure request twice within a 12-month period.

To exercise your rights, you will need to provide us with:

• Enough information to identify you (e.g., your full name, address, and account information);
• Proof of your identity and address (e.g., a copy of your driving license or passport and a recent utility or credit card bill); and
• A description of what right you want to exercise and the information to which your request relates.

We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information or is someone authorized to act on such person’s behalf.

Any personal information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.

Categories of Personal Information

Specific Types of Personal Information Collected

Identifiers (e.g., a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers)

See Information We Collect

Information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, their name, signature, physical characteristics or description, address, telephone number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

See Information We Collect

Characteristics of protected classifications under California or federal law

See Information We Collect

Commercial information (e.g., records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)

See Information We Collect

Biometric information

None

Internet or other electronic network activity information (e.g., browsing history, search history, and information regarding a consumer’s interaction with an Internet Website, application, or advertisement)

See Information We Collect

Geolocation data

See Information We Collect

Audio, electronic, visual, thermal, olfactory, or similar information

None

Professional or employment-related information

None

Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (FERPA)

None

Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

See Information We Collect

Sensitive Personal Information

See Information We Collect

You may have rights under other state consumer privacy laws, including Colorado, Connecticut, Oregon, Texas, Utah, and Virginia. Please contact us at compliance@feltclinic.com if you have questions or would like to exercise a right under these laws.

The Services are controlled and operated by us from the United States and are not intended to subject us to the laws or jurisdiction of any state, country or territory other than that of the United States. Any information you provide to us through use of the Services may be stored and processed, transferred between and accessed from the United States and other countries that may not guarantee the same level of protection of personal data as the one in which you reside. However, we will handle your information in accordance with this Privacy Policy regardless of where your information is stored/accessed.

You can update your account information or close your account through your profile settings in your respective application. Note that we are legally required to maintain certain health care treatment information and that we therefore may not have the option to delete certain information about you.

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

If you have any questions, comments, or concerns please email us at support@felt.zendesk.com.

If you would like to request access, deletion, or correction of your Personal Information, email us at compliance@feltclinic.com. We will acknowledge requests within 10 business days and respond within 45 days; if we need more time, we will notify you.

We must verify your identity before acting on a request (for example, by confirming your name, contact details, and information about your account or prior transactions). You may also designate an authorized agent to submit a request on your behalf; we may require proof of the agent’s authority and may verify your identity directly.

We honor requests as required by law and may deny or limit a request where a legal exception applies or retention is required (for example, certain health-care records).

Information We Collect on Behalf of Our Health App Partners

When you connect our Services with a participating health app or device, we collect personal data on behalf of that health app provider. The categories of information we may collect— either directly from you or via the health app—include:

• Registration and Account Information: such as your legal name, guardian name (if applicable), phone number, email address, and date of birth.
• Contact Information: such as your name, email address, and phone number.
• Household Information: such as household member names and their relationship to you.
• Payment Information: such as credit card or other financial information, if payments are made through our Services.
• Health Information: such as height, weight, and other biometric or physiological data needed to deliver care or support the services.
• Device Information: such as IP address, device type, device identifiers, browser and OS details, session tokens, and push notification tokens.
• Usage Information: such as which pages or content you view, referring website, timestamps of your visits or interactions.
• Message Content: including information from messages you exchange with chatbots within our Services.
• Tracking Technologies: such as cookies, pixel tags, SDKs, or other analytics technologies that help measure and support use of the app or services.

This information is collected and processed as a service provider or processor on behalf of the health app provider and is governed by our agreements with them. The information is used solely to deliver and improve health-related services and to fulfill obligations under our agreements. We do not retain or use this information for any independent commercial purpose unless explicitly permitted by applicable law or by the provider.

Last updated: Mar 30, 2026

This notice supplements the Privacy Policy and applies to personal data defined as “consumer health data” subject to the Washington State My Health My Data Act (MHMDA), the Nevada Health Data Privacy Act (NHDPA), or other applicable state consumer health privacy law.

Consumer Health Data We Collect

As described in the Information We Collect section of the Privacy Policy, the data we collect depends on the context of your interactions with us and the choices you make (including your privacy settings), the Services you use, your location, and applicable law. Because consumer health data is defined very broadly, many of the categories of data we collect could also be considered consumer health data.

Examples of consumer health data may include:

• Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments (including surgeries, procedures, medications, or other interventions). For example, we may collect such information through surveys or other communication with you for research studies and improving product accessibility.
• Measurements of bodily functions, vital signs, or characteristics, including photographs, which may also be considered biometric information under the MHMDA, the NHDPA, or other applicable state consumer health privacy law.
• Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies.
• Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health.
• Other information that may be used to infer or derive data related to the above or other health information.

Sources of Consumer Health Data

As described further in the Information We Collect section of the Privacy Policy, we collect personal data (which may include consumer health data) directly from you, from your interactions with our Services, from third parties, and from publicly available sources.

Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes described in the Information We Collect Section of the Privacy Policy. Primarily, we collect and use consumer health data as reasonably necessary to provide you with the Services you have requested or authorized. This may include delivering and operating the Services and their features, personalization of certain Service features, ensuring the secure and reliable operation of the Services and the systems that support them, troubleshooting and improving the Services, and other essential business operations that support the provision of the Services (such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development).

We may use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law – for example, for advertising or marketing purposes. See the Your Choice section of the Privacy Policy and the How to Exercise Your Rights section below for more details on the controls and choices you may have.

Our Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described in the Information We Collect section of the Privacy Policy. In particular, we may share personal data, including consumer health data, with your consent or as reasonably necessary to complete any transaction or provide any Service you have requested or authorized, as described above.

For example, we share your content with third parties when you tell us to do so. And we may disclose data when we believe that doing so is necessary to comply with applicable law or respond to valid legal process.

Third Parties With Which We Share Consumer Health Data

As necessary for the purposes described above, we share consumer health data with the following categories of third parties:

• Service providers. Vendors or agents (“processors”) working on our behalf may access consumer health data for the purposes described above. For example, companies we’ve hired to provide customer service support or assist in protecting and securing our systems and Services may need access to data to provide those functions.
• Business partners. We may share consumer health data with other companies, for example, where you use a Service that is cobranded and jointly operated with another company, or where you use our Services to interact with another company.
• Financial institutions & payment processors. When you make a purchase or enter into a financial transaction, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, or other related financial services.
• Parties to a corporate transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.
• Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our Services and operate our business.
• Government agencies. As described in our Privacy Policy, we disclose data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
• Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.
• Other users and individuals. If you use our Services to interact with other Users of the Service or other recipients of communications, we will share data, including consumer health data, as directed by you and your interactions.
• The public. You may select options available through our Services to publicly display and disclose certain information, such as your profile, demographic data, content and files, or geolocation data, which may include consumer health data.

How to Exercise Your Rights

If you are covered by the MHMDA, the NHDPA, or other applicable consumer health privacy law then you may have certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. You can request to exercise such rights using the various tools and mechanisms described in the Your Choice and Information We Collect sections of the Privacy Policy. For example, depending on the Service you use, you can access and make choices about your data through product controls. You can also access and clear some of your data through your web browser. And if you want to access or control consumer health data processed by us that is not available via those tools or directly through the Service you use, you can always contact us at compliance@feltclinic.com.

If your request to exercise a right is denied, you may appeal that decision by contacting our support team at compliance@feltclinic.com. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint, the Nevada State Attorney General at https://ag.nv.gov/complaints/file_complaint/, or other regulatory authority as applicable.