Privacy Policy

Our Digital Services are not intended for children under 18 years of age. No one under the age of 18 may provide any Personal Information to or through the Digital Services. We do not knowingly collect Personal Information from children under 18. If you are under 18, do not use or provide any information on through our Digital Services or through any of its features or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or username you may use. If we learn we have collected or received Personal Information from a child under 18 without the consent of a parent or guardian, we will delete that information as soon as possible. If you believe we have collected such information, please contact us using the contact details set forth in Section 15 (How to Contact Us).

The Solution, which is accessed through our Digital Services, is not intended for use by individuals under the age of 18. Due to the nature of the Solution and its role in clinical documentation and healthcare workflows, minors are strictly prohibited from accessing or using the Solution, whether directly or indirectly. Healthcare providers are not permitted to make the Solution available to minors under any circumstances. The Solution is designed exclusively for use by licensed professionals and their authorized administrative staff. While the Solution may facilitate limited patient-facing interactions—such as the delivery of intake forms or visit summaries—these interactions are initiated and controlled solely by the Provider and do not involve direct access to the Solution by the patient.

California residents under 16 years of age may have additional rights regarding the collection and sale of their Personal Information.

We collect "Non-Personal Information" and "Personal Information." "Non-Personal Information" includes information about you but that cannot be used to personally identify you, such as anonymous usage data (including, but not limited to, your device's IP address, browser type, browser version, the pages of the Digital Services that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data), general demographic information we may collect, referring/exit pages and URLs, platform types, preferences you submit and preferences that are generated based on the data you submit and number of clicks. "Personal Information" includes information that may personally identify you such as name, postal address, email address, telephone number, date of birth, marital status, or any other identifier by which you may be contacted online or offline, which you submit to us through the Digital Services. We may also collect information about your internet connection, the equipment you use to access our Digital Services, and usage details.

When you access the Digital Services by or through a mobile device, we may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers and other diagnostic data.

We collect this information: (i) directly from you when you provide it to us, (ii) automatically as you navigate through the Digital Services. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies, and (iii) from third parties.

In connection with the use of the Solution by healthcare professionals, we may also collect or process information that is considered PHI under HIPAA. This may include audio recordings of clinical encounters, transcribed medical notes, and query responses generated using our co-pilot features. Collection and use of PHI is subject to the terms of any applicable BAA and applicable healthcare privacy laws.

As you navigate through and interact with the Digital Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including, but not limited to: (i) details of your visits to the Digital Services, including, but not limited to, traffic data, location data, logs, and other communication data and the resources that you access and use on the Digital Services, and/or (ii) information about your computer and internet connection, including, but not limited to, your IP address, operating system, and browser type. We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (also known as behavioral tracking). You may contact us to request more information about how to opt out of behavioral tracking on our Digital Services and how we respond to web browser signals and other mechanisms that allow consumers to exercise choice regarding such tracking.

The information we collect automatically may include Personal Information, or we may maintain it or associate it with Personal Information we collect in other ways or receive from third parties. It helps us to improve our Digital Services and to deliver a better and more personalized service, including by enabling us to: (i) estimate our audience size and usage patterns, (ii) store information about your preferences, allowing us to customize the Digital Services according to your individual interests, (iii) speed up your searches, and/or (iv) recognize you when you return to our Digital Services.

In connection with our Solution, we may also collect metadata and usage analytics related to how authorized users engage with clinical features, such as time spent using transcription tools, frequency of co-pilot queries, or navigation patterns within the dashboard. This information may help us enhance clinical workflow support, optimize product performance, and fulfill obligations under customer agreements. Any PHI collected through automated technologies is handled in accordance with applicable BAAs and HIPAA.

The technologies we use for this automatic data collection may include:

a. Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Digital Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to the Digital Services.

b. Web Beacons. Pages of our the Website, videos, and our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Resonately, for example, to count users who have visited those pages, viewed a video, or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

c. Flash Cookies. Certain features of the Digital Services may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Digital Services. Flash cookies are not managed by the same browser settings as are used for browser cookies.

The Digital Services do not collect Personal Information automatically, but we may tie this information to Personal Information about you that we collect from other sources or you provide to us. If you are an authorized user accessing the Solution through our Digital Services, we may collect certain Personal Information during the authentication process. For example, when you log in using single sign-on (SSO) functionality, such as "Continue with Google," our authentication provider may provide us with your name and other account-related details to enable secure access to the Solution. This information is collected only in connection with verified Solution access and is not collected automatically from visitors who do not log in or use the Solution.

a. Disclosure of Personal Information. Resonately may use or disclose Personal Information for the following purposes or in the following ways:

• To present our Digital Services and its contents to you;
• To provide and maintain the Digital Services, including to monitor the usage of our Digital Services;
• To notify you about changes to our Digital Services or any products or services we offer or provide though it;
• To provide you with information, products, or services that you request from us;
• To provide you with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or inquired about unless you have opted not to receive such information;
• To enter you into a promotion or share your information with the co-sponsor of that promotion;
• To enforce or apply our Terms of Use and Usage Policy, and other agreements, including for billing and collection purposes;
• To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including, but not limited to, the security updates, when necessary or reasonable for their implementation;
• To our subsidiaries and affiliates;
• To subprocessors and service providers who help us operate the Solution or support its functionality, such as secure cloud hosting providers, data analytics vendors, transcription engines, or infrastructure support. If these parties may have access to PHI, they will be subject to BAAs and HIPAA-compliant safeguards;
• To affiliates, strategic partners, agents, third party marketers, or other unaffiliated parties who are offering products or services that we believe may be of interest to you or who require your name, contact information or any behavioral or geolocation data that we have collected from you, for research, administrative, and/or internal business purposes;
• To unaffiliated third-party service providers, agents, or independent contractors who help us maintain the Digital Services and provide other administrative services to us, including, but not limited to, order processing and fulfillment, providing customer service, maintaining and analyzing data, sending customer communications on our behalf, and entry collection, winner selection, and prize fulfillment for contests, sweepstakes, and other promotions;
• PHI will be used and disclosed only as permitted by HIPAA and the applicable BAAs. We do not use or disclose PHI for advertising, marketing, or behavioral tracking purposes;
• For our own internal business purposes, such as to evaluate, audit, debug, or improve the usage, quality, and performance of programs and technologies related to interactions with us or third parties; design new services; process and catalog your responses to surveys or questionnaires (e.g., customer satisfaction reviews); perform internal research for technological development and demonstration; conduct data analysis and testing; and maintain proper business records and other relevant records;
• With third parties such as law enforcement or other government agencies to comply with law or legal requirements; to enforce agreements between you and us; and to protect our rights, property, and safety, and of our users and third parties;
• To comply with applicable law, or in the good faith belief that such action is necessary in order to conform to the requirements of applicable law or comply with legal process served on us; protect and defend our rights or property; or act in urgent circumstances to protect the personal safety of our end users;
• To third parties as part of any corporate reorganization process including, but not limited to, mergers, divestitures, restructures, reorganizations, dissolutions, or other sales or transfers of all or substantially all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our users is among the assets transferred;
• To track and analyze non-identifying and aggregate usage and volume statistical information from our visitors, clients, and instructors and provide such information to third parties;
• To protect against potential fraud, we may verify with third parties the information collected from the Digital Services;
• To comply with any court order, law, or legal process, including to respond to any government or regulatory request;
• In any other way we may describe when you provide the information; and/or
• For any other purpose with your consent.

Except as described in this Privacy Policy or at the time we request the information, we do not otherwise use, share, or otherwise disclose your personally identifiable information to any third parties.

b. Disclosure of Non-Personal Information. In general, we use Non-Personal Information to help us improve the Digital Services and customize the user experience. We may also aggregate Non-Personal Information in order to track trends and analyze use patterns across our Digital Services, including this Website and the App. This Privacy Policy does not limit in any way our use or disclosure of Non-Personal Information and we reserve the right to use and disclose such Non-Personal Information to our partners and other third parties at our discretion.

Resonately expressly reserves the right to disclose your Personal Information and Non-Personal Information if Resonately reasonably believes it is required: (i) to do so by applicable law, (ii) to protect itself or to protect the rights of another user, (iii) to reduce risk of credit or other kind of fraud, or (iv) to comply with a court order.

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyze web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies and similar tracking technologies to identify which areas of our Digital Services are being used. This helps us analyze data about user interactions and improve our Website and App in order to tailor the experience to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

Cookies are not used to track or process clinical content, transcriptions, audio recordings, or any PHI generated through the use of the Solution. However, when an authorized user accesses the Solution through our Digital Services, we may use cookies to store authentication-related information—such as a user's name or login credentials—for the purpose of identifying and securely authenticating the user.

For general visitors to our publicly accessible Website and App, we may use cookies and similar technologies to analyze usage patterns, remember preferences, and improve user experience. We seek your consent before placing any cookies used for advertising, marketing, or other tracking purposes not essential to site functionality.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the Digital Services.

PHI is stored on secure servers located in the United States, unless otherwise disclosed or required by law. In very limited circumstances, we may transfer data outside the United States for processing or storage. By providing your Personal Information to us, you agree to this transfer, storing and processing.

We do our utmost to ensure that all reasonable steps are taken to make sure that your data is stored and transmitted securely. To the extent any PHI is stored or processed on our behalf, we use secure, HIPAA-compliant data hosting providers and industry-standard encryption measures that meet applicable privacy and data protection laws.

Unfortunately, the sending of information via the internet is not totally secure and on occasion such information can be intercepted. We cannot guarantee the security of data that you choose to send us electronically; sending and storing such information is entirely at your own risk.

Certain data processed by Resonately may be exempt from state consumer privacy laws under applicable federal laws, including HIPAA. Where Resonately acts as business associate to a HIPAA-covered entity, the rights described in this section may not apply to PHI handled under a BAA.

These state privacy disclosures apply solely to residents of California and other states that have adopted generally applicable privacy laws (collectively, the "State Privacy Laws") whose personal information is covered under the State Privacy Laws and supplements the information contained elsewhere in this Privacy Policy.

a. Your Rights.

If you live in California or other states that have adopted State Privacy Laws, you may have several rights in relation to your personal information, as summarized below. These rights apply only to Personal Information governed by State Privacy Laws. Information subject to HIPAA, including PHI processed under a BAA, is governed by HIPAA and is not subject to these state-level consumer rights:

b. Shine the Light (California).

If you have an established business relationship with us, you may have rights to know how your information is disclosed to third parties for their direct marketing purposes under California's "Shine the Light" law (Civ. Code § 1798.83). To make such a request, please use the following email address: hello@getresonately.com or the following mailing address: Resonately, Inc. 700 Soldiers Field Road. Boston, MA 02163.

c. Submitting Rights Requests.

(i) You may exercise your right to request access, deletion, and correction of your personal information (as such rights are described above) by emailing us at hello@getresonately.com.

(ii) For the rights to opt-out of "sales," "shares," and processing of personal information for "targeted advertising," (as such rights are described above), please use the Your Privacy Choices link (referenced in the table above or otherwise activate the opt-out preference signal on the browsers or browser extensions that support such signal (for example, the GPC signal).

(iii) As permitted by applicable law, we may require verification of your, or your authorized agent's, identity for security of your personal information (such as by requesting certain information that cross-references with information we have internally, or for authorized agents, ensuring that they are duly authorized by you, such as name, email address, zip code, keytag number, and first five digits of your payment method).

Except as provided for under applicable privacy laws, there is no charge to exercise any of your legal rights. However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may (as permitted under applicable State Privacy Law): (i) Charge a reasonable fee taking in account the administrative costs of providing the information or taking the action requested; or (ii) refuse to act on the request and notify you of the reason for refusing the request.

d. Appeals.

In the event that we decline to take action on a request exercising one of your rights set forth above, you may have the right to appeal our decision. To appeal a decision regarding a consumer rights request email us at hello@getresonately.com.

e. Authorized Agents.

You are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above, though we must verify the authorized agent's authority to act on your behalf before acting on such request. For requests to access, delete, and correct personal information, we require the following for verification purposes: (i) a power of attorney valid under the laws of the relevant state from you or your authorized agent; or (ii) sufficient evidence to show that you have: (a) provided the authorized agent signed permission to act on your behalf; and (b) verified your own identity directly with us.

f. Additional Data Processing Disclosures / Notice at Collection.

(i) List of categories of personal information collected.

1. Identifiers, such as your name, e-mail address, date of birth, or other similar identifiers.
2. California Customer Records (Cal. Civ. Code § 1798.80(e)), such as birth date, contact information, and payment information.
3. Protected Classification Characteristics, such as age and gender.
4. Commercial Information, such as payment information and purchase history.
5. Internet/Network Information, such as device information, logs, and analytics data.
6. Non-Precise Geolocation Data, such as location information from your device or generated based on IP address or Wi-Fi.
7. Audio, Electronic, Visual or Other Sensory Information, such as photographs and audio/video recordings of our Facilities and call center.
8. Profession/Employment Information, such as your employer if your subscription is tied to an account managed by your employer.
9. Sensitive Personal Information, such as driver's license or other government identifiers, account log-in and password, or data concerning health. Sensitive Personal Information is used for the limited purposes specified under the CCPA that do not require a corresponding opt-out right, such as the provision of goods or services reasonably expected by the consumer requesting such goods or services. For example, the Visitor's driver's license or similar identifier may be used to provide a guest pass or register for services, and limited health-related data (like height and weight) may be used to suggest a recommended workout routine or training regime.

(ii) The purposes for which the categories of personal information are used (but see above for Sensitive Personal Information):

1. To provide our products or services;
2. To communicate with you about our products or services (or to communicate with you about products or services of third parties), such as in connection with renewing your subscription, updating your information, or informing you about new offerings from us or third parties;
3. To better understand your use of, and improve, our products and services, such as through internal research and generation/analysis of analytics data and usage trends;
4. To target you or others with advertising and to measure the effectiveness of such advertising campaigns, such as: (i) to market the Resonately's products or services to you (or the products or services of third parties) including through marketing e-mails or text messages, where applicable, and to alert you to special promotions, discounts, offers, and the like; or (ii) to match your use or purchase of Facilities, products, and services with your online activity on our Online Services (for example, we may connect your offline activity at our Facilities with activity on our Online Services or share the personal information you provide when you sign up for a membership with advertising/marketing and analytics partners to facilitate or track the effectiveness of advertising campaigns);
5. To assist with customer service or otherwise respond to requests;
6. To distribute surveys and collect feedback;
7. To facilitate transactions;
8. To coordinate sweepstakes and contests;
9. To protect the safety, security, and integrity of our Facilities, Visitors, and Online Services;
10. To monitor and prevent fraud;
11. To recognize you and your devices (for example, such as when you check-in at a Facility or when you use our Online Services);
12. To support employee training;
13. To conduct audits; and
14. To fulfill contractual obligations or otherwise take steps to effectuate or defend our rights.

(iii) The following categories of personal information may be "sold" or "shared" (as such terms are broadly defined under the CCPA) to our advertising/marketing and analytics partners for the purposes of advertising/marketing and analytics services: Identifiers, Commercial Information, Geolocation Data, and Internet/Network Information. You may opt-out of these "sales" and "shares".

(iv) Data Retention. We retain the categories of personal information above as reasonably necessary to fulfill the purposes outlined in this notice, unless a longer retention period is required or permitted by law. In many situations, we must obtain all, or a portion, of your personal information to comply with legal obligations, resolve disputes, enforce our agreements, protect against fraudulent, deceptive, or illegal activity, or for another one of our business purposes.